@brainervirus/workit-codex 1.0.11 → 1.1.0

package/dist/workit-hook.js

@@ -3,8 +3,8 @@ import { createRequire } from "node:module";
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // packages/workit-codex/hooks/workit-hook.ts
-import { existsSync as existsSync4, realpathSync as realpathSync5, statSync } from "node:fs";
-import path7 from "node:path";
+import { existsSync as existsSync5, realpathSync as realpathSync6, statSync } from "node:fs";
+import path9 from "node:path";
 
 // packages/workit-core/src/core/task-contract.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -7353,8 +7353,97 @@ var refSchema = discriminatedUnion("kind", [
     id
   }).strict(),
   object({ kind: literal("host"), host: hostSchema, handle: nonEmpty }).strict(),
-  object({ kind: literal("external"), url: text.url() }).strict()
+  object({ kind: literal("external"), url: text.url() }).strict(),
+  object({
+    kind: literal("standing"),
+    workspace: nonEmpty,
+    class: nonEmpty,
+    configDigest: nullableDigest
+  }).strict()
 ]);
+var rewriteUnknown = (value, map) => {
+  if (Array.isArray(value)) {
+    const out = [];
+    for (const item of value) {
+      const rewritten = rewriteUnknown(item, map);
+      if (!rewritten.drop)
+        out.push(rewritten.value);
+    }
+    return { drop: false, value: out };
+  }
+  if (typeof value === "object" && value !== null) {
+    if (refSchema.safeParse(value).success) {
+      const mapped = map(value);
+      return mapped === null ? { drop: true } : { drop: false, value: mapped };
+    }
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+      const rewritten = rewriteUnknown(item, map);
+      out[key] = rewritten.drop ? null : rewritten.value;
+    }
+    return { drop: false, value: out };
+  }
+  return { drop: false, value };
+};
+var rewriteNode = (value, schema, map) => {
+  if (typeof value === "object" && value !== null && !Array.isArray(value) && refSchema.safeParse(value).success) {
+    const mapped = map(value);
+    return mapped === null ? { drop: true } : { drop: false, value: mapped };
+  }
+  let node = schema;
+  while (node instanceof ZodNullable || node instanceof ZodOptional || node instanceof ZodDefault) {
+    node = node.unwrap();
+  }
+  if (node === refSchema) {
+    if (!refSchema.safeParse(value).success)
+      return { drop: false, value };
+    const mapped = map(value);
+    return mapped === null ? { drop: true } : { drop: false, value: mapped };
+  }
+  if (node instanceof ZodArray) {
+    if (!Array.isArray(value))
+      return { drop: false, value };
+    const out = [];
+    for (const item of value) {
+      const rewritten = rewriteNode(item, node.element, map);
+      if (!rewritten.drop)
+        out.push(rewritten.value);
+    }
+    return { drop: false, value: out };
+  }
+  if (node instanceof ZodObject) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+      return { drop: false, value };
+    const shape = node.shape;
+    const record = value;
+    const out = {};
+    for (const [key, item] of Object.entries(record)) {
+      if (!(key in shape)) {
+        const scrubbed = rewriteUnknown(item, map);
+        out[key] = scrubbed.drop ? null : scrubbed.value;
+        continue;
+      }
+      const child = shape[key];
+      const rewritten = rewriteNode(item, child, map);
+      if (rewritten.drop) {
+        if (child instanceof ZodOptional || child instanceof ZodDefault)
+          continue;
+        if (child instanceof ZodNullable) {
+          out[key] = null;
+          continue;
+        }
+        return { drop: true };
+      }
+      out[key] = rewritten.value;
+    }
+    return { drop: false, value: out };
+  }
+  return { drop: false, value };
+};
+var rewriteRecordRefs = (value, schema, map) => {
+  const rewritten = rewriteNode(value, schema, map);
+  return rewritten.drop ? null : rewritten.value;
+};
 var provenanceSchema = object({
   kind: _enum(["host_observed", "agent_reported", "imported"]),
   host: hostSchema,
@@ -7575,7 +7664,8 @@ var decisionSchema = object({
     approvedContent: text,
     displayed: text.optional(),
     contentRefs: array(refSchema),
-    statedChoice: object({ ref: text, text }).strict().optional()
+    statedChoice: object({ ref: text, text }).strict().optional(),
+    standing: object({ workspace: nonEmpty, class: nonEmpty }).strict().optional()
   }).strict(),
   digest,
   response: _enum(["approved", "rejected", "stated"]),
@@ -9005,11 +9095,11 @@ class TaskStore {
         return workspace;
       if (!workspace.data)
         return failure("not_found", "workspace not found");
-      const expectedTaskRevision = input.expectedTaskRevision ?? input.expectedRevision;
-      if (!expectedTaskRevision)
+      const expected = input.expectedRevision;
+      if (!expected)
         return failure("invalid_input", "task revision is required");
-      if (task.data.revision !== expectedTaskRevision)
-        return this.conflict(expectedTaskRevision, task.data.revision);
+      if (task.data.revision !== expected)
+        return this.conflict(expected, task.data.revision);
       if (workspace.data.revision !== input.expectedWorkspaceRevision)
         return this.conflict(input.expectedWorkspaceRevision, workspace.data.revision);
       const previousWorkspaceBytes = this.snapshotBytes(this.workspacePath);
@@ -9543,6 +9633,7 @@ var same = (left, right) => {
 };
 var UNCERTAIN_WORKER_STATES = ["dispatching", "running", "cancelling", "unknown"];
 var isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state);
+var workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state);
 var callerSession = (caller) => caller.session ?? { kind: "host", host: caller.host, handle: caller.actor };
 var validPath = (value) => typeof value === "string" && value.length > 0 && ![...value].some((char) => {
   const code = char.charCodeAt(0);
@@ -9589,21 +9680,398 @@ function assertProductWriteAllowed(input) {
 }
 
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import * as fs6 from "node:fs";
 import { spawnSync } from "node:child_process";
-import path6 from "node:path";
+import path8 from "node:path";
 
 // packages/workit-core/src/core/authority.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import * as fs5 from "node:fs";
+import path7 from "node:path";
+
+// packages/workit-core/src/core/auto-approval.ts
+import { createHash as createHash3 } from "node:crypto";
+import { readFileSync as readFileSync4 } from "node:fs";
+
+// packages/workit-core/src/core/workspaces.ts
+import { readFileSync as readFileSync3, realpathSync as realpathSync2 } from "node:fs";
+import path6 from "node:path";
+
+// packages/workit-core/src/core/config.ts
+import {
+  copyFileSync,
+  cpSync,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  readdirSync as readdirSync2,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import os from "node:os";
 import path5 from "node:path";
+
+// packages/workit-core/src/core/boundary.ts
+var EVENT = {
+  initialization: "initialization",
+  provenance: "provenance",
+  assets: "assets",
+  configurationSource: "configuration_source",
+  hooks: "hooks",
+  mcpConnection: "mcp_connection",
+  migration: "migration",
+  installSteps: "install_steps",
+  uncaughtFailure: "uncaught_failure",
+  toolsFailed: "tools_failed",
+  doctor: "doctor"
+};
+var errorDetail = (err) => {
+  if (err instanceof Error) {
+    return { error_name: err.name, error: err.message };
+  }
+  return { error_name: "unknown", error: String(err) };
+};
+
+// packages/workit-core/src/core/config.ts
+var diagnosticLogger;
+var PRESETS = {
+  gitflow: {
+    allowed: ["feature/*", "bugfix/*", "hotfix/*", "release/*"],
+    protected: ["main", "develop", "master", "prod", "production"]
+  },
+  "github-flow": { allowed: ["*"], protected: ["main"] },
+  "trunk-based": { allowed: ["*"], protected: ["main"] },
+  custom: { allowed: [], protected: [] }
+};
+var resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path5.join(process.env.XDG_CONFIG_HOME || path5.join(os.homedir(), ".config"), "workit");
+var migratedDir = null;
+var migrationFailed = false;
+var ensureConfigDir = (dir = resolveConfigDir()) => {
+  if (migratedDir === dir)
+    return dir;
+  if (process.env.WORKFLOW_TOOLKIT_CONFIG || process.env.WORKFLOW_TOOLKIT_CONFIG_DIR) {
+    migratedDir = dir;
+    return dir;
+  }
+  const legacy = path5.join(process.env.XDG_CONFIG_HOME || path5.join(os.homedir(), ".config"), "workflow-toolkit");
+  if (!existsSync3(legacy)) {
+    migratedDir = dir;
+    return dir;
+  }
