@brainervirus/workit-cli 8.39.2 → 8.39.4

package/dist/index.js

@@ -9317,7 +9317,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.39.2",
+    version: "8.39.4",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9355,13 +9355,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.39.2",
+      "@brainervirus/workit-cursor": "^8.39.4",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.39.2"
+      "@brainervirus/workit-core": "^8.39.4"
     },
     engines: {
       node: ">=24"
@@ -9462,6 +9462,11 @@ function detectedChecks(root) {
       if (typeof script === "string" && script.trim() !== "")
         add(scriptCheck(pm, name));
     }
+    for (const [name, script] of Object.entries(SCRIPT_CHECK_ALIASES)) {
+      const body = scripts[script];
+      if (typeof body === "string" && body.trim() !== "")
+        add({ ...scriptCheck(pm, script), name });
+    }
   }
   const plain = (name, argv) => ({ name, argv, accepts: [argv] });
   if (read("go.mod") !== null)
@@ -9580,7 +9585,7 @@ function workitAvailable(env = process.env) {
 function checkCommand(args, version, onPath = workitAvailable()) {
   return onPath ? `workit check ${args}` : `npx -y @brainervirus/workit-cli@${version} check ${args}`;
 }
-var SCRIPT_CHECKS, CHECKS_FILE = ".workit/checks.json", LEGACY_CHECKS_FILE = "workit.checks.json", WORKIT_GITIGNORE = `*
+var SCRIPT_CHECKS, SCRIPT_CHECK_ALIASES, CHECKS_FILE = ".workit/checks.json", LEGACY_CHECKS_FILE = "workit.checks.json", WORKIT_GITIGNORE = `*
 !risk-paths
 `, isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SHELL_META, git3 = (cwd, args) => {
   const run = spawnSync7("git", args, {
@@ -9610,6 +9615,7 @@ var SCRIPT_CHECKS, CHECKS_FILE = ".workit/checks.json", LEGACY_CHECKS_FILE = "wo
 }, CHECK_NAME, GATES, sameArgv = (left, right) => left.length === right.length && left.every((item, index) => item === right[index]), workitOnPath;
 var init_check_config = __esm(() => {
   SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
+  SCRIPT_CHECK_ALIASES = { packaging: "test:packaging" };
   SHELL_META = /[|&;<>()$`\\*?[\]{}~!#]/u;
   CHECK_NAME = /^[a-z0-9][a-z0-9:._-]{0,63}$/u;
   GATES = ["testing", "verification"];
@@ -15571,6 +15577,7 @@ function recordVerdict(context, input) {
     sessionSource: context.sessionSource ?? "env",
     ...context.sessionBound === true ? { sessionBound: true } : {},
     evidenceRefs: input.evidenceRefs ?? [],
+    ...input.checkEvidence?.length ? { checkEvidence: input.checkEvidence } : {},
     ...untrackedField(context.cwd)
   }, { now: context.now });
 }
@@ -21298,7 +21305,10 @@ async function payloadValue(raw, deps) {
   }
   try {
     const value = JSON.parse(source);
-    return isObject7(value) ? { ok: true, value } : { ok: false, result: failure2("invalid_input", "payload must be a JSON object") };
+    return isObject7(value) ? { ok: true, value } : {
+      ok: false,
+      result: failure2("invalid_input", "payload must be a JSON object")
+    };
   } catch (error) {
     return {
       ok: false,
@@ -21493,7 +21503,11 @@ function laneOf(root) {
   } catch {
     verification = DEFAULT_VERIFICATION;
   }
-  const lane = branchLane(root, { head: null, workingTree: true, judgment: currentJudgment(root) });
+  const lane = branchLane(root, {
+    head: null,
+    workingTree: true,
+    judgment: currentJudgment(root)
+  });
   return {
     lane: lane.lane,
     reasons: lane.reasons,
@@ -21567,7 +21581,69 @@ function printHuman(result, deps, handoff = false) {
       write(stream, `policy gap: ${gap.reason}`);
   }
 }
+function runFindingList(argv, deps) {
+  let json = false;
+  let branch;
+  let status;
+  const fail = (message) => {
+    if (json)
+      jsonResult(outOf(deps), usage(message));
+    else
+      write(errOf(deps), `${message}
+usage: ${FINDING_LIST_USAGE}`);
+    return 2;
+  };
+  for (let i = 0;i < argv.length; i += 1) {
+    const eq = argv[i].startsWith("--") ? argv[i].indexOf("=") : -1;
+    const token = eq > 0 ? argv[i].slice(0, eq) : argv[i];
+    if (token === "--json")
+      json = true;
+    else if (token === "--branch" || token === "--status") {
+      const value = eq > 0 ? argv[i].slice(eq + 1) : argv[++i];
+      if (value === undefined || !value.trim())
+        return fail(`${token} requires a value`);
+      if (token === "--branch")
+        branch = value;
+      else
+        status = value;
+    } else
+      return fail(`unknown argument: ${argv[i]}`);
+  }
+  if (status !== undefined && status !== "open" && status !== "resolved")
+    return fail(`--status is open or resolved (got ${status})`);
+  const store = new TaskStore(workspaceRootFor(deps));
+  const index = store.listTaskIndex();
