@brainervirus/workit-codex 2.1.0 → 2.1.2

package/dist/workit-hook.js

@@ -8783,6 +8783,45 @@ var metadataLockSchema = object({
   nonce: string2().min(1),
   externalAction: literal(true).optional()
 }).strict();
+var INDEX_VERSION = 1;
+var hostSession = (value) => isObject2(value) && value.kind === "host" && typeof value.host === "string" && typeof value.handle === "string" ? { host: value.host, handle: value.handle } : null;
+var indexEntry = (task, file) => {
+  const sessions = [];
+  const intent = hostSession(task.intent.provenance.session);
+  if (intent)
+    sessions.push({ ...intent, workerId: null });
+  for (const worker of task.workers) {
+    const session = hostSession(worker.data.session);
+    if (session)
+      sessions.push({ ...session, workerId: worker.id });
+  }
+  return {
+    id: task.id,
+    revision: task.revision,
+    status: task.status,
+    createdAt: task.createdAt,
+    updatedAt: task.updatedAt,
+    objective: task.intent.data.objective,
+    source: { host: task.intent.provenance.host, kind: task.intent.provenance.kind },
+    progress: { summary: task.progress.summary, nextAction: task.progress.nextAction },
+    sessions,
+    file
+  };
+};
+var fileSignature = (file) => {
+  try {
+    const stat = fs4.statSync(file, { bigint: true });
+    return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
+  } catch {
+    return null;
+  }
+};
+var RACY_WINDOW_NS = 2000000000n;
+var racySignature = (signature) => {
+  const [mtime = 0n, ctime = 0n] = signature.split(":").slice(3, 5).map(BigInt);
+  const changed = mtime > ctime ? mtime : ctime;
+  return BigInt(Date.now()) * 1000000n - changed < RACY_WINDOW_NS;
+};
 var now = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
 var cachedRuntimeVersion = null;
 var runtimeVersion = () => {
@@ -8911,6 +8950,57 @@ class TaskStore {
     }
     return success(null, null, tasks);
   }
+  listTaskIndex() {
+    if (!fs4.existsSync(this.tasksDir))
+      return success(null, null, []);
+    let names;
+    try {
+      names = fs4.readdirSync(this.tasksDir).filter((name) => name.endsWith(".json"));
+    } catch (error) {
+      return failure("storage_error", `unable to list tasks: ${String(error)}`, {
+        path: this.tasksDir
+      });
+    }
+    const workspace = this.readWorkspace();
+    if (!workspace.ok)
+      return workspace;
+    if (!workspace.data)
+      return failure("recovery_required", "task workspace binding is invalid", {
+        path: this.workspacePath
+      });
+    const stored = this.readIndex(workspace.data.id);
+    const entries = [];
+    let changed = Object.keys(stored).length !== names.length;
+    for (const name of names.sort()) {
+      const file = path4.join(this.tasksDir, name);
+      const signature = fileSignature(file);
+      if (signature === null) {
+        changed = true;
+        continue;
+      }
+      const cached = stored[name.slice(0, -5)];
+      if (cached && cached.file === signature && !racySignature(signature)) {
+        entries.push(cached);
+        continue;
+      }
+      const item = this.readRecord(file, taskRecordSchema);
+      if (!item.exists)
+        continue;
+      if (!item.result.ok)
+        return item.result;
+      if (!validId(name.slice(0, -5)) || item.result.data.id !== name.slice(0, -5))
+        return failure("recovery_required", "task filename and record ID differ", { path: name });
+      if (item.result.data.workspaceId !== workspace.data.id)
+        return failure("recovery_required", "task workspace binding is invalid", { path: name });
+      const entry = indexEntry(item.result.data, signature);
+      if (!cached || canonicalJson(cached) !== canonicalJson(entry))
+        changed = true;
+      entries.push(entry);
+    }
+    if (changed)
+      this.writeIndex(workspace.data.id, entries);
+    return success(null, null, entries);
+  }
   readWorkspace() {
     const item = this.readRecord(this.workspacePath, workspaceRecordSchema);
     if (!item.exists)
@@ -9590,6 +9680,8 @@ class TaskStore {
       fs4.renameSync(temporary, file);
       temporary = undefined;
       this.fsyncDirectory(path4.dirname(file));
+      if (path4.dirname(file) === this.tasksDir)
+        this.indexTaskWrite(file, value);
       return success(null, null, value);
     } catch (error) {
       return failure("storage_error", `snapshot replacement failed: ${String(error)}`, {
@@ -9602,6 +9694,45 @@ class TaskStore {
         } catch {}
     }
   }
+  readIndex(workspaceId) {
+    try {
+      const value = JSON.parse(fs4.readFileSync(this.indexPath, "utf8"));
+      if (!isObject2(value) || value.version !== INDEX_VERSION || value.workspaceId !== workspaceId || !isObject2(value.tasks))
+        return {};
+      const tasks = {};
+      for (const [id, entry] of Object.entries(value.tasks))
+        if (isObject2(entry) && entry.id === id && typeof entry.file === "string" && typeof entry.status === "string" && typeof entry.updatedAt === "string" && Array.isArray(entry.sessions) && isObject2(entry.progress) && isObject2(entry.source))
+          tasks[id] = entry;
+      return tasks;
+    } catch {
+      return {};
+    }
+  }
+  writeIndex(workspaceId, entries) {
+    const temporary = `${this.indexPath}.${process.pid}.${randomUUID2()}.tmp`;
+    try {
+      fs4.writeFileSync(temporary, JSON.stringify({
+        version: INDEX_VERSION,
+        workspaceId,
+        tasks: Object.fromEntries(entries.map((entry) => [entry.id, entry]))
