@brainervirus/workit-codex 1.0.10 → 1.0.12

package/dist/workit-hook.js

@@ -7355,6 +7355,89 @@ var refSchema = discriminatedUnion("kind", [
   object({ kind: literal("host"), host: hostSchema, handle: nonEmpty }).strict(),
   object({ kind: literal("external"), url: text.url() }).strict()
 ]);
+var rewriteUnknown = (value, map) => {
+  if (Array.isArray(value)) {
+    const out = [];
+    for (const item of value) {
+      const rewritten = rewriteUnknown(item, map);
+      if (!rewritten.drop)
+        out.push(rewritten.value);
+    }
+    return { drop: false, value: out };
+  }
+  if (typeof value === "object" && value !== null) {
+    if (refSchema.safeParse(value).success) {
+      const mapped = map(value);
+      return mapped === null ? { drop: true } : { drop: false, value: mapped };
+    }
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+      const rewritten = rewriteUnknown(item, map);
+      out[key] = rewritten.drop ? null : rewritten.value;
+    }
+    return { drop: false, value: out };
+  }
+  return { drop: false, value };
+};
+var rewriteNode = (value, schema, map) => {
+  if (typeof value === "object" && value !== null && !Array.isArray(value) && refSchema.safeParse(value).success) {
+    const mapped = map(value);
+    return mapped === null ? { drop: true } : { drop: false, value: mapped };
+  }
+  let node = schema;
+  while (node instanceof ZodNullable || node instanceof ZodOptional || node instanceof ZodDefault) {
+    node = node.unwrap();
+  }
+  if (node === refSchema) {
+    if (!refSchema.safeParse(value).success)
+      return { drop: false, value };
+    const mapped = map(value);
+    return mapped === null ? { drop: true } : { drop: false, value: mapped };
+  }
+  if (node instanceof ZodArray) {
+    if (!Array.isArray(value))
+      return { drop: false, value };
+    const out = [];
+    for (const item of value) {
+      const rewritten = rewriteNode(item, node.element, map);
+      if (!rewritten.drop)
+        out.push(rewritten.value);
+    }
+    return { drop: false, value: out };
+  }
+  if (node instanceof ZodObject) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+      return { drop: false, value };
+    const shape = node.shape;
+    const record = value;
+    const out = {};
+    for (const [key, item] of Object.entries(record)) {
+      if (!(key in shape)) {
+        const scrubbed = rewriteUnknown(item, map);
+        out[key] = scrubbed.drop ? null : scrubbed.value;
+        continue;
+      }
+      const child = shape[key];
+      const rewritten = rewriteNode(item, child, map);
+      if (rewritten.drop) {
+        if (child instanceof ZodOptional || child instanceof ZodDefault)
+          continue;
+        if (child instanceof ZodNullable) {
+          out[key] = null;
+          continue;
+        }
+        return { drop: true };
+      }
+      out[key] = rewritten.value;
+    }
+    return { drop: false, value: out };
+  }
+  return { drop: false, value };
+};
+var rewriteRecordRefs = (value, schema, map) => {
+  const rewritten = rewriteNode(value, schema, map);
+  return rewritten.drop ? null : rewritten.value;
+};
 var provenanceSchema = object({
   kind: _enum(["host_observed", "agent_reported", "imported"]),
   host: hostSchema,
@@ -7574,10 +7657,11 @@ var decisionSchema = object({
     presented: text,
     approvedContent: text,
     displayed: text.optional(),
-    contentRefs: array(refSchema)
+    contentRefs: array(refSchema),
+    statedChoice: object({ ref: text, text }).strict().optional()
   }).strict(),
   digest,
-  response: _enum(["approved", "rejected"]),
+  response: _enum(["approved", "rejected", "stated"]),
   requirementIds: array(digest),
   revoked: object({ at: utc, reason: text }).strict().nullable(),
   consumption: object({
@@ -9004,11 +9088,11 @@ class TaskStore {
         return workspace;
       if (!workspace.data)
         return failure("not_found", "workspace not found");
-      const expectedTaskRevision = input.expectedTaskRevision ?? input.expectedRevision;
-      if (!expectedTaskRevision)
+      const expected = input.expectedRevision;
+      if (!expected)
         return failure("invalid_input", "task revision is required");
-      if (task.data.revision !== expectedTaskRevision)
-        return this.conflict(expectedTaskRevision, task.data.revision);
+      if (task.data.revision !== expected)
+        return this.conflict(expected, task.data.revision);
       if (workspace.data.revision !== input.expectedWorkspaceRevision)
         return this.conflict(input.expectedWorkspaceRevision, workspace.data.revision);
       const previousWorkspaceBytes = this.snapshotBytes(this.workspacePath);
@@ -9542,6 +9626,7 @@ var same = (left, right) => {
 };
 var UNCERTAIN_WORKER_STATES = ["dispatching", "running", "cancelling", "unknown"];
 var isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state);
+var workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state);
 var callerSession = (caller) => caller.session ?? { kind: "host", host: caller.host, handle: caller.actor };
 var validPath = (value) => typeof value === "string" && value.length > 0 && ![...value].some((char) => {
   const code = char.charCodeAt(0);
@@ -9603,6 +9688,36 @@ var trustedAuthority = (kind, provenance, expected, binding, caller) => {
   verifiedAuthorities.set(token, { kind, provenance, ...expected, ...binding, caller });
   return token;
 };
+var chainStepKey = (step) => step.kind === "commit" ? step.message : step.kind === "branch" ? `branch:${step.target}` : "pr";
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var normalizeChainSteps = (steps) => {
+  if (!Array.isArray(steps) || steps.length === 0 || steps.length > 32)
+    return null;
+  const normalized = [];
+  for (const step of steps) {
+    if (typeof step === "string") {
+      if (!step.trim())
+        return null;
+      normalized.push({ kind: "commit", message: step });