+  if (!migrationFailed && existsSync3(dir)) {
+    migratedDir = dir;
+    return dir;
+  }
+  migrationFailed = false;
+  mkdirSync2(dir, { recursive: true });
+  diagnosticLogger?.info(EVENT.migration, { from: legacy, to: dir });
+  for (const entry of readdirSync2(legacy, { withFileTypes: true })) {
+    const src = path5.join(legacy, entry.name);
+    const dest = path5.join(dir, entry.name);
+    if (existsSync3(dest))
+      continue;
+    try {
+      if (entry.isDirectory())
+        cpSync(src, dest, { recursive: true });
+      else if (entry.isFile())
+        copyFileSync(src, dest);
+    } catch (err) {
+      migrationFailed = true;
+      diagnosticLogger?.warn(EVENT.migration, { from: src, ok: false, ...errorDetail(err) });
+      console.warn(`[workit] config migration: a file could not be copied to ${dir}; it will be retried on the next run`);
+    }
+  }
+  if (!migrationFailed)
+    migratedDir = dir;
+  return dir;
+};
+var configDir = () => ensureConfigDir();
+var DEFAULTS = {
+  locale: "en",
+  localeOptions: ["en", "es-CL", "es-MX", "es-AR", "pt-BR"],
+  timezone: "America/Santiago",
+  branchPolicy: {
+    preset: "gitflow",
+    allowed: [...PRESETS.gitflow.allowed],
+    protected: [...PRESETS.gitflow.protected]
+  },
+  commitPolicy: { preset: "conventional" }
+};
+var isConfigObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+
+// packages/workit-core/src/core/workspaces.ts
+var readWorkspacesResult = (dir = configDir()) => {
+  const file = path6.join(dir, "workspaces.json");
+  let raw;
+  try {
+    raw = readFileSync3(file, "utf8");
+  } catch {
+    return { status: "missing", path: file, entries: [] };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { status: "malformed", path: file, entries: [], error: `${file} is not valid JSON` };
+  }
+  if (!isConfigObject(parsed)) {
+    return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
+  }
+  const list = parsed.workspaces;
+  return {
+    status: "valid",
+    path: file,
+    entries: Array.isArray(list) ? list : []
+  };
+};
+var loadWorkspacesFrom = (dir) => readWorkspacesResult(dir).entries;
+var globToRegExp = (glob) => {
+  let out = "";
+  for (let i = 0;i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        if (glob[i + 2] === "/") {
+          if (out === "")
+            out += "/?";
+          out += "(?:[^/]+/)*";
+          i += 2;
+        } else {
+          if (i + 2 >= glob.length) {
+            if (out.endsWith("/")) {
+              out = out.slice(0, -1);
+              out += "(?:/.*)?";
+            } else {
+              out += ".*";
+            }
+          } else {
+            out += ".*";
+          }
+          i++;
+        }
+      } else {
+        out += "[^/]*";
+      }
+    } else {
+      out += c.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${out}$`);
+};
+var matchWorkspace = (glob, target) => globToRegExp(glob.replaceAll("\\", "/")).test(target.replaceAll("\\", "/"));
+var realpathOf = (p) => {
+  const real = realpathSync2.native ?? realpathSync2;
+  try {
+    return real(p);
+  } catch {
+    return p;
+  }
+};
+var canonicalGlob = (glob) => {
+  const m = /[*?[\]{]/.exec(glob);
+  const prefix = m ? glob.slice(0, m.index) : glob;
+  const rest = m ? glob.slice(m.index) : "";
+  if (!prefix)
+    return glob;
+  const real = realpathOf(prefix.replace(/\/+$/, "") || "/");
+  return real + (prefix.endsWith("/") ? "/" : "") + rest;
+};
+var resolveWorkspaceFrom = (cwd, dir) => {
+  const targets = [cwd, realpathOf(cwd)].map((p) => p.replaceAll("\\", "/"));
+  for (const entry of loadWorkspacesFrom(dir)) {
+    if (!entry || typeof entry !== "object")
+      continue;
+    const ws = entry;
+    if (typeof ws.glob !== "string" || !ws.glob)
+      continue;
+    const glob = ws.glob.replaceAll("\\", "/");
+    const canonical = canonicalGlob(glob);
+    for (const target of targets) {
+      if (matchWorkspace(glob, target))
+        return ws;
+      if (canonical !== glob && matchWorkspace(canonical, target))
+        return ws;
+    }
+  }
+  return null;
+};
+
+// packages/workit-core/src/core/branch.ts
+import { execFileSync } from "node:child_process";
+var verifyPushIdentity = (root, provider, account) => {
+  if (!account || typeof account !== "string")
+    return { ok: false, error: "push identity requires a configured area account" };
+  const probe = provider === "gitlab" ? ["api", "user", "--jq", ".username"] : ["api", "user", "--jq", ".login"];
+  const bin = provider === "gitlab" ? "glab" : "gh";
+  let login;
+  try {
+    login = execFileSync(bin, [...probe], {
+      cwd: root,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return { ok: false, error: `${bin} identity could not be resolved` };
+  }
+  if (!login || login.toLowerCase() !== account.toLowerCase())
+    return {
+      ok: false,
+      error: `push identity ${login || "(unknown)"} does not match area account ${account}`
+    };
+  return { ok: true };
+};
+
+// packages/workit-core/src/core/auto-approval.ts
+var AUTO_CLASSES = ["branch", "commit", "push", "pr", "merge"];
+var OPERATION_CLASS = {
+  "git.branch_setup": "branch",
+  "git.commit": "commit",
+  "git.push": "push",
+  "hosting.pull_request": "pr",
+  "hosting.merge": "merge"
+};
+var operationAutoClass = (operation) => typeof operation === "string" ? OPERATION_CLASS[operation] ?? null : null;
+var digestOf = (configDirPath) => {
+  try {
+    const raw = readFileSync4(`${configDirPath}/workspaces.json`, "utf8");
+    return createHash3("sha256").update(raw).digest("hex");
+  } catch {
+    return null;
+  }
+};
+var normalizeClasses = (value) => {
+  if (value === true)
+    return [...AUTO_CLASSES];
+  if (!Array.isArray(value))
+    return [];
+  const seen = new Set;
+  for (const item of value) {
+    if (typeof item === "string" && AUTO_CLASSES.includes(item))
+      seen.add(item);
+  }
+  return [...seen];
+};
+var resolveAutoApproval = (root, dir = configDir()) => {
+  let match;
+  try {
+    match = resolveWorkspaceFrom(root, dir);
+  } catch {
+    return { status: "off" };
+  }
+  if (!match)
+    return { status: "off" };
+  const classes = normalizeClasses(match.autoApprove);
+  if (classes.length === 0)
+    return { status: "off" };
+  return {
+    status: "on",
+    workspace: match.name,
+    classes,
+    account: typeof match.vcs?.account === "string" && match.vcs.account ? match.vcs.account : null,
+    configDigest: digestOf(dir)
+  };
+};
+var isStandingReceipt = (value) => typeof value === "object" && value !== null && value.kind === "standing";
+var standingApprovalLive = (root, receipt, cls, dir) => {
+  if (!isStandingReceipt(receipt))
+    return false;
+  if (typeof cls !== "string" || !AUTO_CLASSES.includes(cls))
+    return false;
+  if (receipt.class !== cls)
+    return false;
+  const resolved = resolveAutoApproval(root, dir);
+  if (resolved.status !== "on")
+    return false;
+  if (resolved.workspace !== receipt.workspace)
+    return false;
+  return resolved.classes.includes(cls);
+};
+var standingReceiptFor = (root, workspace, cls, dir) => {
+  const resolved = resolveAutoApproval(root, dir);
+  return {
+    kind: "standing",
+    workspace,
+    class: cls,
+    configDigest: resolved.status === "on" && resolved.workspace === workspace ? resolved.configDigest : null
+  };
+};
+var verifyStandingApproval = (root, task, caller, binding) => {
+  if (task.status !== "active")
+    return failure("invalid_transition", "only active tasks can authorize actions");
+  const session = task.intent?.provenance?.session;
+  if (!session || session.kind !== "host" || session.host !== caller.host || session.handle !== caller.actor)
+    return failure("permission_denied", "standing approval requires the lead session");
+  const standing = binding.standing;
+  if (!standing || typeof standing.workspace !== "string" || typeof standing.class !== "string")
+    return failure("invalid_input", "standing approval needs a workspace and class");
+  let operation;
+  try {
+    operation = typeof binding.approvedContent === "string" ? JSON.parse(binding.approvedContent).operation : null;
+  } catch {
+    operation = null;
+  }
+  const cls = operationAutoClass(operation);
+  if (!cls || cls !== standing.class)
+    return failure("permission_denied", "standing approval does not cover this operation");
+  const resolved = resolveAutoApproval(root);
+  if (resolved.status !== "on" || resolved.workspace !== standing.workspace || !resolved.classes.includes(cls))
+    return failure("permission_denied", "standing auto-approval is not live for this operation");