+      }), { mode: 384, flag: "wx" });
+      fs4.renameSync(temporary, this.indexPath);
+    } catch {
+      try {
+        fs4.unlinkSync(temporary);
+      } catch {}
+    }
+  }
+  indexTaskWrite(file, task) {
+    try {
+      const signature = fileSignature(file);
+      if (signature === null)
+        return;
+      const tasks = this.readIndex(task.workspaceId);
+      tasks[task.id] = indexEntry(task, signature);
+      this.writeIndex(task.workspaceId, Object.values(tasks));
+    } catch {}
+  }
   saveRecovery(file, bytes) {
     const target = path4.basename(file) === "workspace.json" ? "workspace" : "task";
     const id = target === "task" ? path4.basename(file, ".json") : "workspace";
@@ -9760,6 +9891,9 @@ class TaskStore {
   get workspacePath() {
     return path4.join(this.workitDir, "workspace.json");
   }
+  get indexPath() {
+    return path4.join(this.workitDir, "index.json");
+  }
   get lockPath() {
     return path4.join(this.workitDir, "metadata.lock");
   }
@@ -9767,71 +9901,8 @@ class TaskStore {
     return path4.join(this.workitDir, ".gitignore");
   }
 }
-// packages/workit-core/src/core/workers.ts
-var same = (left, right) => {
-  try {
-    return canonicalJson(left) === canonicalJson(right);
-  } catch {
-    return false;
-  }
-};
-var UNCERTAIN_WORKER_STATES = ["dispatching", "running", "cancelling", "unknown"];
-var isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state);
-var workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state);
-var callerSession = (caller) => caller.session ?? { kind: "host", host: caller.host, handle: caller.actor };
-var validPath = (value) => typeof value === "string" && value.length > 0 && ![...value].some((char) => {
-  const code = char.charCodeAt(0);
-  return code < 32 || code === 127;
-}) && !value.split(/[\\/]/).includes("..");
-var callerValue = (value) => ({ host: value.host, actor: value.actor });
-var workerIdOf = (value) => value.workerId ?? null;
-var currentWriterOwnsTask = (task, workspace, caller) => {
-  const owner = workspace.writer?.owner;
-  return task.status === "active" && task.workspaceId === workspace.id && owner?.taskId === task.id && owner.session.host === caller.host && owner.session.handle === caller.actor;
-};
-function assertProductWriteAllowed(input) {
-  if (!Array.isArray(input.paths) || input.paths.some((path) => !validPath(path)))
-    return failure("invalid_input", "invalid product write path");
-  if (!input.store)
-    return failure("permission_denied", "write authorization requires core state");
-  const task = input.store.readTask(input.task.id);
-  if (!task.ok)
-    return task;
-  const workspace = input.store.readWorkspace();
-  if (!workspace.ok)
-    return workspace;
-  if (!workspace.data)
-    return failure("not_found", "workspace not found");
-  const workspaceRecord = workspace.data;
-  if (task.data.status !== "active")
-    return failure("invalid_transition", "paused or closed tasks cannot own product writes");
-  if (workspaceRecord.id !== task.data.workspaceId || workspaceRecord.root.length === 0)
-    return failure("recovery_required", "task and workspace bindings are invalid");
-  const writer = workspaceRecord.writer;
-  if (!writer)
-    return failure("permission_denied", "checkout has no writer owner");
-  if (writer.state === "uncertain")
-    return failure("recovery_required", "checkout writer requires recovery", {
-      owner: writer.owner
-    });
-  const caller = callerValue(input.caller);
-  const workerId = workerIdOf(input.caller);
-  const owner = writer.owner;
-  if (owner.taskId !== task.data.id || owner.workerId !== workerId || owner.session.host !== caller.host || owner.session.handle !== caller.actor)
-    return failure("writer_conflict", "checkout is owned by another validated actor", { owner });
-  const worker = workerId === null ? null : task.data.workers.find((entry) => entry.id === workerId);
-  if (workerId !== null && (!worker || worker.data.assignment.role !== "implementer"))
-    return failure("permission_denied", "only implementers can own product writes");
-  if (workerId !== null && (!worker?.data.session || worker.data.state === "cancelling" || worker.data.state === "unknown" || worker.data.state === "stopped" || !same(worker.data.session, callerSession(input.caller))))
-    return failure("recovery_required", "worker session is not an active writer");
-  return success(null, workspaceRecord.revision, owner);
-}
-
-// packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash7 } from "node:crypto";
-import * as fs7 from "node:fs";
-import { spawnSync as spawnSync2 } from "node:child_process";
-import path10 from "node:path";
+// packages/workit-core/src/core/task-engine.ts
+import { realpathSync as realpathSync6 } from "node:fs";
 
 // packages/workit-core/src/core/authority.ts
 import { createHash as createHash6 } from "node:crypto";
@@ -10656,6 +10727,66 @@ var verifyPushIdentity = (root, provider, account) => {
   return { ok: true };
 };
 
+// packages/workit-core/src/core/workers.ts
+var same = (left, right) => {
+  try {
+    return canonicalJson(left) === canonicalJson(right);
+  } catch {
+    return false;
+  }
+};
+var UNCERTAIN_WORKER_STATES = ["dispatching", "running", "cancelling", "unknown"];
+var isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state);
+var workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state);
+var callerSession = (caller) => caller.session ?? { kind: "host", host: caller.host, handle: caller.actor };