+  const tasks = store.listTasks();
+  const result = !index.ok ? index : !tasks.ok ? tasks : success(null, null, null);
+  if (!result.ok || !index.ok || !tasks.ok) {
+    if (json)
+      jsonResult(outOf(deps), result);
+    else
+      printHuman(result, deps);
+    return 1;
+  }
+  const keys = new Map(index.data.map((entry) => [entry.id, entry.key]));
+  const rows = tasks.data.filter((task) => branch === undefined || keys.get(task.id) === branch).flatMap((task) => task.findings.filter((item) => status === undefined || item.data.disposition === "open" === (status === "open")).map((item) => ({
+    id: item.id,
+    taskId: task.id,
+    branch: keys.get(task.id) ?? null,
+    disposition: item.data.disposition,
+    recordedAt: item.recordedAt,
+    claim: item.data.claim
+  })));
+  const total = tasks.data.reduce((sum, task) => sum + task.findings.length, 0);
+  if (json)
+    jsonResult(outOf(deps), success(null, null, { findings: rows, total }));
+  else if (!rows.length)
+    write(outOf(deps), total ? `no findings match the filters (${total} finding${total === 1 ? "" : "s"} in all; drop --branch/--status to list them)` : "no findings recorded (record one: workit finding record --payload '{…}'); ledger rows hold verdicts and rulings, not findings");
+  else
+    for (const row of rows)
+      write(outOf(deps), `${row.id} ${row.disposition}${row.branch ? ` [${row.branch}]` : ""} (task ${row.taskId}) ${row.claim}`);
+  return 0;
+}
 async function runTaskCommand(argv, deps = {}) {
+  if (argv[0] === "finding" && argv[1] === "list")
+    return runFindingList(argv.slice(2), deps);
   const parsed = await parseTaskArgs(argv, deps);
   if (!parsed.ok) {
     if (parsed.json)
@@ -21580,7 +21656,9 @@ async function runTaskCommand(argv, deps = {}) {
   const store = new TaskStore(root);
   try {
     const now = new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
-    closeDeliveredTasks(store, now, { cached: parsed.parsed.action !== "list" });
+    closeDeliveredTasks(store, now, {
+      cached: parsed.parsed.action !== "list"
+    });
   } catch {}
   const core = new WorkitCore(store, contextFor(root, parsed.parsed.actor !== undefined ? { ...deps, actor: parsed.parsed.actor } : deps));
   let result;
@@ -21671,7 +21749,7 @@ var TASK_FAMILIES, workspaceRootFor = (deps = {}) => {
   capabilities: deps.capabilities ?? [],
   constraints: deps.constraints ?? [],
   now: deps.now ?? (() => new Date().toISOString())
-});
+}), FINDING_LIST_USAGE = "workit finding list [--branch <b>] [--status open|resolved] [--json]";
 var init_task = __esm(() => {
   init_check_config();
   init_autonomy();
@@ -21688,7 +21766,7 @@ var init_task = __esm(() => {
     task: ["start", "list", "inspect", "revise", "progress", "pause", "resume", "close"],
     policy: ["assess", "preview", "explain"],
     evidence: ["record"],
-    finding: ["record", "resolve"],
+    finding: ["record", "resolve", "list"],
     decision: ["record", "revoke"],
     worker: ["assign", "report", "cancel"],
     state: ["export", "import"]
@@ -78399,7 +78477,7 @@ var init_resources = __esm(() => {
   init_checks3();
   init_heavy();
   init_heavy_scope();
-  DEFAULT_HEAVY_CHECKS = ["test", "build"];
+  DEFAULT_HEAVY_CHECKS = ["test", "build", "packaging"];
   DEFAULT_LIGHT_CHECKS = ["lint", "typecheck", "format"];
   SIZE = /^(\d+(?:\.\d+)?)([KMGT]?)$/iu;
   PERCENT = /^(\d+(?:\.\d+)?)%$/u;
@@ -78617,28 +78695,39 @@ function countWarnings(log) {
   return redactLog(log).replace(ANSI_COLOR, "").split(`
 `).filter((line) => WARNING_LINE.test(line) && !NO_WARNINGS.test(line)).length;
 }
-function boundedOutput(log, lines, stderr = "") {
+function boundedOutput(log, lines, stderr = "", failed = false) {
   const all = tailLines(log, Number.MAX_SAFE_INTEGER);
   if (all.length === 0)
     return "";
-  let shown = all.slice(-lines);
+  const markers = failed ? [...new Set(all.filter((line) => FAILURE_LINE.test(line)))] : [];
+  const listed = markers.slice(0, MAX_FAILURE_LINES);
+  const more = markers.length - listed.length;
+  const failureRoom = listed.length ? listed.length + 2 + (more > 0 ? 1 : 0) : 0;
+  let shown = all.slice(-Math.max(1, lines - failureRoom));
   const errors = tailLines(redactLog(stderr), STDERR_TAIL_LINES);
   let missing = [];
   if (errors.length) {
     const tail = new Set(shown);
     if (errors.some((line) => !tail.has(line))) {
-      shown = all.slice(-Math.max(1, lines - errors.length - 2));
+      shown = all.slice(-Math.max(1, lines - failureRoom - errors.length - 2));
       const kept = new Set(shown);
       missing = errors.filter((line) => !kept.has(line));
     }
   }
   const omitted = all.length - shown.length;
