@brainervirus/workit-claude-code 8.0.0 → 8.1.0

package/dist/workit.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.0.0",
+    version: "8.1.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -103,9 +103,9 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-core": "^8.0.0",
-      "@brainervirus/workit-cursor": "^8.0.0",
-      "@brainervirus/workit-opencode": "^8.0.0",
+      "@brainervirus/workit-core": "^8.1.0",
+      "@brainervirus/workit-cursor": "^8.1.0",
+      "@brainervirus/workit-opencode": "^8.1.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
@@ -165,7 +165,7 @@ var init_output = __esm(() => {
   };
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/check-config.ts
+// packages/workit-core/src/check-config.ts
 import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
@@ -7974,7 +7974,7 @@ var init_zod = __esm(() => {
   init_external();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/task-contract.ts
+// packages/workit-core/src/core/task-contract.ts
 import { createHash, randomUUID } from "node:crypto";
 function parseOperation(family, input) {
   if (typeof input === "object" && input !== null && "schemaVersion" in input && input.schemaVersion !== SCHEMA_VERSION)
@@ -8812,7 +8812,7 @@ var init_task_contract = __esm(() => {
   compiledOperationSchemas = Object.fromEntries(OPERATION_FAMILIES.map((family) => [family, compile(operationSchemas[family])]));
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/operation-input.ts
+// packages/workit-core/src/core/operation-input.ts
 function normalizeOperationInput(family, input, host) {
   if (!isObject2(input))
     return input;
@@ -9149,7 +9149,7 @@ var init_operation_input = __esm(() => {
   ]);
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/policy/judgment.ts
+// packages/workit-core/src/core/policy/judgment.ts
 function normalizeJudgment(raw, previous) {
   const input = isObject3(raw) ? raw : {};
   const legacy = Object.keys(input).some((key) => LEGACY_KEYS.has(key));
@@ -9914,7 +9914,7 @@ var init_file_lock = __esm(() => {
   init_file_lock_sync();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/package-root.ts
+// packages/workit-core/src/core/package-root.ts
 import { existsSync } from "node:fs";
 import path4 from "node:path";
 import { fileURLToPath } from "node:url";
@@ -9933,7 +9933,7 @@ var packageRoot = () => {
 };
 var init_package_root = () => {};
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/store/paths.ts
+// packages/workit-core/src/store/paths.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import fs5 from "node:fs";
@@ -10209,7 +10209,7 @@ var init_paths = __esm(() => {
   ];
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/store-lock.ts
+// packages/workit-core/src/core/store-lock.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
 import fs6 from "node:fs";
 import { hostname } from "node:os";
@@ -10401,7 +10401,7 @@ var init_store_lock = __esm(() => {
   FOREIGN_LOCK_TTL_MS = 10 * 60000;
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/store/event-log.ts
+// packages/workit-core/src/store/event-log.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import fs7 from "node:fs";
 import path7 from "node:path";
@@ -10556,7 +10556,7 @@ var init_event_log = __esm(() => {
   TRANSIENT_WINDOWS_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/store/patch.ts
+// packages/workit-core/src/store/patch.ts
 function diff(before, after, path = []) {
   if (equal(before, after))
     return [];
@@ -10662,7 +10662,7 @@ var isPlainObject2 = (value) => typeof value === "object" && value !== null && !
   return false;
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/store/reduce.ts
+// packages/workit-core/src/store/reduce.ts
 import { createHash as createHash3 } from "node:crypto";
 function reduce(state, event, blobs) {
   const data = event.data;
@@ -10788,7 +10788,7 @@ var init_reduce = __esm(() => {
   ]);
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/store/notes.ts
+// packages/workit-core/src/store/notes.ts
 var SLOT, reportMigration = (report) => {
   try {
     const reporter = globalThis[SLOT];
@@ -10800,7 +10800,7 @@ var init_notes = __esm(() => {
   SLOT = Symbol.for("workit.migrationReporter");
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/task-store.ts
+// packages/workit-core/src/core/task-store.ts
 import { createHash as createHash4, randomUUID as randomUUID3 } from "node:crypto";
 import * as fs8 from "node:fs";
 import path8 from "node:path";
@@ -12427,13 +12427,13 @@ var init_task_store = __esm(() => {
   heldInProcess = new Map;
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/workers.ts
+// packages/workit-core/src/core/workers.ts
 var UNCERTAIN_WORKER_STATES, isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state), workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state);
 var init_workers = __esm(() => {
   UNCERTAIN_WORKER_STATES = ["dispatching", "running", "cancelling", "unknown"];
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/git/rev.ts
+// packages/workit-core/src/git/rev.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
 import fs9 from "node:fs";
@@ -12964,7 +12964,7 @@ var init_rev = __esm(() => {
   };
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/ledger.ts
+// packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
 import { createHash as createHash6, randomBytes as randomBytes2 } from "node:crypto";
 import fs10 from "node:fs";
@@ -13267,7 +13267,7 @@ function authorSessions(cwd, rows, branch, range = { base: null, head: null }) {
     sessions.add(session);
   return sessions;
 }
-function effectiveOf(rows, authors) {
+function effectiveOf(rows, authors, sameCode) {
   let effective = null;
   for (const row of rows) {
     if (!effective) {
@@ -13278,7 +13278,7 @@ function effectiveOf(rows, authors) {
     const effIndependent = independenceReasons(effective, authors).length === 0;
     if (effIndependent && !rowIndependent)
       continue;
-    if (effIndependent && FAILING.has(String(effective.result)) && row.actor.session === effective.actor.session)
+    if (effIndependent && FAILING.has(String(effective.result)) && row.actor.session === effective.actor.session && sameCode(effective, row))
       continue;
     effective = row;
   }
@@ -13309,16 +13309,22 @@ function checkVerdicts(cwd, branch, rows) {
   const head = branchHead(cwd, branch);
   const fallbackBase = defaultBase(cwd);
   const keyCache = new Map;
-  const keyFor = (base) => {
-    if (!base || !head)
+  const keysAt = (base, at) => {
+    if (!base || !at)
       return { patchId: null, diffHash: null };
-    let key = keyCache.get(base);
+    const cacheKey = `${base}\x00${at}`;
+    let key = keyCache.get(cacheKey);
     if (!key) {
-      key = { patchId: patchId(cwd, base, head), diffHash: diffHash(cwd, base, head) };
-      keyCache.set(base, key);
+      key = { patchId: patchId(cwd, base, at), diffHash: diffHash(cwd, base, at) };
+      keyCache.set(cacheKey, key);
     }
     return key;
   };
+  const keyFor = (base) => keysAt(base, head);
+  const sameCode = (failed, row) => verdictBasis(failed, {
+    head: row.head,
+    ...keysAt(failed.base ?? fallbackBase, row.head)
+  }) !== "stale" || restackCarries(rows, branch, failed.head, row.head);
   const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head });
   const byKind = new Map;
   for (const row of rows)
@@ -13328,7 +13334,7 @@ function checkVerdicts(cwd, branch, rows) {
     }
   const verdicts = [];
   for (const [kind, list] of byKind) {
-    const row = effectiveOf(list, authors);
+    const row = effectiveOf(list, authors, sameCode);
     if (!row)
       continue;
     let basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
@@ -13354,11 +13360,11 @@ function checkVerdicts(cwd, branch, rows) {
   verdicts.sort((a, b) => a.verdict.seq - b.verdict.seq);
   const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
   const failing = verdicts.find((entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)));
-  const newestAccepted = verdicts.findLast((entry) => entry.accepted) ?? null;
+  const newestAccepted = verdicts.findLast((entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result))) ?? null;
   const accepted = newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
     accepted: false,
     verdict: failing?.verdict ?? null,
-    reasons: failing ? ["failing_verdict"] : newestCurrent?.reasons ?? ["no_verdict"]
+    reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
   };
   const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && STRONG_RESULTS.has(String(entry.verdict.result)));
   return {
@@ -13587,6 +13593,9 @@ function summarizeRow(row) {
     case "pr.merged":
       summary = `#${row.pr ?? "?"} ${text("method")} at ${(row.head ?? "?").slice(0, 12)}${text("mergeSha") ? ` -> ${text("mergeSha").slice(0, 12)}` : ""}`;
       break;
+    case "merge.unverified":
+      summary = `#${row.pr ?? "?"} unverified merge requested at ${(row.head ?? "?").slice(0, 12)} (reason: ${text("reason")})`;
+      break;
     case "delivery.verified":
       summary = `${text("expect")} delivered at ${(row.head ?? "?").slice(0, 12)}`;
       break;
@@ -13911,10 +13920,10 @@ var init_ledger = __esm(() => {
       return false;
     }
   };
-  OBSERVED_ONLY = new Set(["check", ...PR_ROW_TYPES]);
+  OBSERVED_ONLY = new Set(["check", "merge.unverified", ...PR_ROW_TYPES]);
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/policy/derive.ts
+// packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync3 } from "node:fs";
 import path11 from "node:path";
 function deriveRequirements(judgment, scope, constraints, verification = "self") {
@@ -14102,7 +14111,7 @@ var init_derive = __esm(() => {
   };
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/task-evaluation.ts
+// packages/workit-core/src/core/task-evaluation.ts
 import { createHash as createHash7 } from "node:crypto";
 import * as fs11 from "node:fs";
 import { spawnSync as spawnSync6 } from "node:child_process";
@@ -14750,7 +14759,7 @@ var init_task_evaluation = __esm(() => {
   scopeCovers2 = scopeCovers;
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/methods.ts
+// packages/workit-core/src/core/methods.ts
 function selectMethods(policy, capabilities) {
   return Object.entries(METHODS).flatMap(([id, definition]) => {
     const requirements = policy.requirements.filter((requirement) => methodMatches(definition, requirement));
@@ -14797,7 +14806,7 @@ var init_methods = __esm(() => {
   };
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/task-context.ts
+// packages/workit-core/src/core/task-context.ts
 function reconcileResume(view, observations = []) {
   if (observations.length > 0)
     return failure2("permission_denied", "worker observations require native host verification");
@@ -14910,61 +14919,7 @@ var init_task_context = __esm(() => {
   privateKey = /-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/gi;
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/commit-flavors.ts
-var CONVENTIONAL_RE, TICKET_RE, GITMOJI_RE, matchCommitFlavor = (message, flavor, pattern) => {
-  const subject = message.split(`
-`, 1)[0] ?? "";
-  switch (flavor) {
-    case "conventional":
-      return CONVENTIONAL_RE.test(subject);
-    case "gitmoji":
-      return GITMOJI_RE.test(subject);
-    case "ticket-prefix":
-      return TICKET_RE.test(subject);
-    case "freeform":
-      return subject.trim().length > 0;
-    case "custom":
-      if (!pattern)
-        return false;
-      try {
-        return new RegExp(pattern).test(subject);
-      } catch {
-        return false;
-      }
-    case "auto":
-      return subject.trim().length > 0;
-  }
-}, DETECTABLE, detectCommitFlavor = (subjects, threshold = 0.7) => {
-  if (subjects.length === 0)
-    return { flavor: null, confidence: 0 };
-  const votes = new Map;
-  for (const subject of subjects) {
-    const hit = DETECTABLE.find((flavor) => matchCommitFlavor(subject, flavor));
-    if (hit)
-      votes.set(hit, (votes.get(hit) ?? 0) + 1);
-  }
-  let best = null;
-  let count = 0;
-  for (const [flavor, votesFor] of votes) {
-    if (votesFor > count) {
-      best = flavor;
-      count = votesFor;
-    }
-  }
-  const confidence = count / subjects.length;
-  return best !== null && confidence >= threshold ? { flavor: best, confidence } : { flavor: null, confidence };
-};
-var init_commit_flavors = __esm(() => {
-  CONVENTIONAL_RE = /^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?(!)?: .+/;
-  TICKET_RE = /^[A-Z]{2,}-\d+\b/;
-  GITMOJI_RE = /^\p{Extended_Pictographic}/u;
-  DETECTABLE = ["conventional", "gitmoji", "ticket-prefix"];
-});
-
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/git.ts
-var init_git = () => {};
-
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/boundary.ts
+// packages/workit-core/src/core/boundary.ts
 var EVENT, errorDetail = (err) => {
   if (err instanceof Error) {
     return { error_name: err.name, error: err.message };
@@ -14987,7 +14942,7 @@ var init_boundary = __esm(() => {
   };
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/config.ts
+// packages/workit-core/src/core/config.ts
 import {
   copyFileSync as copyFileSync2,
   cpSync as cpSync2,
@@ -15048,7 +15003,7 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
   if (!migrationFailed)
     migratedDir = dir;
   return dir;
-}, configDir = () => ensureConfigDir(), LOCALE_RE, DEFAULTS, readSafe = (p) => {
+}, configDir = () => ensureConfigDir(), LOCALE_RE, DEFAULTS, unchosenBranchPolicy, readSafe = (p) => {
   try {
     return readFileSync3(p, "utf8");
   } catch {
@@ -15070,22 +15025,21 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
   const locale = LOCALE_RE.test(String(input.locale ?? "")) ? input.locale : DEFAULTS.locale;
   const preset = Object.hasOwn(PRESETS, input.branchPolicy?.preset) ? input.branchPolicy?.preset : "gitflow";
   const commitPreset = COMMIT_PRESETS.includes(String(input.commitPolicy?.preset ?? "")) ? input.commitPolicy?.preset : "conventional";
-  return {
-    status: "valid",
-    path: file,
-    config: {
-      locale,
-      localeOptions: Array.isArray(input.localeOptions) ? input.localeOptions : DEFAULTS.localeOptions,
-      branchPolicy: mergePreset(preset, {
-        allowed: Array.isArray(input.branchPolicy?.allowed) ? input.branchPolicy.allowed : undefined,
-        protectedNames: Array.isArray(input.branchPolicy?.protected) ? input.branchPolicy.protected : undefined
-      }, DEFAULTS),
-      commitPolicy: {
-        preset: commitPreset,
-        ...typeof input.commitPolicy?.pattern === "string" ? { pattern: input.commitPolicy.pattern } : {}
-      }
+  const config = {
+    locale,
+    localeOptions: Array.isArray(input.localeOptions) ? input.localeOptions : DEFAULTS.localeOptions,
+    branchPolicy: mergePreset(preset, {
+      allowed: Array.isArray(input.branchPolicy?.allowed) ? input.branchPolicy.allowed : undefined,
+      protectedNames: Array.isArray(input.branchPolicy?.protected) ? input.branchPolicy.protected : undefined
+    }, DEFAULTS),
+    commitPolicy: {
+      preset: commitPreset,
+      ...typeof input.commitPolicy?.pattern === "string" ? { pattern: input.commitPolicy.pattern } : {}
     }
   };
+  if (!Object.hasOwn(PRESETS, input.branchPolicy?.preset))
+    unchosenBranchPolicy.add(config);
+  return { status: "valid", path: file, config };
 }, readConfigTyped = (dir) => {
   const file = path13.join(dir ?? configDir(), "config.json");
   return parseConfigResult(readSafe(file), file);
@@ -15099,9 +15053,11 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
   if (result.status === "malformed")
     throw new Error(result.error);
   return result.config ?? DEFAULTS;
-}, vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path13.join(configDir(), "vcs.json"), branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"), resolveBranchPolicy = (config, workspace) => {
+}, vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path13.join(configDir(), "vcs.json"), branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"), resolveBranchPolicy = (config, workspace, repoPreset) => {
   const wp = workspace?.branchPolicy ?? {};
-  const preset = Object.hasOwn(PRESETS, wp.preset) ? wp.preset : config.branchPolicy?.preset ?? "gitflow";
+  const workspacePreset = Object.hasOwn(PRESETS, wp.preset);
+  const detected = !workspacePreset && unchosenBranchPolicy.has(config) ? repoPreset?.() ?? null : null;
+  const preset = workspacePreset ? wp.preset : detected ?? config.branchPolicy?.preset ?? "gitflow";
   const merged = mergePreset(preset, {
     allowed: wp.allowed,
     protectedNames: wp.protected
@@ -15110,9 +15066,10 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
   return {
     preset,
     allowed,
-    protected: new Set(merged.protected.map((p) => p.toLowerCase())),
+    protected: new Set([...merged.protected, ...detected ? PRESETS.gitflow.protected : []].map((p) => p.toLowerCase())),
     integration: wp.integration === "merge" ? "merge" : "pr",
-    defaultTargetBranch: preset === "github-flow" ? "main" : preset === "trunk-based" ? "master" : "develop"
+    defaultTargetBranch: preset === "github-flow" ? "main" : preset === "trunk-based" ? "master" : "develop",
+    detected: detected !== null
   };
 }, COMMIT_PRESETS, resolveCommitPolicy = (config, workspace) => {
   const wp = workspace?.commitPolicy ?? {};
@@ -15146,6 +15103,7 @@ var init_config = __esm(() => {
     },
     commitPolicy: { preset: "conventional" }
   };
+  unchosenBranchPolicy = new WeakSet([DEFAULTS]);
   COMMIT_PRESETS = [
     "conventional",
     "gitmoji",
@@ -15156,7 +15114,127 @@ var init_config = __esm(() => {
   ];
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/workspaces.ts
+// packages/workit-core/src/core/branch-policy.ts
+import { spawnSync as spawnSync7 } from "node:child_process";
+var PREFIXES, branchNames = (workspaceRoot) => {
+  const r = spawnSync7("git", ["for-each-ref", "--format=%(refname)", "refs/heads", "refs/remotes/origin"], { cwd: workspaceRoot, encoding: "utf8" });
+  if (r.status !== 0)
+    return new Set;
+  return new Set((r.stdout ?? "").split(`
+`).filter(Boolean).map((ref) => ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref.slice("refs/remotes/origin/".length)));
+}, detectBranchPolicy = (workspaceRoot) => {
+  const names = branchNames(workspaceRoot);
+  const develop = names.has("develop");
+  const main = names.has("main");
+  const master = names.has("master");
+  const root = main ? "main" : master ? "master" : null;
+  if (develop) {
+    return {
+      preset: "gitflow",
+      developBranch: "develop",
+      integration: "merge",
+      protected: root ? [root, "develop"] : ["develop"],
+      allowed: [...PRESETS.gitflow.allowed],
+      prefixes: PREFIXES
+    };
+  }
+  if (root === "main") {
+    return {
+      preset: "github-flow",
+      developBranch: null,
+      integration: "pr",
+      protected: [root],
+      allowed: ["*"],
+      prefixes: PREFIXES
+    };
+  }
+  if (root === "master") {
+    return {
+      preset: "trunk-based",
+      developBranch: null,
+      integration: "pr",
+      protected: [root],
+      allowed: ["*"],
+      prefixes: PREFIXES
+    };
+  }
+  return {
+    preset: "gitflow",
+    developBranch: null,
+    integration: "merge",
+    protected: [],
+    allowed: [],
+    prefixes: PREFIXES
+  };
+}, repoBranchPreset = (workspaceRoot) => {
+  const detected = detectBranchPolicy(workspaceRoot);
+  return detected.developBranch || detected.allowed.length ? detected.preset : null;
+};
+var init_branch_policy = __esm(() => {
+  init_config();
+  PREFIXES = {
+    feature: "feature/*",
+    bugfix: "bugfix/*",
+    release: "release/*",
+    hotfix: "hotfix/*"
+  };
+});
+
+// packages/workit-core/src/core/commit-flavors.ts
+var CONVENTIONAL_RE, TICKET_RE, GITMOJI_RE, matchCommitFlavor = (message, flavor, pattern) => {
+  const subject = message.split(`
+`, 1)[0] ?? "";
+  switch (flavor) {
+    case "conventional":
+      return CONVENTIONAL_RE.test(subject);
+    case "gitmoji":
+      return GITMOJI_RE.test(subject);
+    case "ticket-prefix":
+      return TICKET_RE.test(subject);
+    case "freeform":
+      return subject.trim().length > 0;
+    case "custom":
+      if (!pattern)
+        return false;
+      try {
+        return new RegExp(pattern).test(subject);