+var validPath = (value) => typeof value === "string" && value.length > 0 && ![...value].some((char) => {
+  const code = char.charCodeAt(0);
+  return code < 32 || code === 127;
+}) && !value.split(/[\\/]/).includes("..");
+var callerValue = (value) => ({ host: value.host, actor: value.actor });
+var workerIdOf = (value) => value.workerId ?? null;
+var currentWriterOwnsTask = (task, workspace, caller) => {
+  const owner = workspace.writer?.owner;
+  return task.status === "active" && task.workspaceId === workspace.id && owner?.taskId === task.id && owner.session.host === caller.host && owner.session.handle === caller.actor;
+};
+function assertProductWriteAllowed(input) {
+  if (!Array.isArray(input.paths) || input.paths.some((path) => !validPath(path)))
+    return failure("invalid_input", "invalid product write path");
+  if (!input.store)
+    return failure("permission_denied", "write authorization requires core state");
+  const task = input.store.readTask(input.task.id);
+  if (!task.ok)
+    return task;
+  const workspace = input.store.readWorkspace();
+  if (!workspace.ok)
+    return workspace;
+  if (!workspace.data)
+    return failure("not_found", "workspace not found");
+  const workspaceRecord = workspace.data;
+  if (task.data.status !== "active")
+    return failure("invalid_transition", "paused or closed tasks cannot own product writes");
+  if (workspaceRecord.id !== task.data.workspaceId || workspaceRecord.root.length === 0)
+    return failure("recovery_required", "task and workspace bindings are invalid");
+  const writer = workspaceRecord.writer;
+  if (!writer)
+    return failure("permission_denied", "checkout has no writer owner");
+  if (writer.state === "uncertain")
+    return failure("recovery_required", "checkout writer requires recovery", {
+      owner: writer.owner
+    });
+  const caller = callerValue(input.caller);
+  const workerId = workerIdOf(input.caller);
+  const owner = writer.owner;
+  if (owner.taskId !== task.data.id || owner.workerId !== workerId || owner.session.host !== caller.host || owner.session.handle !== caller.actor)
+    return failure("writer_conflict", "checkout is owned by another validated actor", { owner });
+  const worker = workerId === null ? null : task.data.workers.find((entry) => entry.id === workerId);
+  if (workerId !== null && (!worker || worker.data.assignment.role !== "implementer"))
+    return failure("permission_denied", "only implementers can own product writes");
+  if (workerId !== null && (!worker?.data.session || worker.data.state === "cancelling" || worker.data.state === "unknown" || worker.data.state === "stopped" || !same(worker.data.session, callerSession(input.caller))))
+    return failure("recovery_required", "worker session is not an active writer");
+  return success(null, workspaceRecord.revision, owner);
+}
+
 // packages/workit-core/src/core/auto-approval.ts
 var AUTO_CLASSES = ["branch", "commit", "push", "pr", "merge"];
 var OPERATION_CLASS = {
@@ -11346,41 +11477,18 @@ function reconcileAction(input) {
 var bindingCovers = scopeCovers;
 var verifyDecisionContent = verifyContentRefs;
 
-// packages/workit-core/src/core/task-evaluation.ts
-var digestBytes3 = (value) => createHash7("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path10.sep}`);
-var relative = (root, candidate) => path10.relative(root, candidate).split(path10.sep).join("/") || ".";
-var canonicalPath = (value) => {
-  if (typeof value !== "string" || !value)
-    return null;
-  if (value.includes("\\") || value.split("/").includes(".."))
-    return null;
-  const normalized = path10.posix.normalize(value);
-  if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
-    return null;
-  return normalized === "." ? "." : normalized.replace(/\/$/, "");
-};
-var canonicalScope = (scope) => {
-  const paths = scope.paths.length ? scope.paths : ["."];
-  const normalizedPaths = paths.map(canonicalPath);
-  const normalizedExclusions = scope.exclusions.map(canonicalPath);
-  if (normalizedPaths.some((value) => value === null) || normalizedExclusions.some((value) => value === null))
-    return null;
-  return {
-    description: scope.description,
-    paths: [...new Set(normalizedPaths)],
-    exclusions: [...new Set(normalizedExclusions)]
-  };
-};
-var excluded = (value, exclusions) => exclusions.some((item) => item === value || item !== "." && value.startsWith(`${item}/`));
-var scopeMatches = (value, scope) => {
-  const normalized = canonicalScope(scope);
-  if (!normalized)
-    return false;
-  const paths = normalized.paths;
-  return paths.some((item) => item === "." || value === item || value.startsWith(`${item}/`)) && !excluded(value, normalized.exclusions);
-};
-var pathRelevant = (value, scope) => scopeMatches(value, scope);
+// packages/workit-core/src/core/policy-resolver.ts
+var resolverInputSchema = object({
+  intent: intentSchema,
+  assessment: assessmentSchema,
+  constraints: array(constraintSchema),
+  prior: object({
+    decisions: array(decisionSchema),
+    findings: array(findingSchema),
+    requirements: array(requirementSchema)
+  }).strict(),
+  preferences: object({ fast: boolean2().optional(), thorough: boolean2().optional() }).strict().optional()
+}).strict();
 var compareCodeUnits2 = (left, right) => {
   const length = Math.min(left.length, right.length);
   for (let index = 0;index < length; index += 1) {
@@ -11390,1152 +11498,1049 @@ var compareCodeUnits2 = (left, right) => {