+      continue;
+    }
+    if (!isRecord(step))
+      return null;
+    if (typeof step.branch === "string" && step.branch.trim() && Object.keys(step).length === 1) {
+      normalized.push({ kind: "branch", target: step.branch });
+      continue;
+    }
+    if (step.pr === true && Object.keys(step).length === 1) {
+      normalized.push({ kind: "pr" });
+      continue;
+    }
+    return null;
+  }
+  const keys = normalized.map(chainStepKey);
+  if (new Set(keys).size !== keys.length)
+    return null;
+  return normalized;
+};
 var scopeEqual = (left, right) => canonicalJson(left) === canonicalJson(right);
 var parseSteps = (content) => {
   let value;
@@ -9614,7 +9729,10 @@ var parseSteps = (content) => {
   if (typeof value !== "object" || value === null || !("steps" in value))
     return [];
   const steps = value.steps;
-  return Array.isArray(steps) && steps.every((step) => typeof step === "string") ? steps : null;
+  if (!Array.isArray(steps))
+    return null;
+  const normalized = normalizeChainSteps(steps);
+  return normalized;
 };
 var decisionMatches = (entry, purpose, binding) => {
   const decision = entry.data;
@@ -9805,14 +9923,12 @@ var validateAction = (store, task, workspaceId, input, authority) => {
     return content;
   const requestedSteps = parseSteps(decision.binding.approvedContent);
   if (requestedSteps === null)
-    return failure("invalid_input", "bounded action steps must be a string array");
-  if (input.steps && canonicalJson(input.steps) !== canonicalJson(requestedSteps))
+    return failure("invalid_input", "bounded action steps must be a unique non-empty array");
+  if (input.steps && canonicalJson(input.steps) !== canonicalJson(requestedSteps.map(chainStepKey)))
     return failure("permission_denied", "bounded action steps do not match approved content");
-  if (requestedSteps.some((step) => !step || typeof step !== "string") || new Set(requestedSteps).size !== requestedSteps.length)
-    return failure("invalid_input", "bounded action steps must be unique and non-empty");
   const stored = task.actionProgress?.find((item) => item.decisionId === input.decisionId);
-  const workflow = stored ? { steps: stored.steps, completed: stored.completedSteps } : { steps: requestedSteps, completed: [] };
-  if (workflow.steps.length && requestedSteps.length && canonicalJson(workflow.steps) !== canonicalJson(requestedSteps))
+  const workflow = stored ? { steps: stored.steps, completed: stored.completedSteps } : { steps: requestedSteps.map(chainStepKey), completed: [] };
+  if (workflow.steps.length && requestedSteps.length && canonicalJson(workflow.steps) !== canonicalJson(requestedSteps.map(chainStepKey)))
     return failure("permission_denied", "bounded action scope changed");
   return success(null, null, { entry, workflow });
 };
@@ -10367,13 +10483,28 @@ function evaluateEvidence(task, candidate) {
   });
 }
 var scopeCovers2 = scopeCovers;
+var checkPin = (assignment, beforeCandidateId, candidateId) => {
+  const pin = assignment.candidateId ?? null;
+  if (pin === null)
+    return true;
+  return (beforeCandidateId ?? null) === pin || (candidateId ?? null) === pin;
+};
+var resolveBinding = (evidence, pin, currentCandidateId) => {
+  const bound = evidence.kind === "check" || evidence.kind === "review";
+  const fallback = bound ? pin ?? currentCandidateId : null;
+  return {
+    beforeCandidateId: evidence.beforeCandidateId ?? fallback,
+    candidateId: evidence.candidateId ?? fallback
+  };
+};
+var findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId === findingCandidateId);
 var applicableDecision2 = (task, workspace, requirement, checkoutRoot) => task.decisions.filter((entry) => entry.provenance.kind !== "imported").map((entry) => entry.data).filter((decision) => decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.binding.taskId === task.id && decision.binding.workspaceId === workspace.id && decision.requirementIds.includes(requirement.id) && decision.binding.scope && scopeCovers2(decision.binding.scope, requirement.scope) && decision.digest === decisionDigest(decision) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok : decision.binding.contentRefs.every((reference) => reference.kind !== "file")));
-var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && data.response === "approved" && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
-var evidenceMatchesRequirement = (kind, evidenceKind, dimension) => {
+var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && (data.response === "approved" || data.response === "stated") && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
+var evidenceMatchesRequirement = (kind, evidenceKind, dimension, ruleId) => {
   if (kind !== "passed")
     return false;
   if (dimension === "testing" || dimension === "verification")
-    return evidenceKind === "check";
+    return evidenceKind === "check" || ruleId === "pre-pr-cleanup" && evidenceKind === "artifact";
   if (dimension === "review")
     return evidenceKind === "review";
   if (dimension === "investigation" || dimension === "challenge")
@@ -10382,6 +10513,21 @@ var evidenceMatchesRequirement = (kind, evidenceKind, dimension) => {
     return evidenceKind === "artifact";
   return false;
 };
+var expectedKinds = (dimension, ruleId) => {
+  if (dimension === "testing")
+    return "check";
+  if (dimension === "verification")
+    return ruleId === "pre-pr-cleanup" ? "check or artifact" : "check";
+  if (dimension === "review")
+    return "review";
+  if (dimension === "investigation" || dimension === "challenge")
+    return "investigation";
+  if (dimension === "artifacts" || dimension === "continuity")
+    return "artifact";
+  if (dimension === "decisions")
+    return "decision";
+  return "worker report";
+};
 function evaluateRequirements(task, workspace, capabilities, candidate, checkoutRoot, _caller) {