+  if (cls === "push") {
+    const workspace = resolveWorkspaceFrom(root, configDir());
+    const provider = workspace?.vcs?.provider;
+    const account = resolved.account;
+    if (!provider || !account)
+      return failure("permission_denied", "auto-push requires a workspace provider and area account");
+    const identity = verifyPushIdentity(root, provider, account);
+    if (!identity.ok)
+      return failure("permission_denied", identity.error);
+  }
+  return success(null, null, {
+    kind: "host_observed",
+    host: caller.host,
+    session: { kind: "host", host: caller.host, handle: caller.actor },
+    workerId: null,
+    receipts: [standingReceiptFor(root, standing.workspace, cls)]
+  });
+};
+
+// packages/workit-core/src/core/authority.ts
 var verifiedAuthorities = new WeakMap;
 var trustedAuthority = (kind, provenance, expected, binding, caller) => {
   const token = {};
   verifiedAuthorities.set(token, { kind, provenance, ...expected, ...binding, caller });
   return token;
 };
+var chainStepKey = (step) => step.kind === "commit" ? step.message : step.kind === "branch" ? `branch:${step.target}` : "pr";
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var normalizeChainSteps = (steps) => {
+  if (!Array.isArray(steps) || steps.length === 0 || steps.length > 32)
+    return null;
+  const normalized = [];
+  for (const step of steps) {
+    if (typeof step === "string") {
+      if (!step.trim())
+        return null;
+      normalized.push({ kind: "commit", message: step });
+      continue;
+    }
+    if (!isRecord(step))
+      return null;
+    if (typeof step.branch === "string" && step.branch.trim() && Object.keys(step).length === 1) {
+      normalized.push({ kind: "branch", target: step.branch });
+      continue;
+    }
+    if (step.pr === true && Object.keys(step).length === 1) {
+      normalized.push({ kind: "pr" });
+      continue;
+    }
+    return null;
+  }
+  const keys = normalized.map(chainStepKey);
+  if (new Set(keys).size !== keys.length)
+    return null;
+  return normalized;
+};
 var scopeEqual = (left, right) => canonicalJson(left) === canonicalJson(right);
 var parseSteps = (content) => {
   let value;
@@ -9615,7 +10083,10 @@ var parseSteps = (content) => {
   if (typeof value !== "object" || value === null || !("steps" in value))
     return [];
   const steps = value.steps;
-  return Array.isArray(steps) && steps.every((step) => typeof step === "string") ? steps : null;
+  if (!Array.isArray(steps))
+    return null;
+  const normalized = normalizeChainSteps(steps);
+  return normalized;
 };
 var decisionMatches = (entry, purpose, binding) => {
   const decision = entry.data;
@@ -9711,7 +10182,7 @@ function applicableDecision(task, purpose, binding, checkoutRoot) {
     return [];
   return task.decisions.filter((entry) => entry.provenance.kind !== "imported" && decisionMatches(entry, purpose, binding) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, entry.data.binding).ok : entry.data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map((entry) => entry.data);
 }
-var digestBytes2 = (bytes) => createHash3("sha256").update(bytes).digest("hex");
+var digestBytes2 = (bytes) => createHash4("sha256").update(bytes).digest("hex");
 var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
   let root;
   try {
@@ -9724,23 +10195,23 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
       continue;
     if (!reference.digest)
       return failure("invalid_input", "document references require a byte digest");
-    const target = path5.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path5.sep}`))
+    const target = path7.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path7.sep}`))
       return failure("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const relative = path5.relative(root, target);
+      const relative = path7.relative(root, target);
       let current = root;
-      for (const segment of relative.split(path5.sep)) {
+      for (const segment of relative.split(path7.sep)) {
         if (!segment)
           continue;
-        current = path5.join(current, segment);
+        current = path7.join(current, segment);
         const stat = fs5.lstatSync(current);
         const real = fs5.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path5.sep}`))
+        if (real !== root && !real.startsWith(`${root}${path7.sep}`))
           return failure("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -9793,6 +10264,20 @@ var validateAction = (store, task, workspaceId, input, authority) => {
     return failure("permission_denied", "decision was rejected");
   if (entry.provenance.kind !== "host_observed" || entry.provenance.receipts.length === 0 || !provenanceMatches(entry.provenance, authority.provenance))
     return failure("permission_denied", "action approval lacks native receipt assurance");
+  const receipts = entry.provenance.receipts;
+  const standing = receipts.filter((receipt) => typeof receipt === "object" && receipt !== null && receipt.kind === "standing");
+  const questionBacked = receipts.some((receipt) => typeof receipt === "object" && receipt !== null && receipt.kind === "host");
+  if (!questionBacked && standing.length > 0) {
+    let operation;
+    try {
+      operation = JSON.parse(decision.binding.approvedContent).operation;
+    } catch {
+      operation = null;
+    }
+    const cls = operationAutoClass(operation);
+    if (!cls || !standing.some((receipt) => standingApprovalLive(store.root, receipt, cls)))
+      return failure("permission_denied", "standing auto-approval is not live for this operation");
+  }
   if (decision.revoked)
     return failure("permission_denied", "decision is revoked");
   if (decision.digest !== decisionDigest(decision))
@@ -9806,14 +10291,12 @@ var validateAction = (store, task, workspaceId, input, authority) => {
     return content;
   const requestedSteps = parseSteps(decision.binding.approvedContent);
   if (requestedSteps === null)
-    return failure("invalid_input", "bounded action steps must be a string array");
-  if (input.steps && canonicalJson(input.steps) !== canonicalJson(requestedSteps))
+    return failure("invalid_input", "bounded action steps must be a unique non-empty array");
+  if (input.steps && canonicalJson(input.steps) !== canonicalJson(requestedSteps.map(chainStepKey)))
     return failure("permission_denied", "bounded action steps do not match approved content");
-  if (requestedSteps.some((step) => !step || typeof step !== "string") || new Set(requestedSteps).size !== requestedSteps.length)
-    return failure("invalid_input", "bounded action steps must be unique and non-empty");
   const stored = task.actionProgress?.find((item) => item.decisionId === input.decisionId);
-  const workflow = stored ? { steps: stored.steps, completed: stored.completedSteps } : { steps: requestedSteps, completed: [] };
-  if (workflow.steps.length && requestedSteps.length && canonicalJson(workflow.steps) !== canonicalJson(requestedSteps))
+  const workflow = stored ? { steps: stored.steps, completed: stored.completedSteps } : { steps: requestedSteps.map(chainStepKey), completed: [] };
+  if (workflow.steps.length && requestedSteps.length && canonicalJson(workflow.steps) !== canonicalJson(requestedSteps.map(chainStepKey)))
     return failure("permission_denied", "bounded action scope changed");
   return success(null, null, { entry, workflow });
 };
@@ -10094,15 +10577,15 @@ var bindingCovers = scopeCovers;
 var verifyDecisionContent = verifyContentRefs;
 
 // packages/workit-core/src/core/task-evaluation.ts
-var digestBytes3 = (value) => createHash4("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path6.sep}`);
-var relative = (root, candidate) => path6.relative(root, candidate).split(path6.sep).join("/") || ".";
+var digestBytes3 = (value) => createHash5("sha256").update(value).digest("hex");
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path8.sep}`);
+var relative = (root, candidate) => path8.relative(root, candidate).split(path8.sep).join("/") || ".";
 var canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path6.posix.normalize(value);
+  const normalized = path8.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -10150,14 +10633,14 @@ var gitPaths = (root) => {
       git: /not a git repository/i.test(stderr) ? false : true
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path6.sep).join("/")) : [];
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path8.sep).join("/")) : [];