+      } catch {
+        return false;
+      }
+    case "auto":
+      return subject.trim().length > 0;
+  }
+}, DETECTABLE, detectCommitFlavor = (subjects, threshold = 0.7) => {
+  if (subjects.length === 0)
+    return { flavor: null, confidence: 0 };
+  const votes = new Map;
+  for (const subject of subjects) {
+    const hit = DETECTABLE.find((flavor) => matchCommitFlavor(subject, flavor));
+    if (hit)
+      votes.set(hit, (votes.get(hit) ?? 0) + 1);
+  }
+  let best = null;
+  let count = 0;
+  for (const [flavor, votesFor] of votes) {
+    if (votesFor > count) {
+      best = flavor;
+      count = votesFor;
+    }
+  }
+  const confidence = count / subjects.length;
+  return best !== null && confidence >= threshold ? { flavor: best, confidence } : { flavor: null, confidence };
+};
+var init_commit_flavors = __esm(() => {
+  CONVENTIONAL_RE = /^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?(!)?: .+/;
+  TICKET_RE = /^[A-Z]{2,}-\d+\b/;
+  GITMOJI_RE = /^\p{Extended_Pictographic}/u;
+  DETECTABLE = ["conventional", "gitmoji", "ticket-prefix"];
+});
+
+// packages/workit-core/src/core/git.ts
+var init_git = () => {};
+
+// packages/workit-core/src/core/workspaces.ts
 import { createHash as createHash8 } from "node:crypto";
 import { readFileSync as readFileSync4, realpathSync as realpathSync3 } from "node:fs";
 import path14 from "node:path";
@@ -15165,7 +15243,7 @@ function workspaceDefaultTarget(cwd, globalDefault) {
   const wp = ws?.branchPolicy ?? {};
   const hasWorkspacePolicy = typeof wp.preset === "string" && Object.hasOwn(PRESETS, wp.preset);
   const selected = resolveRuntimeWorkspacePolicy(cwd, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined);
-  const policyDefault = resolveBranchPolicy(readConfig(), selected.policy ? { branchPolicy: selected.policy } : null).defaultTargetBranch;
+  const policyDefault = resolveBranchPolicy(readConfig(), selected.policy ? { branchPolicy: selected.policy } : null, () => repoBranchPreset(cwd)).defaultTargetBranch;
   return String(ws?.vcs?.defaultTargetBranch ?? (hasWorkspacePolicy ? policyDefault : globalDefault ?? policyDefault) ?? "develop");
 }
 var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspaceCommitPolicySchema, workspaceProfileSchema, versionSourceSchema, releaseTrackSchema, workspaceConfigSchema, workspacesFileSchema, workspacesRevision = (contents) => createHash8("sha256").update(contents ?? "<missing>").digest("hex"), validateWorkspacesDocument = (parsed, file) => {
@@ -15447,7 +15525,7 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
       commitPolicy: profile?.commitPolicy ? `profile:${profileName}` : workspace.commitPolicy ? `workspace:${workspace.name}` : "user-default"
     }
   };
-}, resolveWorkspacePolicy = (config, workspace, profileName) => {
+}, resolveWorkspacePolicy = (config, workspace, profileName, repoPreset) => {
   const selected = workspace ? resolveWorkspaceProfile(workspace, profileName) : {
     status: "resolved",
     profileName: null,
@@ -15460,7 +15538,7 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     status: "resolved",
     workspace: selected.workspace,
     profileName: selected.profileName,
-    branchPolicy: resolveBranchPolicy(config, selected.workspace),
+    branchPolicy: resolveBranchPolicy(config, selected.workspace, repoPreset),
     commitPolicy: resolveCommitPolicy(config, selected.workspace),
     provenance: selected.provenance
   };
@@ -15468,6 +15546,7 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
 var init_workspaces = __esm(() => {
   init_zod();
   init_config();
+  init_branch_policy();
   nonBlank = string2().refine((value) => value.trim().length > 0, "must not be blank");
   branchPreset = custom((value) => typeof value === "string" && Object.hasOwn(PRESETS, value), "unsupported branch preset");
   commitPreset = custom((value) => typeof value === "string" && COMMIT_PRESETS.includes(value), "unsupported commit preset");
@@ -15592,9 +15671,9 @@ var init_workspaces = __esm(() => {
   }).passthrough();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/release-tracks.ts
+// packages/workit-core/src/core/release-tracks.ts
 import { createHash as createHash9 } from "node:crypto";
-import { spawnSync as spawnSync7 } from "node:child_process";
+import { spawnSync as spawnSync8 } from "node:child_process";
 import { readFileSync as readFileSync5 } from "node:fs";
 function readReleaseTracks(raw) {
   const out = { tracks: [], issues: [], error: null, protectedBranches: [] };
@@ -15996,7 +16075,7 @@ var ReleaseTrackError, KNOWN_FIELDS, BRANCH_FIELDS, PLACEHOLDER, HAS_PLACEHOLDER
   const remote = remotes.find((name) => bare.startsWith(`${name}/`));
   return remote ? bare.slice(remote.length + 1) : bare;
 }, MAX_RECORDED_HOPS = 10, git4 = (cwd, args) => {
-  const run = spawnSync7("git", args, {
+  const run = spawnSync8("git", args, {
     cwd,
     encoding: "utf8",
     timeout: 20000,
@@ -16054,10 +16133,10 @@ var init_release_tracks = __esm(() => {
   memo3 = new Map;
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/vcs-config.ts
+// packages/workit-core/src/core/vcs-config.ts
 import fs12 from "node:fs";
 import path15 from "node:path";
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 function vcsConfig(mode, cwd, options = {}) {
   const ws = resolveRuntimeWorkspaceVcs(vcsCwd(cwd));
   const wsVcs = ws?.vcs ?? {};
@@ -16140,7 +16219,7 @@ function vcsConfig(mode, cwd, options = {}) {
   return out;
 }
 var workspacesPath = () => path15.join(configDir(), "workspaces.json"), vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), remoteProvider = (cwd) => {
-  const r = spawnSync8("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
+  const r = spawnSync9("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
   if (r.status !== 0)
     return null;
   const url = (r.stdout ?? "").trim();
@@ -16182,7 +16261,7 @@ var init_vcs_config = __esm(() => {
   init_release_tracks();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/branch.ts
+// packages/workit-core/src/core/branch.ts
 import { execFileSync } from "node:child_process";
 import { createHash as createHash10 } from "node:crypto";
 import path16 from "node:path";
@@ -16190,7 +16269,7 @@ function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
   const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
   const config = readConfig();
   return kind === "branch" ? {
-    branchPolicy: withReleaseTracks(workspaceRoot, resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null)),
+    branchPolicy: withReleaseTracks(workspaceRoot, resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null, () => repoBranchPreset(workspaceRoot))),
     provenance: { branchPolicy: selected.source }
   } : {
     commitPolicy: resolveCommitPolicy(config, selected.policy ? { commitPolicy: selected.policy } : null),
@@ -16347,6 +16426,7 @@ var withReleaseTracks = (workspaceRoot, policy) => {
   return dirty ? "carry" : "clean";
 };
 var init_branch = __esm(() => {
+  init_branch_policy();
   init_commit_flavors();
   init_git();
   init_config();
@@ -16355,12 +16435,12 @@ var init_branch = __esm(() => {
   init_release_tracks();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/route-intent.ts
+// packages/workit-core/src/core/route-intent.ts
 var init_route_intent = __esm(() => {
   init_branch();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/runtime-identity.ts
+// packages/workit-core/src/core/runtime-identity.ts
 import { createHash as createHash11 } from "node:crypto";
 import { readFileSync as readFileSync6 } from "node:fs";
 var sha256Hex = (bytes) => createHash11("sha256").update(bytes).digest("hex"), bundleHashOfFile = (file) => {
@@ -16385,7 +16465,7 @@ var init_runtime_identity = __esm(() => {
   ];
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/policy-resolver.ts
+// packages/workit-core/src/core/policy-resolver.ts
 function resolvePolicy(input) {
   const ids = input.constraints.map((constraint) => constraint.id);
   if (new Set(ids).size !== ids.length)
@@ -16445,7 +16525,7 @@ var init_policy_resolver = __esm(() => {
   init_derive();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/safe-write.ts
+// packages/workit-core/src/core/safe-write.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
 import {
   closeSync as closeSync2,
@@ -16523,7 +16603,7 @@ function writeFileAtomic(file, content, mode) {
 }
 var init_safe_write = () => {};
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/autonomy.ts
+// packages/workit-core/src/autonomy.ts
 import { copyFileSync as copyFileSync3, existsSync as existsSync6 } from "node:fs";
 import os3 from "node:os";
 import path18 from "node:path";
@@ -16656,7 +16736,7 @@ function requireGrant(cwd, kind, options = {}) {
     allowed: true,
     kind,
     source: configured ? autonomy.source : "default",
-    requireVerdict: kind === "merge" && value !== true,
+    allowUnverified: kind === "merge" && value === true,
     workspace
   };
 }
@@ -16804,7 +16884,7 @@ var init_autonomy = __esm(() => {
   DEFAULT_ENDPOINTS = ["commit", "pr", "green", "merged"];
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/task-engine.ts
+// packages/workit-core/src/core/task-engine.ts
 import { realpathSync as realpathSync4 } from "node:fs";
 
 class WorkitCore {
@@ -18386,13 +18466,13 @@ var init_task_engine = __esm(() => {
   retryPause = new Int32Array(new SharedArrayBuffer(4));
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/repo-context.ts
+// packages/workit-core/src/core/repo-context.ts
 var init_repo_context = __esm(() => {
   init_vcs_config();
   init_core3();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/forge/pr-body.ts
+// packages/workit-core/src/forge/pr-body.ts
 function parseGhIssue(value) {
   const m = /issues\/(\d+)/.exec(value);
   return m ? m[1] : String(value).trim().replace(/^#/, "");
@@ -18453,9 +18533,9 @@ var init_pr_body = __esm(() => {
   init_vcs_config();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/pr-create.ts
+// packages/workit-core/src/core/pr-create.ts
 import path19 from "node:path";
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 import { pathToFileURL } from "node:url";
 var safePushUrl = (remote) => {
   const raw = remote.trim();
@@ -18483,7 +18563,7 @@ var safePushUrl = (remote) => {
   const target = safePushUrl(remote);
   if (!target)
     return false;
-  const result = spawnSync9("git", ["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"], { cwd, encoding: "utf8" });
+  const result = spawnSync10("git", ["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"], { cwd, encoding: "utf8" });
   if (result.status !== 0 && result.status !== 1)
     return false;
   const prefixes = (result.stdout ?? "").split(/\r?\n/u).map((line) => line.trim().slice(line.trim().indexOf(" ") + 1)).filter(Boolean);
@@ -18496,13 +18576,13 @@ var init_pr_create = __esm(() => {
   init_pr_body();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/tracker-issues.ts
+// packages/workit-core/src/core/tracker-issues.ts
 var init_tracker_issues = __esm(() => {
   init_pr_create();
   init_vcs_config();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/templates.ts
+// packages/workit-core/src/core/templates.ts
 var repoRoot;
 var init_templates = __esm(() => {
   init_config();
@@ -18510,7 +18590,7 @@ var init_templates = __esm(() => {
   repoRoot = assetRoot();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/scripts.ts
+// packages/workit-core/src/core/scripts.ts
 var PLUGIN_ROOT, ASSET_ROOT, resolveWorkspaceRoot = (explicit) => explicit || process.cwd();
 var init_scripts = __esm(() => {
   init_package_root();
@@ -18518,7 +18598,7 @@ var init_scripts = __esm(() => {
   ASSET_ROOT = assetRoot();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/youtrack.ts
+// packages/workit-core/src/core/youtrack.ts
 import fs13 from "node:fs";
 import path20 from "node:path";
 function readYouTrackConfig(required) {
@@ -18990,7 +19070,7 @@ var init_youtrack = __esm(() => {
   };
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/context-read.ts
+// packages/workit-core/src/core/context-read.ts
 var contextReadSchema;
 var init_context_read = __esm(() => {
   init_zod();
@@ -19021,7 +19101,7 @@ var init_context_read = __esm(() => {
   }).strict();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core.ts
+// packages/workit-core/src/core.ts
 import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
 import path21 from "node:path";
 function resolveInside(root, candidate) {
@@ -19123,20 +19203,30 @@ async function parseTaskArgs(argv, deps) {
   const judge = [];
   const seen = new Set;
   for (let i = 2;i < argv.length; i += 1) {
-    const token = argv[i];
+    if (argv[i] === "--") {
+      const extra = argv.slice(i + 1);
+      if (extra.length)
+        return parseUsage(`${family} ${actionName} takes no positional arguments (got: ${extra.join(" ")})`, json);
+      break;
+    }
+    const eq = argv[i].startsWith("--") ? argv[i].indexOf("=") : -1;
+    const token = eq > 0 ? argv[i].slice(0, eq) : argv[i];
+    const inline = eq > 0 ? argv[i].slice(eq + 1) : undefined;
     if (family === "policy" && (token === "--judge" || token === "--ref")) {
       if (token === "--ref") {
-        const value = argv[++i];
+        const value = inline ?? argv[++i];
         if (value === undefined || !value.trim())
           return parseUsage("--ref requires a value", json);
         judge.push(`ref=${value}`);
         continue;
       }
+      if (inline !== undefined)
+        judge.push(inline);
       while (argv[i + 1] !== undefined && !argv[i + 1].startsWith("--"))
         judge.push(argv[++i]);
       continue;
     }
-    if (token === "--json" || token === "--confirm") {
+    if ((token === "--json" || token === "--confirm") && inline === undefined) {
       if (seen.has(token))
         return parseUsage(`duplicate argument: ${token}`, json);
       seen.add(token);
@@ -19145,8 +19235,8 @@ async function parseTaskArgs(argv, deps) {
       continue;
     }
     if (!["--payload", "--task", "--revision", "--workspace-revision", "--view", "--actor"].includes(token))
-      return parseUsage(`unknown argument: ${token}`, json);
-    const value = argv[++i];
+      return parseUsage(`unknown argument: ${argv[i]}`, json);
+    const value = inline ?? argv[++i];
     if (value === undefined || value.trim() === "" && token !== "--workspace-revision")
       return parseUsage(`${token} requires a value`, json);
     if (seen.has(token))
@@ -19205,6 +19295,12 @@ async function parseHandoffArgs(argv, deps) {
   const seen = new Set;
   for (let i = 0;i < argv.length; i += 1) {
     const token = argv[i];
+    if (token === "--") {
+      const extra = argv.slice(i + 1);
+      if (extra.length)
+        return parseUsage(`handoff takes no positional arguments (got: ${extra.join(" ")})`, json);
+      break;
+    }
     if (token === "--json") {
       if (seen.has(token))
         return parseUsage(`duplicate argument: ${token}`, json);
@@ -19212,14 +19308,18 @@ async function parseHandoffArgs(argv, deps) {
       json = true;
       continue;
     }
-    if (token !== "--task")
+    const inline = token.startsWith("--task=") ? token.slice("--task=".length) : undefined;
+    if (token !== "--task" && inline === undefined)
       return parseUsage(`unknown argument: ${token}`, json);
-    if (taskId !== undefined || argv[i + 1] === undefined || argv[i + 1].trim() === "")
+    const value = inline ?? argv[i + 1];
+    if (taskId !== undefined || value === undefined || value.trim() === "")
       return parseUsage("--task requires one non-empty value", json);
-    if (seen.has(token))
-      return parseUsage(`duplicate argument: ${token}`, json);
-    seen.add(token);
-    taskId = argv[++i];
+    if (seen.has("--task"))
+      return parseUsage("duplicate argument: --task", json);
+    seen.add("--task");
+    taskId = value;
+    if (inline === undefined)
+      i += 1;
   }
   if (!taskId)
     return parseUsage("handoff requires --task <id>", json);
@@ -19406,13 +19506,14 @@ var init_task = __esm(() => {
 
 // packages/workit-cli/src/verbs/task.ts
 function isImplicitTaskForm(argv) {
-  const [action, first] = argv;
+  const [action, ...rest] = argv;
   if (!action)
     return false;
   if (IMPLICIT2.has(action))
     return true;
+  const first = rest.find((arg) => arg !== "--json");
   if (action === "start")
-    return first !== undefined && !first.startsWith("--");
+    return first !== undefined && (first === "--" || !first.startsWith("--"));
   if (action === "close")
     return !argv.includes("--task") && !argv.includes("--payload");
   return false;
@@ -19421,6 +19522,10 @@ function parse4(argv) {
   const flags = { positionals: [], values: new Map, switches: new Set };
   for (let index = 0;index < argv.length; index += 1) {
     const arg = argv[index];
+    if (arg === "--") {
+      flags.positionals.push(...argv.slice(index + 1));
+      break;
+    }
     const [flag, inline] = arg.startsWith("--") && arg.includes("=") ? arg.split(/=(.*)/su) : [arg];
     if (SWITCHES.has(flag)) {
       flags.switches.add(flag);
@@ -34280,7 +34385,7 @@ function getSgrPrefix(code) {
   if (code.startsWith("›")) {
     return "›";
   }
-  return `${ESCAPE}${ANSI_CSI2}`;
+  return `${ESCAPE2}${ANSI_CSI2}`;
 }
 function createSgrCode(prefix, values) {
   return `${prefix}${values.join(";")}${ANSI_SGR_TERMINATOR2}`;
@@ -34289,7 +34394,7 @@ function getSgrFragments(code) {
   const fragments = [];
   const sgrPrefix = getSgrPrefix(code);
   let parameterString;
-  if (code.startsWith(`${ESCAPE}${ANSI_CSI2}`)) {
+  if (code.startsWith(`${ESCAPE2}${ANSI_CSI2}`)) {
     parameterString = code.slice(2, -1);
   } else if (code.startsWith("›")) {
     parameterString = code.slice(1, -1);
@@ -34450,7 +34555,7 @@ function parseHyperlinkCode(string, index) {
         endIndex: sequenceIndex + 1
       };
     }
-    if (character === ESCAPE && string[sequenceIndex + 1] === ANSI_OSC_TERMINATOR) {
+    if (character === ESCAPE2 && string[sequenceIndex + 1] === ANSI_OSC_TERMINATOR) {
       const code = string.slice(index, sequenceIndex + 2);
       const action = sequenceIndex === uriStart + 1 ? "close" : "open";
       return {
@@ -34533,7 +34638,7 @@ function parseControlStringCode(string, index) {
     if (supportsBellTerminator && string[sequenceIndex] === ANSI_BELL) {
       return createControlParseResult(string.slice(index, sequenceIndex + 1), sequenceIndex + 1);
     }
-    if (string[sequenceIndex] === ESCAPE && string[sequenceIndex + 1] === ANSI_OSC_TERMINATOR) {
+    if (string[sequenceIndex] === ESCAPE2 && string[sequenceIndex + 1] === ANSI_OSC_TERMINATOR) {
       return createControlParseResult(string.slice(index, sequenceIndex + 2), sequenceIndex + 2);
     }
     if (string[sequenceIndex] === C1_STRING_TERMINATOR) {
@@ -34758,7 +34863,7 @@ function tokenizeAnsi(string, { endCharacter = Number.POSITIVE_INFINITY } = {})
   }
   return tokens;
 }
-var ESCAPE_CODE_POINT = 27, C1_DCS_CODE_POINT = 144, C1_SOS_CODE_POINT = 152, C1_CSI_CODE_POINT = 155, C1_ST_CODE_POINT = 156, C1_OSC_CODE_POINT = 157, C1_PM_CODE_POINT = 158, C1_APC_CODE_POINT = 159, ESCAPES2, ESCAPE = "\x1B", ANSI_BELL = "\x07", ANSI_CSI2 = "[", ANSI_OSC2 = "]", ANSI_DCS = "P", ANSI_SOS = "X", ANSI_PM = "^", ANSI_APC = "_", ANSI_SGR_TERMINATOR2 = "m", ANSI_OSC_TERMINATOR = "\\", ANSI_STRING_TERMINATOR, C1_OSC = "", C1_STRING_TERMINATOR = "œ", ANSI_HYPERLINK_ESC_PREFIX, ANSI_HYPERLINK_C1_PREFIX, ANSI_HYPERLINK_ESC_CLOSE, ANSI_HYPERLINK_C1_CLOSE, CODE_POINT_0, CODE_POINT_9, CODE_POINT_SEMICOLON, CODE_POINT_COLON, CODE_POINT_CSI_PARAMETER_START, CODE_POINT_CSI_PARAMETER_END, CODE_POINT_CSI_INTERMEDIATE_START, CODE_POINT_CSI_INTERMEDIATE_END, CODE_POINT_CSI_FINAL_START, CODE_POINT_CSI_FINAL_END, REGIONAL_INDICATOR_SYMBOL_LETTER_A = 127462, REGIONAL_INDICATOR_SYMBOL_LETTER_Z = 127487, SGR_RESET_CODE = 0, SGR_EXTENDED_FOREGROUND_CODE = 38, SGR_DEFAULT_FOREGROUND_CODE = 39, SGR_EXTENDED_BACKGROUND_CODE = 48, SGR_DEFAULT_BACKGROUND_CODE = 49, SGR_COLOR_TYPE_ANSI_256 = 5, SGR_COLOR_TYPE_TRUECOLOR = 2, SGR_ANSI_256_FRAGMENT_LENGTH = 3, SGR_TRUECOLOR_FRAGMENT_LENGTH = 5, SGR_ANSI_256_LAST_PARAMETER_OFFSET = 2, SGR_TRUECOLOR_LAST_PARAMETER_OFFSET = 4, VARIATION_SELECTOR_16_CODE_POINT = 65039, COMBINING_ENCLOSING_KEYCAP_CODE_POINT = 8419, EMOJI_PRESENTATION_GRAPHEME_REGEX, GRAPHEME_SEGMENTER, endCodeNumbers;