   const evidence = evaluateEvidence(task, candidate);
   if (task.policy && task.policy.policyVersion !== POLICY_VERSION)
@@ -10395,7 +10541,7 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
   return (task.policy?.requirements ?? []).map((requirement) => {
     const related = task.evidence.map((entry, index) => ({ entry, evaluation: evidence[index] })).filter(({ entry }) => entry.data.requirementIds.includes(requirement.id));
     const passed = related.filter(({ entry, evaluation }) => {
-      if (!evidenceMatchesRequirement(evaluation.status, entry.data.kind, requirement.dimension))
+      if (!evidenceMatchesRequirement(evaluation.status, entry.data.kind, requirement.dimension, requirement.ruleId))
         return false;
       if ((entry.data.kind === "check" || entry.data.kind === "review") && (!entry.data.beforeCandidateId || !entry.data.candidateId || entry.data.beforeCandidateId !== entry.data.candidateId))
         return false;
@@ -10403,11 +10549,12 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
         return true;
       const reviewSession = sessionFromRef(entry.data.reviewContext);
       const sameImplementation = sameSession(reviewSession, task.intent.provenance.session);
-      const sameEvidenceSession = task.evidence.some((other) => other.id !== entry.id && other.data.kind === "review" && sameSession(reviewSession, other.provenance.session));
+      const sameEvidenceSession = related.some(({ entry: other }) => other.id !== entry.id && other.data.kind === "review" && other.data.candidateId !== null && other.data.candidateId === entry.data.candidateId && sameSession(reviewSession, other.provenance.session));
       return entry.data.kind === "review" && reviewSession !== null && sameSession(reviewSession, entry.provenance.session) && (requirement.ruleId === "self-review" || !sameImplementation && !sameEvidenceSession);
     });
     if (passed.length) {
-      const withRed = requirement.dimension === "testing" ? passed.filter(({ entry }) => related.some((other) => other.entry.data.kind === "check" && other.evaluation.status === "failed" && other.entry.data.requirementIds.includes(requirement.id) && other.entry.recordedAt <= entry.recordedAt)) : passed;
+      const currentId = candidate?.id ?? null;
+      const withRed = requirement.dimension === "testing" ? passed.filter(({ entry }) => related.some((other) => other.entry.data.kind === "check" && other.evaluation.status === "failed" && other.entry.data.requirementIds.includes(requirement.id) && other.entry.recordedAt <= entry.recordedAt) || related.some((baseline) => baseline.entry.id !== entry.id && baseline.entry.data.kind === "check" && baseline.entry.data.result === "passed" && baseline.entry.data.candidateId !== null && currentId !== null && baseline.entry.data.candidateId !== currentId)) : passed;
       if (withRed.length)
         return {
           requirementId: requirement.id,
@@ -10444,7 +10591,7 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
         status: "satisfied",
         evidenceIds: [],
         decisionIds: decisions.map((decision) => decision.id),
-        reason: "an applicable approved decision satisfies the requirement"
+        reason: "an applicable approved or stated decision satisfies the requirement"
       };
     const limitations = requirement.acceptanceAllowed ? applicableDecision2(task, workspace, requirement, checkoutRoot) : [];
     if (limitations.length)
@@ -10456,6 +10603,14 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
         reason: "an applicable approved limitation permits the missing evidence"
       };
     const unavailable = capabilities.some((capability) => capability.assurance === "unavailable" && (capability.name === requirement.dimension || capability.surface === requirement.dimension));
+    if (!unavailable && related.length > 0 && !passed.length)
+      return {
+        requirementId: requirement.id,
+        status: "unsatisfied",
+        evidenceIds: related.map(({ entry }) => entry.id),
+        decisionIds: [],
+        reason: `no passing evidence (needs kind:${expectedKinds(requirement.dimension, requirement.ruleId)})`
+      };
     return {
       requirementId: requirement.id,
       status: unavailable ? "unavailable" : "unsatisfied",
@@ -10480,7 +10635,13 @@ function evaluateClosure(requestedOutcome, view) {
       if (entry.data.disposition === "fixed") {
         const verified = entry.data.resolution?.evidenceIds.some((id) => {
           const evidence = view.task.evidence.find((item) => item.id === id);
-          return evidenceById.get(id) === "passed" && (evidence?.data.kind === "check" || evidence?.data.kind === "review");
+          if (!evidence)
+            return false;
+          return findingVerificationPasses(entry.data.candidateId, {
+            kind: evidence.data.kind,
+            candidateId: evidence.data.candidateId,
+            status: evidenceById.get(id) ?? "missing"
+          });
         });
         if (!verified)
           return failure("requirements_unsatisfied", "fixed findings require current verification");
@@ -10496,7 +10657,12 @@ function evaluateClosure(requestedOutcome, view) {
       }
     }
   }
-  const blocking = evaluations.filter((item) => item.status === "unsatisfied" || item.status === "unavailable");
+  const blocking = evaluations.filter((item) => {
+    if (item.status !== "unsatisfied" && item.status !== "unavailable")
+      return false;
+    const requirement = view.task.policy?.requirements.find((candidate) => candidate.id === item.requirementId);
+    return !requirement || requirement.before === "close";
+  });
   if (requestedOutcome !== "stopped" && blocking.length)
     return failure("requirements_unsatisfied", "applicable requirements are unsatisfied", {
       requirementIds: blocking.map((item) => item.requirementId),
@@ -10539,15 +10705,15 @@ function evaluateClosure(requestedOutcome, view) {