   const stagedDeleted = spawnSync("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path6.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path8.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 };
@@ -10172,7 +10655,7 @@ var walk = (root, directory, output) => {
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path6.join(directory, name);
+    const target = path8.join(directory, name);
     let stat;
     try {
       stat = fs6.lstatSync(target);
@@ -10190,12 +10673,12 @@ var walk = (root, directory, output) => {
 var scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path6.resolve(root, item);
+    const target = path8.resolve(root, item);
     if (!inside(root, target))
       return failure("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
     while (!fs6.existsSync(ancestor) && ancestor !== root)
-      ancestor = path6.dirname(ancestor);
+      ancestor = path8.dirname(ancestor);
     try {
       if (!inside(root, fs6.realpathSync(ancestor)))
         return failure("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
@@ -10247,7 +10730,7 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].sort()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path6.join(checkout, item);
+    const target = path8.join(checkout, item);
     try {
       const stat = fs6.lstatSync(target);
       if (stat.isSymbolicLink()) {
@@ -10368,13 +10851,28 @@ function evaluateEvidence(task, candidate) {
   });
 }
 var scopeCovers2 = scopeCovers;
+var checkPin = (assignment, beforeCandidateId, candidateId) => {
+  const pin = assignment.candidateId ?? null;
+  if (pin === null)
+    return true;
+  return (beforeCandidateId ?? null) === pin || (candidateId ?? null) === pin;
+};
+var resolveBinding = (evidence, pin, currentCandidateId) => {
+  const bound = evidence.kind === "check" || evidence.kind === "review";
+  const fallback = bound ? pin ?? currentCandidateId : null;
+  return {
+    beforeCandidateId: evidence.beforeCandidateId ?? fallback,
+    candidateId: evidence.candidateId ?? fallback
+  };
+};
+var findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId === findingCandidateId);
 var applicableDecision2 = (task, workspace, requirement, checkoutRoot) => task.decisions.filter((entry) => entry.provenance.kind !== "imported").map((entry) => entry.data).filter((decision) => decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.binding.taskId === task.id && decision.binding.workspaceId === workspace.id && decision.requirementIds.includes(requirement.id) && decision.binding.scope && scopeCovers2(decision.binding.scope, requirement.scope) && decision.digest === decisionDigest(decision) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok : decision.binding.contentRefs.every((reference) => reference.kind !== "file")));
 var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && (data.response === "approved" || data.response === "stated") && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
-var evidenceMatchesRequirement = (kind, evidenceKind, dimension) => {
+var evidenceMatchesRequirement = (kind, evidenceKind, dimension, ruleId) => {
   if (kind !== "passed")
     return false;
   if (dimension === "testing" || dimension === "verification")
-    return evidenceKind === "check";
+    return evidenceKind === "check" || ruleId === "pre-pr-cleanup" && evidenceKind === "artifact";
   if (dimension === "review")
     return evidenceKind === "review";
   if (dimension === "investigation" || dimension === "challenge")
@@ -10383,6 +10881,21 @@ var evidenceMatchesRequirement = (kind, evidenceKind, dimension) => {
     return evidenceKind === "artifact";
   return false;
 };
+var expectedKinds = (dimension, ruleId) => {
+  if (dimension === "testing")
+    return "check";
+  if (dimension === "verification")
+    return ruleId === "pre-pr-cleanup" ? "check or artifact" : "check";
+  if (dimension === "review")
+    return "review";
+  if (dimension === "investigation" || dimension === "challenge")
+    return "investigation";
+  if (dimension === "artifacts" || dimension === "continuity")
+    return "artifact";
+  if (dimension === "decisions")
+    return "decision";
+  return "worker report";
+};
 function evaluateRequirements(task, workspace, capabilities, candidate, checkoutRoot, _caller) {
   const evidence = evaluateEvidence(task, candidate);
   if (task.policy && task.policy.policyVersion !== POLICY_VERSION)
@@ -10396,7 +10909,7 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
   return (task.policy?.requirements ?? []).map((requirement) => {
     const related = task.evidence.map((entry, index) => ({ entry, evaluation: evidence[index] })).filter(({ entry }) => entry.data.requirementIds.includes(requirement.id));
     const passed = related.filter(({ entry, evaluation }) => {
-      if (!evidenceMatchesRequirement(evaluation.status, entry.data.kind, requirement.dimension))
+      if (!evidenceMatchesRequirement(evaluation.status, entry.data.kind, requirement.dimension, requirement.ruleId))
         return false;
       if ((entry.data.kind === "check" || entry.data.kind === "review") && (!entry.data.beforeCandidateId || !entry.data.candidateId || entry.data.beforeCandidateId !== entry.data.candidateId))
         return false;
@@ -10404,11 +10917,12 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
         return true;
       const reviewSession = sessionFromRef(entry.data.reviewContext);
       const sameImplementation = sameSession(reviewSession, task.intent.provenance.session);
-      const sameEvidenceSession = task.evidence.some((other) => other.id !== entry.id && other.data.kind === "review" && sameSession(reviewSession, other.provenance.session));
+      const sameEvidenceSession = related.some(({ entry: other }) => other.id !== entry.id && other.data.kind === "review" && other.data.candidateId !== null && other.data.candidateId === entry.data.candidateId && sameSession(reviewSession, other.provenance.session));
       return entry.data.kind === "review" && reviewSession !== null && sameSession(reviewSession, entry.provenance.session) && (requirement.ruleId === "self-review" || !sameImplementation && !sameEvidenceSession);
     });
     if (passed.length) {
-      const withRed = requirement.dimension === "testing" ? passed.filter(({ entry }) => related.some((other) => other.entry.data.kind === "check" && other.evaluation.status === "failed" && other.entry.data.requirementIds.includes(requirement.id) && other.entry.recordedAt <= entry.recordedAt)) : passed;
+      const currentId = candidate?.id ?? null;
+      const withRed = requirement.dimension === "testing" ? passed.filter(({ entry }) => related.some((other) => other.entry.data.kind === "check" && other.evaluation.status === "failed" && other.entry.data.requirementIds.includes(requirement.id) && other.entry.recordedAt <= entry.recordedAt) || related.some((baseline) => baseline.entry.id !== entry.id && baseline.entry.data.kind === "check" && baseline.entry.data.result === "passed" && baseline.entry.data.candidateId !== null && currentId !== null && baseline.entry.data.candidateId !== currentId)) : passed;
       if (withRed.length)
         return {
           requirementId: requirement.id,
@@ -10457,6 +10971,14 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
         reason: "an applicable approved limitation permits the missing evidence"
       };
     const unavailable = capabilities.some((capability) => capability.assurance === "unavailable" && (capability.name === requirement.dimension || capability.surface === requirement.dimension));
+    if (!unavailable && related.length > 0 && !passed.length)
+      return {
+        requirementId: requirement.id,
+        status: "unsatisfied",
+        evidenceIds: related.map(({ entry }) => entry.id),
+        decisionIds: [],
+        reason: `no passing evidence (needs kind:${expectedKinds(requirement.dimension, requirement.ruleId)})`
+      };
     return {
       requirementId: requirement.id,
       status: unavailable ? "unavailable" : "unsatisfied",
@@ -10481,7 +11003,13 @@ function evaluateClosure(requestedOutcome, view) {
       if (entry.data.disposition === "fixed") {
         const verified = entry.data.resolution?.evidenceIds.some((id) => {
           const evidence = view.task.evidence.find((item) => item.id === id);
-          return evidenceById.get(id) === "passed" && (evidence?.data.kind === "check" || evidence?.data.kind === "review");
+          if (!evidence)
+            return false;
+          return findingVerificationPasses(entry.data.candidateId, {