   }
   return left.length - right.length;
 };
-var gitPaths = (root) => {
-  const result = spawnSync2("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
-    cwd: root,
-    encoding: "buffer"
-  });
-  if (result.status !== 0) {
-    const stderr = result.stderr?.toString("utf8") ?? "";
-    return {
-      paths: [],
-      uncertain: !/not a git repository/i.test(stderr),
-      git: /not a git repository/i.test(stderr) ? false : true
-    };
-  }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path10.sep).join("/")) : [];
-  const stagedDeleted = spawnSync2("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
-  if (stagedDeleted.status !== 0) {
-    const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
-    if (!/not a git repository/i.test(stderr))
-      return { paths, uncertain: true, git: true };
-  } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path10.sep).join("/")));
-  }
-  return { paths: [...new Set(paths)], uncertain: false, git: true };
-};
-var walk = (root, directory, output) => {
-  let names;
-  try {
-    names = fs7.readdirSync(directory);
-  } catch {
-    return true;
-  }
-  let uncertain = false;
-  for (const name of names) {
-    if (name === ".git" || name === ".workit")
-      continue;
-    const target = path10.join(directory, name);
-    let stat;
-    try {
-      stat = fs7.lstatSync(target);
-    } catch {
-      uncertain = true;
-      continue;
-    }
-    const item = relative(root, target);
-    output.add(item);
-    if (stat.isDirectory() && !stat.isSymbolicLink())
-      uncertain = walk(root, target, output) || uncertain;
-  }
-  return uncertain;
-};
-var scopeRoots = (root, scope) => {
-  const roots = [];
-  for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path10.resolve(root, item);
-    if (!inside(root, target))
-      return failure("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
-    let ancestor = target;
-    while (!fs7.existsSync(ancestor) && ancestor !== root)
-      ancestor = path10.dirname(ancestor);
-    try {
-      if (!inside(root, fs7.realpathSync(ancestor)))
-        return failure("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
-    } catch {
-      return failure("invalid_input", `candidate scope cannot be inspected: ${item}`);
-    }
-    roots.push(target);
-  }
-  return success(null, null, roots);
-};
-function captureCandidate(root, scope, environment = []) {
-  let checkout;
-  try {
-    checkout = fs7.realpathSync(root);
-  } catch {
-    return failure("invalid_input", "candidate root does not exist");
-  }
-  const normalizedScope = canonicalScope(scope);
-  if (!normalizedScope)
-    return failure("invalid_input", "candidate scope is invalid: paths must be checkout-relative — to work in another repository, keep this task here and coordinate a separate linked task in that checkout", { fields: [{ path: "scope.paths", reason: "must be checkout-relative" }] });
-  const roots = scopeRoots(checkout, normalizedScope);
-  if (!roots.ok)
-    return roots;
-  const git = gitPaths(checkout);
-  const names = new Set;
-  let uncertain = git.uncertain;
-  for (const target of roots.data) {
-    const item = relative(checkout, target);
-    if (item === ".git" || item === ".workit")
-      continue;
-    names.add(item);
-    if (!fs7.existsSync(target))
-      continue;
-    let stat;
-    try {
-      stat = fs7.lstatSync(target);
-    } catch {
-      uncertain = true;
-      continue;
-    }
-    if (!git.git && stat.isDirectory() && !stat.isSymbolicLink())
-      uncertain = walk(checkout, target, names) || uncertain;
-  }
-  for (const item of git.paths)
-    if (scopeMatches(item, normalizedScope))
-      names.add(item);
-  const files = [];
-  let completeness = uncertain ? "uncertain" : "known";
-  for (const item of [...names].sort()) {
-    if (!scopeMatches(item, normalizedScope))
-      continue;
-    const target = path10.join(checkout, item);
-    try {
-      const stat = fs7.lstatSync(target);
-      if (stat.isSymbolicLink()) {
-        const link = fs7.readlinkSync(target);
-        files.push({ path: item, kind: "symlink", digest: digestBytes3(link), executable: null });
-      } else if (stat.isFile()) {
-        files.push({
-          path: item,
-          kind: "file",
-          digest: digestBytes3(fs7.readFileSync(target)),
-          executable: (stat.mode & 73) !== 0
-        });
-      } else if (!stat.isDirectory()) {
-        completeness = "uncertain";
-      } else if (git.git && git.paths.includes(item)) {
-        completeness = "uncertain";
-      }
-    } catch (error) {
-      if (error?.code === "ENOENT") {
-        files.push({ path: item, kind: "absent", digest: null, executable: null });
-      } else
-        completeness = "uncertain";
-    }
-  }
-  const supplied = Array.isArray(environment) ? environment.map((value) => typeof value === "string" ? { name: value, value: process.env[value] ?? null } : { name: value.name, value: value.value ?? null }) : Object.keys(environment).map((name) => ({
+var stableUnique = (values) => [...new Set(values)].sort(compareCodeUnits2);
+var stableList = (values) => [...values].sort((left, right) => compareCodeUnits2(canonicalJson(left), canonicalJson(right)));
+var normalizedScope = (scope) => ({
+  description: scope.description,
+  paths: stableUnique(scope.paths),
+  exclusions: stableUnique(scope.exclusions)
+});
+var normalizedRefList = (values) => stableList(values);