 // packages/workit-core/src/core/methods.ts
 var METHODS = {
   "workit-challenge": { dimensions: ["challenge", "decisions"] },
-  "workit-behavioral-tdd": { dimensions: ["testing"] },
-  "workit-review": { dimensions: ["review"], ruleIds: ["fresh-context-review"] },
+  "workit-behavioral-tdd": { dimensions: ["testing"], ruleIds: ["mechanical-existing-checks"] },
+  "workit-review": { dimensions: ["review"], ruleIds: ["fresh-context-review", "self-review"] },
   "workit-plan": { dimensions: ["artifacts", "continuity"] },
   "workit-implement": { dimensions: ["delegation"] },
-  "workit-debug": { ruleIds: ["root-cause-investigation"] },
-  "workit-handoff": { ruleIds: ["durable-handoff"] },
+  "workit-debug": {},
+  "workit-handoff": {},
   "workit-deslop": { ruleIds: ["pre-pr-cleanup"] }
 };
-var methodMatches = (id, definition, requirement) => definition.dimensions?.includes(requirement.dimension) === true && !(id === "workit-review" && requirement.ruleId === "self-review") || definition.ruleIds?.includes(requirement.ruleId) === true;
+var methodMatches = (definition, requirement) => definition.dimensions?.includes(requirement.dimension) === true || definition.ruleIds?.includes(requirement.ruleId) === true;
 var assuranceFor = (id, definition, capabilities) => {
   const keys = new Set([
     id,
@@ -10568,7 +10734,7 @@ var assuranceFor = (id, definition, capabilities) => {
 };
 function selectMethods(policy, capabilities) {
   return Object.entries(METHODS).flatMap(([id, definition]) => {
-    const requirements = policy.requirements.filter((requirement) => methodMatches(id, definition, requirement));
+    const requirements = policy.requirements.filter((requirement) => methodMatches(definition, requirement));
     if (requirements.length === 0)
       return [];
     const capability = assuranceFor(id, definition, capabilities);
@@ -10777,6 +10943,44 @@ function shellRouteIntent(command) {
   }
   return null;
 }
+function hasLiveWorkitTask(dir) {
+  try {
+    if (typeof dir !== "string" || dir === "")
+      return false;
+    const listed = new TaskStore(dir).listTasks();
+    if (!listed.ok)
+      return false;
+    return listed.data.some((task) => task.status === "active" || task.status === "paused");
+  } catch {
+    return false;
+  }
+}
+function shouldDenyShellRoute(dir, command) {
+  if (!hasLiveWorkitTask(dir))
+    return null;
+  return shellRouteIntent(command);
+}
+// packages/workit-core/src/core/config.ts
+var PRESETS = {
+  gitflow: {
+    allowed: ["feature/*", "bugfix/*", "hotfix/*", "release/*"],
+    protected: ["main", "develop", "master", "prod", "production"]
+  },
+  "github-flow": { allowed: ["*"], protected: ["main"] },
+  "trunk-based": { allowed: ["*"], protected: ["main"] },
+  custom: { allowed: [], protected: [] }
+};
+var DEFAULTS = {
+  locale: "en",
+  localeOptions: ["en", "es-CL", "es-MX", "es-AR", "pt-BR"],
+  timezone: "America/Santiago",
+  branchPolicy: {
+    preset: "gitflow",
+    allowed: [...PRESETS.gitflow.allowed],
+    protected: [...PRESETS.gitflow.protected]
+  },
+  commitPolicy: { preset: "conventional" }
+};
 // packages/workit-core/src/core/external-action.ts
 var externalActionSchema = discriminatedUnion("operation", [
   object({
@@ -11314,6 +11518,8 @@ var applyWorkerLifecycle = (input) => {
   if (task.data.status === "paused" && (input.state === "running" || input.state === "cancelling"))
     return failure("invalid_transition", "paused task cannot run a worker");
   const notStarted = input.dispatch === true;
+  if (notStarted && entry.data.state === "stopped" && input.session === null)
+    return success(task.data.revision, workspace.data.revision, entry);
   if (notStarted && (input.state !== "stopped" || input.session !== null))
     return failure("invalid_input", "a never-dispatched worker stops with no session");
   if (notStarted && entry.data.session !== null)
@@ -11345,7 +11551,7 @@ var applyWorkerLifecycle = (input) => {
     return success(task.data.revision, workspace.data.revision, entry);
   const changed = input.store.mutateTaskAndWorkspace({
     taskId: task.data.id,
-    expectedTaskRevision: input.expectedRevision,
+    expectedRevision: input.expectedRevision,
     expectedWorkspaceRevision: input.expectedWorkspaceRevision,
     now: input.now,
     workspace: (current, mutation) => success(mutation.revision, mutation.revision, {
@@ -11393,90 +11599,22 @@ var importedProvenance = (context) => ({
   receipts: []
 });
 var portableTask = (task) => {
-  const clone = structuredClone(task);
-  const portableProvenance = (value) => ({
-    ...value,
-    session: null,
-    receipts: []
-  });
-  const entries = [
-    clone.intent,
-    ...clone.assessments,
-    ...clone.evidence,
-    ...clone.decisions,
-    ...clone.findings,
-    ...clone.workers
-  ];
-  for (const entry of entries)
-    entry.provenance = portableProvenance(entry.provenance);
-  for (const worker of clone.workers)
-    worker.data.session = null;
-  clone.intent = {
-    ...clone.intent,
-    data: { ...clone.intent.data, authorityRefs: portableRefs(clone.intent.data.authorityRefs) }
-  };
-  clone.constraints = clone.constraints.flatMap((constraint) => {
-    const source = portableRef(constraint.source);
-    return source ? [
-      {
-        ...constraint,
-        source,
-        requires: constraint.requires.map((requirement) => ({
-          ...requirement,
-          refs: portableRefs(requirement.refs)
-        }))
-      }
-    ] : [];
-  });
-  clone.assessments = clone.assessments.map((entry) => ({
-    ...entry,
-    data: {
-      ...entry.data,
-      facts: entry.data.facts.map(portableFact),
-      signals: Object.fromEntries(Object.entries(entry.data.signals).map(([name, signal]) => [name, portableSignal(signal)])),
-      consequences: entry.data.consequences.map((consequence) => ({
-        ...consequence,