+            kind: evidence.data.kind,
+            candidateId: evidence.data.candidateId,
+            status: evidenceById.get(id) ?? "missing"
+          });
         });
         if (!verified)
           return failure("requirements_unsatisfied", "fixed findings require current verification");
@@ -10497,7 +11025,12 @@ function evaluateClosure(requestedOutcome, view) {
       }
     }
   }
-  const blocking = evaluations.filter((item) => item.status === "unsatisfied" || item.status === "unavailable");
+  const blocking = evaluations.filter((item) => {
+    if (item.status !== "unsatisfied" && item.status !== "unavailable")
+      return false;
+    const requirement = view.task.policy?.requirements.find((candidate) => candidate.id === item.requirementId);
+    return !requirement || requirement.before === "close";
+  });
   if (requestedOutcome !== "stopped" && blocking.length)
     return failure("requirements_unsatisfied", "applicable requirements are unsatisfied", {
       requirementIds: blocking.map((item) => item.requirementId),
@@ -10540,15 +11073,15 @@ function evaluateClosure(requestedOutcome, view) {
 // packages/workit-core/src/core/methods.ts
 var METHODS = {
   "workit-challenge": { dimensions: ["challenge", "decisions"] },
-  "workit-behavioral-tdd": { dimensions: ["testing"] },
-  "workit-review": { dimensions: ["review"], ruleIds: ["fresh-context-review"] },
+  "workit-behavioral-tdd": { dimensions: ["testing"], ruleIds: ["mechanical-existing-checks"] },
+  "workit-review": { dimensions: ["review"], ruleIds: ["fresh-context-review", "self-review"] },
   "workit-plan": { dimensions: ["artifacts", "continuity"] },
   "workit-implement": { dimensions: ["delegation"] },
-  "workit-debug": { ruleIds: ["root-cause-investigation"] },
-  "workit-handoff": { ruleIds: ["durable-handoff"] },
+  "workit-debug": {},
+  "workit-handoff": {},
   "workit-deslop": { ruleIds: ["pre-pr-cleanup"] }
 };
-var methodMatches = (id, definition, requirement) => definition.dimensions?.includes(requirement.dimension) === true && !(id === "workit-review" && requirement.ruleId === "self-review") || definition.ruleIds?.includes(requirement.ruleId) === true;
+var methodMatches = (definition, requirement) => definition.dimensions?.includes(requirement.dimension) === true || definition.ruleIds?.includes(requirement.ruleId) === true;
 var assuranceFor = (id, definition, capabilities) => {
   const keys = new Set([
     id,
@@ -10569,7 +11102,7 @@ var assuranceFor = (id, definition, capabilities) => {
 };
 function selectMethods(policy, capabilities) {
   return Object.entries(METHODS).flatMap(([id, definition]) => {
-    const requirements = policy.requirements.filter((requirement) => methodMatches(id, definition, requirement));
+    const requirements = policy.requirements.filter((requirement) => methodMatches(definition, requirement));
     if (requirements.length === 0)
       return [];
     const capability = assuranceFor(id, definition, capabilities);
@@ -10740,7 +11273,8 @@ var exportDigest = (bundle) => sha256({
 // packages/workit-core/src/core/route-intent.ts
 var GUIDANCE = {
   "git.branch_setup": "use the Workit git.branch_setup action (workit_external_action in hosts, or `workit action git.branch_setup --payload '{}' --confirm --json` in the CLI)",
-  "hosting.pull_request": "use the Workit hosting.pull_request action (workit_external_action in hosts, or `workit action hosting.pull_request --payload '{...}' --confirm --json` in the CLI), then drive the created PR through workit-babysit"
+  "hosting.pull_request": "use the Workit hosting.pull_request action (workit_external_action in hosts, or `workit action hosting.pull_request --payload '{...}' --confirm --json` in the CLI), then drive the created PR through workit-babysit",
+  "hosting.merge": "use the Workit hosting.merge action (workit_external_action in hosts, or `workit action hosting.merge --payload '{...}' --confirm --json` in the CLI)"
 };
 var unbalancedQuotes = (segment) => {
   const text = segment.replace(/\\./gu, "");
@@ -10775,6 +11309,10 @@ function shellRouteIntent(command) {
       return { route: "hosting.pull_request", guidance: GUIDANCE["hosting.pull_request"] };
     if (head === "glab" && second === "mr" && third === "create")
       return { route: "hosting.pull_request", guidance: GUIDANCE["hosting.pull_request"] };
+    if (head === "gh" && second === "pr" && third === "merge")
+      return { route: "hosting.merge", guidance: GUIDANCE["hosting.merge"] };
+    if (head === "glab" && second === "mr" && third === "merge")
+      return { route: "hosting.merge", guidance: GUIDANCE["hosting.merge"] };
   }
   return null;
 }
@@ -10828,6 +11366,13 @@ var externalActionSchema = discriminatedUnion("operation", [
       babysit: boolean2().optional()
     }).strict()
   }).strict(),
+  object({
+    operation: literal("hosting.merge"),
+    payload: object({
+      target_branch: string2().min(1).optional(),
+      source_branch: string2().min(1).optional()
+    }).strict()
+  }).strict(),
   object({
     operation: literal("youtrack.update"),
     payload: object({
@@ -10888,7 +11433,7 @@ var externalActionSchema = discriminatedUnion("operation", [
   }).strict()
 ]);
 // packages/workit-core/src/core/task-engine.ts
-import { realpathSync as realpathSync4 } from "node:fs";
+import { realpathSync as realpathSync5 } from "node:fs";
 
 // packages/workit-core/src/core/policy-resolver.ts
 var resolverInputSchema = object({
@@ -11332,6 +11877,8 @@ var applyWorkerLifecycle = (input) => {
   if (task.data.status === "paused" && (input.state === "running" || input.state === "cancelling"))
     return failure("invalid_transition", "paused task cannot run a worker");
   const notStarted = input.dispatch === true;
+  if (notStarted && entry.data.state === "stopped" && input.session === null)
+    return success(task.data.revision, workspace.data.revision, entry);
   if (notStarted && (input.state !== "stopped" || input.session !== null))
     return failure("invalid_input", "a never-dispatched worker stops with no session");
   if (notStarted && entry.data.session !== null)
@@ -11363,7 +11910,7 @@ var applyWorkerLifecycle = (input) => {
     return success(task.data.revision, workspace.data.revision, entry);
   const changed = input.store.mutateTaskAndWorkspace({
     taskId: task.data.id,
-    expectedTaskRevision: input.expectedRevision,
+    expectedRevision: input.expectedRevision,
     expectedWorkspaceRevision: input.expectedWorkspaceRevision,
     now: input.now,
     workspace: (current, mutation) => success(mutation.revision, mutation.revision, {
@@ -11411,90 +11958,22 @@ var importedProvenance = (context) => ({
   receipts: []
 });
 var portableTask = (task) => {
-  const clone = structuredClone(task);
-  const portableProvenance = (value) => ({
-    ...value,
-    session: null,
-    receipts: []
-  });
-  const entries = [
-    clone.intent,
-    ...clone.assessments,
-    ...clone.evidence,
-    ...clone.decisions,
-    ...clone.findings,
-    ...clone.workers
-  ];
-  for (const entry of entries)
-    entry.provenance = portableProvenance(entry.provenance);
-  for (const worker of clone.workers)
-    worker.data.session = null;
-  clone.intent = {
-    ...clone.intent,
-    data: { ...clone.intent.data, authorityRefs: portableRefs(clone.intent.data.authorityRefs) }
-  };
-  clone.constraints = clone.constraints.flatMap((constraint) => {
-    const source = portableRef(constraint.source);
-    return source ? [
-      {
-        ...constraint,
-        source,
-        requires: constraint.requires.map((requirement) => ({
-          ...requirement,
-          refs: portableRefs(requirement.refs)
-        }))
-      }
-    ] : [];
-  });
-  clone.assessments = clone.assessments.map((entry) => ({
-    ...entry,
-    data: {
-      ...entry.data,
-      facts: entry.data.facts.map(portableFact),
-      signals: Object.fromEntries(Object.entries(entry.data.signals).map(([name, signal]) => [name, portableSignal(signal)])),
-      consequences: entry.data.consequences.map((consequence) => ({
-        ...consequence,
-        fact: portableFact(consequence.fact)
-      })),
-      verification: entry.data.verification.map((verification) => ({
-        ...verification,
-        availableChecks: portableRefs(verification.availableChecks)
-      }))
-    }
-  }));
-  clone.progress = {
-    ...clone.progress,
-    blockers: clone.progress.blockers.map((blocker) => ({
-      ...blocker,
-      refs: portableRefs(blocker.refs)
-    }))