+  const inTail = new Set([...shown, ...missing]);
+  const failures = listed.filter((line) => !inTail.has(line));
+  const failureFooter = failures.length ? `… failures from the omitted lines:
+${failures.join(`
+`)}
+${more > 0 ? `+${more} more failures in the log
+` : ""}` : "";
   const footer = missing.length ? `… the last stderr lines, which the merged log holds earlier:
 ${missing.join(`
 `)}
 ` : "";
   return `${omitted ? `… ${omitted} earlier line${omitted === 1 ? "" : "s"} omitted (the full log is named below; --full streams it)
-` : ""}${shown.join(`
+` : ""}${failureFooter}${shown.join(`
 `)}
 ${footer}`;
 }
@@ -78938,7 +79027,7 @@ async function run12(argv, io) {
 `);
   else {
     if (!options.full)
-      io.stdout(boundedOutput(result.log, OUTPUT_LINES, stderrTail));
+      io.stdout(boundedOutput(result.log, OUTPUT_LINES, stderrTail, !passed));
     io.stderr(`${summary}
 `);
     if (recordError && passed)
@@ -78955,7 +79044,7 @@ async function run12(argv, io) {
     return recordError.code === "busy" ? 4 : recordError.code === "invalid_input" ? 2 : 5;
   return 0;
 }
-var USAGE6 = 'workit check <name> [--full] [--wait <dur> | --no-wait] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <dur> | --no-wait] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path53.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, ANSI_COLOR, WARNING_LINE, NO_WARNINGS, STDERR_TAIL_LINES = 10, STDERR_KEEP_CHARS = 65536;
+var USAGE6 = 'workit check <name> [--full] [--wait <dur> | --no-wait] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <dur> | --no-wait] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path53.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, ANSI_COLOR, WARNING_LINE, NO_WARNINGS, STDERR_TAIL_LINES = 10, STDERR_KEEP_CHARS = 65536, FAILURE_LINE, MAX_FAILURE_LINES = 15;
 var init_check = __esm(() => {
   init_check_config();
   init_checks3();
@@ -78976,6 +79065,7 @@ var init_check = __esm(() => {
   ANSI_COLOR = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
   WARNING_LINE = /^\s*(?:⚠|\[(?:WARN|WARNING|warn|warning)\]|(?:npm\s+)?(?:WARN\s|warn\s)|warn(?:ing)?(?:\[[^\]]*\])?:|\d+:\d+\s+warning\s|\S+\(\d+,\d+\):\s*warning\s|\S+:\d+:\d+:\s*warning\b)/;
   NO_WARNINGS = /\b(?:no|0|zero|none)\s+warnings?\b/i;
+  FAILURE_LINE = /^\s*(?:\(fail\)|FAIL\b|✗|error:)/u;
 });
 
 // packages/workit-cli/src/verbs/lock.ts
@@ -80398,6 +80488,67 @@ var init_pr_lane = __esm(() => {
   init_lane();
 });
 
+// packages/workit-core/src/core/policy/check-evidence.ts
+function neededChecks(lane, configured) {
+  if (lane !== "focused" && lane !== "full")
+    return [];
+  const names = configured.filter((name) => name !== AGGREGATE);
+  return names.length ? names : [...configured];
+}
+function localCheckRows(rows) {
+  return rows.filter((row) => row.type === "check" && row.observer === "workit_cli").map((row) => ({
+    name: String(row.name ?? ""),
+    head: String(row.head ?? ""),
+    dirty: row.dirty === true,
+    passed: row.result === "passed"
+  }));
+}
+function verdictEvidence(cwd, input) {
+  const lane = branchLane(cwd, { base: input.base ?? null, head: input.head });
+  return checkEvidence({
+    lane: lane.lane,
+    head: input.head,
+    configured: gateCheckNames(loadCheckConfig(cwd), "verification"),
+    local: localCheckRows(input.rows),
+    ci: []
+  });
+}
+function checkEvidence(input) {
+  const ciCovers = input.lane === "focused";
+  const needed = neededChecks(input.lane, input.configured).map((name) => {
+    const last = input.local.findLast((row) => row.name === name && row.head === input.head && !row.dirty);
+    if (last?.passed)
+      return { name, status: "fresh", via: "local", ciCovers };
+    const ci = input.ci.filter((check) => ciMatch(check, name));
+    if (ci.some((check) => check.state === "failing"))
+      return { name, status: "failing", via: "ci", ciCovers };
+    if (last)
+      return { name, status: "failing", via: "local", ciCovers };
+    if (ciCovers && ci.some((check) => check.state === "passing"))
+      return { name, status: "fresh", via: "ci", ciCovers };
+    return { name, status: "missing", via: null, ciCovers };
+  });
+  return {
+    lane: input.lane,
+    head: input.head,
+    needed,
+    satisfied: needed.every((item) => item.status === "fresh")
+  };
+}
+function evidenceLines(doc) {
+  if (!doc.needed.length)
+    return [`evidence: lane ${doc.lane} needs no check run`];
+  return [
+    `evidence for lane ${doc.lane} on ${doc.head.slice(0, 7)}: ${doc.satisfied ? "complete" : "incomplete"}`,
+    ...doc.needed.map((item) => `  ${item.status === "fresh" ? "ok" : "x"} ${item.name}: ${item.status}${item.via ? ` (${item.via})` : item.ciCovers ? " (run it, or green CI covers it)" : " (run workit check " + item.name + " on this head)"}`)