+var normalizeAssessment = (assessment) => ({
+  facts: stableList(assessment.facts.map((fact) => ({ ...fact, refs: normalizedRefList(fact.refs) }))),
+  signals: Object.fromEntries(Object.entries(assessment.signals).map(([name, signal]) => [
     name,
-    value: environment[name] ?? null
-  }));
-  const namesByEnvironment = supplied.map(({ name }) => name);
-  if (new Set(namesByEnvironment).size !== namesByEnvironment.length || namesByEnvironment.some((name) => typeof name !== "string" || !name))
-    return failure("invalid_input", "candidate environment names must be unique and non-empty");
-  const values = supplied.sort((left, right) => compareCodeUnits2(left.name, right.name)).map(({ name, value }) => ({ name, value, refs: [] }));
-  if (values.some(({ value }) => value === null))
-    completeness = "uncertain";
-  const headResult = spawnSync2("git", ["rev-parse", "HEAD"], { cwd: checkout, encoding: "utf8" });
-  if (headResult.status !== 0 && !/not a git repository/i.test(headResult.stderr ?? ""))
-    completeness = "uncertain";
-  const head = headResult.status === 0 ? headResult.stdout.trim() : null;
-  const partial = {
-    id: "0".repeat(64),
-    scope: normalizedScope,
-    completeness,
-    files,
-    environment: values,
-    head
+    { ...signal, refs: normalizedRefList(signal.refs) }
+  ])),
+  consequences: stableList(assessment.consequences.map((consequence) => ({
+    ...consequence,
+    fact: { ...consequence.fact, refs: normalizedRefList(consequence.fact.refs) }
+  }))),
+  verification: stableList(assessment.verification.map((verification) => ({
+    ...verification,
+    scope: normalizedScope(verification.scope),
+    availableChecks: normalizedRefList(verification.availableChecks),
+    gaps: stableUnique(verification.gaps)
+  })))
+});
+var normalizeConstraint = (constraint) => ({
+  ...constraint,
+  source: constraint.source,
+  requires: stableList(constraint.requires.map((requirement) => ({
+    ...requirement,
+    scope: normalizedScope(requirement.scope),
+    refs: normalizedRefList(requirement.refs)
+  })))
+});
+var normalizeDecision = (decision) => ({
+  ...decision,
+  binding: {
+    ...decision.binding,
+    scope: normalizedScope(decision.binding.scope),
+    contentRefs: normalizedRefList(decision.binding.contentRefs)
+  },
+  requirementIds: stableUnique(decision.requirementIds)
+});
+var normalizeIntent = (intent) => ({
+  ...intent,
+  scope: normalizedScope(intent.scope),
+  authorityRefs: normalizedRefList(intent.authorityRefs)
+});
+var normalizePrior = (prior) => ({
+  decisions: stableList(prior.decisions.map(normalizeDecision)),
+  findings: stableList(prior.findings.map((finding) => ({
+    ...finding,
+    scope: normalizedScope(finding.scope),
+    refs: normalizedRefList(finding.refs),
+    resolution: finding.resolution ? {
+      ...finding.resolution,
+      evidenceIds: stableUnique(finding.resolution.evidenceIds),
+      decisionIds: stableUnique(finding.resolution.decisionIds)
+    } : null
+  }))),
+  requirements: stableList(prior.requirements.map((requirement) => ({
+    ...requirement,
+    scope: normalizedScope(requirement.scope)
+  })))
+});
+var invalidFields = (error) => ({
+  fields: error.issues.map((issue) => ({
+    path: issue.code === "unrecognized_keys" ? issue.keys.join(".") : issue.path.join("."),
+    reason: issue.message
+  }))
+});
+function normalizeResolverInput(input) {
+  const parsed = resolverInputSchema.safeParse(input);
+  if (!parsed.success)
+    return failure("invalid_input", "resolver input is invalid", invalidFields(parsed.error));
+  const value = parsed.data;
+  const signals = value.assessment.signals;
+  if (signals.behaviorChange.value === true && signals.mechanicalLowRisk.value === true)
+    return failure("invalid_input", "behavioral change cannot be wholly mechanical", {
+      fields: [
+        {
+          path: "assessment.signals",
+          reason: "contradictory behaviorChange and mechanicalLowRisk"
+        }
+      ]
+    });
+  const ids = value.constraints.map((constraint) => constraint.id);
+  if (new Set(ids).size !== ids.length)
+    return failure("invalid_input", "constraint IDs must be unique", {
+      fields: [{ path: "constraints", reason: "duplicate constraint id" }]
+    });
+  if (value.preferences?.fast && value.preferences.thorough)
+    return failure("invalid_input", "fast and thorough preferences contradict", {
+      fields: [{ path: "preferences", reason: "fast and thorough cannot both be enabled" }]
+    });
+  const normalized = {
+    intent: normalizeIntent(value.intent),
+    assessment: normalizeAssessment(value.assessment),
+    constraints: stableList(value.constraints.map(normalizeConstraint)),
+    prior: normalizePrior(value.prior),
+    ...value.preferences ? { preferences: { ...value.preferences } } : {},
+    policyVersion: POLICY_VERSION
   };
-  const candidate = { ...partial, id: candidateDigest(partial) };
-  const parsed = candidateSchema.safeParse(candidate);
-  return parsed.success ? success(null, null, parsed.data) : failure("invalid_input", "captured candidate is invalid");
+  return success(null, null, normalized);
 }
-var fileMap = (candidate) => new Map(candidate.files.map((file) => [file.path, file]));
-var changedPaths = (before, after) => {
-  const paths = new Set([...before.files, ...after.files].map((file) => file.path));
-  const left = fileMap(before);
-  const right = fileMap(after);