+  const stripped = rewriteRecordRefs(task, taskRecordSchema, portableRef);
+  if (typeof stripped !== "object" || stripped === null || Array.isArray(stripped))
+    throw new TypeError("portable task rewrite produced a non-record");
+  const clone = structuredClone(stripped);
+  const demote = (facts, signals, consequences) => {
+    for (const fact of facts)
+      Object.assign(fact, portableFact(fact));
+    for (const name of Object.keys(signals)) {
+      const signal = signals[name];
+      Object.assign(signal, portableSignal(signal));
+    }
+    for (const consequence of consequences)
+      Object.assign(consequence.fact, portableFact(consequence.fact));
   };
-  clone.evidence = clone.evidence.map((entry) => ({
-    ...entry,
-    data: {
-      ...entry.data,
-      refs: portableRefs(entry.data.refs),
-      reviewContext: portableRef(entry.data.reviewContext)
-    }
-  }));
-  clone.decisions = clone.decisions.map((entry) => ({
-    ...entry,
-    data: {
-      ...entry.data,
-      consumption: entry.data.consumption ? portableRef(entry.data.consumption.actionRef) ? {
-        ...entry.data.consumption,
-        actionRef: portableRef(entry.data.consumption.actionRef)
-      } : null : null,
-      binding: {
-        ...entry.data.binding,
-        contentRefs: portableRefs(entry.data.binding.contentRefs)
-      }
-    }
-  }));
-  clone.findings = clone.findings.map((entry) => ({
-    ...entry,
-    data: { ...entry.data, refs: portableRefs(entry.data.refs) }
-  }));
+  for (const entry of clone.assessments)
+    demote(entry.data.facts, entry.data.signals, entry.data.consequences);
   clone.candidates = [];
   return clone;
 };
@@ -11519,15 +11998,13 @@ var importedTask = (source, bundle, destinationWorkspaceId, context, timestamp)
     allocate(entry.id);
   const fresh = (id) => allocate(id);
   const provenance = importedProvenance(context);
+  const remap = (ref) => mapRef(ref, ids);
   const intent = {
     ...source.intent,
     id: fresh(source.intent.id),
     recordedAt: timestamp,
     provenance,
-    data: {
-      ...source.intent.data,
-      authorityRefs: source.intent.data.authorityRefs.map((ref) => mapRef(ref, ids))
-    }
+    data: rewriteRecordRefs(source.intent.data, intentSchema, remap)
   };
   const assessments = source.assessments.map((entry) => {
     const data = entry.data;
@@ -11536,28 +12013,7 @@ var importedTask = (source, bundle, destinationWorkspaceId, context, timestamp)
       id: fresh(entry.id),
       recordedAt: timestamp,
       provenance,
-      data: {
-        ...data,
-        facts: data.facts.map((fact) => ({
-          ...fact,
-          refs: fact.refs.map((ref) => mapRef(ref, ids))
-        })),
-        signals: Object.fromEntries(Object.entries(data.signals).map(([name, signal]) => [
-          name,
-          { ...signal, refs: signal.refs.map((ref) => mapRef(ref, ids)) }
-        ])),
-        consequences: data.consequences.map((consequence) => ({
-          ...consequence,
-          fact: {
-            ...consequence.fact,
-            refs: consequence.fact.refs.map((ref) => mapRef(ref, ids))
-          }
-        })),
-        verification: data.verification.map((verification) => ({
-          ...verification,
-          availableChecks: verification.availableChecks.map((ref) => mapRef(ref, ids))
-        }))
-      }
+      data: rewriteRecordRefs(data, assessmentSchema, remap)
     };
   });
   const evidence = source.evidence.map((entry) => ({
@@ -11565,11 +12021,7 @@ var importedTask = (source, bundle, destinationWorkspaceId, context, timestamp)
     id: fresh(entry.id),
     recordedAt: timestamp,
     provenance,
-    data: {
-      ...entry.data,
-      refs: entry.data.refs.map((ref) => mapRef(ref, ids)),
-      reviewContext: entry.data.reviewContext ? mapRef(entry.data.reviewContext, ids) : null
-    }
+    data: rewriteRecordRefs(entry.data, evidenceSchema, remap)
   }));
   const decisions = source.decisions.map((entry) => ({
     ...entry,
@@ -11577,21 +12029,23 @@ var importedTask = (source, bundle, destinationWorkspaceId, context, timestamp)
     recordedAt: timestamp,
     provenance
   }));
-  const findings = source.findings.map((entry) => ({
-    ...entry,
-    id: fresh(entry.id),
-    recordedAt: timestamp,
-    provenance,
-    data: {
-      ...entry.data,
-      refs: entry.data.refs.map((ref) => mapRef(ref, ids)),
-      resolution: entry.data.resolution ? {
-        ...entry.data.resolution,
-        evidenceIds: entry.data.resolution.evidenceIds.map((id) => ids.get(id) ?? id),
-        decisionIds: entry.data.resolution.decisionIds.map((id) => ids.get(id) ?? id)
-      } : null
-    }
-  }));
+  const findings = source.findings.map((entry) => {
+    const data = rewriteRecordRefs(entry.data, findingSchema, remap);
+    return {
+      ...entry,
+      id: fresh(entry.id),
+      recordedAt: timestamp,
+      provenance,
+      data: {
+        ...data,
+        resolution: data.resolution ? {
+          ...data.resolution,
+          evidenceIds: data.resolution.evidenceIds.map((id) => ids.get(id) ?? id),
+          decisionIds: data.resolution.decisionIds.map((id) => ids.get(id) ?? id)
+        } : null
+      }
+    };
+  });
   const workers = source.workers.map((entry) => ({
     ...entry,
     id: fresh(entry.id),
@@ -11634,19 +12088,21 @@ var importedTask = (source, bundle, destinationWorkspaceId, context, timestamp)
     closure: null,
     assessments,
     evidence,
-    decisions: decisions.map((entry) => ({
-      ...entry,
-      data: {
-        ...entry.data,
-        binding: {
-          ...entry.data.binding,
-          taskId: "",
-          workspaceId: destinationWorkspaceId,
-          contentRefs: entry.data.binding.contentRefs.map((ref) => mapRef(ref, ids))
-        },
-        consumption: null
-      }
-    })),
+    decisions: decisions.map((entry) => {
+      const data = rewriteRecordRefs(entry.data, decisionSchema, remap);
+      return {
+        ...entry,
+        data: {
+          ...data,
+          binding: {
+            ...data.binding,
+            taskId: "",
+            workspaceId: destinationWorkspaceId
+          },
+          consumption: null
+        }
+      };
+    }),
     ...actionProgress ? { actionProgress } : {},
     findings,
     workers,
@@ -11684,7 +12140,7 @@ class WorkitCore {
   }
   contextRootError() {
     try {
-      if (realpathSync4(this.context.root) !== this.store.root)
+      if (realpathSync5(this.context.root) !== this.store.root)
         return failure("invalid_input", "operation context root does not match the task store root");
     } catch {
       return failure("invalid_input", "operation context root cannot be resolved");
@@ -11729,7 +12185,7 @@ class WorkitCore {
   activeWorkerBlocker(task, workspace) {
     if (workspace.writer)
       return failure("recovery_required", "writer ownership must be released first");
-    if (task.workers.some((entry) => isUncertainWorker(entry.data.state)))
+    if (task.workers.some((entry) => workerBlocksTransition("close", entry.data.state)))
       return failure("recovery_required", "worker state requires reconciliation");
     return null;
   }
@@ -11975,37 +12431,33 @@ class WorkitCore {
     const currentCandidate = captureCandidate(this.store.root, task.data.intent.data.scope, environment());
     if (!currentCandidate.ok)
       return currentCandidate;
-    if (evidence.kind === "check" || evidence.kind === "review") {
-      evidence.beforeCandidateId ??= currentCandidate.data.id;
-      evidence.candidateId ??= currentCandidate.data.id;
-    } else {
-      evidence.beforeCandidateId ??= null;
-      evidence.candidateId ??= null;
-    }
+    const pin = helper && helper.ok ? helper.data.data.assignment.candidateId : null;
+    const bound = resolveBinding(evidence, pin, currentCandidate.data.id);
     if (helper?.ok) {
       const assignment = helper.data.data.assignment;
-      if (evidence.requirementIds.some((id) => !assignment.requirementIds.includes(id)) || assignment.candidateId !== null && evidence.candidateId !== assignment.candidateId && evidence.beforeCandidateId !== assignment.candidateId || !refsWithinScope(evidence.refs, assignment.scope) || !refsWithinScope(evidence.refs, task.data.intent.data.scope))
+      if (evidence.requirementIds.some((id) => !assignment.requirementIds.includes(id)) || !checkPin(assignment, bound.beforeCandidateId, bound.candidateId) || !refsWithinScope(evidence.refs, assignment.scope) || !refsWithinScope(evidence.refs, task.data.intent.data.scope))