+  ];
+}
+var AGGREGATE = "check", ciMatch = (ci, name) => new RegExp(`(^|[^a-z0-9])${name.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}([^a-z0-9]|$)`, "iu").test(ci.name);
+var init_check_evidence = __esm(() => {
+  init_check_config();
+  init_lane();
+});
+
 // packages/workit-core/src/forge/reruns.ts
 import fs27 from "node:fs";
 import path58 from "node:path";
@@ -80614,6 +80765,14 @@ function selectPr(cwd, resolved, options) {
   }
   return success2(found.data.number);
 }
+function evidenceFor(cwd, status, ci = status.checks) {
+  const lane = branchLane(cwd, { base: status.base, head: status.head.sha });
+  const configured = gateCheckNames(loadCheckConfig(cwd), "verification");
+  const read = readLedger(cwd);
+  const local = read.ok ? localCheckRows(read.value.rows) : [];
+  const ciChecks = ci.flatMap((check) => check.state === "skipped" ? [] : [{ name: check.name, state: check.state }]);
+  return checkEvidence({ lane: lane.lane, head: status.head.sha, configured, local, ci: ciChecks });
+}
 function buildStatusDoc(cwd, resolved, status, options) {
   const { forge } = resolved;
   const reruns = rerunCounts(cwd, { repo: forge.repo, pr: status.number, head: status.head.sha });
@@ -80691,6 +80850,7 @@ function buildStatusDoc(cwd, resolved, status, options) {
       passing: status.checks.filter((check) => check.state === "passing").length,
       missingRequired: missing
     },
+    evidence: evidenceFor(cwd, status),
     reviews: { decision: status.reviewDecision, unresolvedThreads: status.threads },
     blockers: status.state === "open" ? blockers.map((blocker) => blocker.reason) : [],
     identity: options.identity ?? null,
@@ -80874,6 +81034,9 @@ var MAX_LOG_TAILS = 5, GITLAB_MERGEABLE, GITHUB_MERGEABLE, NO_CHECKS_GRACE_MS =
 var init_report2 = __esm(() => {
   init_rev();
   init_ledger();
+  init_check_config();
+  init_lane();
+  init_check_evidence();
   init_reruns();
   GITLAB_MERGEABLE = new Set(["mergeable"]);
   GITHUB_MERGEABLE = new Set(["clean", "unstable", "has_hooks"]);
@@ -86620,6 +86783,8 @@ function renderStatus(doc) {
     lines.push(`  - ${thread.path ? `${thread.path}${thread.line ? `:${thread.line}` : ""} ` : ""}@${thread.author ?? "?"}${thread.isBot ? " (bot)" : ""}: ${thread.body}`);
   if (doc.truncated)
     lines.push("(lists truncated at the page cap)");
+  if (doc.evidence)
+    lines.push(...evidenceLines(doc.evidence));
   if (doc.blockers.length)
     lines.push(`blockers: ${doc.blockers.join(", ")}`);
   if (doc.identity?.note)
@@ -86636,6 +86801,7 @@ var forgeDeps, MAX_REASON = 500, usage4 = (io, message, line) => emit(io, fail2(
   now: forgeDeps.now
 }), short = (sha) => sha ? sha.slice(0, 7) : "?";
 var init_forge_common = __esm(() => {
+  init_check_evidence();
   init_resolve();
   init_vcs_config();
   init_duration();
@@ -86652,10 +86818,124 @@ var init_forge_common = __esm(() => {
 // packages/workit-cli/src/verbs/pr.ts
 var exports_pr = {};
 __export(exports_pr, {
+  checkPrTitle: () => checkPrTitle,
   run: () => run15
 });
-import { readFileSync as readFileSync27 } from "node:fs";
+import { existsSync as existsSync26, readFileSync as readFileSync27 } from "node:fs";
 import path66 from "node:path";
+function titleRules(cwd) {
+  let root;
+  try {
+    root = checkRoot(cwd);
+  } catch {
+    return { rules: null, note: null };
+  }
+  let text = null;
+  let name = "";
+  for (const candidate of COMMITLINT_FILES) {
+    const full = path66.join(root, candidate);
+    if (!existsSync26(full))
+      continue;
+    text = readFileSync27(full, "utf8");
+    name = candidate;
+    break;
+  }
+  if (text === null) {
+    try {
+      const pkg = JSON.parse(readFileSync27(path66.join(root, "package.json"), "utf8"));
+      if (pkg.commitlint === undefined)
+        return { rules: null, note: null };
+      text = JSON.stringify(pkg.commitlint);
+    } catch {
+      return { rules: null, note: null };
+    }
+  }
+  if (/\.[cm]?[jt]s$/u.test(name))
+    return UNCHECKED("JS/TS");
+  let config;
+  try {
+    const parsed = JSON.parse(text);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+      return UNCHECKED("not a plain JSON object");
+    config = parsed;
+  } catch {
+    return UNCHECKED(/\.ya?ml$|^\.commitlintrc$/u.test(name) ? "YAML" : "unreadable");
+  }
+  if (config.ignores !== undefined)
+    return UNCHECKED("using custom ignores");
+  const extend = config.extends === undefined ? [] : [config.extends].flat();
+  const known = (entry) => typeof entry === "string" && /^(@commitlint\/)?config-conventional$/u.test(entry);