+var ESCAPE_CODE_POINT = 27, C1_DCS_CODE_POINT = 144, C1_SOS_CODE_POINT = 152, C1_CSI_CODE_POINT = 155, C1_ST_CODE_POINT = 156, C1_OSC_CODE_POINT = 157, C1_PM_CODE_POINT = 158, C1_APC_CODE_POINT = 159, ESCAPES2, ESCAPE2 = "\x1B", ANSI_BELL = "\x07", ANSI_CSI2 = "[", ANSI_OSC2 = "]", ANSI_DCS = "P", ANSI_SOS = "X", ANSI_PM = "^", ANSI_APC = "_", ANSI_SGR_TERMINATOR2 = "m", ANSI_OSC_TERMINATOR = "\\", ANSI_STRING_TERMINATOR, C1_OSC = "", C1_STRING_TERMINATOR = "œ", ANSI_HYPERLINK_ESC_PREFIX, ANSI_HYPERLINK_C1_PREFIX, ANSI_HYPERLINK_ESC_CLOSE, ANSI_HYPERLINK_C1_CLOSE, CODE_POINT_0, CODE_POINT_9, CODE_POINT_SEMICOLON, CODE_POINT_COLON, CODE_POINT_CSI_PARAMETER_START, CODE_POINT_CSI_PARAMETER_END, CODE_POINT_CSI_INTERMEDIATE_START, CODE_POINT_CSI_INTERMEDIATE_END, CODE_POINT_CSI_FINAL_START, CODE_POINT_CSI_FINAL_END, REGIONAL_INDICATOR_SYMBOL_LETTER_A = 127462, REGIONAL_INDICATOR_SYMBOL_LETTER_Z = 127487, SGR_RESET_CODE = 0, SGR_EXTENDED_FOREGROUND_CODE = 38, SGR_DEFAULT_FOREGROUND_CODE = 39, SGR_EXTENDED_BACKGROUND_CODE = 48, SGR_DEFAULT_BACKGROUND_CODE = 49, SGR_COLOR_TYPE_ANSI_256 = 5, SGR_COLOR_TYPE_TRUECOLOR = 2, SGR_ANSI_256_FRAGMENT_LENGTH = 3, SGR_TRUECOLOR_FRAGMENT_LENGTH = 5, SGR_ANSI_256_LAST_PARAMETER_OFFSET = 2, SGR_TRUECOLOR_LAST_PARAMETER_OFFSET = 4, VARIATION_SELECTOR_16_CODE_POINT = 65039, COMBINING_ENCLOSING_KEYCAP_CODE_POINT = 8419, EMOJI_PRESENTATION_GRAPHEME_REGEX, GRAPHEME_SEGMENTER, endCodeNumbers;
 var init_tokenize_ansi = __esm(() => {
   init_ansi_styles();
   init_is_fullwidth_code_point();
@@ -34772,8 +34877,8 @@ var init_tokenize_ansi = __esm(() => {
     C1_PM_CODE_POINT,
     C1_APC_CODE_POINT
   ]);
-  ANSI_STRING_TERMINATOR = `${ESCAPE}${ANSI_OSC_TERMINATOR}`;
-  ANSI_HYPERLINK_ESC_PREFIX = `${ESCAPE}${ANSI_OSC2}8;`;
+  ANSI_STRING_TERMINATOR = `${ESCAPE2}${ANSI_OSC_TERMINATOR}`;
+  ANSI_HYPERLINK_ESC_PREFIX = `${ESCAPE2}${ANSI_OSC2}8;`;
   ANSI_HYPERLINK_C1_PREFIX = `${C1_OSC}8;`;
   ANSI_HYPERLINK_ESC_CLOSE = `${ANSI_HYPERLINK_ESC_PREFIX};`;
   ANSI_HYPERLINK_C1_CLOSE = `${ANSI_HYPERLINK_C1_PREFIX};`;
@@ -62177,7 +62282,7 @@ var init_build3 = __esm(async () => {
   init_types();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/gitignore.ts
+// packages/workit-core/src/core/gitignore.ts
 var GITIGNORE_ENTRIES;
 var init_gitignore = __esm(() => {
   GITIGNORE_ENTRIES = [
@@ -62198,7 +62303,7 @@ var init_gitignore = __esm(() => {
   ];
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/changelog.ts
+// packages/workit-core/src/core/changelog.ts
 import fs16 from "node:fs";
 import path23 from "node:path";
 import { createHash as createHash12 } from "node:crypto";
@@ -62527,7 +62632,7 @@ var init_changelog = __esm(() => {
   HEADING_RE = /^###\s+/;
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/hygiene.ts
+// packages/workit-core/src/core/hygiene.ts
 import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
 import path24 from "node:path";
 var repoRoot2, templatesDir = () => path24.join(repoRoot2, "templates", "hygiene"), packageJson = (root) => {
@@ -62732,7 +62837,7 @@ var init_registration = __esm(() => {
   CURSOR_HOOK_RUN_COMMAND = `npx -y --prefer-online --min-release-age=0 --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-hook`;
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/support-matrix.ts
+// packages/workit-core/src/core/support-matrix.ts
 var SUPPORT_MATRIX;
 var init_support_matrix = __esm(() => {
   SUPPORT_MATRIX = {
@@ -62746,7 +62851,7 @@ var init_support_matrix = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/host-install.ts
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { spawnSync as spawnSync11 } from "node:child_process";
 import {
   accessSync,
   constants as constants2,
@@ -63017,7 +63122,7 @@ function runHostCommand(step, context = {}) {
       stderr: `Cannot safely execute batch shim ${step.command}; resolve its Node.js CLI entrypoint and retry`
     };
   }
-  const result = spawnSync10(step.command, step.args, {
+  const result = spawnSync11(step.command, step.args, {
     cwd: step.cwd,
     env: (() => {
       const home = context.home ?? context.env?.HOME ?? os6.homedir();
@@ -63176,7 +63281,7 @@ var init_host_install = __esm(() => {
   CLAUDE_SCOPES = new Set(["user", "project", "local"]);
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/skill-manifests.ts
+// packages/workit-core/src/core/skill-manifests.ts
 import { cpSync as cpSync3, existsSync as existsSync12, readFileSync as readFileSync12, readdirSync as readdirSync5, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import path28 from "node:path";
 var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync12(root) ? readdirSync5(root).filter((name) => existsSync12(path28.join(root, name, "SKILL.md"))).toSorted() : [], validateSkillManifests = (root, expected, label) => {
@@ -63222,7 +63327,7 @@ var init_skill_manifests = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/doctor.ts
-import { spawnSync as spawnSync11 } from "node:child_process";
+import { spawnSync as spawnSync12 } from "node:child_process";
 import {
   existsSync as existsSync13,
   lstatSync as lstatSync4,
@@ -63306,7 +63411,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return false;
 }, versionOf = (bin, env, timeout) => {
-  const r = spawnSync11(bin, ["--version"], { encoding: "utf8", env, timeout });
+  const r = spawnSync12(bin, ["--version"], { encoding: "utf8", env, timeout });
   if (r.error)
     return null;
   return (r.stdout ?? "").trim();
@@ -63555,7 +63660,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 `)) {
       return false;
     }
-    return spawnSync11(runtime, ["--check", entry], { encoding: "utf8", env }).status === 0;
+    return spawnSync12(runtime, ["--check", entry], { encoding: "utf8", env }).status === 0;
   } catch {
     return false;
   }
@@ -63769,7 +63874,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (!cmd)
     return null;
   try {
-    const r = spawnSync11(cmd, ["view", pkgName, "version"], {
+    const r = spawnSync12(cmd, ["view", pkgName, "version"], {
       encoding: "utf8",
       timeout: 20000,
       env: res.env
@@ -64053,6 +64158,16 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     detail: `malformed config: ${bad.join(", ")}`,
     fix: `Repair the malformed config in ${bad[0]}`
   };
+}, branchPresetLine = (res, workspace) => {
+  try {
+    const resolved = resolveWorkspacePolicy(readConfigFromDir(res.configDir), workspace, undefined, () => repoBranchPreset(res.cwd));
+    if (resolved.status === "invalid")
+      return [];
+    const { preset, detected } = resolved.branchPolicy;
+    return [`preset: ${detected ? `detected (${preset})` : preset}`];
+  } catch {
+    return [];
+  }
 }, checkWorkspaceMismatch = (res) => {
   const result = readWorkspacesResult(res.configDir);
   const file = result.path;
@@ -64060,7 +64175,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return {
       id: "workspace_mismatch",
       status: "pass",
-      detail: "no workspaces configured"
+      detail: ["no workspaces configured", ...branchPresetLine(res, null)].join("; ")
     };
   if (result.status === "malformed" || result.status === "invalid")
     return {
@@ -64084,7 +64199,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     const matched = `current directory matches workspace "${match.name}"`;
     const tracks = releaseTracksReport(res.cwd);
     const lines = describeReleaseTracks(tracks);
-    const detail = [matched, ...lines].join("; ");
+    const detail = [matched, ...branchPresetLine(res, match), ...lines].join("; ");
     if (tracks.error)
       return {
         id: "workspace_mismatch",
@@ -64198,7 +64313,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, defaultIdentityProbes = (env) => ({
   origin: (cwd) => {
     try {
-      const out = spawnSync11("git", ["remote", "get-url", "origin"], {
+      const out = spawnSync12("git", ["remote", "get-url", "origin"], {
         cwd,
         encoding: "utf8",
         env
@@ -64210,7 +64325,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   ghLogin: (e) => {
     try {
-      const out = spawnSync11("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
+      const out = spawnSync12("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
       const login = (out.stdout ?? "").trim();
       return out.status === 0 && login ? login : null;
     } catch {
@@ -64219,7 +64334,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   glabLogin: (e) => {
     try {
-      const out = spawnSync11("glab", ["api", "user", "--jq", ".username"], {
+      const out = spawnSync12("glab", ["api", "user", "--jq", ".username"], {
         encoding: "utf8",
         env: e
       });
@@ -64231,7 +64346,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   sshLogin: (host) => {
     try {
-      const out = spawnSync11("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "-T", `git@${host}`], {
+      const out = spawnSync12("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "-T", `git@${host}`], {
         encoding: "utf8",
         env
       });
@@ -64426,6 +64541,7 @@ var init_doctor = __esm(() => {
   init_runtime_identity();
   init_boundary();
   init_release_tracks();
+  init_branch_policy();
   init_config();
   init_package_root();
   init_registration();
@@ -65439,70 +65555,7 @@ var init_setup = __esm(() => {
   SETUP_OVERRIDES = [...YT_OVERRIDES, ...VCS_OVERRIDES];
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/branch-policy.ts
-import { spawnSync as spawnSync12 } from "node:child_process";
-var PREFIXES, detectBranchPolicy = (workspaceRoot) => {
-  const branchExists = (name) => {
-    const r = spawnSync12("git", ["branch", "--list", name], {
-      cwd: workspaceRoot,
-      encoding: "utf8"
-    });
-    return r.status === 0 && (r.stdout ?? "").trim() !== "";
-  };
-  const develop = branchExists("develop");
-  const main = branchExists("main");
-  const master = branchExists("master");
-  const root = main ? "main" : master ? "master" : null;
-  if (develop) {
-    return {
-      preset: "gitflow",
-      developBranch: "develop",
-      integration: "merge",
-      protected: root ? [root, "develop"] : ["develop"],
-      allowed: [...PRESETS.gitflow.allowed],
-      prefixes: PREFIXES
-    };
-  }
-  if (root === "main") {
-    return {
-      preset: "github-flow",
-      developBranch: null,
-      integration: "pr",
-      protected: [root],
-      allowed: ["*"],
-      prefixes: PREFIXES
-    };
-  }
-  if (root === "master") {
-    return {
-      preset: "trunk-based",
-      developBranch: null,
-      integration: "pr",
-      protected: [root],
-      allowed: ["*"],
-      prefixes: PREFIXES
-    };
-  }
-  return {
-    preset: "gitflow",
-    developBranch: null,
-    integration: "merge",
-    protected: [],
-    allowed: [],
-    prefixes: PREFIXES
-  };
-};
-var init_branch_policy = __esm(() => {
-  init_config();
-  PREFIXES = {
-    feature: "feature/*",
-    bugfix: "bugfix/*",
-    release: "release/*",
-    hotfix: "hotfix/*"
-  };
-});
-
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/workspace-branch-policy.ts
+// packages/workit-core/src/core/workspace-branch-policy.ts
 import { mkdirSync as mkdirSync6, readFileSync as readFileSync15, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "node:fs";
 import path31 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
@@ -68590,7 +68643,7 @@ function Screen({
           };
           const checkout = resolveBasePath(draft.values);
           const workspace = resolveWorkspaceFromEntries(checkout, draft.values.workspaces);
-          const resolved = resolveWorkspacePolicy(config, workspace);
+          const resolved = resolveWorkspacePolicy(config, workspace, undefined, () => repoBranchPreset(checkout));
           if (resolved.status === "invalid")
             return { error: resolved.error };
           return {
@@ -68980,7 +69033,7 @@ var init_steps = __esm(async () => {
   ];
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/logger.ts
+// packages/workit-core/src/core/logger.ts
 import { appendFileSync, mkdirSync as mkdirSync7, readdirSync as readdirSync7, unlinkSync as unlinkSync3 } from "node:fs";
 import os11 from "node:os";
 import path34 from "node:path";
@@ -69988,7 +70041,7 @@ var init_launch = __esm(() => {
   init_upgrade();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/knowledge.ts
+// packages/workit-core/src/knowledge.ts
 import { spawnSync as spawnSync14 } from "node:child_process";
 import fs17 from "node:fs";
 import path36 from "node:path";
@@ -70385,7 +70438,7 @@ var init_doctor2 = __esm(() => {
   init_task();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/forge/redact.ts
+// packages/workit-core/src/forge/redact.ts
 function redactText(value) {
   let out = stripAnsi2(value).replace(PRIVATE_KEY, "[REDACTED PRIVATE KEY]");
   out = out.replace(WEBHOOK, `$1/${R}`);
@@ -70488,7 +70541,7 @@ var init_redact = __esm(() => {
   NOT_FIRST_ERROR = /^\s*(?:\(pass\)|\(skip\)|\(todo\)|✓|✔|ok\b|PASS\b)|^\s*\d+ fail\b|##\[error\]Process completed|^\s*0 (?:errors?|fail)/u;
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/checks.ts
+// packages/workit-core/src/checks.ts
 import { spawn, spawnSync as spawnSync15 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
 import fs18 from "node:fs";
@@ -71015,18 +71068,14 @@ async function change(verb, argv, io, deps) {
   ]);
 }
 async function runGrant(argv, io, deps = defaultDeps) {
-  const [sub, ...rest] = argv;
+  const end = argv.indexOf("--");
+  const [sub, ...rest] = end < 0 ? argv : [...argv.slice(0, end), ...argv.slice(end + 1)];
   if (sub === "show")
     return show(rest, io);
-  if (sub === undefined || sub.startsWith("--") && sub !== "--help")
+  if (sub === undefined || sub.startsWith("--"))
     return show(argv, io);
   if (sub === "set" || sub === "unset")
     return change(sub, rest, io, deps);
-  if (sub === "--help" || sub === "-h") {
-    io.stdout(`usage: ${USAGE2}
-`);
-    return 0;
-  }
   return usage2(io, `unknown subcommand "${sub}"`);
 }
 var USAGE2 = "workit grant show [<workspace>] [--all] | grant set <workspace> <kind>=<true|false|verified>… [defaultEndpoint=commit|pr|green|merged] [verification=self|independent] | grant unset <workspace> <kind>…  (kinds: push, pr, merge, release, rerun, defaultEndpoint, verification)", AGENT_ENV, agentMarker = (env) => AGENT_ENV.find((name) => env[name]) ?? Object.keys(env).find((name) => name.startsWith("CODEX_") && env[name]), defaultDeps, parseValue = (raw) => raw === "true" || raw === "yes" || raw === "on" ? true : raw === "false" || raw === "no" || raw === "off" ? false : raw === "verified" ? "verified" : null, STOPS_AT, endpointLabel = (view) => view.effectiveEndpoint === view.defaultEndpoint ? view.defaultEndpoint : `${view.defaultEndpoint} (effective: ${view.effectiveEndpoint}${view.endpointReason ? `, ${view.endpointReason}` : ""})`, describe2 = (grants, configured, endpoint, verification) => [
@@ -71390,11 +71439,51 @@ var init_check = __esm(() => {
   FINGERPRINT_VARS = ["CI", "NODE_ENV", "npm_config_script_shell", "NODE_OPTIONS", "SHELL"];
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/forge/types.ts
+// packages/workit-core/src/forge/types.ts
 var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock) => ({ ok: false, code, error, ...unblock ? { unblock } : {} });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/git/ops.ts
+// packages/workit-core/src/git/ops.ts
 import { spawnSync as spawnSync16 } from "node:child_process";
+import { existsSync as existsSync18, readFileSync as readFileSync18 } from "node:fs";
+import path39 from "node:path";
+function operationInProgress(cwd) {
+  const markers = [
+    ["rebase-merge", "rebase"],
+    ["rebase-apply", "rebase"],
+    ["MERGE_HEAD", "merge"],
+    ["CHERRY_PICK_HEAD", "cherry-pick"],
+    ["REVERT_HEAD", "revert"]
+  ];
+  const run = git5(cwd, ["rev-parse", ...markers.flatMap(([name]) => ["--git-path", name])]);
+  if (!run.ok)
+    return null;
+  const found = run.stdout.split(`
+`).map((line) => path39.resolve(cwd, line.trim()));
+  const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
+  for (const [index, [, operation]] of markers.entries()) {
+    const marker = found[index];
+    if (!marker || !existsSync18(marker))
+      continue;
+    if (index === 1 && existsSync18(path39.join(marker, "applying")))
+      return { operation: "am", commitAllowed: false, branch: null };
+    if (index === 0 && existsSync18(path39.join(marker, "amend")) && !conflicted()) {
+      let headName = "";
+      try {
+        headName = readFileSync18(path39.join(marker, "head-name"), "utf8").trim();
+      } catch {}
+      const branch = headName.startsWith("refs/heads/") ? headName.slice("refs/heads/".length) : null;
+      return { operation, commitAllowed: branch !== null, branch };
+    }
+    if ((operation === "revert" || operation === "merge") && !conflicted())
+      return { operation, commitAllowed: true, branch: null };
+    return { operation, commitAllowed: false, branch: null };
+  }
+  return null;
+}
+function inProgressFailure(operation, verb) {
+  const command = operation === "am" ? "git am" : `git ${operation}`;
+  return failure3("blocked", `${operation.replace("-", "_")}_in_progress: a ${operation === "am" ? "git am" : operation} is in progress; finish or abort it before workit can ${verb}`, `resolve the conflicts, git add <files>, then ${command} --continue  # or ${command} --abort to return to where you started`);
+}
 function dirtEntries(cwd) {
   const run = git5(cwd, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
   if (!run.ok)
@@ -71414,6 +71503,9 @@ function dirtEntries(cwd) {
 function gitBranch(cwd, input) {
   if (!headSha(cwd) && currentBranch(cwd) === null)
     return failure3("invalid_input", "not inside a git repository with a commit");
+  const progress = operationInProgress(cwd);
+  if (progress)
+    return inProgressFailure(progress.operation, "create a branch");
   const explicitBase = input.base?.trim() || null;
   const resolved = vcsConfig("resolve", cwd, {
     track: input.track ?? null,
@@ -71518,53 +71610,156 @@ function lintCommitMessage(cwd, message) {
     correction: `use a ${detected} commit subject`
   };
 }
+function messageTrailers(cwd, message) {
+  const run = git5(cwd, [...TRAILER_CONFIG, "interpret-trailers", "--parse", "--no-divider"], {
+    input: `${message}
+`
+  });
+  return run.ok ? run.stdout.split(`
+`).filter((line) => line.trim()) : [];
+}
+function withTrailers(cwd, message, trailers) {
+  if (!trailers.length)
+    return message;
+  const run = git5(cwd, [
+    ...TRAILER_CONFIG,
+    "interpret-trailers",
+    "--no-divider",
+    "--if-exists",
+    "addIfDifferent",
+    ...trailers.flatMap((trailer) => ["--trailer", trailer])
+  ], { input: `${message}
+` });
+  return run.ok ? run.stdout.trim() : `${message}
+
+${trailers.join(`
+`)}`;
+}
+function branchesContaining(cwd, sha) {
+  const run = git5(cwd, [
+    "for-each-ref",
+    "--format=%(refname)",
+    "--contains",
+    sha,
+    "refs/heads",
+    "refs/remotes"
+  ]);
+  const names = new Set;
+  for (const ref of run.ok ? run.stdout.split(`
+`) : []) {
+    if (ref.startsWith("refs/heads/"))
+      names.add(ref.slice("refs/heads/".length));
+    else if (ref.startsWith("refs/remotes/")) {
+      const name = ref.split("/").slice(3).join("/");
+      if (name && name !== "HEAD")
+        names.add(name);
+    }
+  }
+  return names;
+}
+function sharedBranchContaining(cwd, sha, branch) {
+  const resolved = vcsConfig("resolve", cwd);
+  const defaults = new Set(resolved.ok === false ? [] : [resolved.defaultTargetBranch, resolved.baseBranch].map((value) => String(value ?? "")).filter(Boolean));
+  for (const name of branchesContaining(cwd, sha))
+    if (name !== branch && (defaults.has(name) || isProtectedTarget(cwd, name)))
+      return name;
+  return null;
+}
 function gitCommit(cwd, input) {
-  const message = input.message.trim();
-  if (!message)
-    return failure3("invalid_input", "a commit message is required (-m <msg>)");
+  const given = input.message?.trim() ?? "";
+  if (!given && !input.amend)
+    return failure3("invalid_input", "a commit message is required (-m <msg> or -F <file>)");
   const paths = input.paths ?? [];
   if (input.all && paths.length)