-        fact: portableFact(consequence.fact)
-      })),
-      verification: entry.data.verification.map((verification) => ({
-        ...verification,
-        availableChecks: portableRefs(verification.availableChecks)
-      }))
-    }
-  }));
-  clone.progress = {
-    ...clone.progress,
-    blockers: clone.progress.blockers.map((blocker) => ({
-      ...blocker,
-      refs: portableRefs(blocker.refs)
-    }))
+  const stripped = rewriteRecordRefs(task, taskRecordSchema, portableRef);
+  if (typeof stripped !== "object" || stripped === null || Array.isArray(stripped))
+    throw new TypeError("portable task rewrite produced a non-record");
+  const clone = structuredClone(stripped);
+  const demote = (facts, signals, consequences) => {
+    for (const fact of facts)
+      Object.assign(fact, portableFact(fact));
+    for (const name of Object.keys(signals)) {
+      const signal = signals[name];
+      Object.assign(signal, portableSignal(signal));
+    }
+    for (const consequence of consequences)
+      Object.assign(consequence.fact, portableFact(consequence.fact));
   };
-  clone.evidence = clone.evidence.map((entry) => ({
-    ...entry,
-    data: {
-      ...entry.data,
-      refs: portableRefs(entry.data.refs),
-      reviewContext: portableRef(entry.data.reviewContext)
-    }
-  }));
-  clone.decisions = clone.decisions.map((entry) => ({
-    ...entry,
-    data: {
-      ...entry.data,
-      consumption: entry.data.consumption ? portableRef(entry.data.consumption.actionRef) ? {
-        ...entry.data.consumption,
-        actionRef: portableRef(entry.data.consumption.actionRef)
-      } : null : null,
-      binding: {
-        ...entry.data.binding,
-        contentRefs: portableRefs(entry.data.binding.contentRefs)
-      }
-    }
-  }));
-  clone.findings = clone.findings.map((entry) => ({
-    ...entry,
-    data: { ...entry.data, refs: portableRefs(entry.data.refs) }
-  }));
+  for (const entry of clone.assessments)
+    demote(entry.data.facts, entry.data.signals, entry.data.consequences);
   clone.candidates = [];
   return clone;
 };
@@ -11501,15 +11639,13 @@ var importedTask = (source, bundle, destinationWorkspaceId, context, timestamp)
     allocate(entry.id);
   const fresh = (id) => allocate(id);
   const provenance = importedProvenance(context);
+  const remap = (ref) => mapRef(ref, ids);
   const intent = {
     ...source.intent,
     id: fresh(source.intent.id),
     recordedAt: timestamp,
     provenance,
-    data: {
-      ...source.intent.data,
-      authorityRefs: source.intent.data.authorityRefs.map((ref) => mapRef(ref, ids))
-    }
+    data: rewriteRecordRefs(source.intent.data, intentSchema, remap)
   };
   const assessments = source.assessments.map((entry) => {
     const data = entry.data;
@@ -11518,28 +11654,7 @@ var importedTask = (source, bundle, destinationWorkspaceId, context, timestamp)
       id: fresh(entry.id),
       recordedAt: timestamp,
       provenance,
-      data: {
-        ...data,
-        facts: data.facts.map((fact) => ({
-          ...fact,
-          refs: fact.refs.map((ref) => mapRef(ref, ids))
-        })),
-        signals: Object.fromEntries(Object.entries(data.signals).map(([name, signal]) => [
-          name,
-          { ...signal, refs: signal.refs.map((ref) => mapRef(ref, ids)) }
-        ])),
-        consequences: data.consequences.map((consequence) => ({
-          ...consequence,
-          fact: {
-            ...consequence.fact,
-            refs: consequence.fact.refs.map((ref) => mapRef(ref, ids))
-          }
-        })),
-        verification: data.verification.map((verification) => ({
-          ...verification,
-          availableChecks: verification.availableChecks.map((ref) => mapRef(ref, ids))
-        }))
-      }
+      data: rewriteRecordRefs(data, assessmentSchema, remap)
     };
   });
   const evidence = source.evidence.map((entry) => ({
@@ -11547,11 +11662,7 @@ var importedTask = (source, bundle, destinationWorkspaceId, context, timestamp)
     id: fresh(entry.id),
     recordedAt: timestamp,
     provenance,
-    data: {
-      ...entry.data,
-      refs: entry.data.refs.map((ref) => mapRef(ref, ids)),
-      reviewContext: entry.data.reviewContext ? mapRef(entry.data.reviewContext, ids) : null
-    }
+    data: rewriteRecordRefs(entry.data, evidenceSchema, remap)
   }));
   const decisions = source.decisions.map((entry) => ({
     ...entry,
@@ -11559,21 +11670,23 @@ var importedTask = (source, bundle, destinationWorkspaceId, context, timestamp)
     recordedAt: timestamp,
     provenance
   }));
-  const findings = source.findings.map((entry) => ({
-    ...entry,
-    id: fresh(entry.id),
-    recordedAt: timestamp,
-    provenance,
-    data: {
-      ...entry.data,
-      refs: entry.data.refs.map((ref) => mapRef(ref, ids)),
-      resolution: entry.data.resolution ? {
-        ...entry.data.resolution,
-        evidenceIds: entry.data.resolution.evidenceIds.map((id) => ids.get(id) ?? id),
-        decisionIds: entry.data.resolution.decisionIds.map((id) => ids.get(id) ?? id)
-      } : null
-    }
-  }));
+  const findings = source.findings.map((entry) => {
+    const data = rewriteRecordRefs(entry.data, findingSchema, remap);
+    return {
+      ...entry,
+      id: fresh(entry.id),
+      recordedAt: timestamp,
+      provenance,
+      data: {
+        ...data,
+        resolution: data.resolution ? {
+          ...data.resolution,
+          evidenceIds: data.resolution.evidenceIds.map((id) => ids.get(id) ?? id),
+          decisionIds: data.resolution.decisionIds.map((id) => ids.get(id) ?? id)
+        } : null
+      }
+    };
+  });
   const workers = source.workers.map((entry) => ({
     ...entry,
     id: fresh(entry.id),
@@ -11616,19 +11729,21 @@ var importedTask = (source, bundle, destinationWorkspaceId, context, timestamp)
     closure: null,
     assessments,
     evidence,