-  const changed = [...paths].filter((item) => JSON.stringify(left.get(item) ?? null) !== JSON.stringify(right.get(item) ?? null));
-  if (before.head !== after.head)
-    changed.push(".");
-  if (JSON.stringify(before.environment) !== JSON.stringify(after.environment))
-    changed.push(".");
-  return changed;
-};
-var sessionFromRef = (value) => {
-  if (typeof value !== "object" || value === null || value.kind !== "host")
-    return null;
-  return typeof value.host === "string" && typeof value.handle === "string" ? { host: value.host, handle: value.handle } : null;
-};
-var sameSession = (left, right) => {
-  const other = sessionFromRef(right);
-  return left !== null && other !== null && left.host === other.host && left.handle === other.handle;
-};
-var evidenceScopes = (task, ids) => (task.policy?.requirements ?? []).filter((requirement) => ids.includes(requirement.id)).map((requirement) => requirement.scope);
-function evaluateEvidence(task, candidate) {
-  const current = candidate ?? task.candidates.at(-1) ?? null;
-  return task.evidence.map((entry) => {
-    const evidence = entry.data;
-    if (evidence.result === "failed")
-      return {
-        evidenceId: entry.id,
-        status: "failed",
-        reason: "failed evidence remains historical"
-      };
-    if (evidence.kind === "check" || evidence.kind === "review") {
-      if (!evidence.beforeCandidateId || !evidence.candidateId)
-        return {
-          evidenceId: entry.id,
-          status: "stale",
-          reason: "check or review evidence lacks start and end candidates"
-        };
-      if (evidence.beforeCandidateId !== evidence.candidateId)
-        return {
-          evidenceId: entry.id,
-          status: "stale",
-          reason: "candidate changed during the check or review"
-        };
+var requirement = (spec) => ({
+  ...spec,
+  id: requirementId({
+    ruleId: spec.ruleId,
+    scope: spec.scope,
+    satisfaction: spec.satisfaction,
+    before: spec.before,
+    dependentAction: spec.dependentAction
+  })
+});
+var signalReason = (input, name) => input.assessment.signals[name].reason;
+function resolveRequirements(input) {
+  const { signals } = input.assessment;
+  const scope = input.intent.scope;
+  const requirements = [];
+  const hasUnknownSignal = Object.values(signals).some((signal) => signal.value === "unknown");
+  const hasUnknownFact = [
+    ...input.assessment.facts,
+    ...input.assessment.consequences.map(({ fact }) => fact)
+  ].some((fact) => fact.basis === "unknown");
+  if (hasUnknownSignal || hasUnknownFact)
+    requirements.push(requirement({
+      ruleId: "consequential-unknown",
+      dimension: "investigation",
+      scope,
+      reason: `Resolve consequential uncertainty before the dependent action: ${[
+        ...Object.entries(signals).filter(([, signal]) => signal.value === "unknown").map(([name]) => name),
+        ...hasUnknownFact ? ["unknown fact"] : []
+      ].join(", ")}`,
+      satisfaction: "An observed or inferred fact resolves the uncertainty and records its supporting references.",
+      before: "dependent_action",
+      dependentAction: null,
+      acceptanceAllowed: false
+    }));
+  if (signals.productChoiceOpen.value === true)
+    requirements.push(requirement({
+      ruleId: "product-decision",
+      dimension: "decisions",
+      scope,
+      reason: `A consequential product choice remains open: ${signalReason(input, "productChoiceOpen")}`,
+      satisfaction: "Present the material alternatives and record the user's decision before the dependent action.",
+      before: "dependent_action",
+      dependentAction: null,
+      acceptanceAllowed: false
+    }));
+  const independentBehaviorReview = input.preferences?.thorough === true || input.assessment.consequences.some((consequence) => ["security", "data", "public_contract", "operations"].includes(consequence.area));
+  if (signals.behaviorChange.value === true)
+    requirements.push(requirement({
+      ruleId: "behavioral-verification",
+      dimension: "testing",
+      scope,
+      reason: `Behavior, side effects, permissions, or data handling may change: ${signalReason(input, "behaviorChange")}`,
+      satisfaction: "A useful behavioral check passes against the affected behavior and current candidate.",
+      before: "close",
+      dependentAction: null,
+      acceptanceAllowed: false
+    }), requirement({
+      ruleId: independentBehaviorReview ? "fresh-context-review" : "self-review",
+      dimension: "review",
+      scope,
+      reason: independentBehaviorReview ? "Consequential behavior or the thorough preference requires fresh-context review." : "Bounded behavior changes use self-review unless consequential risks or trusted rules require more.",
+      satisfaction: independentBehaviorReview ? "A separate review context examines the current candidate and records its result." : "The lead reviews the resulting diff and records the relevant scope and checks.",
+      before: "close",
+      dependentAction: null,
+      acceptanceAllowed: !independentBehaviorReview
+    }));
+  else if (signals.mechanicalLowRisk.value === true)
+    requirements.push(requirement({
+      ruleId: "mechanical-existing-checks",
+      dimension: "verification",
+      scope,
+      reason: `The change is demonstrably mechanical and low-risk: ${signalReason(input, "mechanicalLowRisk")}`,
+      satisfaction: "Run the relevant existing checks for affected consumers; do not add tautological tests.",