     return failure3("invalid_input", "pass --all or paths, not both");
-  const branch = currentBranch(cwd);
+  const progress = operationInProgress(cwd);
+  if (progress && !progress.commitAllowed)
+    return inProgressFailure(progress.operation, "commit");
+  const branch = progress?.branch ?? currentBranch(cwd);
   if (!branch)
     return failure3("invalid_input", "HEAD is detached; commit on a branch (workit git branch <name>)");
   if (isProtectedTarget(cwd, branch))
     return failure3("blocked", `protected_branch: ${branch} is protected by the workspace branch policy; workit never commits to it`, "workit git branch <feature/name>  # then commit there");
-  const lint = lintCommitMessage(cwd, message);
-  if (!lint.ok)
-    return failure3("blocked", lint.error, lint.correction);
+  const previous = input.amend ? headSha(cwd) : null;
+  if (input.amend && !previous)
+    return failure3("invalid_input", `nothing to amend: ${branch} has no commit yet`);
+  if (previous) {
+    const shared = sharedBranchContaining(cwd, previous, branch);
+    if (shared)
+      return failure3("blocked", `amend_shared_commit: ${previous.slice(0, 12)} is already on ${shared}, so it is not ${branch}'s own commit; workit never rewrites it`, "workit git commit -m '<msg>' -- <paths>  # add a new commit instead");
+  }
+  let message = given;
+  let carried = [];
+  if (given) {
+    const lint = lintCommitMessage(cwd, given);
+    if (!lint.ok)
+      return failure3("blocked", lint.error, lint.correction);
+  }
+  if (previous) {
+    const kept = git5(cwd, ["log", "-1", "--format=%B", previous]);
+    if (!kept.ok)
+      return failure3("failed", `could not read the message of ${branch}: ${gitError(kept)}`);
+    if (given)
+      carried = messageTrailers(cwd, kept.stdout.trim());
+    else
+      message = kept.stdout.trim();
+  }
   const session = input.actor.session;
   if (session && !SESSION_SAFE.test(session))
     return failure3("invalid_input", "WORKIT_SESSION_ID must be 1-128 characters of [A-Za-z0-9_.:@/+-]");
-  const args = ["commit", "--no-edit", "-m", message];
-  if (session)
-    args.push("--trailer", `Workit-Session: ${session}`);
+  const changeRequired = !input.amend && !input.allowEmpty;
+  const emptyAmend = previous !== null && git5(cwd, ["rev-parse", "--verify", "-q", `${previous}^{tree}`]).stdout.trim() === git5(cwd, ["rev-parse", "--verify", "-q", `${previous}~1^{tree}`]).stdout.trim();
+  const args = ["commit", "--no-edit"];
+  if (input.amend)
+    args.push("--amend");
+  if (input.allowEmpty || emptyAmend)
+    args.push("--allow-empty");
+  args.push("-m", withTrailers(cwd, message, [...carried, ...session ? [`Workit-Session: ${session}`] : []]));
   if (paths.length) {
     if (paths.some((value) => value.startsWith("-") || !value.trim()))
       return failure3("invalid_input", "paths must not be empty or start with -");
-    const added = git5(cwd, ["add", "-A", "--", ...paths]);
-    if (!added.ok)
-      return failure3("failed", `git add failed: ${gitError(added)}`);
+    const tracked = new Set(nulList(git5(cwd, ["ls-files", "-z", "--", ...paths]).stdout));
+    const addable = paths.filter((value) => existsSync18(path39.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
+    if (addable.length) {
+      const added = git5(cwd, ["add", "-A", "--", ...addable]);
+      if (!added.ok)
+        return failure3("failed", `git add failed: ${gitError(added)}`);
+    }
+    if (changeRequired && git5(cwd, ["diff", "--cached", "--quiet", "HEAD", "--", ...paths]).ok)
+      return nothingToCommit(`${paths.join(", ")} has no change to commit`);
     args.push("--", ...paths);
   } else if (input.all) {
     const added = git5(cwd, ["add", "-A"]);
     if (!added.ok)
       return failure3("failed", `git add failed: ${gitError(added)}`);
-  } else {
+    if (changeRequired && git5(cwd, ["diff", "--cached", "--quiet"]).ok)
+      return nothingToCommit("the working tree is clean");
+  } else if (changeRequired) {
     const staged = git5(cwd, ["diff", "--cached", "--name-only", "-z"]);
     if (staged.ok && !staged.stdout.replaceAll("\x00", "")) {
       const dirt = dirtEntries(cwd);
-      return failure3(dirt.length ? "blocked" : "failed", dirt.length ? `nothing_staged: nothing is staged and workit never commits unrelated changes implicitly (${dirt.length} changed: ${dirt.slice(0, 5).map((entry) => entry.slice(3)).join(", ")}${dirt.length > 5 ? ", …" : ""})` : "nothing_to_commit: the working tree is clean", dirt.length ? `workit git commit -m '<msg>' -- <paths>  # or --all to commit every change` : undefined);
+      if (!dirt.length)
+        return nothingToCommit("the working tree is clean");
+      return failure3("blocked", `nothing_staged: nothing is staged and workit never commits unrelated changes implicitly (${dirt.length} changed: ${dirt.slice(0, 5).map((entry) => entry.slice(3)).join(", ")}${dirt.length > 5 ? ", …" : ""})`, `workit git commit -m '<msg>' -- <paths>  # or --all to commit every change`);
     }
   }
-  const committed = git5(cwd, args, { timeoutMs: COMMIT_TIMEOUT_MS, env: input.env });
+  const committed = git5(cwd, args, {
+    timeoutMs: COMMIT_TIMEOUT_MS,
+    env: input.env
+  });
   if (!committed.ok)
-    return failure3("failed", `git commit failed: ${gitError(committed, 6)}`);
+    return failure3("failed", `git commit failed (a hook or git refused it):
+${gitOutput(committed)}`);
   const sha = headSha(cwd);
   if (!sha)
     return failure3("failed", "the commit did not resolve");
-  const files = nulList(git5(cwd, ["diff-tree", "--root", "--no-commit-id", "--name-only", "-r", "-z", sha]).stdout);
+  const merge = git5(cwd, ["rev-parse", "-q", "--verify", `${sha}^2`]).ok;
+  const files = nulList(git5(cwd, merge ? ["diff", "--name-only", "-z", `${sha}^1`, sha] : ["diff-tree", "--root", "--no-commit-id", "--name-only", "-r", "-z", sha]).stdout);
   const leftDirty = dirtEntries(cwd).length;
+  const notes = [];
+  const upstream = `refs/remotes/${pushRemoteName(cwd, branch) ?? "origin"}/${branch}`;
+  if (previous && git5(cwd, ["merge-base", "--is-ancestor", previous, upstream]).ok)
+    notes.push(`the amended commit ${previous.slice(0, 12)} was already pushed (${upstream.slice("refs/remotes/".length)}); publish the rewrite with: workit git push --force-with-lease`);
   const listed = [];
   let size = 0;
   for (const file of files) {
@@ -71584,7 +71779,8 @@ function gitCommit(cwd, input) {
     subject: (message.split(`
 `, 1)[0] ?? "").slice(0, 200),
     files: listed,
-    fileCount: files.length
+    fileCount: files.length,
+    ...previous ? { amended: previous } : {}
   });
   return success2({
     sha,
@@ -71593,10 +71789,15 @@ function gitCommit(cwd, input) {
     files,
     leftDirty,
     session,
+    amended: previous,
+    notes,
     recorded: row.ok ? { id: String(row.value.id) } : { error: row.error }
   });
 }
 function pushPreflight(cwd, options = {}) {
+  const progress = operationInProgress(cwd);
+  if (progress)
+    return inProgressFailure(progress.operation, "push");
   const branch = options.branch ?? currentBranch(cwd);
   if (!branch)
     return failure3("invalid_input", "HEAD is detached; push a branch");
@@ -71635,11 +71836,35 @@ function recordedRemoteTip(cwd, plan) {
   return;
 }
 function includesRemoteTip(cwd, branch, tip) {
-  if (git5(cwd, ["merge-base", "--is-ancestor", tip, `refs/heads/${branch}`]).ok)
+  const ref = `refs/heads/${branch}`;
+  if (git5(cwd, ["merge-base", "--is-ancestor", tip, ref]).ok)
+    return true;
+  const reflog = git5(cwd, ["reflog", "show", "--format=%H", ref, "--"]);
+  const former = [
+    ...new Set((reflog.ok ? reflog.stdout : "").split(`
+`).map((line) => line.trim()).filter(Boolean))
+  ];
+  if (former.includes(tip))
     return true;
-  const reflog = git5(cwd, ["reflog", "show", "--format=%H", `refs/heads/${branch}`, "--"]);
-  return reflog.ok && reflog.stdout.split(`
-`).some((line) => line.trim() === tip);
+  if (!former.length)
+    return false;
+  const outside = git5(cwd, ["rev-list", "-n", "1", "--stdin"], {
+    input: `${tip}
+${former.map((sha) => `^${sha}`).join(`
+`)}
+`
+  });
+  return outside.ok && !outside.stdout.trim();
+}
+function patchEquivalent(cwd, branch, tip) {
+  const ref = `refs/heads/${branch}`;
+  const merges = git5(cwd, ["rev-list", "--count", "--merges", `${ref}..${tip}`]);
+  if (!merges.ok || merges.stdout.trim() !== "0")
+    return false;
+  const cherry = git5(cwd, ["cherry", ref, tip]);
+  const lines = cherry.ok ? cherry.stdout.split(`
+`).filter(Boolean) : [];
+  return lines.length > 0 && lines.every((line) => line.startsWith("-"));
 }
 function executePush(cwd, plan, input) {
   const before = remoteRefTip(cwd, plan.rawUrl, `refs/heads/${plan.branch}`);
@@ -71674,9 +71899,17 @@ ${run.stdout}`;
         return failure3("unavailable", `git push to ${plan.url} timed out`);
       if (/stale info/iu.test(text))
         return failure3("blocked", `lease_mismatch: ${plan.remote}/${plan.branch} moved while pushing`, `git fetch ${plan.remote} ${plan.branch} && git rebase ${plan.remote}/${plan.branch}  # or merge it; then: workit git push`);
+      const rejected = /non-fast-forward|fetch first|\[rejected\]/iu.test(text);
+      const integrated = rejected && before.sha !== null && includesRemoteTip(cwd, plan.branch, before.sha);
+      const equivalent = rejected && !integrated && before.sha !== null && patchEquivalent(cwd, plan.branch, before.sha);
+      if (before.sha !== null && (integrated || equivalent)) {
+        const lease = recordedRemoteTip(cwd, plan) === before.sha ? "workit git push --force-with-lease" : `workit git push --force-with-lease --expect ${before.sha}`;
+        return failure3("failed", integrated ? `non_fast_forward: local ${plan.branch} was rewritten (amend or rebase) after ${plan.remote}/${plan.branch} (${before.sha.slice(0, 12)}) was pushed; that tip is already part of the local history, so do not fetch and rebase` : `non_fast_forward: every commit on ${plan.remote}/${plan.branch} (${before.sha.slice(0, 12)}) has a patch-equivalent commit in local ${plan.branch} (rebased elsewhere); fetching and rebasing would apply them twice`, integrated ? lease : `${lease} --overwrite-unintegrated  # after checking ${plan.remote}/${plan.branch} holds nothing else`);
+      }
       if (/non-fast-forward|fetch first|\[rejected\]/iu.test(text))
         return failure3("failed", `non_fast_forward: ${plan.remote}/${plan.branch} has commits this branch does not`, `git fetch ${plan.remote} && git rebase ${plan.remote}/${plan.branch}  # or, if the rewrite is intended: workit git push --force-with-lease`);
-      return failure3("failed", `git push to ${plan.url} failed: ${gitError(run)}`);
+      return failure3("failed", `git push to ${plan.url} failed:
+${gitOutput(run)}`);
     }
     pushed = true;
   }
@@ -71735,7 +71968,11 @@ function deleteRemoteBranch(cwd, target, branch, expectedTip, options = {}) {
     return { ok: true };
   const text = `${run.stderr}
 ${run.stdout}`;
-  return /stale info|cannot lock ref|fetch first|non-fast-forward/iu.test(text) ? { ok: false, lease: true, error: "the remote branch tip changed before deletion" } : { ok: false, lease: false, error: gitError(run) };
+  return /stale info|cannot lock ref|fetch first|non-fast-forward/iu.test(text) ? {
+    ok: false,
+    lease: true,
+    error: "the remote branch tip changed before deletion"
+  } : { ok: false, lease: false, error: gitError(run) };
 }
 var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git5 = (cwd, args, options = {}) => {
   const result = spawnSync16("git", args, {
@@ -71746,7 +71983,7 @@ var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git5 = (cwd, args, options = {}
     timeout: options.timeoutMs ?? GIT_TIMEOUTS.local,
     killSignal: "SIGKILL",
     windowsHide: true,
-    stdio: ["ignore", "pipe", "pipe"]
+    ...options.input === undefined ? { stdio: ["ignore", "pipe", "pipe"] } : { input: options.input, stdio: ["pipe", "pipe", "pipe"] }
   });
   return {
     ok: result.status === 0,
@@ -71758,7 +71995,22 @@ var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git5 = (cwd, args, options = {}
   const lines = redactText(`${run.stderr}
 ${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trim()).filter((value) => value && !value.startsWith("hint:"));
   return lines.slice(-max).join(" / ").slice(0, 400) || "git failed";
-}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, SHA;
+}, OUTPUT_LINES = 200, OUTPUT_LINE_CHARS = 1000, gitOutput = (run) => {
+  const lines = redactText(`${run.stderr}
+${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trimEnd()).filter((value) => value.trim() && !value.trimStart().startsWith("hint:")).map((value) => value.length > OUTPUT_LINE_CHARS ? `${value.slice(0, OUTPUT_LINE_CHARS)}…` : value);
+  if (!lines.length)
+    return "git failed";
+  if (lines.length <= OUTPUT_LINES)
+    return lines.join(`
+`);
+  const half = OUTPUT_LINES / 2;
+  return [
+    ...lines.slice(0, half),
+    `… ${lines.length - OUTPUT_LINES} lines omitted …`,
+    ...lines.slice(-half)
+  ].join(`
+`);
+}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, TRAILER_CONFIG, nothingToCommit = (what) => failure3("failed", `nothing_to_commit: ${what}`, "workit git commit --allow-empty -m '<msg>'  # only to record an empty commit on purpose"), SHA;
 var init_ops = __esm(() => {
   init_branch();
   init_commit_flavors();
@@ -71770,15 +72022,16 @@ var init_ops = __esm(() => {
   init_rev();
   COMMIT_TIMEOUT_MS = 10 * 60000;
   SESSION_SAFE = /^[\w.:@/+-]{1,128}$/u;
+  TRAILER_CONFIG = ["-c", "trailer.separators=:", "-c", "trailer.where=end"];
   SHA = /^[0-9a-f]{40,64}$/u;
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/forge/reruns.ts
+// packages/workit-core/src/forge/reruns.ts
 import fs19 from "node:fs";
-import path39 from "node:path";
+import path40 from "node:path";
 function rerunLogPath(cwd) {
   const common = gitCommonDir(cwd);
-  return common ? path39.join(common, "workit", "ci-reruns.jsonl") : null;
+  return common ? path40.join(common, "workit", "ci-reruns.jsonl") : null;
 }
 function rerunCounts(cwd, key) {
   const counts = new Map;
@@ -71813,7 +72066,7 @@ function recordReruns(cwd, rows) {
   if (!file)
     return false;
   try {
-    fs19.mkdirSync(path39.dirname(file), { recursive: true });
+    fs19.mkdirSync(path40.dirname(file), { recursive: true });
     fs19.appendFileSync(file, rows.map((row) => `${JSON.stringify(row)}
 `).join(""));
     return true;
@@ -71826,7 +72079,7 @@ function withRerunLock(cwd, fn) {
   if (!file)
     return fn();
   const lock = `${file.slice(0, -".jsonl".length)}.lock`;
-  fs19.mkdirSync(path39.dirname(lock), { recursive: true });
+  fs19.mkdirSync(path40.dirname(lock), { recursive: true });
   const until = Date.now() + LOCK_WAIT_MS2;
   for (;; ) {
     try {
@@ -71864,7 +72117,7 @@ var init_reruns = __esm(() => {
   init_rev();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/forge/report.ts
+// packages/workit-core/src/forge/report.ts
 function gatingChecks(status) {
   const required = status.checks.filter((check) => check.required === true);
   const protectionNamesChecks = (status.requiredContexts?.length ?? 0) > 0;
@@ -72218,7 +72471,7 @@ var init_report = __esm(() => {
   GITHUB_MERGEABLE = new Set(["clean", "unstable", "has_hooks"]);
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/forge/pr-ops.ts
+// packages/workit-core/src/forge/pr-ops.ts
 import { spawnSync as spawnSync17 } from "node:child_process";
 function fillFromCommits(cwd, resolved, base) {
   const tracking = `refs/remotes/${resolved.baseRemote}/${base}`;
@@ -72339,13 +72592,19 @@ async function createPullRequest(cwd, resolved, input, sleep) {
     head: sha,
     created,
     draft: input.draft,
-    recorded: row.ok ? { id: String(row.value.id) } : { error: row.error }
+    recorded: row.ok ? { id: String(row.value.id) } : { error: row.error },
+    next: createNext(cwd)
   });
 }
 async function mergePullRequest(cwd, resolved, input, sleep) {
   const grant = requireGrant(cwd, "merge");
   if (!grant.allowed)
     return refuse(grant.error, grant.unblock, { reason: "grant_required" });
+  const bypass = input.unverified ?? null;
+  if (bypass && !bypass.reason.trim())
+    return failure3("invalid_input", "--unverified needs --reason <why the user asked for it>");
+  if (bypass && !grant.allowUnverified)
+    return refuse(`unverified_refused: workspace ${grant.workspace ? `"${grant.workspace}"` : "(none)"} grants merge: "verified", which never merges without an accepted independent verdict`, "a non-author session verifies the head (workit-review), then merge without --unverified", { reason: "unverified_refused" });
   const number = selectPr(cwd, resolved, { pr: input.pr });
   if (!number.ok)
     return number;
@@ -72379,27 +72638,40 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     if (reason)
       return refuse(`protected_branch: --delete-branch would delete ${branch}, which ${reason}; workit never deletes it`, `workit pr merge${input.pr ? ` --pr ${doc.number}` : ""} --method ${input.method}  # without --delete-branch`, { reason: "protected_branch" });
   }
+  const ledger = readLedger(cwd);
+  if (!ledger.ok)
+    return ledger;
+  const check = checkVerdicts(cwd, branch, ledger.value.rows);
+  const summary = { head: check.head, accepted: check.accepted, authors: check.authors };
+  const covered = check.head === head && check.accepted.accepted;
   let verdict = {
-    required: grant.requireVerdict,
-    accepted: false,
-    verdictId: null
+    required: true,
+    accepted: covered,
+    verdictId: covered && typeof check.accepted.verdict?.id === "string" ? check.accepted.verdict.id : null
   };
-  if (grant.requireVerdict) {
-    const ledger = readLedger(cwd);
-    if (!ledger.ok)
-      return ledger;
-    const check = checkVerdicts(cwd, branch, ledger.value.rows);
-    const summary = { head: check.head, accepted: check.accepted, authors: check.authors };
-    if (check.head !== head)
-      return refuse(`head_mismatch: the verdict check reads ${branch} at ${check.head?.slice(0, 12) ?? "(missing)"} but ${label} is at ${head.slice(0, 12)}`, `git fetch && git switch ${branch} && git merge --ff-only @{u}  # then re-verify that head`, { reason: "head_mismatch", verdict: summary });
-    if (!check.accepted.accepted)
-      return refuse(`NEEDS_VERDICT: ${label} has no accepted independent verdict for ${head.slice(0, 12)} (${check.accepted.reasons.join(", ")})`, `an independent session verifies the head and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${branch}`, { reason: "needs_verdict", verdict: summary });
-    verdict = {
-      required: true,
-      accepted: true,
-      verdictId: typeof check.accepted.verdict?.id === "string" ? check.accepted.verdict.id : null
-    };
-  }
+  let unverified = null;
+  if (!covered && bypass && check.accepted.reasons.includes("failing_verdict"))
+    return refuse(`failed_verdict: ${label} has a current independent failed verdict${typeof check.accepted.verdict?.id === "string" ? ` (${check.accepted.verdict.id})` : ""}; --unverified never merges over a rejection`, "a new independent verdict on the head supersedes it", { reason: "failed_verdict", verdict: summary });
+  if (!covered && bypass) {
+    const reason = bypass.reason.trim();
+    const recorded = appendObserved(cwd, {
+      type: "merge.unverified",
+      actor: input.actor,
+      branch,
+      head,
+      pr: doc.number,
+      base: doc.base,
+      reason,
+      grant: grant.source
+    });
+    if (!recorded.ok)
+      return failure3("failed", `unverified_unrecorded: the --unverified bypass could not be recorded (${recorded.error}); nothing was merged`);
+    verdict = { required: false, accepted: false, verdictId: null };
+    unverified = { reason, recorded: String(recorded.value.id) };
+  } else if (check.head !== head)
+    return refuse(`head_mismatch: the verdict check reads ${branch} at ${check.head?.slice(0, 12) ?? "(missing)"} but ${label} is at ${head.slice(0, 12)}`, `git fetch && git switch ${branch} && git merge --ff-only @{u}  # then re-verify that head`, { reason: "head_mismatch", verdict: summary });
+  else if (!covered)