+  if (!extend.every(known))
+    return UNCHECKED("extending a shareable config");
+  const rules = {
+    types: null,
+    maxHeader: null,
+    format: 0,
+    defaultIgnores: config.defaultIgnores !== false
+  };
+  if (extend.length) {
+    rules.types = { level: 2, values: CONVENTIONAL_TYPES };
+    rules.maxHeader = { level: 2, value: 100 };
+    rules.format = 2;
+  }
+  const own = config.rules ?? {};
+  const types = readRule(own, "type-enum");
+  if (types === "off")
+    rules.types = null;
+  else if (types && Array.isArray(types.value))
+    rules.types = { level: types.level, values: types.value.map(String) };
+  const max = readRule(own, "header-max-length");
+  if (max === "off")
+    rules.maxHeader = null;
+  else if (max && typeof max.value === "number")
+    rules.maxHeader = { level: max.level, value: max.value };
+  for (const rule of ["type-empty", "subject-empty"]) {
+    const read = readRule(own, rule);
+    if (read === "off")
+      rules.format = 0;
+    else if (read)
+      rules.format = Math.max(rules.format, read.level);
+  }
+  return { rules, note: null };
+}
+function checkPrTitle(cwd, title) {
+  const { rules, note } = titleRules(cwd);
+  if (!rules)
+    return { error: null, notes: note ? [note] : [] };
+  const header = title.split(`
+`, 1)[0] ?? "";
+  if (rules.defaultIgnores && DEFAULT_IGNORES.some((pattern) => pattern.test(title)))
+    return { error: null, notes: [] };
+  const problems = [];
+  const parsed = /^(\w*)(?:\((.*)\))?!?: (.*)$/u.exec(header);
+  if (rules.format && (!parsed || !parsed[1] || !parsed[3]?.trim()))
+    problems.push({
+      level: rules.format,
+      message: `PR title ${JSON.stringify(header)} is not a Conventional Commit "<type>(<scope>): <subject>" (commitlint type-empty/subject-empty); the squash-merge title is the commit and CI lints it`
+    });
+  else if (parsed && rules.types && !rules.types.values.includes(parsed[1]))
+    problems.push({
+      level: rules.types.level,
+      message: `PR title type "${parsed[1]}" is not allowed (commitlint type-enum: ${rules.types.values.join(", ")})`
+    });
+  if (rules.maxHeader && header.length > rules.maxHeader.value)
+    problems.push({
+      level: rules.maxHeader.level,
+      message: `PR title is ${header.length} characters, over the ${rules.maxHeader.value} allowed (commitlint header-max-length); shorten it by ${header.length - rules.maxHeader.value}`
+    });
+  const refused = problems.filter((problem) => problem.level >= 2);
+  return {
+    error: refused.length ? refused.map((problem) => problem.message).join("; ") : null,
+    notes: problems.filter((problem) => problem.level < 2).map((p) => `warning: ${p.message}`)
+  };
+}
+function refuseTitle(io, title, line) {
+  const checked = checkPrTitle(io.cwd, title);
+  for (const note of checked.notes)
+    io.stderr(`${note}
+`);
+  return checked.error ? usage4(io, checked.error, line) : null;
+}
 function readBodyFile(io, file) {
   try {
     return {
@@ -86825,6 +87105,9 @@ async function create4(argv, io) {
   }
   if (!base)
     return usage4(io, "no default target branch is configured; pass --base <b>", CREATE_USAGE);
+  const given = flags.values.title ? refuseTitle(io, flags.values.title, CREATE_USAGE) : null;
+  if (given !== null)
+    return given;
   const connected = connect(io, branch);
   if (!connected.ok)
     return forgeFail(io, connected);
@@ -86836,6 +87119,11 @@ async function create4(argv, io) {
     title ||= filled.data.title;
     body ??= filled.data.body;
   }
+  if (!flags.values.title) {
+    const filled = refuseTitle(io, title, CREATE_USAGE);
+    if (filled !== null)
+      return filled;
+  }
   const forge = connected.data.forge;
   const planned = planIssueLinks(io.cwd, {
     issues: flags.lists.issue ?? [],
@@ -87054,6 +87342,11 @@ async function edit(argv, io) {
       return usage4(io, read, EDIT_USAGE);
     body = read.body;
   }
+  if (flags.values.title !== undefined) {
+    const edited = refuseTitle(io, flags.values.title, EDIT_USAGE);
+    if (edited !== null)
+      return edited;
+  }
   const connected = connect(io);
   if (!connected.ok)
     return forgeFail(io, connected);
@@ -87156,7 +87449,19 @@ async function run15(argv, io) {
     return reply(rest, io);
   return usage4(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", USAGE9);
 }
-var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--issue <#n|ID|url>]… [--refs] [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>] [--base-red-ok --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE9 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, NEED_TEXT, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : landed.lane === "none" && !landed.verdictId ? `merged at ${(landed.head ?? "?").slice(0, 12)} with no verdict (lane none)` : landed.review === "self-reviewed" ? `merged self-reviewed (lane self) with the author's verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, mergedOnLine = (verdict) => {