-    decisions: decisions.map((entry) => ({
-      ...entry,
-      data: {
-        ...entry.data,
-        binding: {
-          ...entry.data.binding,
-          taskId: "",
-          workspaceId: destinationWorkspaceId,
-          contentRefs: entry.data.binding.contentRefs.map((ref) => mapRef(ref, ids))
-        },
-        consumption: null
-      }
-    })),
+    decisions: decisions.map((entry) => {
+      const data = rewriteRecordRefs(entry.data, decisionSchema, remap);
+      return {
+        ...entry,
+        data: {
+          ...data,
+          binding: {
+            ...data.binding,
+            taskId: "",
+            workspaceId: destinationWorkspaceId
+          },
+          consumption: null
+        }
+      };
+    }),
     ...actionProgress ? { actionProgress } : {},
     findings,
     workers,
@@ -11711,7 +11826,7 @@ class WorkitCore {
   activeWorkerBlocker(task, workspace) {
     if (workspace.writer)
       return failure("recovery_required", "writer ownership must be released first");
-    if (task.workers.some((entry) => isUncertainWorker(entry.data.state)))
+    if (task.workers.some((entry) => workerBlocksTransition("close", entry.data.state)))
       return failure("recovery_required", "worker state requires reconciliation");
     return null;
   }
@@ -11957,37 +12072,33 @@ class WorkitCore {
     const currentCandidate = captureCandidate(this.store.root, task.data.intent.data.scope, environment());
     if (!currentCandidate.ok)
       return currentCandidate;
-    if (evidence.kind === "check" || evidence.kind === "review") {
-      evidence.beforeCandidateId ??= currentCandidate.data.id;
-      evidence.candidateId ??= currentCandidate.data.id;
-    } else {
-      evidence.beforeCandidateId ??= null;
-      evidence.candidateId ??= null;
-    }
+    const pin = helper && helper.ok ? helper.data.data.assignment.candidateId : null;
+    const bound = resolveBinding(evidence, pin, currentCandidate.data.id);
     if (helper?.ok) {
       const assignment = helper.data.data.assignment;
-      if (evidence.requirementIds.some((id) => !assignment.requirementIds.includes(id)) || assignment.candidateId !== null && evidence.candidateId !== assignment.candidateId && evidence.beforeCandidateId !== assignment.candidateId || !refsWithinScope(evidence.refs, assignment.scope) || !refsWithinScope(evidence.refs, task.data.intent.data.scope))
+      if (evidence.requirementIds.some((id) => !assignment.requirementIds.includes(id)) || !checkPin(assignment, bound.beforeCandidateId, bound.candidateId) || !refsWithinScope(evidence.refs, assignment.scope) || !refsWithinScope(evidence.refs, task.data.intent.data.scope))
         return failure("permission_denied", "evidence is outside the worker assignment");
     }
     const knownCandidates = new Set(task.data.candidates.map((candidate) => candidate.id));
-    for (const candidateId of [evidence.beforeCandidateId, evidence.candidateId]) {
+    for (const candidateId of [bound.beforeCandidateId, bound.candidateId]) {
       if (candidateId && candidateId !== currentCandidate.data.id && !knownCandidates.has(candidateId))
         return failure("invalid_input", "evidence candidate is not a captured candidate");
     }
+    const boundEvidence = { ...evidence, ...bound };
     const changed = this.store.mutateTask(task.data.id, input.expectedRevision, (current, mutation) => {
       const candidates = current.candidates.some((item) => item.id === currentCandidate.data.id) ? current.candidates : [...current.candidates, currentCandidate.data];
       const entry = {
         id: newId(),
         recordedAt: mutation.now,
         provenance: provenance(this.context, "agent_reported"),
-        data: evidence
+        data: boundEvidence
       };
       return success(mutation.revision, null, {
         ...current,
         candidates,
         evidence: [...current.evidence, entry],
         findings: current.findings.map((finding) => {
-          if (finding.data.disposition === "open" || evidence.result === "skipped")
+          if (finding.data.disposition === "open" || boundEvidence.result === "skipped")
             return finding;
           if (finding.data.disposition !== "fixed")
             return finding;
@@ -11996,8 +12107,12 @@ class WorkitCore {
             item.evidenceId,
             item.status
           ]));
-          const verified = withEntry.evidence.some((item) => statuses.get(item.id) === "passed" && (item.data.kind === "check" || item.data.kind === "review") && (finding.data.candidateId === null || item.data.candidateId === finding.data.candidateId));
-          const contradicted = evidence.result === "failed" && finding.data.refs.some((left) => evidence.refs.some((right) => JSON.stringify(left) === JSON.stringify(right)));
+          const verified = withEntry.evidence.some((item) => findingVerificationPasses(finding.data.candidateId, {
+            kind: item.data.kind,
+            candidateId: item.data.candidateId,
+            status: statuses.get(item.id) ?? "missing"
+          }));
+          const contradicted = boundEvidence.result === "failed" && finding.data.refs.some((left) => boundEvidence.refs.some((right) => sameValue(left, right)));
           return verified && !contradicted ? finding : { ...finding, data: { ...finding.data, disposition: "open", resolution: null } };
         })
       });
@@ -12022,7 +12137,12 @@ class WorkitCore {
     const input = parsed.data;
     if (nativeRequired && input.action !== "record")
       return failure("permission_denied", "native observation is only valid for recording decisions");
-    if (nativeRequired && nativeObservation === undefined)
+    const stated = input.action === "record" && input.response === "stated";
+    if (stated && input.purpose === "action")
+      return failure("permission_denied", "stated choices cannot authorize mutating actions");