+    return refuse(`NEEDS_VERDICT: ${label} has no accepted independent verdict for ${head.slice(0, 12)} (${check.accepted.reasons.join(", ")})`, `an independent session verifies the head and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${branch}${grant.allowUnverified ? `; or, only if the user asks to merge unverified: workit pr merge --unverified --reason "<why>"` : ""}`, { reason: "needs_verdict", verdict: summary });
   const merged = resolved.forge.merge(doc.number, { sha: head, method: input.method });
   if (!merged.ok)
     return merged;
@@ -72437,6 +72709,7 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     mergeSha: merged.data.mergeSha,
     method: input.method,
     verdictId: verdict.verdictId,
+    ...unverified ? { unverified: unverified.recorded } : {},
     grant: grant.source
   });
   return {
@@ -72450,6 +72723,7 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
       method: input.method,
       mergeSha: merged.data.mergeSha,
       verdict,
+      unverified,
       grant: { source: grant.source },
       deletedBranch,
       recorded: row.ok ? { id: String(row.value.id) } : { error: row.error },
@@ -72458,7 +72732,10 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     }
   };
 }
-var VERIFY_DELAYS_MS, noun = (resolved) => resolved.forge.kind === "github" ? "pull request" : "merge request", grantBlocked = (decision) => failure3("blocked", decision.error, decision.unblock), mergeBackFor = (cwd, base) => {
+var VERIFY_DELAYS_MS, noun = (resolved) => resolved.forge.kind === "github" ? "pull request" : "merge request", grantBlocked = (decision) => failure3("blocked", decision.error, decision.unblock), AFTER_REVIEW, createNext = (cwd) => {
+  const endpoint = resolveAutonomy(cwd).effectiveEndpoint;
+  return `a non-author verifies the head (workit-review); the endpoint is ${endpoint}, so ${AFTER_REVIEW[endpoint]}`;
+}, mergeBackFor = (cwd, base) => {
   try {
     const owners = workspaceReleaseTracks(cwd).tracks.filter((track) => track.productionBranch === base);
     if (owners.length !== 1)
@@ -72487,6 +72764,12 @@ var init_pr_ops = __esm(() => {
   init_ledger();
   init_report();
   VERIFY_DELAYS_MS = [1000, 2000, 4000];
+  AFTER_REVIEW = {
+    commit: "stop here; review comes when the user asks",
+    pr: "stop here; review comes when the user asks",
+    green: "babysit it to merge-ready, never merging",
+    merged: "babysit it, then land it after verification"
+  };
   NEXT_HINTS = {
     RESOLVE_CONFLICTS: "rebase onto the base, resolve, then workit git push --force-with-lease",
     REBASE: "rebase onto the base, then workit git push --force-with-lease",
@@ -72501,16 +72784,16 @@ var init_pr_ops = __esm(() => {
   };
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/forge/exec.ts
+// packages/workit-core/src/forge/exec.ts
 import { spawnSync as spawnSync18 } from "node:child_process";
 import fs20 from "node:fs";
-import path40 from "node:path";
+import path41 from "node:path";
 function findExecutable(bin, env) {
-  const dirs = (env.PATH ?? env.Path ?? "").split(path40.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path41.delimiter).filter(Boolean);
   const exts = process.platform === "win32" ? [".exe"] : [""];
   for (const dir of dirs)
     for (const ext of exts) {
-      const candidate = path40.join(dir, `${bin}${ext}`);
+      const candidate = path41.join(dir, `${bin}${ext}`);
       try {
         const stat = fs20.statSync(candidate);
         if (stat.isFile())
@@ -72619,7 +72902,7 @@ var init_exec = __esm(() => {
   MAX_BUFFER2 = 64 * 1024 * 1024;
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/forge/github.ts
+// packages/workit-core/src/forge/github.ts
 function checkFromContext(node) {
   const required = node.isRequired ?? null;
   if (node.__typename === "StatusContext") {
@@ -72918,7 +73201,7 @@ var init_github = __esm(() => {
   ]);
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/forge/gitlab.ts
+// packages/workit-core/src/forge/gitlab.ts
 function checkFromBridge(bridge, pipelineId, scope) {
   const status = bridge.downstream_pipeline?.status ?? bridge.status;
   const allow = bridge.allow_failure === true;
@@ -73206,7 +73489,7 @@ var init_gitlab = __esm(() => {
   UNSETTLED = new Set(["checking", "unchecked", "preparing", "approvals_syncing"]);
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/forge/resolve.ts
+// packages/workit-core/src/forge/resolve.ts
 import fs21 from "node:fs";
 function resolveForge(cwd, options = {}) {
   let workspace;
@@ -73326,7 +73609,7 @@ var init_resolve = __esm(() => {
   init_gitlab();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/duration.ts
+// packages/workit-core/src/duration.ts
 function parseDuration2(value) {
   const text = value.trim().toLowerCase();
   if (/^\d+(?:\.\d+)?$/u.test(text))
@@ -73358,6 +73641,10 @@ function parseFlags(argv, spec) {
   const parsed = { values: {}, booleans: new Set, lists: {}, positionals: [] };
   for (let index = 0;index < argv.length; index += 1) {
     const arg = argv[index];
+    if (arg === "--") {
+      parsed.positionals.push(...argv.slice(index + 1));
+      break;
+    }
     if (arg === "--json")
       continue;
     if (!arg.startsWith("--")) {
@@ -73495,8 +73782,8 @@ var exports_pr = {};
 __export(exports_pr, {
   run: () => run10
 });
-import { readFileSync as readFileSync18 } from "node:fs";
-import path41 from "node:path";
+import { readFileSync as readFileSync19 } from "node:fs";
+import path42 from "node:path";
 async function status(argv, io) {
   const flags = parseFlags(argv, { pr: "value", branch: "value", "log-lines": "value" });
   if (typeof flags === "string")
@@ -73567,7 +73854,7 @@ async function create4(argv, io) {
   let body = flags.values.body ?? null;
   if (flags.values["body-file"] !== undefined) {
     try {
-      body = readFileSync18(path41.resolve(io.cwd, flags.values["body-file"]), "utf8");
+      body = readFileSync19(path42.resolve(io.cwd, flags.values["body-file"]), "utf8");
     } catch {
       return usage3(io, `cannot read --body-file ${flags.values["body-file"]}`, CREATE_USAGE);
     }
@@ -73912,6 +74199,8 @@ var exports_git = {};
 __export(exports_git, {
   run: () => run12
 });
+import { readFileSync as readFileSync20 } from "node:fs";
+import path43 from "node:path";
 async function branch(argv, io) {
   const flags = parseFlags(argv, {
     base: "value",
@@ -73948,7 +74237,15 @@ async function branch(argv, io) {
   ]);
 }
 function parseCommit(argv) {
-  const out = { messages: [], all: false, paths: [] };
+  const out = {
+    messages: [],
+    files: [],
+    all: false,
+    amend: false,
+    noEdit: false,
+    allowEmpty: false,
+    paths: []
+  };
   for (let index = 0;index < argv.length; index += 1) {
     const arg = argv[index];
     if (arg === "--") {
@@ -73957,23 +74254,24 @@ function parseCommit(argv) {
     }
     if (arg === "--json")
       continue;
-    if (arg === "-a" || arg === "--all") {
-      out.all = true;
+    const flag = COMMIT_SWITCHES[arg];
+    if (flag) {
+      out[flag] = true;
       continue;
     }
-    if (arg === "-m" || arg === "--message") {
-      const value = argv[++index];
-      if (value === undefined)
-        return `${arg} requires a message`;
-      out.messages.push(value);
-      continue;
-    }
-    if (arg.startsWith("--message=")) {
-      out.messages.push(arg.slice("--message=".length));
-      continue;
-    }
-    if (arg.startsWith("-m") && arg.length > 2) {
-      out.messages.push(arg.slice(2));
+    const valued = [
+      ["-m", "--message", out.messages],
+      ["-F", "--file", out.files]
+    ].find(([shortName, longName]) => arg === shortName || arg === longName || arg.startsWith(`${longName}=`) || arg.startsWith(shortName) && arg.length > 2);
+    if (valued) {
+      const [shortName, longName, into] = valued;
+      if (arg === shortName || arg === longName) {
+        const value = argv[++index];
+        if (value === undefined)
+          return `${arg} requires a ${shortName === "-m" ? "message" : "file"}`;
+        into.push(value);
+      } else
+        into.push(arg.startsWith(`${longName}=`) ? arg.slice(longName.length + 1) : arg.slice(2));
       continue;
     }
     if (arg.startsWith("-"))
@@ -73982,20 +74280,48 @@ function parseCommit(argv) {
   }
   return out;
 }
+function commitMessage(parsed, io) {
+  if (parsed.messages.length && parsed.files.length)
+    return { error: "pass -m or -F, not both" };
+  if (parsed.files.length > 1)
+    return { error: "-F takes one file" };
+  const [file] = parsed.files;
+  if (file === undefined)
+    return parsed.messages.join(`
+
+`);
+  try {
+    return file === "-" ? readFileSync20(0, "utf8") : readFileSync20(path43.resolve(io.cwd, file), "utf8");
+  } catch (error) {
+    return {
+      error: `cannot read -F ${file}: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
 async function commit(argv, io) {
   const parsed = parseCommit(argv);
   if (typeof parsed === "string")
     return usage3(io, parsed, COMMIT_USAGE);
-  if (!parsed.messages.length)
-    return usage3(io, "missing -m <msg>", COMMIT_USAGE);
   if (parsed.all && parsed.paths.length)
     return usage3(io, "pass --all or paths, not both", COMMIT_USAGE);
+  if (parsed.noEdit && !parsed.amend)
+    return usage3(io, "--no-edit only applies with --amend", COMMIT_USAGE);
+  const given = parsed.messages.length + parsed.files.length > 0;
+  if (parsed.noEdit && given)
+    return usage3(io, "--no-edit keeps the message; drop -m/-F or --no-edit", COMMIT_USAGE);
+  if (!given && !parsed.noEdit)
+    return usage3(io, parsed.amend ? "--amend needs -m/-F or --no-edit" : "missing -m <msg> or -F <file>", COMMIT_USAGE);
+  const message = given ? commitMessage(parsed, io) : null;
+  if (message !== null && typeof message !== "string")
+    return usage3(io, message.error, COMMIT_USAGE);
+  if (message !== null && !message.trim())
+    return usage3(io, "the commit message is empty", COMMIT_USAGE);
   const result = gitCommit(io.cwd, {
-    message: parsed.messages.join(`
-
-`),
+    message,
     all: parsed.all,
     paths: parsed.paths,
+    amend: parsed.amend,
+    allowEmpty: parsed.allowEmpty,
     actor: actorFromEnv(io.env),
     env: io.env
   });
@@ -74004,8 +74330,9 @@ async function commit(argv, io) {
   await ensureImplicitTask(io);
   return emit(io, ok(result.data), (data) => [
     `${data.branch} ${short2(data.sha)} ${data.message.split(`
-`, 1)[0]} (${data.files.length} file${data.files.length === 1 ? "" : "s"})`,
+`, 1)[0]} (${data.files.length ? `${data.files.length} file${data.files.length === 1 ? "" : "s"}` : "empty commit"})${data.amended ? `, amends ${short2(data.amended)}` : ""}`,
     ...data.leftDirty ? [`${data.leftDirty} change(s) left uncommitted`] : [],
+    ...data.notes.map((note) => `note: ${note}`),
     ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : [],
     ...data.session ? [] : ["note: WORKIT_SESSION_ID is unset; this commit has no session author"]
   ]);
@@ -74039,7 +74366,10 @@ async function push(argv, io) {
   }
   const grant = requireGrant(io.cwd, "push", { forge: !plan.data.local });
   if (!grant.allowed)
-    return emit(io, fail("blocked", grant.error, { unblock: grant.unblock, data: { reason: grant.reason } }));
+    return emit(io, fail("blocked", grant.error, {
+      unblock: grant.unblock,
+      data: { reason: grant.reason }
+    }));
   const result = executePush(io.cwd, plan.data, {
     forceWithLease: flags.booleans.has("force-with-lease"),
     overwriteUnintegrated: flags.booleans.has("overwrite-unintegrated"),
@@ -74048,7 +74378,10 @@ async function push(argv, io) {
     actor: actorFromEnv(io.env)
   });
   if (!result.ok)
-    return forgeFail(io, result, { branch: plan.data.branch, sha: plan.data.sha });
+    return forgeFail(io, result, {
+      branch: plan.data.branch,
+      sha: plan.data.sha
+    });
   return emit(io, ok(result.data), (data) => [
     data.pushed ? `pushed ${data.branch} ${short2(data.previous)} -> ${short2(data.sha)} to ${data.remote}${data.forced ? " (force-with-lease)" : ""}; remote tip verified` : `${data.remote}/${data.branch} is already at ${short2(data.sha)}; remote tip verified`,
     ...data.upstream ? [`upstream: ${data.remote}/${data.branch}`] : []
@@ -74064,7 +74397,7 @@ async function run12(argv, io) {
     return push(rest, io);
   return usage3(io, sub && !sub.startsWith("-") ? `unknown git subcommand "${sub}"` : "missing git subcommand", USAGE5);
 }
-var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m <msg> [--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--json]", USAGE5 = "workit git branch|commit|push ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)";
+var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--json]", USAGE5 = "workit git branch|commit|push ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES;
 var init_git2 = __esm(() => {
   init_autonomy();
   init_ops();
@@ -74072,9 +74405,16 @@ var init_git2 = __esm(() => {
   init_implicit_task();
   init_output();
   init_forge_common();
+  COMMIT_SWITCHES = {
+    "-a": "all",
+    "--all": "all",
+    "--amend": "amend",
+    "--no-edit": "noEdit",
+    "--allow-empty": "allowEmpty"
+  };
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/forge/verify.ts
+// packages/workit-core/src/forge/verify.ts
 import { spawnSync as spawnSync19 } from "node:child_process";
 function finish(cwd, report, actor) {
   const delivered = report.observations.length > 0 && report.observations.every((entry) => entry.ok);
@@ -74394,11 +74734,11 @@ var init_verify_delivery = __esm(() => {
   };
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/stack.ts
+// packages/workit-core/src/stack.ts
 import { spawnSync as spawnSync20 } from "node:child_process";
 import { createHash as createHash15, randomBytes as randomBytes3 } from "node:crypto";
 import fs22 from "node:fs";
-import path42 from "node:path";
+import path44 from "node:path";
 function worktreeOf(cwd, branch) {
   const list = gitRun3(cwd, ["worktree", "list", "--porcelain"]);
   if (!list.ok)
@@ -74442,7 +74782,7 @@ function gitRestack(cwd, input) {
     if (!scratch)
       return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
     fs22.mkdirSync(scratch, { recursive: true });
-    dir = path42.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes3(4).toString("hex")}`);
+    dir = path44.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes3(4).toString("hex")}`);
     const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
     if (!added.ok)
       return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
@@ -74483,7 +74823,7 @@ function pruneScratch(cwd) {
   if (!scratch || !fs22.existsSync(scratch))
     return;
   for (const name of fs22.readdirSync(scratch)) {
-    const dir = path42.join(scratch, name);
+    const dir = path44.join(scratch, name);
     if (!rebaseInProgress(dir) && !trackedDirt(dir))
       gitRun3(cwd, ["worktree", "remove", "--force", dir]);
   }
@@ -74493,7 +74833,7 @@ function stacksDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return stackFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path42.join(root.value.root, "stacks") };
+  return { ok: true, data: path44.join(root.value.root, "stacks") };
 }
 function parseStack(raw) {
   if (!isRecord7(raw) || !Array.isArray(raw.branches))
@@ -74545,7 +74885,7 @@ function readStack(cwd, name) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path42.join(dir.data, fileFor(name));
+  const file = path44.join(dir.data, fileFor(name));
   let text;
   try {
     text = fs22.readFileSync(file, "utf8");
@@ -74566,7 +74906,7 @@ function writeStack(cwd, stack, now = new Date) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path42.join(dir.data, fileFor(stack.name));
+  const file = path44.join(dir.data, fileFor(stack.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
     fs22.mkdirSync(dir.data, { recursive: true });
@@ -74594,7 +74934,7 @@ function listStacks(cwd) {
   for (const name of names) {
     let parsed = null;
     try {
-      parsed = parseStack(JSON.parse(fs22.readFileSync(path42.join(dir.data, name), "utf8")));
+      parsed = parseStack(JSON.parse(fs22.readFileSync(path44.join(dir.data, name), "utf8")));
     } catch {
       parsed = null;
     }
@@ -74653,7 +74993,7 @@ function takeLock(lock) {
     host: localLockHost(),
     nonce: randomBytes3(8).toString("hex")
   };
-  fs22.writeFileSync(path42.join(lock, OWNER), JSON.stringify(owner));
+  fs22.writeFileSync(path44.join(lock, OWNER), JSON.stringify(owner));
   return owner;
 }
 function reapLock(lock, observed) {
@@ -74690,7 +75030,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
     return dir;
   if (!validName(name))
     return stackFail("invalid_input", "a stack name must be 1-200 printable characters");
-  const lock = path42.join(dir.data, `${fileFor(name)}.lock`);
+  const lock = path44.join(dir.data, `${fileFor(name)}.lock`);
   try {
     fs22.mkdirSync(dir.data, { recursive: true });
   } catch (error) {
@@ -74720,7 +75060,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
   const touch = () => {
     try {
       const now = new Date;
-      fs22.utimesSync(path42.join(lock, OWNER), now, now);
+      fs22.utimesSync(path44.join(lock, OWNER), now, now);
     } catch {}
   };
   const beat = setInterval(touch, HEARTBEAT_MS);
@@ -74969,7 +75309,7 @@ function repoMismatch(ctx, stack) {
     return stackFail("blocked", `repo_mismatch: stack ${stack.name} was planned on ${stack.forge ?? "?"} ${stack.repo ?? "?"}, but this checkout resolves to ${kind} ${repo}`, `workit stack plan --name ${stack.name} <branch…>  # re-plan it here, or run from the right checkout`, { planned: { forge: stack.forge, repo: stack.repo }, resolved: { forge: kind, repo } });
   return null;
 }
-function qualify(ctx, stack, entry, doc, verdict, grant, binding = null) {
+function qualify(ctx, stack, entry, doc, verdict, grant, binding = null, bypass = false) {
   const label = entry.pr ? noun2(ctx.resolved, entry.pr) : entry.branch;
   const stop = (reason, detail, unblock, ready = false) => ({
     ok: false,
@@ -74988,9 +75328,11 @@ function qualify(ctx, stack, entry, doc, verdict, grant, binding = null) {
     return stop("base_not_trunk", `${label} targets ${doc.base}, not ${stack.trunk}`, "workit stack sync");
   if (doc.next !== "READY")
     return stop("not_ready", `${label} is ${doc.next}${doc.blockers.length ? ` (${doc.blockers.join(", ")})` : ""}`, doc.next === "WAITING_CI" ? `workit ci wait --pr ${entry.pr}` : `workit pr status --pr ${entry.pr}`);
-  const requireVerdict = grant.allowed ? grant.requireVerdict : true;
-  if (requireVerdict && !verdict.accepted)
-    return stop(verdict.reasons.includes("no_verdict") ? "no_verdict" : "needs_verdict", `${label} has no accepted independent verdict for ${doc.head.sha.slice(0, 12)} (${verdict.reasons.join(", ") || "none"})`, `an independent session verifies ${entry.branch} and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${entry.branch}`);
+  const allowUnverified = grant.allowed && grant.allowUnverified;
+  if (bypass && allowUnverified && verdict.reasons.includes("failing_verdict"))
+    return stop("failed_verdict", `${label} has a current independent failed verdict for ${doc.head.sha.slice(0, 12)}; --unverified never lands over a rejection`, "a new independent verdict on the head supersedes it");
+  if (!(bypass && allowUnverified) && !verdict.accepted)
+    return stop(verdict.reasons.includes("no_verdict") ? "no_verdict" : "needs_verdict", `${label} has no accepted independent verdict for ${doc.head.sha.slice(0, 12)} (${verdict.reasons.join(", ") || "none"})`, `an independent session verifies ${entry.branch} and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${entry.branch}${allowUnverified ? `; or, only if the user asks to land unverified: workit stack land --unverified --reason "<why>"` : ""}`);
   if (!grant.allowed)
     return stop("grant_required", `${label} is verified and ready, but ${grant.error}`, grant.unblock, true);
   return { ok: true };
@@ -75408,6 +75750,14 @@ async function landStack(ctx, stack, options) {
   const mismatch = repoMismatch(ctx, stack);
   if (mismatch)
     return failWith(mismatch);
+  const bypass = options.unverified ?? null;
+  if (bypass) {
+    const grant = requireGrant(ctx.cwd, "merge");
+    if (!grant.allowed)
+      return failWith(stackFail("blocked", grant.error, grant.unblock, { reason: "grant_required" }));
+    if (!grant.allowUnverified)