+var CONVENTIONAL_TYPES, COMMITLINT_FILES, DEFAULT_IGNORES, UNCHECKED = (what) => ({
+  rules: null,
+  note: `commitlint config is ${what}; title not pre-checked, CI checks it`
+}), readRule = (rules, name) => {
+  const rule = rules[name];
+  if (rule === undefined)
+    return null;
+  if (!Array.isArray(rule) || typeof rule[0] !== "number")
+    return "off";
+  if (rule[0] === 0 || rule[1] === "never")
+    return "off";
+  return { level: rule[0], value: rule[2] };
+}, STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--issue <#n|ID|url>]… [--refs] [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>] [--base-red-ok --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE9 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, NEED_TEXT, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : landed.lane === "none" && !landed.verdictId ? `merged at ${(landed.head ?? "?").slice(0, 12)} with no verdict (lane none)` : landed.review === "self-reviewed" ? `merged self-reviewed (lane self) with the author's verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, mergedOnLine = (verdict) => {
   if (verdict.review === "self-reviewed")
     return `self-reviewed (lane ${verdict.lane}): the author's verdict ${verdict.verdictId ?? "?"}; no independent verdict accepted for that head`;
   if (!verdict.verdictId)
@@ -87180,8 +87485,48 @@ var init_pr = __esm(() => {
   init_lane();
   init_pr_lane();
   init_vcs_config();
+  init_check_config();
   init_output();
   init_forge_common();
+  CONVENTIONAL_TYPES = [
+    "build",
+    "chore",
+    "ci",
+    "docs",
+    "feat",
+    "fix",
+    "perf",
+    "refactor",
+    "revert",
+    "style",
+    "test"
+  ];
+  COMMITLINT_FILES = [
+    ".commitlintrc.json",
+    ".commitlintrc",
+    ".commitlintrc.yaml",
+    ".commitlintrc.yml",
+    ".commitlintrc.js",
+    ".commitlintrc.cjs",
+    ".commitlintrc.mjs",
+    ".commitlintrc.ts",
+    "commitlint.config.js",
+    "commitlint.config.cjs",
+    "commitlint.config.mjs",
+    "commitlint.config.ts"
+  ];
+  DEFAULT_IGNORES = [
+    /^((Merge pull request)|(Merge (.*?) into (.*?)|(Merge branch (.*?)))(?:\r?\n)*$)/m,
+    /^(Merge tag (.*?))(?:\r?\n)*$/m,
+    /^(R|r)evert (.*)/,
+    /^(R|r)eapply (.*)/,
+    /^(amend|fixup|squash)!/,
+    /^(Merged (.*?)(in|into) (.*)|Merged PR (.*): (.*))/,
+    /^Merge remote-tracking branch(\s*)(.*)/,
+    /^Automatic merge(.*)/,
+    /^Auto-merged (.*?) into (.*)/,
+    /^(chore(\([^)]+\))?:\s*)?v?\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?\s*$/
+  ];
   NEED_TEXT = {
     none: "no verdict",
     self: "the author's own --self verdict (or an independent one)",
@@ -87638,10 +87983,10 @@ async function push(argv, io) {
   });
   if (typeof flags === "string")
     return usage4(io, flags, PUSH_USAGE);
-  const release = flags.lists.release;
+  const release = flags.lists.release?.flatMap((value) => value.split(",").map((name) => name.trim()).filter(Boolean));
   if (release) {
     if (flags.booleans.size || flags.values.expect !== undefined || flags.positionals.length)
-      return usage4(io, "--release takes only ref names (repeat it: --release main --release v1.2.0)", PUSH_USAGE);
+      return usage4(io, "--release takes only ref names (a comma list or a repeated flag: --release main,v1.2.0)", PUSH_USAGE);
     return releasePush(release, io);
   }
   if (flags.positionals.length)
@@ -87743,7 +88088,7 @@ async function run17(argv, io) {
     return trailers(rest, io);
   return usage4(io, sub && !sub.startsWith("-") ? `unknown git subcommand "${sub}"` : "missing git subcommand", USAGE10);
 }
-var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|release|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--trailer <key: value>]… [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…] [--json]", USAGE10 = "workit git branch|commit|push|trailers ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES, READ_ONLY;
+var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|release|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--trailer <key: value>]… [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>[,…]] [--json]", USAGE10 = "workit git branch|commit|push|trailers ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES, READ_ONLY;
 var init_git2 = __esm(() => {
   init_autonomy();
   init_branch();
@@ -90033,7 +90378,13 @@ async function run22(argv, io) {