+    if (stated && !input.binding?.statedChoice)
+      return failure("invalid_input", "stated choices require binding.statedChoice");
+    if (nativeRequired && nativeObservation === undefined && !stated)
       return failure("permission_denied", "native decision observation is required");
     const task = this.store.readTask(input.taskId);
     if (!task.ok)
@@ -12055,7 +12175,7 @@ class WorkitCore {
         consumption: null
       };
       const data = { ...base, digest: decisionDigest(base) };
-      const native = nativeRequired ? verifyNativeDecision(this.context.nativeAuthority, {
+      const native = nativeRequired && !stated ? verifyNativeDecision(this.context.nativeAuthority, {
         observation: nativeObservation,
         expected: {
           taskId: task.data.id,
@@ -12150,7 +12270,7 @@ class WorkitCore {
     if (input.action === "record") {
       if (helper?.ok) {
         const assignment = helper.data.data.assignment;
-        if (!bindingCovers(assignment.scope, input.scope) || !bindingCovers(task.data.intent.data.scope, input.scope) || assignment.candidateId !== null && input.candidateId !== assignment.candidateId || !refsWithinScope(input.refs, assignment.scope) || !refsWithinScope(input.refs, task.data.intent.data.scope))
+        if (!bindingCovers(assignment.scope, input.scope) || !bindingCovers(task.data.intent.data.scope, input.scope) || !checkPin(assignment, null, input.candidateId ?? null) || !refsWithinScope(input.refs, assignment.scope) || !refsWithinScope(input.refs, task.data.intent.data.scope))
           return failure("permission_denied", "finding is outside the worker assignment");
       }
       if (input.candidateId && !task.data.candidates.some((candidate) => candidate.id === input.candidateId))
@@ -12197,7 +12317,11 @@ class WorkitCore {
       const evaluations = evaluateEvidence(task.data, current.data);
       const verified = evidence.some((entry) => {
         const evaluation = evaluations.find((item) => item.evidenceId === entry.id);
-        return evaluation?.status === "passed" && (entry.data.kind === "check" || entry.data.kind === "review") && (finding.data.candidateId === null || entry.data.candidateId === finding.data.candidateId);
+        return findingVerificationPasses(finding.data.candidateId, {
+          kind: entry.data.kind,
+          candidateId: entry.data.candidateId,
+          status: evaluation?.status ?? "missing"
+        });
       });
       if (!verified)
         return failure("permission_denied", "fixed findings require passing verification evidence");
@@ -12209,7 +12333,7 @@ class WorkitCore {
         if (entry.data.result === "missing" || entry.data.result === "skipped")
           return false;
         const candidateMatches = finding.data.candidateId === null ? entry.data.candidateId === null : entry.data.candidateId === finding.data.candidateId || entry.data.beforeCandidateId === finding.data.candidateId;
-        const referenceMatches = finding.data.refs.some((left) => entry.data.refs.some((right) => JSON.stringify(left) === JSON.stringify(right)));
+        const referenceMatches = finding.data.refs.some((left) => entry.data.refs.some((right) => sameValue(left, right)));
         return candidateMatches && (referenceMatches || entry.data.claim === finding.data.claim);
       });
       if (!relevant)
@@ -12287,7 +12411,7 @@ class WorkitCore {
       const workerId = newId();
       const changed = this.store.mutateTaskAndWorkspace({
         taskId: task.data.id,
-        expectedTaskRevision: input.expectedRevision,
+        expectedRevision: input.expectedRevision,
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         now: trustedNow(this.context),
         workspace: (current, mutation) => success(mutation.revision, mutation.revision, current),
@@ -12325,7 +12449,7 @@ class WorkitCore {
         return failure("permission_denied", "worker report is outside the worker assignment");
       const changed = this.store.mutateTaskAndWorkspace({
         taskId: task.data.id,
-        expectedTaskRevision: input.expectedRevision,
+        expectedRevision: input.expectedRevision,
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         now: trustedNow(this.context),
         workspace: (current, mutation) => success(mutation.revision, mutation.revision, current),
@@ -12349,24 +12473,25 @@ class WorkitCore {
       return failure("invalid_transition", "closed task cannot cancel workers");
     if (entry.data.state === "unknown")
       return failure("recovery_required", "worker state requires recovery");
-    if (entry.data.state === "stopped")
-      return failure("invalid_transition", "stopped worker cannot be cancelled");
-    const settles = entry.data.report !== null || entry.data.state === "cancelling";
+    if (entry.data.state === "stopped") {
+      const stopped = task.data.workers.find((candidate) => candidate.id === input.workerId);
+      return success(task.data.revision, workspace.data.revision, stopped);
+    }
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
-      workspace: (current, mutation) => success(mutation.revision, mutation.revision, current),
+      workspace: (current, mutation) => success(mutation.revision, mutation.revision, {
+        ...current,
+        writer: current.writer?.owner.workerId === input.workerId ? null : current.writer
+      }),
       task: (current, mutation) => success(mutation.revision, null, {
         ...current,
         workers: current.workers.map((candidate) => candidate.id === input.workerId ? {
           ...candidate,
           recordedAt: mutation.now,
-          data: {
-            ...candidate.data,
-            state: settles ? "stopped" : "cancelling"
-          }
+          data: { ...candidate.data, state: "stopped" }
         } : candidate)
       })
     });
@@ -12463,7 +12588,7 @@ class WorkitCore {
       return attested;