+      return failWith(stackFail("blocked", `unverified_refused: workspace ${grant.workspace ? `"${grant.workspace}"` : "(none)"} grants merge: "verified", which never lands without an accepted independent verdict`, "a non-author session verifies each head (workit-review), then land without --unverified", { reason: "unverified_refused" }));
+  }
   if (!options.dryRun) {
     const synced = syncStack(ctx.cwd, ctx, stack, { publish: true, dryRun: false, limit: 1 }, ctx.actor);
     if (!synced.ok)
@@ -75453,7 +75803,7 @@ async function landStack(ctx, stack, options) {
     const grant = requireGrant(ctx.cwd, "merge");
     const verdict = verdictOf(ctx.cwd, entry.branch, ledgerRows());
     const effective = options.dryRun && simulated.size > 0 && doc ? { ...doc, base: stack.trunk } : doc;
-    const q = qualify(ctx, stack, entry, effective, verdict, grant, doc ? prBinding(ctx, entry, doc) : null);
+    const q = qualify(ctx, stack, entry, effective, verdict, grant, doc ? prBinding(ctx, entry, doc) : null, bypass !== null);
     if (!q.ok) {
       outcome.stoppedAt = {
         pr: entry.pr,
@@ -75476,7 +75826,8 @@ async function landStack(ctx, stack, options) {
       method: options.method,
       deleteBranch: false,
       actor: ctx.actor,
-      expect: { base: stack.trunk, branch: entry.branch }
+      expect: { base: stack.trunk, branch: entry.branch },
+      ...bypass && !verdict.accepted ? { unverified: bypass } : {}
     }, ctx.sleep);
     if (!merged.ok) {
       if (merged.code === "blocked" && "refusal" in merged && merged.refusal) {
@@ -75492,7 +75843,12 @@ async function landStack(ctx, stack, options) {
       }
       return failWith(stackFail(merged.code, merged.error, merged.unblock));
     }
-    outcome.landed.push({ pr, branch: entry.branch, mergeSha: merged.data.mergeSha });
+    outcome.landed.push({
+      pr,
+      branch: entry.branch,
+      mergeSha: merged.data.mergeSha,
+      unverified: merged.data.unverified?.recorded ?? null
+    });
     entry.merged = { pr, mergeSha: merged.data.mergeSha, at: new Date().toISOString() };
     const written = writeStack(ctx.cwd, stack);
     if (!written.ok)
@@ -75544,7 +75900,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   return !status.ok || status.stdout.trim() !== "";
 }, scratchDir = (cwd) => {
   const dir = stacksDir(cwd);
-  return dir.ok ? path42.join(dir.data, "worktrees") : null;
+  return dir.ok ? path44.join(dir.data, "worktrees") : null;
 }, firstLine = (run) => (`${run.stderr}
 ${run.stdout}`.split(`
 `).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash15("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
@@ -75559,12 +75915,12 @@ ${run.stdout}`.split(`
 }, isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
   let raw = null;
   try {
-    raw = fs22.readFileSync(path42.join(lock, OWNER), "utf8");
+    raw = fs22.readFileSync(path44.join(lock, OWNER), "utf8");
   } catch {
     raw = null;
   }
   let age = null;
-  for (const target of [path42.join(lock, OWNER), lock])
+  for (const target of [path44.join(lock, OWNER), lock])
     try {
       age = Date.now() - fs22.statSync(target).mtimeMs;
       break;
@@ -75810,11 +76166,11 @@ var init_stack2 = __esm(() => {
   METHODS3 = new Set(["squash", "merge", "rebase"]);
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/fanout.ts
+// packages/workit-core/src/fanout.ts
 import { spawnSync as spawnSync21 } from "node:child_process";
 import { createHash as createHash16 } from "node:crypto";
 import fs23 from "node:fs";
-import path43 from "node:path";
+import path45 from "node:path";
 function expandBraces(pattern, limit = 64) {
   for (let index = 0;index < pattern.length; index += 1) {
     if (pattern[index] === "\\") {
@@ -76048,7 +76404,7 @@ function parsePlan(raw, defaults, name) {
       id,
       branch,
       base: optional("base") ?? "",
-      worktree: path43.resolve(defaults.root, optional("worktree") ?? path43.join(defaults.worktreeRoot, id)),
+      worktree: path45.resolve(defaults.root, optional("worktree") ?? path45.join(defaults.worktreeRoot, id)),
       tier,
       dependsOn: [...new Set(dependsOn ?? [])],
       scope,
@@ -76277,11 +76633,11 @@ function defaultTrunk(cwd) {
 }
 function mainCheckout(cwd) {
   const common = gitCommonDir(cwd);
-  return common && path43.basename(common) === ".git" ? path43.dirname(common) : path43.resolve(cwd);
+  return common && path45.basename(common) === ".git" ? path45.dirname(common) : path45.resolve(cwd);
 }
 function worktreeRoot(cwd) {
   const main = mainCheckout(cwd);
-  return path43.join(path43.dirname(main), `${path43.basename(main)}-wt`);
+  return path45.join(path45.dirname(main), `${path45.basename(main)}-wt`);
 }
 function sliceHash(slice) {
   const {
@@ -76299,7 +76655,7 @@ function fanoutsDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return fanoutFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path43.join(root.value.root, "fanouts") };
+  return { ok: true, data: path45.join(root.value.root, "fanouts") };
 }
 function parseStored(raw) {
   if (!isRecord8(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
@@ -76365,7 +76721,7 @@ function readFanout(cwd, name) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path43.join(dir.data, stackFileName(name));
+  const file = path45.join(dir.data, stackFileName(name));
   let parsed = null;
   try {
     parsed = parseStored(JSON.parse(fs23.readFileSync(file, "utf8")));
@@ -76390,7 +76746,7 @@ function listFanouts(cwd) {
   for (const entry of names) {
     let parsed = null;
     try {
-      parsed = parseStored(JSON.parse(fs23.readFileSync(path43.join(dir.data, entry), "utf8")));
+      parsed = parseStored(JSON.parse(fs23.readFileSync(path45.join(dir.data, entry), "utf8")));
     } catch {
       parsed = null;
     }
@@ -76420,7 +76776,7 @@ function writeFanout(cwd, plan) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path43.join(dir.data, stackFileName(plan.name));
+  const file = path45.join(dir.data, stackFileName(plan.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
     fs23.mkdirSync(dir.data, { recursive: true });
@@ -76621,10 +76977,10 @@ var init_fanout = __esm(() => {
   ID = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/fanout-worktree.ts
+// packages/workit-core/src/fanout-worktree.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 import fs24 from "node:fs";
-import path44 from "node:path";
+import path46 from "node:path";
 function rowSample(lines) {
   const out = [];
   let bytes = 0;
@@ -76684,7 +77040,7 @@ function adminDir(worktree) {
   const file = dir.stdout.trim();
   let token = null;
   try {
-    token = fs24.readFileSync(path44.join(file, TOKEN_FILE), "utf8").trim() || null;
+    token = fs24.readFileSync(path46.join(file, TOKEN_FILE), "utf8").trim() || null;
   } catch {
     token = null;
   }
@@ -76692,7 +77048,7 @@ function adminDir(worktree) {
     const stat = worktreeDeps.stat(file);
     return {
       path: file,
-      id: path44.basename(file),
+      id: path46.basename(file),
       ino: stat.ino.toString(),
       token,
       birthMs: stat.birthtimeNs > 0n ? Number(stat.birthtimeMs) : null,
@@ -76708,7 +77064,7 @@ function markAdminDir(worktree) {
     return null;
   const token = randomBytes4(16).toString("hex");
   try {
-    fs24.writeFileSync(path44.join(admin.path, TOKEN_FILE), `${token}
+    fs24.writeFileSync(path46.join(admin.path, TOKEN_FILE), `${token}
 `);
   } catch {
     return null;
@@ -76723,7 +77079,7 @@ function excludeScratch(cwd) {
   const common = gitCommonDir(cwd);
   if (!common)
     return;
-  const file = path44.join(common, "info", "exclude");
+  const file = path46.join(common, "info", "exclude");
   let text = "";
   try {
     text = fs24.readFileSync(file, "utf8");
@@ -76732,7 +77088,7 @@ function excludeScratch(cwd) {
   }
   if (text.split(/\r?\n/u).includes(EXCLUDE_LINE))
     return;
-  fs24.mkdirSync(path44.dirname(file), { recursive: true });
+  fs24.mkdirSync(path46.dirname(file), { recursive: true });
   fs24.appendFileSync(file, `${text && !text.endsWith(`
 `) ? `
 ` : ""}# workit fanout: per-worker scratch dirs
@@ -76740,7 +77096,7 @@ ${EXCLUDE_LINE}
 `);
 }
 function ensureScratch(worktree) {
-  const scratch = path44.join(worktree, SCRATCH_DIR);
+  const scratch = path46.join(worktree, SCRATCH_DIR);
   fs24.mkdirSync(scratch, { recursive: true });
   return scratch;
 }
@@ -76958,7 +77314,7 @@ function unpushedCount(cwd, branch) {
   return count.ok ? Number(count.stdout.trim()) : null;
 }
 function removeScratch(worktree) {
-  const scratch = path44.join(worktree, SCRATCH_DIR);
+  const scratch = path46.join(worktree, SCRATCH_DIR);
   let stat;
   try {
     stat = fs24.lstatSync(scratch);
@@ -76974,16 +77330,16 @@ var SLOW, SCRATCH_DIR = ".workit-scratch", EXCLUDE_LINE, DIRTY_ROW_BYTES = 2000,
   try {
     return fs24.realpathSync.native(target);
   } catch {
-    return path44.resolve(target);
+    return path46.resolve(target);
   }
 }, samePath = (a, b) => {
   const left = canonical2(a);
   const right = canonical2(b);
   return process.platform === "win32" || process.platform === "darwin" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }, inside2 = (child, parent) => {
-  const relative = path44.relative(canonical2(parent), canonical2(child));
-  return relative === "" || !relative.startsWith("..") && !path44.isAbsolute(relative);
-}, slicePath = (cwd, slice) => path44.isAbsolute(slice.worktree) ? slice.worktree : path44.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, TOKEN_FILE = "workit-fanout-token", worktreeDeps, worktreeFailed = (stderr) => fanoutFail("failed", `git worktree add failed: ${stderr.trim().split(`
+  const relative = path46.relative(canonical2(parent), canonical2(child));
+  return relative === "" || !relative.startsWith("..") && !path46.isAbsolute(relative);
+}, slicePath = (cwd, slice) => path46.isAbsolute(slice.worktree) ? slice.worktree : path46.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, TOKEN_FILE = "workit-fanout-token", worktreeDeps, worktreeFailed = (stderr) => fanoutFail("failed", `git worktree add failed: ${stderr.trim().split(`
 `)[0] || "unknown error"}`);
 var init_fanout_worktree = __esm(() => {
   init_ops();
@@ -76997,7 +77353,7 @@ var init_fanout_worktree = __esm(() => {
   };
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/fanout-brief.ts
+// packages/workit-core/src/fanout-brief.ts
 import { createHash as createHash17 } from "node:crypto";
 function workerSession(lead, slice, attempt) {
   const tail = attempt === null ? "" : `+try${attempt}`;
@@ -77103,7 +77459,7 @@ var init_fanout_brief = __esm(() => {
   ];
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/fanout-landed.ts
+// packages/workit-core/src/fanout-landed.ts
 import { spawnSync as spawnSync22 } from "node:child_process";
 function forgeBreaker(resolved) {
   if (!resolved)
@@ -77308,7 +77664,7 @@ var init_fanout_landed = __esm(() => {
   init_fanout();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/fanout-check.ts
+// packages/workit-core/src/fanout-check.ts
 function mergeConflicts(cwd, a, b) {
   const run = gitRun4(cwd, [
     "merge-tree",
@@ -77566,7 +77922,7 @@ var init_fanout_check = __esm(() => {
   init_fanout_landed();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/fanout-status.ts
+// packages/workit-core/src/fanout-status.ts
 function timeboxMs(text) {
   if (!text || /^\s*\d+(?:\.\d+)?\s*$/u.test(text))
     return null;
@@ -77759,7 +78115,7 @@ __export(exports_fanout, {
   run: () => run15
 });
 import fs25 from "node:fs";
-import path45 from "node:path";
+import path47 from "node:path";
 function forgeFor(io, offline) {
   if (offline)
     return { forge: null, error: "--offline" };
@@ -77820,7 +78176,7 @@ function plan2(argv, io) {
     return usage3(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE2);
   if (flags.positionals.length !== 1)
     return usage3(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <plan.json>", PLAN_USAGE2);
-  const file = path45.resolve(io.cwd, flags.positionals[0]);
+  const file = path47.resolve(io.cwd, flags.positionals[0]);
   let raw;
   try {
     raw = JSON.parse(fs25.readFileSync(file, "utf8"));
@@ -93252,7 +93608,7 @@ var init_ast = __esm(() => {
 
 // packages/workit-cli/src/test-audit/rules.ts
 import { builtinModules } from "node:module";
-import path46 from "node:path";
+import path48 from "node:path";
 function testCallee(call) {
   let callee = call.callee;
   if (callee.type === "CallExpression")
@@ -93745,12 +94101,12 @@ function checkConstantsOnly(ctx, emit) {
 }
 function checkOverMocking(ctx, emit) {
   const { program } = ctx.parsed;
-  const unit = path46.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
+  const unit = path48.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
   const mocked = find2(program, (node) => node.type === "CallExpression" && MODULE_MOCK.test(calleeName(node.callee) ?? "") && node.arguments[0]?.type === "StringLiteral");
   const internal = mocked.filter((call) => /^(?:\.|@\/|~\/)/.test(call.arguments[0].value));
   for (const call of mocked) {
     const spec = call.arguments[0].value;
-    const base = path46.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
+    const base = path48.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
     if (base === unit)
       emit({
         rule: "over-mocking",
@@ -94139,8 +94495,8 @@ var init_rules = __esm(() => {
 
 // packages/workit-cli/src/test-audit/audit.ts
 import { spawnSync as spawnSync23 } from "node:child_process";
-import { existsSync as existsSync18, readdirSync as readdirSync8, readFileSync as readFileSync19, statSync as statSync7 } from "node:fs";
-import path47 from "node:path";
+import { existsSync as existsSync19, readdirSync as readdirSync8, readFileSync as readFileSync21, statSync as statSync7 } from "node:fs";
+import path49 from "node:path";
 function git6(cwd, args) {
   const run = spawnSync23("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
@@ -94153,7 +94509,7 @@ function walkTests(dir, out) {
   for (const entry of readdirSync8(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
-    const full = path47.join(dir, entry.name);
+    const full = path49.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name))
         walkTests(full, out);
@@ -94165,8 +94521,8 @@ function expandPaths(cwd, inputs) {
   const files = [];
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
-    const full = path47.resolve(cwd, input);
-    if (!existsSync18(full))
+    const full = path49.resolve(cwd, input);
+    if (!existsSync19(full))
       missing.push(input);
     else if (statSync7(full).isDirectory())
       walkTests(full, files);
@@ -94202,11 +94558,11 @@ function changedLines(cwd, base) {
       for (let offset = 0;offset < count; offset += 1)
         lines.add(start + offset);
     }
-    changed.set(path47.join(root, file), lines);
+    changed.set(path49.join(root, file), lines);
   }
   const untracked = git6(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
   for (const file of untracked.stdout.split("\x00").filter(Boolean))
-    changed.set(path47.join(root, file), "all");
+    changed.set(path49.join(root, file), "all");
   return changed;
 }
 function auditFiles(files, display) {
@@ -94219,7 +94575,7 @@ function auditFiles(files, display) {
     const shown = display(file);
     let parsed;
     try {
-      parsed = parseSource(readFileSync19(file, "utf8"), file);
+      parsed = parseSource(readFileSync21(file, "utf8"), file);
     } catch (error) {
       parseErrors.push({
         file: shown,
@@ -94268,7 +94624,7 @@ function auditFiles(files, display) {
     durationMs: Math.round(performance.now() - started)
   };
 }
-var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path47.sep).join("/"), SEVERITY_ORDER, ruleIds;
+var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path49.sep).join("/"), SEVERITY_ORDER, ruleIds;
 var init_audit = __esm(() => {
   init_ast();
   init_rules();
@@ -94282,12 +94638,12 @@ var init_audit = __esm(() => {
 // packages/workit-cli/src/test-audit/mutate.ts
 import { spawn as spawn2 } from "node:child_process";
 import {
-  existsSync as existsSync19,
+  existsSync as existsSync20,
   lstatSync as lstatSync7,
   mkdirSync as mkdirSync9,
   mkdtempSync as mkdtempSync4,
   readdirSync as readdirSync9,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync22,
   readlinkSync as readlinkSync3,
   realpathSync as realpathSync9,
   renameSync as renameSync5,
@@ -94298,7 +94654,7 @@ import {
   copyFileSync as copyFileSync6
 } from "node:fs";
 import os14 from "node:os";
-import path48 from "node:path";
+import path50 from "node:path";
 function mutantsFor(source, file, lines) {
   const parsed = parseSource(source, file);
   const out = [];
@@ -94371,7 +94727,7 @@ function relatedTests(source, testFiles) {
     for (const match of text.matchAll(SPECIFIER)) {
       const spec = match[1];
       if (spec.startsWith(".")) {
-        if (stripExt(path48.posix.join(path48.posix.dirname(file), spec)) === target)
+        if (stripExt(path50.posix.join(path50.posix.dirname(file), spec)) === target)
           return true;
       } else if (spec.includes("/") && stripExt(spec).split("/").slice(-2).join("/") === tail)
         return true;
@@ -94391,12 +94747,12 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
   for (const name of names) {
     if (!name.startsWith(TEMP_PREFIX))
       continue;
-    const dir = path48.join(tmp, name);
+    const dir = path50.join(tmp, name);
     try {
       const stat = lstatSync7(dir);
       if (!stat.isDirectory() || uid !== undefined && stat.uid !== uid)
         continue;
-      const pid = Number(readFileSync20(path48.join(dir, PID_FILE), "utf8"));
+      const pid = Number(readFileSync22(path50.join(dir, PID_FILE), "utf8"));
       if (Number.isInteger(pid) && pid > 0 && alive(pid))
         continue;
     } catch (error) {
@@ -94413,8 +94769,8 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
 function linkNodeModules(origin, target, repo, copy) {
   mkdirSync9(target, { recursive: true });
   for (const entry of readdirSync9(origin, { withFileTypes: true })) {
-    const from = path48.join(origin, entry.name);
-    const to = path48.join(target, entry.name);
+    const from = path50.join(origin, entry.name);
+    const to = path50.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
       linkNodeModules(from, to, repo, copy);
       continue;
@@ -94430,9 +94786,9 @@ function linkNodeModules(origin, target, repo, copy) {
       } catch {
         continue;
       }
-      const relative = path48.relative(repo, real);
-      if (!relative.startsWith("..") && !path48.isAbsolute(relative) && !relative.split(path48.sep).includes("node_modules")) {
-        symlinkSync(path48.join(copy, relative), to, "junction");
+      const relative = path50.relative(repo, real);
+      if (!relative.startsWith("..") && !path50.isAbsolute(relative) && !relative.split(path50.sep).includes("node_modules")) {
+        symlinkSync(path50.join(copy, relative), to, "junction");
         continue;
       }
     }
@@ -94448,7 +94804,7 @@ function copySymlink(repo, tree, from, to) {
   }
   const realRepo = realpathSync9(repo);
   if (real && inside3(realRepo, real)) {
-    symlinkSync(path48.relative(path48.dirname(to), path48.join(tree, path48.relative(realRepo, real))), to);
+    symlinkSync(path50.relative(path50.dirname(to), path50.join(tree, path50.relative(realRepo, real))), to);
     return;
   }
   if (real && statSync8(real).isFile())
@@ -94457,10 +94813,10 @@ function copySymlink(repo, tree, from, to) {
     symlinkSync(readlinkSync3(from), to);
 }
 function writeInside(copy, file, content) {
-  const target = path48.join(copy, file);
+  const target = path50.join(copy, file);
   try {
     const stat = lstatSync7(target);
-    if (!stat.isFile() || !inside3(realpathSync9(copy), realpathSync9(path48.dirname(target))))
+    if (!stat.isFile() || !inside3(realpathSync9(copy), realpathSync9(path50.dirname(target))))
       return false;
   } catch {
     return false;
@@ -94471,9 +94827,9 @@ function writeInside(copy, file, content) {
   return true;
 }
 function copyWorkingTree(repo) {
-  const dir = mkdtempSync4(path48.join(os14.tmpdir(), TEMP_PREFIX));
-  writeFileSync10(path48.join(dir, PID_FILE), String(process.pid));