         return failure("permission_denied", "evidence is outside the worker assignment");
     }
     const knownCandidates = new Set(task.data.candidates.map((candidate) => candidate.id));
-    for (const candidateId of [evidence.beforeCandidateId, evidence.candidateId]) {
+    for (const candidateId of [bound.beforeCandidateId, bound.candidateId]) {
       if (candidateId && candidateId !== currentCandidate.data.id && !knownCandidates.has(candidateId))
         return failure("invalid_input", "evidence candidate is not a captured candidate");
     }
+    const boundEvidence = { ...evidence, ...bound };
     const changed = this.store.mutateTask(task.data.id, input.expectedRevision, (current, mutation) => {
       const candidates = current.candidates.some((item) => item.id === currentCandidate.data.id) ? current.candidates : [...current.candidates, currentCandidate.data];
       const entry = {
         id: newId(),
         recordedAt: mutation.now,
         provenance: provenance(this.context, "agent_reported"),
-        data: evidence
+        data: boundEvidence
       };
       return success(mutation.revision, null, {
         ...current,
         candidates,
         evidence: [...current.evidence, entry],
         findings: current.findings.map((finding) => {
-          if (finding.data.disposition === "open" || evidence.result === "skipped")
+          if (finding.data.disposition === "open" || boundEvidence.result === "skipped")
             return finding;
           if (finding.data.disposition !== "fixed")
             return finding;
@@ -12014,8 +12466,12 @@ class WorkitCore {
             item.evidenceId,
             item.status
           ]));
-          const verified = withEntry.evidence.some((item) => statuses.get(item.id) === "passed" && (item.data.kind === "check" || item.data.kind === "review") && (finding.data.candidateId === null || item.data.candidateId === finding.data.candidateId));
-          const contradicted = evidence.result === "failed" && finding.data.refs.some((left) => evidence.refs.some((right) => JSON.stringify(left) === JSON.stringify(right)));
+          const verified = withEntry.evidence.some((item) => findingVerificationPasses(finding.data.candidateId, {
+            kind: item.data.kind,
+            candidateId: item.data.candidateId,
+            status: statuses.get(item.id) ?? "missing"
+          }));
+          const contradicted = boundEvidence.result === "failed" && finding.data.refs.some((left) => boundEvidence.refs.some((right) => sameValue(left, right)));
           return verified && !contradicted ? finding : { ...finding, data: { ...finding.data, disposition: "open", resolution: null } };
         })
       });
@@ -12030,7 +12486,10 @@ class WorkitCore {
   observeDecision(request, observation) {
     return this.recordDecision(request, observation, true);
   }
-  recordDecision(request, nativeObservation, nativeRequired = false) {
+  observeStandingDecision(request) {
+    return this.recordDecision(request, undefined, true, true);
+  }
+  recordDecision(request, nativeObservation, nativeRequired = false, standing = false) {
     const root = this.contextRootError();
     if (!root.ok)
       return root;
@@ -12045,8 +12504,10 @@ class WorkitCore {
       return failure("permission_denied", "stated choices cannot authorize mutating actions");
     if (stated && !input.binding?.statedChoice)
       return failure("invalid_input", "stated choices require binding.statedChoice");
-    if (nativeRequired && nativeObservation === undefined && !stated)
+    if (nativeRequired && nativeObservation === undefined && !stated && !standing)
       return failure("permission_denied", "native decision observation is required");
+    if (standing && (!input.binding?.standing || input.purpose !== "action" || input.response !== "approved"))
+      return failure("invalid_input", "standing approvals need an approved action binding with a standing rule");
     const task = this.store.readTask(input.taskId);
     if (!task.ok)
       return task;
@@ -12078,7 +12539,10 @@ class WorkitCore {
         consumption: null
       };
       const data = { ...base, digest: decisionDigest(base) };
-      const native = nativeRequired && !stated ? verifyNativeDecision(this.context.nativeAuthority, {
+      const standingApproval = standing && !stated ? verifyStandingApproval(this.store.root, task.data, this.context.caller, input.binding) : null;
+      if (standingApproval && !standingApproval.ok)
+        return standingApproval;
+      const native = nativeRequired && !stated && !standingApproval ? verifyNativeDecision(this.context.nativeAuthority, {
         observation: nativeObservation,
         expected: {
           taskId: task.data.id,
@@ -12109,7 +12573,7 @@ class WorkitCore {
         const entry = {
           id: newId(),
           recordedAt: mutation.now,
-          provenance: nativeProvenance ?? provenance(this.context, "agent_reported"),
+          provenance: standingApproval?.ok === true ? standingApproval.data : nativeProvenance ?? provenance(this.context, "agent_reported"),
           data
         };
         return success(mutation.revision, null, {
@@ -12173,7 +12637,7 @@ class WorkitCore {
     if (input.action === "record") {
       if (helper?.ok) {
         const assignment = helper.data.data.assignment;
-        if (!bindingCovers(assignment.scope, input.scope) || !bindingCovers(task.data.intent.data.scope, input.scope) || assignment.candidateId !== null && input.candidateId !== assignment.candidateId || !refsWithinScope(input.refs, assignment.scope) || !refsWithinScope(input.refs, task.data.intent.data.scope))
+        if (!bindingCovers(assignment.scope, input.scope) || !bindingCovers(task.data.intent.data.scope, input.scope) || !checkPin(assignment, null, input.candidateId ?? null) || !refsWithinScope(input.refs, assignment.scope) || !refsWithinScope(input.refs, task.data.intent.data.scope))
           return failure("permission_denied", "finding is outside the worker assignment");
       }
       if (input.candidateId && !task.data.candidates.some((candidate) => candidate.id === input.candidateId))
@@ -12220,7 +12684,11 @@ class WorkitCore {
       const evaluations = evaluateEvidence(task.data, current.data);
       const verified = evidence.some((entry) => {
         const evaluation = evaluations.find((item) => item.evidenceId === entry.id);
-        return evaluation?.status === "passed" && (entry.data.kind === "check" || entry.data.kind === "review") && (finding.data.candidateId === null || entry.data.candidateId === finding.data.candidateId);
+        return findingVerificationPasses(finding.data.candidateId, {
+          kind: entry.data.kind,
+          candidateId: entry.data.candidateId,
+          status: evaluation?.status ?? "missing"
+        });
       });
       if (!verified)
         return failure("permission_denied", "fixed findings require passing verification evidence");
@@ -12232,7 +12700,7 @@ class WorkitCore {
         if (entry.data.result === "missing" || entry.data.result === "skipped")
           return false;
         const candidateMatches = finding.data.candidateId === null ? entry.data.candidateId === null : entry.data.candidateId === finding.data.candidateId || entry.data.beforeCandidateId === finding.data.candidateId;
-        const referenceMatches = finding.data.refs.some((left) => entry.data.refs.some((right) => JSON.stringify(left) === JSON.stringify(right)));
+        const referenceMatches = finding.data.refs.some((left) => entry.data.refs.some((right) => sameValue(left, right)));
         return candidateMatches && (referenceMatches || entry.data.claim === finding.data.claim);
       });
       if (!relevant)
@@ -12310,7 +12778,7 @@ class WorkitCore {
       const workerId = newId();
       const changed = this.store.mutateTaskAndWorkspace({
         taskId: task.data.id,
-        expectedTaskRevision: input.expectedRevision,
+        expectedRevision: input.expectedRevision,
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         now: trustedNow(this.context),
         workspace: (current, mutation) => success(mutation.revision, mutation.revision, current),
@@ -12348,7 +12816,7 @@ class WorkitCore {
         return failure("permission_denied", "worker report is outside the worker assignment");
       const changed = this.store.mutateTaskAndWorkspace({
         taskId: task.data.id,
-        expectedTaskRevision: input.expectedRevision,
+        expectedRevision: input.expectedRevision,
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         now: trustedNow(this.context),