       type: values.type,
       last: last ?? 50
     });
-    return emit(io, ok2({ path: ledger.value.path, skipped: ledger.value.skipped, rows: listed }), (data) => data.rows.length ? data.rows.map((row) => {
+    const note = values.type === "finding" && listed.length === 0 ? "findings are not ledger rows; they live in the task: workit finding list [--branch <b>] [--status open|resolved]" : undefined;
+    return emit(io, ok2({
+      path: ledger.value.path,
+      skipped: ledger.value.skipped,
+      rows: listed,
+      ...note ? { note } : {}
+    }), (data) => note ? note : data.rows.length ? data.rows.map((row) => {
       const line = summarizeRow(row);
       return `#${line.seq} ${line.at} ${line.type}${line.branch ? ` [${line.branch}]` : ""}${line.labels.length ? ` (${line.labels.join(", ")})` : ""}  ${line.summary}`;
     }) : "ledger is empty");
@@ -90105,6 +90456,16 @@ async function run22(argv, io) {
   const refusal = claimed === null ? null : sessionClaimRefusal(io.env, claimed, io.cwd, { token, flag: acting.source === "flag" });
   if (refusal)
     return emit(io, fail2("blocked", refusal.error, { unblock: refusal.unblock }));
+  const evidence = values.self !== true && (rest[0] === "verified" || rest[0] === "tests-verified") ? verdictCheckEvidence(io.cwd, target.value, values.base ?? null) : null;
+  const redCheck = evidence?.needed.find((item) => item.status === "failing");
+  if (redCheck)
+    return emit(io, fail2("blocked", `check_failing: the configured check "${redCheck.name}" is failing on ${evidence?.head.slice(0, 12)} (${redCheck.via ?? "local"} run); a ${rest[0]} verdict cannot be recorded`, {
+      unblock: `fix it, then workit check ${redCheck.name} on this head, or record failed/blocked`
+    }));
+  const missingChecks = evidence?.needed.filter((item) => item.status === "missing") ?? [];
+  if (missingChecks.length)
+    io.stderr(`warning: no fresh run on ${evidence?.head.slice(0, 12)} of the configured check${missingChecks.length === 1 ? "" : "s"} ${missingChecks.map((item) => item.name).join(", ")}; the verdict records it as missing
+`);
   const bound = claimed !== null && issuedTokenMatches(io.cwd, claimed, token);
   const verdict = await recorded(recordVerdict({ ...context, ...bound ? { sessionBound: true } : {} }, {
     result: rest[0],
@@ -90113,6 +90474,13 @@ async function run22(argv, io) {
     surface: values.surface ?? null,
     self: values.self === true,
     evidenceRefs: values.evidence,
+    ...evidence?.needed.length ? {
+      checkEvidence: evidence.needed.map(({ name, status, via }) => ({
+        name,
+        status,
+        via
+      }))
+    } : {},
     ..."derivedFrom" in acting ? { derivedFrom: acting.derivedFrom } : {}
   }));
   if (verdict.ok && verdict.value.selfReason === "flag" && !passedTestOn(io.cwd, verdict.value))
@@ -90129,6 +90497,13 @@ async function run22(argv, io) {
   ].join(`
 `));
 }
+function verdictCheckEvidence(cwd, branch, base) {
+  const head = branch === null ? headSha(cwd) : resolveRef(cwd, branch);
+  const ledger = readLedger(cwd);
+  if (!head || !ledger.ok)
+    return null;
+  return verdictEvidence(cwd, { head, base, rows: ledger.value.rows });
+}
 function standingFanout(io, values) {
   if (values.fanout !== undefined) {
     const name = values.fanout.trim();
@@ -90273,6 +90648,7 @@ var init_ledger2 = __esm(() => {
   init_fanout();
   init_rev();
   init_host_session();
+  init_check_evidence();
   init_implicit_task();
   init_output();
   OPTIONS = {
@@ -106153,7 +106529,7 @@ var init_rules = __esm(() => {
 
 // packages/workit-cli/src/test-audit/audit.ts
 import { spawnSync as spawnSync29 } from "node:child_process";
-import { existsSync as existsSync26, readdirSync as readdirSync14, readFileSync as readFileSync29, statSync as statSync10 } from "node:fs";
+import { existsSync as existsSync27, readdirSync as readdirSync14, readFileSync as readFileSync29, statSync as statSync10 } from "node:fs";
 import path71 from "node:path";
 function git7(cwd, args) {
   const run = spawnSync29("git", ["-c", "core.quotepath=off", ...args], {
@@ -106180,7 +106556,7 @@ function expandPaths(cwd, inputs) {
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
     const full = path71.resolve(cwd, input);
-    if (!existsSync26(full))
+    if (!existsSync27(full))
       missing.push(input);
     else if (statSync10(full).isDirectory())
       walkTests(full, files);
@@ -106296,7 +106672,7 @@ var init_audit = __esm(() => {
 // packages/workit-cli/src/test-audit/mutate.ts
 import { spawn as spawn2 } from "node:child_process";
 import {
-  existsSync as existsSync27,
+  existsSync as existsSync28,
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync12,