-  const tree = path48.join(dir, "tree");
+  const dir = mkdtempSync4(path50.join(os14.tmpdir(), TEMP_PREFIX));
+  writeFileSync10(path50.join(dir, PID_FILE), String(process.pid));
+  const tree = path50.join(dir, "tree");
   const head = git6(repo, ["rev-parse", "--verify", "--quiet", "HEAD"]).stdout.trim();
   if (head && git6(dir, ["clone", "-q", "--shared", "--no-checkout", repo, tree]).ok) {
     const branch = git6(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout.trim();
@@ -94490,29 +94846,29 @@ function copyWorkingTree(repo) {
   for (const relative of listed) {
     if (!relative)
       continue;
-    const from = path48.join(repo, relative);
+    const from = path50.join(repo, relative);
     let stat;
     try {
       stat = lstatSync7(from);
     } catch {
       continue;
     }
-    const to = path48.join(tree, relative);
-    mkdirSync9(path48.dirname(to), { recursive: true });
+    const to = path50.join(tree, relative);
+    mkdirSync9(path50.dirname(to), { recursive: true });
     if (stat.isSymbolicLink())
       copySymlink(repo, tree, from, to);
     else if (stat.isFile())
       copyFileSync6(from, to);
-    let parent = path48.dirname(relative);
+    let parent = path50.dirname(relative);
     while (parent !== "." && !dirs.has(parent)) {
       dirs.add(parent);
-      parent = path48.dirname(parent);
+      parent = path50.dirname(parent);
     }
   }
   for (const parent of dirs) {
-    const modules = path48.join(repo, parent, "node_modules");
-    if (existsSync19(modules) && !existsSync19(path48.join(tree, parent, "node_modules")))
-      linkNodeModules(modules, path48.join(tree, parent, "node_modules"), repo, tree);
+    const modules = path50.join(repo, parent, "node_modules");
+    if (existsSync20(modules) && !existsSync20(path50.join(tree, parent, "node_modules")))
+      linkNodeModules(modules, path50.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
 }
@@ -94551,20 +94907,20 @@ async function runMutation(options) {
   const tracked = git6(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00").filter(Boolean);
   const testFiles = tracked.filter((file) => TEST_FILE.test(file)).map((file) => {
     try {
-      return { file, text: readFileSync20(path48.join(repo, file), "utf8") };
+      return { file, text: readFileSync22(path50.join(repo, file), "utf8") };
     } catch {
       return { file, text: "" };
     }
   });
   const candidates = [];
   for (const [absolute, lines] of [...options.changed].toSorted(([a], [b]) => a.localeCompare(b))) {
-    const relative = toPosix(path48.relative(repo, absolute));
+    const relative = toPosix(path50.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
-    if (NOT_SOURCE.test(relative) || !existsSync19(absolute))
+    if (NOT_SOURCE.test(relative) || !existsSync20(absolute))
       continue;
     try {
-      candidates.push(...mutantsFor(readFileSync20(absolute, "utf8"), relative, lines));
+      candidates.push(...mutantsFor(readFileSync22(absolute, "utf8"), relative, lines));
     } catch {}
   }
   const mutants = candidates.map((mutant, index) => ({ ...mutant, id: index + 1 }));
@@ -94572,9 +94928,9 @@ async function runMutation(options) {
   for (const mutant of mutants)
     if (!related.has(mutant.file))
       related.set(mutant.file, relatedTests(mutant.file, testFiles));
-  const cwdRelative = path48.relative(repo, options.cwd);
+  const cwdRelative = path50.relative(repo, options.cwd);
   const asArg = (file) => {
-    const relative = toPosix(path48.relative(cwdRelative, file));
+    const relative = toPosix(path50.relative(cwdRelative, file));
     return shellQuote(relative.startsWith(".") ? relative : `./${relative}`);
   };
   const commandFor = (tests) => options.command.replaceAll("{files}", () => tests.map(asArg).join(" "));
@@ -94609,7 +94965,7 @@ async function runMutation(options) {
     return finish2(options, 0, results, counts, started);
   removeStaleCopies();
   const { dir: copyDir, tree: copy } = copyWorkingTree(repo);
-  const copyCwd = path48.join(copy, cwdRelative);
+  const copyCwd = path50.join(copy, cwdRelative);
   let current = null;
   const restore = () => {
     if (current)
@@ -94644,7 +95000,7 @@ async function runMutation(options) {
         record({ ...mutant, status: "skipped", durationMs: 0, tests, reason: "budget" });
         continue;
       }
-      const original = readFileSync20(path48.join(copy, mutant.file), "utf8");
+      const original = readFileSync22(path50.join(copy, mutant.file), "utf8");
       const mutated = original.slice(0, mutant.start) + mutant.replacement + original.slice(mutant.end);
       current = { file: mutant.file, original };
       if (!writeInside(copy, mutant.file, mutated)) {
@@ -94701,8 +95057,8 @@ var NOT_SOURCE, FLIPS, isStringy = (node) => node.type === "StringLiteral" || no
     return error.code === "EPERM";
   }
 }, inside3 = (root, file) => {
-  const relative = path48.relative(root, file);
-  return relative === "" || !relative.startsWith("..") && !path48.isAbsolute(relative);
+  const relative = path50.relative(root, file);
+  return relative === "" || !relative.startsWith("..") && !path50.isAbsolute(relative);
 }, active, killTree = (child) => {
   try {
     if (child.pid && process.platform !== "win32")
@@ -94750,8 +95106,8 @@ var exports_test_audit = {};
 __export(exports_test_audit, {
   run: () => run17
 });
-import { existsSync as existsSync20 } from "node:fs";
-import path49 from "node:path";
+import { existsSync as existsSync21 } from "node:fs";
+import path51 from "node:path";
 function parse7(argv) {
   const options = {
     paths: [],
@@ -94768,6 +95124,10 @@ function parse7(argv) {
   };
   for (let index = 0;index < argv.length; index += 1) {
     const raw = argv[index];
+    if (raw === "--") {
+      options.paths.push(...argv.slice(index + 1));
+      break;
+    }
     const [flag, inline] = raw.startsWith("--") && raw.includes("=") ? [raw.slice(0, raw.indexOf("=")), raw.slice(raw.indexOf("=") + 1)] : [raw, undefined];
     if (flag === "--json")
       continue;
@@ -94851,8 +95211,8 @@ async function run17(argv, io) {
     return emit(io, fail("invalid_input", `${options}
 usage: ${USAGE10}`));
   const top = git6(io.cwd, ["rev-parse", "--show-toplevel"]);
-  const repo = top.ok ? path49.resolve(top.stdout.trim()) : null;
-  const display = (file) => toPosix(path49.relative(io.cwd, file) || file);
+  const repo = top.ok ? path51.resolve(top.stdout.trim()) : null;
+  const display = (file) => toPosix(path51.relative(io.cwd, file) || file);
   let base = null;
   let changed = null;
   if (options.diff || options.mutate) {
@@ -94869,7 +95229,7 @@ usage: ${USAGE10}`));
   }
   let files;
   if (options.diff && changed)
-    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync20(file)).toSorted();
+    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync21(file)).toSorted();
   else {
     const expanded = expandPaths(io.cwd, options.paths);
     if (expanded.missing.length > 0)
@@ -94985,7 +95345,7 @@ var init_knowledge2 = __esm(() => {
   init_output();
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/youtrack-tools.ts
+// packages/workit-core/src/core/youtrack-tools.ts
 async function logTimeUpdate(input, operation = defaultOperations) {
   try {
     const value = await operation.logTime(input);
@@ -95034,7 +95394,7 @@ var init_youtrack_tools = __esm(() => {
   };
 });
 
-// packages/workit-cli/node_modules/@brainervirus/workit-core/src/core/youtrack-writes.ts
+// packages/workit-core/src/core/youtrack-writes.ts
 async function markerPresent(issueId, marker, where) {
   const creds = youTrackToken();
   if ("error" in creds)
@@ -95094,8 +95454,8 @@ var exports_youtrack = {};
 __export(exports_youtrack, {
   run: () => run19
 });
-import { readFileSync as readFileSync21 } from "node:fs";
-import path50 from "node:path";
+import { readFileSync as readFileSync23 } from "node:fs";
+import path52 from "node:path";
 async function run19(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "note" && sub !== "time" && sub !== "meeting")
@@ -95141,7 +95501,7 @@ async function run19(argv, io) {
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
-        markdown = readFileSync21(path50.resolve(io.cwd, flags.values.file), "utf8");
+        markdown = readFileSync23(path52.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
         return usage3(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE12);
       }
@@ -95209,8 +95569,8 @@ var exports_changelog = {};
 __export(exports_changelog, {
   run: () => run20
 });
-import { readFileSync as readFileSync22 } from "node:fs";
-import path51 from "node:path";
+import { readFileSync as readFileSync24 } from "node:fs";
+import path53 from "node:path";
 async function run20(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "apply")
@@ -95256,7 +95616,7 @@ async function run20(argv, io) {
   ]);
 }
 var USAGE13 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
-  const text = raw === "-" ? readFileSync22(0, "utf8") : raw.startsWith("@") ? readFileSync22(path51.resolve(cwd, raw.slice(1)), "utf8") : raw;
+  const text = raw === "-" ? readFileSync24(0, "utf8") : raw.startsWith("@") ? readFileSync24(path53.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
 var init_changelog2 = __esm(() => {
@@ -95339,7 +95699,7 @@ async function resumeBrief(argv, io) {
   return emit(io, ok({ ...data, recorded }), human2);
 }
 async function run21(argv, io) {
-  if (!argv.includes("--task"))
+  if (!argv.some((arg) => arg === "--task" || arg.startsWith("--task=")))
     return resumeBrief(argv, io);
   await Promise.resolve().then(() => init_task());
   return runTaskCommand(["handoff", ...argv]);
@@ -95352,8 +95712,98 @@ var init_handoff = __esm(() => {
 
 // packages/workit-cli/src/main.ts
 init_package();
+import path54 from "node:path";
+
+// packages/workit-cli/src/help.ts
+var HELP_FLAGS = new Set(["--help", "-h"]);
+var ESCAPE = "A value that starts with - goes as --flag=value (or after a bare --).";
+var options = (args) => {
+  const end = args.indexOf("--");
+  return end < 0 ? args : args.slice(0, end);
+};
+var wantsHelp = (args) => options(args).some((arg) => HELP_FLAGS.has(arg));
+var firstWord = (args) => options(args).find((arg) => !arg.startsWith("-"));
+var valueFlags = (lines) => {
+  const out = new Map;
+  const group = /(?<![\w-])(--?[a-zA-Z][\w-]*(?:\|--?[a-zA-Z][\w-]*)*) (?=[<"a-z0-9])/gu;
+  for (const line of lines)
+    for (const match of line.matchAll(group)) {
+      const names = match[1].split("|");
+      const long = names.find((name) => name.startsWith("--")) ?? names[0];
+      for (const name of names)
+        out.set(name, long);
+    }
+  return out;
+};
+function helpAsValue(args, lines) {
+  const before = options(args);
+  const takes = valueFlags(lines);
+  for (let index = 1;index < before.length; index += 1) {
+    const flag = before[index];
+    const long = takes.get(before[index - 1]);
+    if (HELP_FLAGS.has(flag) && long)
+      return `\`${flag}\` looks like the value of ${before[index - 1]}; use ${long}=${flag} or put it after --`;
+  }
+  return null;
+}
+function takesPositionals(lines) {
+  const flag = /(?<![\w-])--?[a-zA-Z][\w-]*(?:\|--?[a-zA-Z][\w-]*)*(?:[ =](?!-)(?:<[^>]*>|"[^"]*"|[\w.,@/|=-]+)…?)?/gu;
+  return lines.some((line) => /<|"|\w…|\s…/u.test(line.replace(flag, "")));
+}
+var usageLines = (entry) => entry.subcommands?.length ? entry.subcommands.map((sub) => sub.usage) : [entry.usage];
+var examplesFor = (entry, sub) => (entry.examples ?? []).filter((example) => sub ? new RegExp(`^workit ${entry.name} ${sub.name}(?![\\w-])`, "u").test(example) : true);
+var exampleBlock = (examples) => examples.length ? ["", "examples:", ...examples.map((line) => `  ${line}`)] : [];
+function verbHelp(entry) {
+  const subs = entry.subcommands ?? [];
+  const usages = usageLines(entry);
+  const examples = examplesFor(entry);
+  const text = [
+    ...subs.length ? [
+      `workit ${entry.name}: ${entry.summary}`,
+      "",
+      ...subs.flatMap((sub) => [`usage: ${sub.usage}`, `    ${sub.summary}`])
+    ] : [`usage: ${entry.usage}`, "", entry.summary],
+    ...exampleBlock(examples),
+    "",
+    ...subs.length ? [`More: workit help ${entry.name} <${subs.map((sub) => sub.name).join("|")}>`] : [],
+    ESCAPE
+  ].join(`
+`);
+  return {
+    name: entry.name,
+    group: entry.group,
+    usage: usages[0],
+    usages,
+    summary: entry.summary,
+    examples,
+    text
+  };
+}
+function subcommandHelp(entry, sub) {
+  const examples = examplesFor(entry, sub);
+  return {
+    name: entry.name,
+    group: entry.group,
+    subcommand: sub.name,
+    usage: sub.usage,
+    usages: [sub.usage],
+    summary: sub.summary,
+    examples,
+    text: [
+      `usage: ${sub.usage}`,
+      "",
+      sub.summary,
+      ...exampleBlock(examples),
+      "",
+      ...sub.aliases?.length ? [`aliases: ${sub.aliases.join(", ")}`] : [],
+      ESCAPE
+    ].join(`
+`)
+  };
+}
+
+// packages/workit-cli/src/main.ts
 init_output();
-import path52 from "node:path";
 
 // packages/workit-cli/src/verbs/registry.ts
 var TASK_FAMILY_NAMES = [
@@ -95365,13 +95815,97 @@ var TASK_FAMILY_NAMES = [
   "worker",
   "state"
 ];
-var family = (name) => ({
+var FAMILY_OPTIONS = "[--task <id>] [--payload <JSON|@file|->] [--revision <r>] [--workspace-revision <r|null>] [--view <v>] [--actor <a>] [--confirm]";
+var FAMILY_ACTIONS = {
+  task: {
+    list: "List the workspace's tasks",
+    inspect: "Show one task's full state",
+    revise: "Change a task's intent or scope",
+    progress: "Record progress on a task",
+    pause: "Pause a task",
+    resume: "Resume a paused task",
+    start: "Start a task from a full payload",
+    close: "Close a task by id"
+  },
+  policy: {
+    assess: "Judge the branch's work and record the derived checks, verdicts and gates",
+    preview: "Show what a judgment would derive, without recording it",
+    explain: "Explain the policy in force"
+  },
+  evidence: { record: "Record evidence against a task's requirements" },
+  finding: { record: "Record a finding", resolve: "Resolve a finding" },
+  decision: { record: "Record a task decision", revoke: "Revoke a task decision" },
+  worker: {
+    assign: "Assign a worker to a task",
+    report: "Report a worker's result",
+    cancel: "Cancel a worker assignment"
+  },
+  state: { export: "Export a task's state (v1)", import: "Import an exported task state" }
+};
+var POLICY_JUDGE = "--judge risk=trivial|normal|high behavior=yes|no product-choice=yes|no plan=yes|no [--ref <path>]…";
+var TASK_IMPLICIT = [
+  {
+    name: "status",
+    usage: "workit task status [--all]",
+    summary: "The current branch's task, or every task with --all"
+  },
+  {
+    name: "start",
+    usage: `workit task start "<objective>" | task start ${FAMILY_OPTIONS}`,
+    summary: "Start tracking the current branch's task (idempotent per branch)"
+  },
+  {
+    name: "note",
+    usage: 'workit task note [--next "<t>"] [--objective "<t>"] [--] "<text>"',
+    summary: "Add a progress note to the current branch's task (creates it if needed)"
+  },
+  {
+    name: "close",
+    usage: `workit task close [--outcome verified|limited|stopped] [--summary "<t>"] [--confirm] | task close ${FAMILY_OPTIONS}`,
+    summary: "Close the current branch's task, or a task by id"
+  },
+  {
+    name: "adopt",
+    usage: "workit task adopt <id>",
+    summary: "Bind a migrated or other task to the current branch"
+  }
+];
+var familySubcommands = (name) => {
+  const implicit = name === "task" ? TASK_IMPLICIT : [];
+  const grammar = Object.entries(FAMILY_ACTIONS[name]).filter(([action]) => !implicit.some((entry) => entry.name === action)).map(([action, summary]) => ({
+    name: action,
+    usage: name === "policy" && action !== "explain" ? `workit policy ${action} ${POLICY_JUDGE} ${FAMILY_OPTIONS}` : `workit ${name} ${action} ${FAMILY_OPTIONS}`,
+    summary
+  }));
+  return [...implicit, ...grammar];
+};
+var family = (name) => withSubcommands({
   name,
   group: "task",
-  usage: name === "task" ? 'workit task status [--all] | task start "<objective>" | task note "<text>" [--next "<t>"] | task close [--outcome verified|limited|stopped] | task adopt <id> | task <action> --payload <JSON>' : name === "policy" ? "workit policy assess|preview --judge risk=trivial|normal|high behavior=yes|no product-choice=yes|no plan=yes|no [--ref <path>] | policy explain" : `workit ${name} <action> [options]`,
   summary: name === "task" ? "The current branch's task (created by its first note, check or recording; no ids needed), or the task family" : name === "policy" ? "Judge the branch's work; Workit derives its checks, verdicts, decision and plan gates" : `Inspect and control a Workit task (${name} family)`,
+  subcommands: familySubcommands(name),
+  ...name === "task" ? {
+    examples: [
+      'workit task note "parser done; wiring the router" --next "add the router test"',
+      "workit task close --outcome verified"
+    ]
+  } : name === "policy" ? {
+    examples: [
+      "workit policy assess --judge risk=normal behavior=yes product-choice=no plan=no"
+    ]
+  } : {},
   load: async () => (await Promise.resolve().then(() => (init_family(), exports_family))).familyVerb(name)
 });
+function withSubcommands(entry, options = {}) {
+  const names = entry.subcommands.map((sub) => sub.name).join("|");
+  return {
+    ...entry,
+    usage: `workit ${entry.name} ${options.optional ? `[${names}]` : names} [options]`,
+    ...options.optional ? { optionalSubcommand: true } : {}
+  };
+}
+var VERIFY_OPTIONS = "[--expect pushed|pr|merged|released] [--pr <n> | --branch <b>] [--sha <sha>] [--tag <t>] [--package <name[@version]>]";
+var LEDGER_ACTOR = "[--branch <b> | --pr <n>] [--supersedes <id>] [--session <id> | --as <role>]";
 var VERBS = [
   {
     name: "init",
@@ -95383,28 +95917,28 @@ var VERBS = [
   {
     name: "upgrade",
     group: "setup",
-    usage: "workit upgrade [--hosts=a,b|none] [--cli] [--preview | --apply --confirm] [--json]",
+    usage: "workit upgrade [--hosts=a,b|none] [--cli] [--preview | --apply --confirm]",
     summary: "Preview upgrades (--apply --confirm to apply)",
     load: () => Promise.resolve().then(() => (init_upgrade2(), exports_upgrade))
   },
   {
     name: "launch",
     group: "setup",
-    usage: "workit launch <host> [--auto-upgrade] [-- args]",
+    usage: "workit launch <host> [--auto-upgrade] [-- <host args…>]",
     summary: "Upgrade before host startup, then start the host",
     load: () => Promise.resolve().then(() => (init_launch(), exports_launch))
   },
   {
     name: "doctor",
     group: "setup",
-    usage: "workit doctor [--json] [--fix-lock [--force [--yes]]]",
+    usage: "workit doctor [--fix-lock [--force [--yes]]]",
     summary: "Verify the offline installation health (--fix-lock clears a stale workit store lock)",
     load: () => Promise.resolve().then(() => (init_doctor2(), exports_doctor))
   },
   {
     name: "gc",
     group: "setup",
-    usage: "workit gc [--dry-run] [--prune-recovery --yes] [--json]",
+    usage: "workit gc [--dry-run] [--prune-recovery --yes]",
     summary: "Compact long task event logs, drop unreferenced blobs and old check logs; report (or prune) 2.x recovery copies",
     load: () => Promise.resolve().then(() => (init_gc(), exports_gc))
   },
@@ -95415,108 +95949,313 @@ var VERBS = [
     summary: "Remove workit host registrations interactively (~/.config/workit is kept)",
     load: () => Promise.resolve().then(() => (init_uninstall2(), exports_uninstall))
   },
-  {
+  withSubcommands({
     name: "grant",
     group: "setup",
-    usage: "workit grant show [<workspace>] [--all] | grant set <workspace> <kind>=<true|false|verified>… | grant unset <workspace> <kind>…",
     summary: "Show or change a workspace's autonomy grants (push, pr, merge, release, rerun) and default endpoint; raising needs the user at a terminal",
+    subcommands: [
+      {
+        name: "show",
+        usage: "workit grant show [<workspace>] [--all]",
+        summary: "Show the grants of the current (or named) workspace, or of every workspace"
+      },
+      {
+        name: "set",
+        usage: "workit grant set <workspace> <kind>=<true|false|verified>… [defaultEndpoint=commit|pr|green|merged] [verification=self|independent]",