+      before: "close",
+      dependentAction: null,
+      acceptanceAllowed: true
+    }), requirement({
+      ruleId: input.preferences?.thorough ? "fresh-context-review" : "self-review",
+      dimension: "review",
+      scope,
+      reason: input.preferences?.thorough ? "The thorough preference upgrades mechanical self-review to fresh-context review." : "Mechanical low-risk work uses self-review rather than mandatory fresh-context review.",
+      satisfaction: input.preferences?.thorough ? "A separate review context examines the current candidate and records its result." : "The lead reviews the resulting diff and records the relevant scope and checks.",
+      before: "close",
+      dependentAction: null,
+      acceptanceAllowed: !input.preferences?.thorough
+    }));
+  if (signals.behaviorChange.value === true || signals.mechanicalLowRisk.value === true)
+    requirements.push(requirement({
+      ruleId: "pre-pr-cleanup",
+      dimension: "verification",
+      scope,
+      reason: "Implementation output must be deslopped before it is delivered.",
+      satisfaction: "Run the workit-deslop pass and record passing check evidence, or record an approved limitation decision waiving cleanup.",
+      before: "dependent_action",
+      dependentAction: "hosting.pull_request",
+      acceptanceAllowed: true
+    }));
+  if (signals.durableAgreementNeeded.value === true)
+    requirements.push(requirement({
+      ruleId: "durable-spec",
+      dimension: "artifacts",
+      scope,
+      reason: `The work needs a durable agreement about intended behavior: ${signalReason(input, "durableAgreementNeeded")}`,
+      satisfaction: "Record the agreed behavior in a durable specification before implementation writes.",
+      before: "write",
+      dependentAction: null,
+      acceptanceAllowed: true
+    }));
+  if (signals.coordinationPlanNeeded.value === true)
+    requirements.push(requirement({
+      ruleId: "coordination-plan",
+      dimension: "continuity",
+      scope,
+      reason: `Dependencies, sequencing, or resumption need durable coordination: ${signalReason(input, "coordinationPlanNeeded")}`,
+      satisfaction: "Record useful sequencing, dependencies, and the next action in a compact plan.",
+      before: "dependent_action",
+      dependentAction: null,
+      acceptanceAllowed: true
+    }));
+  if (signals.helperUseful.value === true && !input.preferences?.fast)
+    requirements.push(requirement({
+      ruleId: "helper-usefulness",
+      dimension: "delegation",
+      scope,
+      reason: `Independent judgment or investigation justifies a scoped helper: ${signalReason(input, "helperUseful")}`,
+      satisfaction: "Use a bounded helper only for the independent objective and reconcile its result.",
+      before: "dependent_action",
+      dependentAction: null,
+      acceptanceAllowed: true
+    }));
+  for (const constraint of input.constraints)
+    for (const obligation of constraint.requires) {
+      const dimension = obligation.method ?? (obligation.kind === "check" ? "verification" : obligation.kind === "decision" ? "decisions" : "challenge");
+      requirements.push(requirement({
+        ruleId: `project-constraint:${constraint.id}:${obligation.kind}:${sha256({
+          kind: obligation.kind,
+          scope: normalizedScope(obligation.scope),
+          refs: normalizedRefList(obligation.refs),
+          method: obligation.method,
+          before: obligation.before,
+          dependentAction: obligation.dependentAction
+        })}`,
+        dimension,
+        scope: obligation.scope,
+        reason: `${constraint.kind} constraint requires ${obligation.kind}: ${constraint.statement}`,
+        satisfaction: `Satisfy the constraint obligation using its referenced ${obligation.kind}.`,
+        before: obligation.before,
+        dependentAction: obligation.dependentAction,
+        acceptanceAllowed: constraint.acceptanceAllowed && obligation.kind !== "decision"
+      }));
     }
-    if (!evidence.candidateId || !current)
-      return {
-        evidenceId: entry.id,
-        status: evidence.result,
-        reason: "evidence has no candidate binding"
-      };
-    const observed = task.candidates.find((item) => item.id === evidence.candidateId) ?? (current.id === evidence.candidateId ? current : undefined);
-    if (!observed || observed.completeness === "uncertain" || current.completeness === "uncertain")
-      return { evidenceId: entry.id, status: "stale", reason: "candidate is missing or uncertain" };
-    if (observed.id === current.id)
-      return { evidenceId: entry.id, status: evidence.result, reason: "candidate is unchanged" };
-    const scopes = evidenceScopes(task, evidence.requirementIds);
-    const changed = changedPaths(observed, current);
-    const environmentChanged = JSON.stringify(observed.environment) !== JSON.stringify(current.environment);
-    if (!scopes.length || environmentChanged || changed.some((item) => scopes.some((scope) => pathRelevant(item, scope))))
-      return { evidenceId: entry.id, status: "stale", reason: "relevant candidate state changed" };
-    return {
-      evidenceId: entry.id,
-      status: evidence.result,
-      reason: "candidate changed outside evidence scope"
-    };
+  const seen = new Set;
+  return requirements.filter((item) => {
+    if (seen.has(item.id))
+      return false;
+    seen.add(item.id);
+    return true;
   });
 }
-var scopeCovers2 = scopeCovers;