   mkdtempSync as mkdtempSync4,
@@ -106525,7 +106901,7 @@ function copyWorkingTree(repo) {
   }
   for (const parent of dirs) {
     const modules = path72.join(repo, parent, "node_modules");
-    if (existsSync27(modules) && !existsSync27(path72.join(tree, parent, "node_modules")))
+    if (existsSync28(modules) && !existsSync28(path72.join(tree, parent, "node_modules")))
       linkNodeModules(modules, path72.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
@@ -106575,7 +106951,7 @@ async function runMutation(options) {
     const relative = toPosix(path72.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
-    if (NOT_SOURCE.test(relative) || !existsSync27(absolute))
+    if (NOT_SOURCE.test(relative) || !existsSync28(absolute))
       continue;
     try {
       candidates.push(...mutantsFor(readFileSync30(absolute, "utf8"), relative, lines));
@@ -106765,7 +107141,7 @@ var exports_test_audit = {};
 __export(exports_test_audit, {
   run: () => run23
 });
-import { existsSync as existsSync28 } from "node:fs";
+import { existsSync as existsSync29 } from "node:fs";
 import path73 from "node:path";
 function parse8(argv) {
   const options = {
@@ -106889,7 +107265,7 @@ usage: ${USAGE16}`));
   }
   let files;
   if (options.diff && changed)
-    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync28(file)).toSorted();
+    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync29(file)).toSorted();
   else {
     const expanded = expandPaths(io.cwd, options.paths);
     if (expanded.missing.length > 0)
@@ -107337,7 +107713,11 @@ var FAMILY_ACTIONS = {
     explain: "Explain the policy in force"
   },
   evidence: { record: "Record evidence against a task's requirements" },
-  finding: { record: "Record a finding", resolve: "Resolve a finding" },
+  finding: {
+    record: "Record a finding",
+    resolve: "Resolve a finding",
+    list: "List findings with their ids [--branch <b>] [--status open|resolved]"
+  },
   decision: {
     record: "Record a task decision",
     revoke: "Revoke a task decision"
@@ -107384,7 +107764,7 @@ var familySubcommands = (name) => {
   const implicit = name === "task" ? TASK_IMPLICIT : [];
   const grammar = Object.entries(FAMILY_ACTIONS[name]).filter(([action]) => !implicit.some((entry) => entry.name === action)).map(([action, summary]) => ({
     name: action,
-    usage: name === "task" && action === "list" ? `workit task list [--status all] ${FAMILY_OPTIONS}` : name === "policy" && action !== "explain" ? `workit policy ${action} ${POLICY_JUDGE} ${FAMILY_OPTIONS}` : name === "worker" && action !== "assign" ? `workit worker ${action} [<workerId>] ${FAMILY_OPTIONS}` : `workit ${name} ${action} ${FAMILY_OPTIONS}`,
+    usage: name === "task" && action === "list" ? `workit task list [--status all] ${FAMILY_OPTIONS}` : name === "finding" && action === "list" ? "workit finding list [--branch <b>] [--status open|resolved] [--json]" : name === "policy" && action !== "explain" ? `workit policy ${action} ${POLICY_JUDGE} ${FAMILY_OPTIONS}` : name === "worker" && action !== "assign" ? `workit worker ${action} [<workerId>] ${FAMILY_OPTIONS}` : `workit ${name} ${action} ${FAMILY_OPTIONS}`,
     summary
   }));
   return [...implicit, ...grammar];
@@ -107699,7 +108079,7 @@ var VERBS = [
       {
         name: "push",
         deferredFlags: ["force"],
-        usage: "workit git push [-u|--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…]",
+        usage: "workit git push [-u|--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>[,…]]",
         summary: "Push the current branch and verify the remote tip (never a blind --force); --release finishes a git-flow release"
       },
       {
@@ -107869,7 +108249,7 @@ var VERBS = [
         name: "list",
         aliases: ["show"],
         usage: "workit ledger list|show [--branch <b>] [--pr <n>] [--type <t>] [--last <n>]",
-        summary: "List ledger rows, newest last"
+        summary: "List ledger rows, newest last (findings live in the task: workit finding list)"
       },
       {
         name: "check",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cli",
-  "version": "8.39.2",
+  "version": "8.39.4",
   "private": false,
   "description": "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
   "keywords": [
@@ -38,13 +38,13 @@
   },
   "dependencies": {
     "@babel/parser": "7.29.9",
-    "@brainervirus/workit-cursor": "^8.39.2",
+    "@brainervirus/workit-cursor": "^8.39.4",
     "@inkjs/ui": "2.0.0",
     "ink": "7.1.1",
     "react": "19.2.8"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.39.2"
+    "@brainervirus/workit-core": "^8.39.4"
   },
   "engines": {
     "node": ">=24"