         workspace: (current, mutation) => success(mutation.revision, mutation.revision, current),
@@ -12372,24 +12840,25 @@ class WorkitCore {
       return failure("invalid_transition", "closed task cannot cancel workers");
     if (entry.data.state === "unknown")
       return failure("recovery_required", "worker state requires recovery");
-    if (entry.data.state === "stopped")
-      return failure("invalid_transition", "stopped worker cannot be cancelled");
-    const settles = entry.data.report !== null || entry.data.state === "cancelling";
+    if (entry.data.state === "stopped") {
+      const stopped = task.data.workers.find((candidate) => candidate.id === input.workerId);
+      return success(task.data.revision, workspace.data.revision, stopped);
+    }
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
-      workspace: (current, mutation) => success(mutation.revision, mutation.revision, current),
+      workspace: (current, mutation) => success(mutation.revision, mutation.revision, {
+        ...current,
+        writer: current.writer?.owner.workerId === input.workerId ? null : current.writer
+      }),
       task: (current, mutation) => success(mutation.revision, null, {
         ...current,
         workers: current.workers.map((candidate) => candidate.id === input.workerId ? {
           ...candidate,
           recordedAt: mutation.now,
-          data: {
-            ...candidate.data,
-            state: settles ? "stopped" : "cancelling"
-          }
+          data: { ...candidate.data, state: "stopped" }
         } : candidate)
       })
     });
@@ -12486,7 +12955,7 @@ class WorkitCore {
       return attested;
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (current, mutation) => success(mutation.revision, mutation.revision, current),
@@ -12652,6 +13121,12 @@ class WorkitCore {
         if (!sameSession2(helper.data.data.session, this.context))
           return failure("permission_denied", "worker session does not match the caller");
       }
+      const gate = this.view(task.data);
+      if (gate.ok) {
+        const writeGates = (task.data.policy?.requirements ?? []).filter((requirement) => requirement.before === "write" && gate.data.requirements.some((evaluation) => evaluation.requirementId === requirement.id && (evaluation.status === "unsatisfied" || evaluation.status === "unavailable")));
+        if (writeGates.length)
+          return failure("requirements_unsatisfied", "writer ownership is gated by unsatisfied requirements; record their evidence or an approved limitation waiver first", { requirementIds: writeGates.map((requirement) => requirement.id) });
+      }
       const owner = {
         taskId: task.data.id,
         workerId: helperId,
@@ -12663,7 +13138,7 @@ class WorkitCore {
       };
       const changed = this.store.mutateTaskAndWorkspace({
         taskId: task.data.id,
-        expectedTaskRevision: input.expectedRevision,
+        expectedRevision: input.expectedRevision,
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         now: trustedNow(this.context),
         workspace: (current, mutation) => success(mutation.revision, mutation.revision, {
@@ -12694,7 +13169,7 @@ class WorkitCore {
     }
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (currentWorkspace, mutation) => success(mutation.revision, mutation.revision, { ...currentWorkspace, writer: null }),
@@ -12926,7 +13401,7 @@ class WorkitCore {
     if (view.task.workspaceId !== view.workspace.id)
       return failure("invalid_input", "task and workspace bindings are invalid");
     try {
-      if (realpathSync4(view.workspace.root) !== this.store.root)
+      if (realpathSync5(view.workspace.root) !== this.store.root)
         return failure("invalid_input", "task view root does not match the task store");
     } catch {
       return failure("invalid_input", "task view root cannot be resolved");
@@ -12943,7 +13418,15 @@ class WorkitCore {
       if (seen.has(observation.workerId))
         return failure("invalid_input", "worker observations must be unique");
       seen.add(observation.workerId);
-      if (observation.taskId !== view.task.id || observation.expectedRevision !== view.task.revision || observation.expectedWorkspaceRevision !== view.workspace.revision)
+      const freshTask = this.store.readTask(view.task.id);
+      const freshWorkspace = this.store.readWorkspace();
+      if (!freshTask.ok)
+        return freshTask;
+      if (!freshWorkspace.ok)
+        return freshWorkspace;
+      if (!freshWorkspace.data)
+        return failure("not_found", "workspace not found");
+      if (observation.taskId !== view.task.id || observation.expectedRevision !== freshTask.data.revision || observation.expectedWorkspaceRevision !== freshWorkspace.data.revision)
         return failure("revision_conflict", "worker observation is stale");
       if (!view.task.workers.some((entry) => entry.id === observation.workerId))
         return failure("permission_denied", "worker observation is not assigned");
@@ -13029,19 +13512,26 @@ class WorkitCore {
         return failure("permission_denied", "imported resume requires native destination approval");
       resumeCandidate = current.data.candidate;
     }
-    const blocker = this.activeWorkerBlocker(task.data, workspace.data);
+    const blocker = status === "paused" ? workspace.data.writer ? failure("recovery_required", "writer ownership must be released first") : null : this.activeWorkerBlocker(task.data, workspace.data);
     if (blocker)
       return blocker;
+    let pauseCandidate = null;
+    if (status === "paused") {
+      const captured = captureCandidate(this.store.root, task.data.intent.data.scope, environment());
+      if (!captured.ok)
+        return captured;
+      pauseCandidate = captured.data;
+    }
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (workspace, context) => success(context.revision, context.revision, workspace),
       task: (current, context) => success(context.revision, null, {
         ...current,
         status,
-        candidates: resumeCandidate && !current.candidates.some((candidate) => candidate.id === resumeCandidate.id) ? [...current.candidates, resumeCandidate] : current.candidates,
+        candidates: (resumeCandidate ?? pauseCandidate) && !current.candidates.some((candidate) => candidate.id === (resumeCandidate ?? pauseCandidate).id) ? [...current.candidates, resumeCandidate ?? pauseCandidate] : current.candidates,
         progress: current.progress,
         pauseReason: status === "paused" ? input.reason ?? null : null
       })
@@ -13079,12 +13569,13 @@ class WorkitCore {
       return workspace;
     if (!workspace.data)
       return failure("not_found", "workspace not found");
-    if (workspace.data.writer || task.data.workers.some((entry) => isUncertainWorker(entry.data.state)))
-      return failure("recovery_required", "scope revision requires worker ownership reconciliation");
+    const revisionBlocker = this.activeWorkerBlocker(task.data, workspace.data);
+    if (revisionBlocker)
+      return revisionBlocker;
     this.fillRevisions(input, task.data, workspace.data);
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (workspace, context) => success(context.revision, context.revision, workspace),
@@ -13140,7 +13631,7 @@ class WorkitCore {
       return closure;
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (value, context) => success(context.revision, context.revision, value),
@@ -13300,7 +13791,7 @@ var parseCodexHookInput = (value) => {
     return { ok: false, error: "permission_mode is invalid" };
   if (!(value.transcript_path === null || nonEmpty2(value.transcript_path)))
     return { ok: false, error: "transcript_path must be a string or null" };
-  if (!nonEmpty2(value.cwd) || !path7.isAbsolute(value.cwd) || !existsSync4(value.cwd))
+  if (!nonEmpty2(value.cwd) || !path9.isAbsolute(value.cwd) || !existsSync5(value.cwd))
     return { ok: false, error: "cwd must be an existing absolute path" };
   try {
     if (!statSync(value.cwd).isDirectory())
@@ -13326,7 +13817,7 @@ var parseCodexHookInput = (value) => {
       model: value.model,
       permission_mode: value.permission_mode,
       transcript_path: value.transcript_path,
-      cwd: realpathSync5(value.cwd),
+      cwd: realpathSync6(value.cwd),
       ...event === "SessionStart" ? { source: value.source } : {},
       ...nonEmpty2(value.turn_id) ? { turn_id: value.turn_id } : {},
       ...nonEmpty2(value.tool_name) ? { tool_name: value.tool_name } : {},