+        summary: "Change grants (kinds: push, pr, merge, release, rerun); raising one asks the user to confirm at a terminal"
+      },
+      {
+        name: "unset",
+        usage: "workit grant unset <workspace> <kind>…",
+        summary: "Remove grants, falling back to the defaults"
+      }
+    ],
+    examples: ["workit grant show", "workit grant set my-repo push=true pr=true"],
     load: () => Promise.resolve().then(() => (init_grant(), exports_grant))
-  },
+  }, { optional: true }),
   ...TASK_FAMILY_NAMES.map(family),
   {
     name: "check",
     group: "delivery",
-    usage: "workit check <name> | workit check [--name <n>] [--shell] [--timeout <s>] [--task <id>] -- <cmd…>",
+    usage: "workit check <name> [--task <id>] [--base <ref>] | workit check [--name <n>] [--shell] [--timeout <s>] [--task <id>] [--base <ref>] -- <cmd…>",
     summary: "Run a configured or ad-hoc check and record CLI-observed evidence (exit = the command's)",
+    examples: ["workit check test", "workit check --name unit -- bun test test/unit"],
     load: () => Promise.resolve().then(() => (init_check(), exports_check))
   },
-  {
+  withSubcommands({
     name: "pr",
     group: "delivery",
-    usage: "workit pr status [--pr <n>] | pr create [--base <b> | --track <t>] (--title <t> | --fill) [--draft] | pr merge [--pr <n>] [--method squash|merge|rebase] [--delete-branch] [--unverified --reason <why>]",
     summary: "PR/MR state with failing log tails and next action; open a SHA-verified PR; merge only when READY, verified and granted",
+    subcommands: [
+      {
+        name: "status",
+        usage: "workit pr status [--pr <n> | --branch <b>] [--log-lines 60]",
+        summary: "PR/MR state, failing check log tails and the next action"
+      },
+      {
+        name: "create",
+        usage: "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f>] | --fill) [--draft]",
+        summary: "Open a PR/MR for the pushed branch, verified against the local HEAD"
+      },
+      {
+        name: "merge",
+        usage: "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--delete-branch] [--unverified --reason <why>]",
+        summary: "Merge when READY, verified by a non-author and granted"
+      }
+    ],
+    examples: [
+      'workit pr create --title "fix(cli): answer help flags first" --body-file pr.md',
+      "workit pr merge --method squash --delete-branch"
+    ],
     load: () => Promise.resolve().then(() => (init_pr(), exports_pr))
-  },
-  {
+  }),
+  withSubcommands({
     name: "ci",
     group: "delivery",
-    usage: "workit ci wait [--pr <n>] [--head <sha>] [--timeout 20m] | ci rerun [--failed | --check <name>…] --reason flake|infra [--force]",
     summary: "Wait for CI on the PR head (exit 0/1/3/4), or rerun failed jobs once per head",
+    subcommands: [
+      {
+        name: "wait",
+        usage: "workit ci wait [--pr <n> | --branch <b>] [--head <sha>] [--timeout 20m] [--interval 30s]",
+        summary: "Wait for CI on the PR head; exit 0 green, 1 red, 3 blocked, 4 still pending"
+      },
+      {
+        name: "rerun",
+        usage: "workit ci rerun [--pr <n> | --branch <b>] [--check <name>… | --failed] --reason flake|infra [--force]",
+        summary: "Rerun failed jobs once per head, with a recorded reason"
+      }
+    ],
+    examples: ["workit ci wait --timeout 30m", "workit ci rerun --failed --reason flake"],
     load: () => Promise.resolve().then(() => (init_ci(), exports_ci))
-  },
-  {
+  }),
+  withSubcommands({
     name: "git",
     group: "delivery",
-    usage: "workit git branch <name> [--base <b>] [--track <t>] | git commit -m <msg> [--all | -- <paths…>] | git push [--set-upstream] [--force-with-lease]",
     summary: "Policy-checked branch and commit (Workit-Session trailer); push with a lease and a verified remote tip",
+    subcommands: [
+      {
+        name: "branch",
+        usage: "workit git branch <name> | git branch --kind feature|bugfix|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry]",
+        summary: "Create and switch to a branch from the trunk or a release track"
+      },
+      {
+        name: "commit",
+        usage: "workit git commit -m|--message <msg>… | -F|--file <file|-> [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>]",
+        summary: "Commit (or --amend) with a linted Conventional Commit message and the session trailer"
+      },
+      {
+        name: "push",
+        usage: "workit git push [-u|--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]]",
+        summary: "Push the current branch and verify the remote tip (never a blind --force)"
+      }
+    ],
+    examples: [
+      "workit git branch --kind feature --slug help-everywhere",
+      'workit git commit -m "fix(cli): answer help flags first" --all',
+      "workit git commit --amend --no-edit -- src/forgotten.ts",
+      "workit git push --set-upstream"
+    ],
     load: () => Promise.resolve().then(() => (init_git2(), exports_git))
-  },
-  {
+  }),
+  withSubcommands({
     name: "verify-delivery",
     group: "delivery",
-    usage: "workit verify-delivery [push|pr|merge|release] [--pr <n> | --branch <b>] [--sha <s>] [--tag <t>] [--package <p>]",
     summary: "Observe that a push, PR head, merge or release really landed on the remote (exit 1 when not)",
+    subcommands: [
+      ["push", "pushed", "the branch's remote tip is the local HEAD"],
+      ["pr", null, "the PR head is the local HEAD"],
+      ["merge", "merged", "the PR merged into its base"],
+      ["release", "released", "the release tag and package exist"]
+    ].map(([name, alias, what]) => ({
+      name,
+      ...alias ? { aliases: [alias] } : {},
+      usage: `workit verify-delivery ${name} ${VERIFY_OPTIONS}`,
+      summary: `Observe that ${what}`
+    })),
+    examples: ["workit verify-delivery push", "workit verify-delivery merge --pr 42"],
     load: () => Promise.resolve().then(() => (init_verify_delivery(), exports_verify_delivery))
-  },
-  {
+  }, { optional: true }),
+  withSubcommands({
     name: "stack",
     group: "delivery",
-    usage: "workit stack plan [<bottom> … <top>] | status | sync [--local] | land [--dry-run] [--max <n>] [--unverified --reason <why>] [--json]",
     summary: "Plan, restack (lease push + retarget) and land a base-branch stack of PRs, root first",
+    subcommands: [
+      {
+        name: "plan",
+        usage: "workit stack plan [--name <n>] [--trunk <b> | --track <t>] [<bottom> … <top>]",
+        summary: "Record the stack's branches, bottom first"
+      },
+      {
+        name: "status",
+        usage: "workit stack status [--name <n>]",
+        summary: "Each stacked PR's base, head, CI and verdict"
+      },
+      {
+        name: "sync",
+        usage: "workit stack sync [--name <n>] [--local] [--dry-run] [--force <branch>]…",
+        summary: "Restack onto the moved bases, lease-push and retarget the PRs"
+      },
+      {
+        name: "land",
+        usage: "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--unverified --reason <why>] [--timeout 20m] [--interval 30s]",
+        summary: "Merge the stack root first, restacking the rest as each lands"
+      }
+    ],
+    examples: ["workit stack plan feature/a feature/b feature/c", "workit stack land --dry-run"],
     load: () => Promise.resolve().then(() => (init_stack2(), exports_stack))
-  },
-  {
+  }),
+  withSubcommands({
     name: "fanout",
     group: "delivery",
-    usage: "workit fanout plan <plan.json> [--name <n>] [--trunk <b> | --track <t>] [--take-lead] | fanout brief <slice> [--mode new|resume] [--attempt <n>] | fanout check [<slice>…] [--name <n>] [--base <ref>] [--offline] | fanout status [--name <n>] [--stuck-after 30m] [--offline] | fanout worktree create|release <slice> [--force] [--json]",
     summary: "Register parallel slices (complete briefs, disjoint scopes, shared-file owners), render each worker's brief with the standing orders, watch them (STUCK, PR, CI, verdict, landed, landing order), make and release slice worktrees, and gate fan-in: out-of-scope edits, trunk and sibling merge conflicts",
+    subcommands: [
+      {
+        name: "plan",
+        usage: "workit fanout plan <plan.json> [--name <n>] [--trunk <b> | --track <t>] [--take-lead]",
+        summary: "Register the slices of a plan file"
+      },
+      {
+        name: "brief",
+        usage: "workit fanout brief <slice> [--mode new|resume] [--attempt <n>] [--name <n>]",
+        summary: "Render one worker's brief with the standing orders"
+      },
+      {
+        name: "check",
+        usage: "workit fanout check [<slice>…] [--name <n>] [--base <ref>] [--offline]",
+        summary: "Gate fan-in: out-of-scope edits, trunk and sibling merge conflicts"
+      },
+      {
+        name: "status",
+        usage: "workit fanout status [--name <n>] [--stuck-after 30m] [--offline]",
+        summary: "Each slice's state: STUCK, PR, CI, verdict, landed, landing order"
+      },
+      {
+        name: "worktree",
+        usage: "workit fanout worktree create|release <slice> [--name <n>] [--force]",
+        summary: "Make or release a slice's worktree (--force applies to release only)"
+      }
+    ],
+    examples: [
+      "workit fanout plan plan.json --take-lead",
+      "workit fanout status --stuck-after 20m"
+    ],
     load: () => Promise.resolve().then(() => (init_fanout2(), exports_fanout))
-  },
-  {
+  }),
+  withSubcommands({
     name: "ledger",
     group: "delivery",
-    usage: "workit ledger decision|ruling|verdict|standing|list|check ...",
     summary: "Record and query decisions, rulings, SHA-keyed verdicts (patch-id carry-over across rebases) and a fanout's standing orders",
+    subcommands: [
+      {
+        name: "decision",
+        usage: `workit ledger decision "<what>" --why "<why>" [--ref <path|url>]… ${LEDGER_ACTOR}`,
+        summary: "Record a decision and why"
+      },
+      {
+        name: "ruling",
+        usage: `workit ledger ruling "<what>" --why "<why>" --cost-if-wrong "<cost>" [--ref <path|url>]… ${LEDGER_ACTOR}`,
+        summary: "Record a ruling on an open choice, with the cost of being wrong"
+      },
+      {
+        name: "verdict",
+        usage: `workit ledger verdict <result> --how "<method/evidence>" [--kind unit|live|perf|review] [--base <ref>] [--surface ui|cli|api] [--evidence <ref>]… [--self] ${LEDGER_ACTOR} | ledger verdict [<branch>]`,
+        summary: "Record a SHA-keyed verdict on the branch head (result: verified, tests-verified, type-check-only, blocked, failed), or show the current verdicts"
+      },
+      {
+        name: "list",
+        aliases: ["show"],
+        usage: "workit ledger list|show [--branch <b>] [--pr <n>] [--type <t>] [--last <n>]",
+        summary: "List ledger rows, newest last"
+      },
+      {
+        name: "check",
+        usage: "workit ledger check [--pr <n> | --branch <b>]",
+        summary: "Whether the branch head carries an accepted non-author verdict"
+      },
+      {
+        name: "standing",
+        usage: `workit ledger standing add "<order>" | standing list | standing clear [<id>]  [--fanout <name>] [--supersedes <id>] [--session <id> | --as <role>]`,
+        summary: "The lead's standing orders for a fanout's workers"
+      },
+      {
+        name: "add",
+        usage: 'workit ledger add decision|ruling|verdict "<what>" …',
+        summary: "Same as the bare decision, ruling and verdict forms"
+      }
+    ],
+    examples: [
+      'workit ledger decision "keep the registry as the help source" --why "one place to update"',
+      'workit ledger verdict verified --how "ran the CLI against a scratch repo" --kind live --as verifier'
+    ],
     load: () => Promise.resolve().then(() => (init_ledger2(), exports_ledger))
-  },
+  }),
   {
     name: "test-audit",
     group: "delivery",
-    usage: "workit test-audit [paths…] [--diff [base]] [--rule <ids>] [--min-severity <level>] [--fail-on <level>] [--mutate [--test-cmd <cmd {files}>] [--max-mutants <n>] [--budget <s>]] [--json]",
+    usage: "workit test-audit [paths…] [--diff [<base>]] [--rule <ids>] [--min-severity <level>] [--fail-on <level>] [--mutate [--test-cmd <cmd {files}>] [--max-mutants <n>] [--budget <s>] [--timeout <s>]]",
     summary: "Flag tautological and low-value tests with a suggested independent oracle; --mutate checks changed lines with diff-scoped mutation",
     load: () => Promise.resolve().then(() => (init_test_audit(), exports_test_audit))
   },
-  {
+  withSubcommands({
     name: "knowledge",
     group: "delivery",
-    usage: "workit knowledge lint [--json]",
     summary: "Lint agent knowledge files: AGENTS.md byte budget, broken local links, scaffold-only files, duplicated rules (exit 1 on findings)",
+    subcommands: [
+      {
+        name: "lint",
+        usage: "workit knowledge lint",
+        summary: "Lint AGENTS.md and the knowledge files it links"
+      }
+    ],
     load: () => Promise.resolve().then(() => (init_knowledge2(), exports_knowledge))
-  },
-  {
+  }),
+  withSubcommands({
     name: "youtrack",
     group: "delivery",
-    usage: "workit youtrack note <ISSUE> (--markdown <t> | --file <p>) [--minutes <n>] | youtrack time|meeting <ISSUE> --minutes <n> [--text <t>] [--date auto|YYYY-MM-DD]",
     summary: "Post a YouTrack comment or log work time (host permission, no grant)",
+    subcommands: [
+      {
+        name: "note",
+        usage: "workit youtrack note <ISSUE> (--markdown <t> | --file <p>) [--minutes <n>] [--date auto|YYYY-MM-DD]",
+        summary: "Post a comment, optionally logging time"
+      },
+      {
+        name: "time",
+        usage: "workit youtrack time <ISSUE> --minutes <n> [--text <t>] [--date auto|YYYY-MM-DD]",
+        summary: "Log work time"
+      },
+      {
+        name: "meeting",
+        usage: "workit youtrack meeting <ISSUE> --minutes <n> --text <t> [--date auto|YYYY-MM-DD]",
+        summary: "Log meeting time"
+      }
+    ],
     load: () => Promise.resolve().then(() => (init_youtrack2(), exports_youtrack))
-  },
-  {
+  }),
+  withSubcommands({
     name: "changelog",
     group: "delivery",
-    usage: "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]",
     summary: "Add entries under the Unreleased section of the changelog",
+    subcommands: [
+      {
+        name: "apply",
+        usage: "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]",
+        summary: "Add entries (or only normalize the file)"
+      }
+    ],
     load: () => Promise.resolve().then(() => (init_changelog2(), exports_changelog))
-  },
+  }),
   {
     name: "handoff",
     group: "delivery",
-    usage: "workit handoff [--note <t>] [--next <t>] [--record] | workit handoff --task <id>",
+    usage: "workit handoff [--note <t>] [--next <t>] [--record] [--last <n>] | workit handoff --task <id>",
     summary: "Print a resume brief (branch, HEAD, dirty state, verdict, rulings, next command); --task exports v1 task state",
     load: () => Promise.resolve().then(() => (init_handoff(), exports_handoff))
   }
 ];
 var BY_NAME = new Map(VERBS.map((entry) => [entry.name, entry]));
 var findVerb = (name) => BY_NAME.get(name);
+var findSubcommand = (entry, name) => entry.subcommands?.find((sub) => sub.name === name || sub.aliases?.includes(name));
 
 // packages/workit-cli/src/main.ts
 var GROUP_TITLES = {
@@ -95548,20 +96287,17 @@ ${sections.join(`
 `)}
 
 Global flags:
-  --json        Machine-readable output: {"ok","code","data","error"?,"unblock"?}
-  --cwd <dir>   Run as if started in <dir>
-  --version     Print the CLI version
-  help <cmd>    Show usage for one command
+  --json             Machine-readable output: {"ok","code","data","error"?,"unblock"?}
+  --cwd <dir>        Run as if started in <dir>
+  --version          Print the CLI version
+  -h, --help         Show usage for the command and subcommand before it (runs nothing)
+  help <cmd> [<sub>] The same, as a command
 
 Exit codes: 0 ok · 1 failed · 2 usage · 3 blocked · 4 busy/pending · 5 unavailable
 
 Run \`npx @brainervirus/workit-cli init\` to configure platforms, YouTrack, VCS and project hygiene.
 `;
 }
-var verbHelp = (entry) => `usage: ${entry.usage}
-
-${entry.summary}${entry.planned ? ` (coming in ${entry.planned})` : ""}
-`;
 function parseGlobals(argv) {
   const rest = [];
   let json = false;
@@ -95597,7 +96333,7 @@ var defaultIo = (json) => ({
 });
 async function main(argv, overrides = {}, options = {}) {
   const parsed = parseGlobals(argv);
-  const cwd = path52.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
+  const cwd = path54.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
   const io = { ...defaultIo(parsed.json), ...overrides, json: parsed.json, cwd };
   if (parsed.error)
     return emit(io, fail("invalid_input", parsed.error));
@@ -95607,18 +96343,38 @@ async function main(argv, overrides = {}, options = {}) {
     return emit(io, ok({ version: package_default.version }), (data) => data.version);
   }
   if (command === undefined || command === "help" || command === "--help" || command === "-h") {
-    const topic = command === "help" ? args.find((arg) => !arg.startsWith("-")) : undefined;
+    const [topic, sub] = command === "help" ? words2(args) : [];
     if (topic) {
       const entry = findVerb(topic);
       if (!entry)
         return unknown2(io, topic);
-      return emit(io, ok(describe3(entry)), () => verbHelp(entry));
+      if (sub === undefined)
+        return help(io, verbHelp(entry));
+      const found = findSubcommand(entry, sub);
+      if (!found)
+        return emit(io, fail("invalid_input", `unknown ${topic} subcommand "${sub}"`, {
+          unblock: `workit help ${topic}`
+        }));
+      return help(io, subcommandHelp(entry, found));
     }
     return emit(io, ok({ version: package_default.version, verbs: listed().map(describe3) }), () => helpText());
   }
   const entry = findVerb(command);
   if (!entry)
     return unknown2(io, command);
+  if (wantsHelp(verbArgs)) {
+    const word = firstWord(verbArgs);
+    const sub = word === undefined ? undefined : findSubcommand(entry, word);
+    const asValue = helpAsValue(verbArgs, sub ? [sub.usage] : usageLines(entry));
+    if (asValue)
+      return emit(io, fail("invalid_input", asValue, {
+        unblock: `workit help ${entry.name}${sub ? ` ${sub.name}` : ""}`
+      }));
+    return help(io, sub ? subcommandHelp(entry, sub) : verbHelp(entry));
+  }
+  const ended = endOfOptions(io, entry, args);
+  if (typeof ended === "number")
+    return ended;
   if (parsed.cwd !== null) {
     try {
       process.chdir(io.cwd);
@@ -95636,8 +96392,8 @@ async function main(argv, overrides = {}, options = {}) {
 `);
   const verb = await entry.load();
   if (!io.json)
-    return verb.run(args, io);
-  return runJsonPure(io, command, (pure) => verb.run(args, pure));
+    return verb.run(ended, io);
+  return runJsonPure(io, command, (pure) => verb.run(ended, pure));
 }
 var CODE_FOR_EXIT = {
   1: "failed",
@@ -95700,10 +96456,32 @@ var withJsonFlag = (args) => {
   return end < 0 ? [...args, "--json"] : [...args.slice(0, end), "--json", ...args.slice(end)];
 };
 var listed = () => VERBS.filter((entry) => !entry.planned);
+function endOfOptions(io, entry, args) {
+  const end = args.indexOf("--");
+  if (end < 0)
+    return args;
+  const word = firstWord(args);
+  const sub = word === undefined ? undefined : findSubcommand(entry, word);
+  const unblock = `workit help ${entry.name}${sub ? ` ${sub.name}` : ""}`;
+  if (entry.subcommands?.length && !sub) {
+    if (entry.optionalSubcommand || word !== undefined)
+      return args;
+    return emit(io, fail("invalid_input", `missing ${entry.name} subcommand`, { unblock }));
+  }
+  if (takesPositionals(sub ? [sub.usage] : [entry.usage]))
+    return args;
+  const extra = args.slice(end + 1);
+  if (extra.length)
+    return emit(io, fail("invalid_input", `${entry.name}${sub ? ` ${sub.name}` : ""} takes no positional arguments (got: ${extra.join(" ")})`, { unblock }));
+  return args.slice(0, end);
+}
+var words2 = (args) => args.filter((arg) => !arg.startsWith("-"));
+var help = (io, doc) => emit(io, ok(doc), (data) => data.text);
 var describe3 = (entry) => ({
   name: entry.name,
   group: entry.group,
   usage: entry.usage,
+  usages: usageLines(entry),
   summary: entry.summary,
   ...entry.planned ? { planned: entry.planned } : {}
 });