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (current, mutation) => success(mutation.revision, mutation.revision, current),
@@ -12629,6 +12754,12 @@ class WorkitCore {
         if (!sameSession2(helper.data.data.session, this.context))
           return failure("permission_denied", "worker session does not match the caller");
       }
+      const gate = this.view(task.data);
+      if (gate.ok) {
+        const writeGates = (task.data.policy?.requirements ?? []).filter((requirement) => requirement.before === "write" && gate.data.requirements.some((evaluation) => evaluation.requirementId === requirement.id && (evaluation.status === "unsatisfied" || evaluation.status === "unavailable")));
+        if (writeGates.length)
+          return failure("requirements_unsatisfied", "writer ownership is gated by unsatisfied requirements; record their evidence or an approved limitation waiver first", { requirementIds: writeGates.map((requirement) => requirement.id) });
+      }
       const owner = {
         taskId: task.data.id,
         workerId: helperId,
@@ -12640,7 +12771,7 @@ class WorkitCore {
       };
       const changed = this.store.mutateTaskAndWorkspace({
         taskId: task.data.id,
-        expectedTaskRevision: input.expectedRevision,
+        expectedRevision: input.expectedRevision,
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         now: trustedNow(this.context),
         workspace: (current, mutation) => success(mutation.revision, mutation.revision, {
@@ -12671,7 +12802,7 @@ class WorkitCore {
     }
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (currentWorkspace, mutation) => success(mutation.revision, mutation.revision, { ...currentWorkspace, writer: null }),
@@ -12920,7 +13051,15 @@ class WorkitCore {
       if (seen.has(observation.workerId))
         return failure("invalid_input", "worker observations must be unique");
       seen.add(observation.workerId);
-      if (observation.taskId !== view.task.id || observation.expectedRevision !== view.task.revision || observation.expectedWorkspaceRevision !== view.workspace.revision)
+      const freshTask = this.store.readTask(view.task.id);
+      const freshWorkspace = this.store.readWorkspace();
+      if (!freshTask.ok)
+        return freshTask;
+      if (!freshWorkspace.ok)
+        return freshWorkspace;
+      if (!freshWorkspace.data)
+        return failure("not_found", "workspace not found");
+      if (observation.taskId !== view.task.id || observation.expectedRevision !== freshTask.data.revision || observation.expectedWorkspaceRevision !== freshWorkspace.data.revision)
         return failure("revision_conflict", "worker observation is stale");
       if (!view.task.workers.some((entry) => entry.id === observation.workerId))
         return failure("permission_denied", "worker observation is not assigned");
@@ -13006,19 +13145,26 @@ class WorkitCore {
         return failure("permission_denied", "imported resume requires native destination approval");
       resumeCandidate = current.data.candidate;
     }
-    const blocker = this.activeWorkerBlocker(task.data, workspace.data);
+    const blocker = status === "paused" ? workspace.data.writer ? failure("recovery_required", "writer ownership must be released first") : null : this.activeWorkerBlocker(task.data, workspace.data);
     if (blocker)
       return blocker;
+    let pauseCandidate = null;
+    if (status === "paused") {
+      const captured = captureCandidate(this.store.root, task.data.intent.data.scope, environment());
+      if (!captured.ok)
+        return captured;
+      pauseCandidate = captured.data;
+    }
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (workspace, context) => success(context.revision, context.revision, workspace),
       task: (current, context) => success(context.revision, null, {
         ...current,
         status,
-        candidates: resumeCandidate && !current.candidates.some((candidate) => candidate.id === resumeCandidate.id) ? [...current.candidates, resumeCandidate] : current.candidates,
+        candidates: (resumeCandidate ?? pauseCandidate) && !current.candidates.some((candidate) => candidate.id === (resumeCandidate ?? pauseCandidate).id) ? [...current.candidates, resumeCandidate ?? pauseCandidate] : current.candidates,
         progress: current.progress,
         pauseReason: status === "paused" ? input.reason ?? null : null
       })
@@ -13056,12 +13202,13 @@ class WorkitCore {
       return workspace;
     if (!workspace.data)
       return failure("not_found", "workspace not found");
-    if (workspace.data.writer || task.data.workers.some((entry) => isUncertainWorker(entry.data.state)))
-      return failure("recovery_required", "scope revision requires worker ownership reconciliation");
+    const revisionBlocker = this.activeWorkerBlocker(task.data, workspace.data);
+    if (revisionBlocker)
+      return revisionBlocker;
     this.fillRevisions(input, task.data, workspace.data);
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (workspace, context) => success(context.revision, context.revision, workspace),
@@ -13117,7 +13264,7 @@ class WorkitCore {
       return closure;
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (value, context) => success(context.revision, context.revision, value),
@@ -13386,7 +13533,7 @@ var handleCodexHook = (raw) => {
   if (input.hook_event_name === "PreToolUse") {
     if (["bash", "unified-exec"].includes(String(input.tool_name).toLowerCase())) {
       const command = record2(input.tool_input) ? input.tool_input.command : undefined;
-      const route = typeof command === "string" ? shellRouteIntent(command) : null;
+      const route = typeof command === "string" ? shouldDenyShellRoute(input.cwd, command) : null;
       if (route)
         return denied("PreToolUse", `direct branch or PR creation bypasses the Workit route; ${route.guidance}`);
     }