-var checkPin = (assignment, beforeCandidateId, candidateId) => {
-  const pin = assignment.candidateId ?? null;
-  if (pin === null)
-    return true;
-  return (beforeCandidateId ?? null) === pin || (candidateId ?? null) === pin;
-};
-var resolveBinding = (evidence, pin, currentCandidateId) => {
-  const bound = evidence.kind === "check" || evidence.kind === "review";
-  const fallback = bound ? pin ?? currentCandidateId : null;
-  return {
-    beforeCandidateId: evidence.beforeCandidateId ?? fallback,
-    candidateId: evidence.candidateId ?? fallback
+function resolvePolicy(input) {
+  const normalized = normalizeResolverInput(input);
+  if (!normalized.ok)
+    return normalized;
+  const requirements = resolveRequirements(normalized.data);
+  const policy = {
+    policyVersion: POLICY_VERSION,
+    inputDigest: sha256(canonicalJson(normalized.data)),
+    requirements
   };
-};
-var findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId != null);
-var applicableDecision2 = (task, workspace, requirement, checkoutRoot) => task.decisions.filter((entry) => entry.provenance.kind !== "imported").map((entry) => entry.data).filter((decision) => decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.binding.taskId === task.id && decision.binding.workspaceId === workspace.id && decision.requirementIds.includes(requirement.id) && decision.binding.scope && scopeCovers2(decision.binding.scope, requirement.scope) && decision.digest === decisionDigest(decision) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok : decision.binding.contentRefs.every((reference) => reference.kind !== "file")));
-var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && (data.response === "approved" || data.response === "stated") && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
-var evidenceMatchesRequirement = (kind, evidenceKind, dimension, ruleId) => {
-  if (kind !== "passed")
-    return false;
-  if (dimension === "testing" || dimension === "verification")
-    return evidenceKind === "check" || ruleId === "pre-pr-cleanup" && evidenceKind === "artifact";
-  if (dimension === "review")
-    return evidenceKind === "review";
-  if (dimension === "investigation" || dimension === "challenge")
-    return evidenceKind === "investigation";
-  if (dimension === "artifacts" || dimension === "continuity")
-    return evidenceKind === "artifact";
-  return false;
-};
-var expectedKinds = (dimension, ruleId) => {
-  if (dimension === "testing")
-    return "check";
-  if (dimension === "verification")
-    return ruleId === "pre-pr-cleanup" ? "check or artifact" : "check";
-  if (dimension === "review")
-    return "review";
-  if (dimension === "investigation" || dimension === "challenge")
-    return "investigation";
-  if (dimension === "artifacts" || dimension === "continuity")
-    return "artifact";
-  if (dimension === "decisions")
-    return "decision";
-  return "worker report";
-};
-function evaluateRequirements(task, workspace, capabilities, candidate, checkoutRoot, _caller) {
-  const evidence = evaluateEvidence(task, candidate);
-  if (task.policy && task.policy.policyVersion !== POLICY_VERSION)
-    return task.policy.requirements.map((requirement) => ({
-      requirementId: requirement.id,
-      status: "unsatisfied",
-      evidenceIds: [],
-      decisionIds: [],
-      reason: "stored policy version is unsupported; reassessment is required"
-    }));
-  return (task.policy?.requirements ?? []).map((requirement) => {
-    const related = task.evidence.map((entry, index) => ({ entry, evaluation: evidence[index] })).filter(({ entry }) => entry.data.requirementIds.includes(requirement.id));
-    const passed = related.filter(({ entry, evaluation }) => {
-      if (!evidenceMatchesRequirement(evaluation.status, entry.data.kind, requirement.dimension, requirement.ruleId))
-        return false;
-      if ((entry.data.kind === "check" || entry.data.kind === "review") && (!entry.data.beforeCandidateId || !entry.data.candidateId || entry.data.beforeCandidateId !== entry.data.candidateId))
-        return false;
-      if (requirement.dimension !== "review")
-        return true;
-      const reviewSession = sessionFromRef(entry.data.reviewContext);
-      const sameImplementation = sameSession(reviewSession, task.intent.provenance.session);
-      const sameEvidenceSession = related.some(({ entry: other }) => other.id !== entry.id && other.data.kind === "review" && other.data.candidateId !== null && other.data.candidateId === entry.data.candidateId && sameSession(reviewSession, other.provenance.session));
-      return entry.data.kind === "review" && reviewSession !== null && sameSession(reviewSession, entry.provenance.session) && (requirement.ruleId === "self-review" || !sameImplementation && !sameEvidenceSession);
-    });
-    if (passed.length) {
-      const currentId = candidate?.id ?? null;
-      const withRed = requirement.dimension === "testing" ? passed.filter(({ entry }) => related.some((other) => other.entry.data.kind === "check" && other.evaluation.status === "failed" && other.entry.data.requirementIds.includes(requirement.id) && other.entry.recordedAt <= entry.recordedAt) || related.some((baseline) => baseline.entry.id !== entry.id && baseline.entry.data.kind === "check" && baseline.entry.data.result === "passed" && baseline.entry.data.candidateId !== null && currentId !== null && baseline.entry.data.candidateId !== currentId)) : passed;
-      if (withRed.length)
-        return {
-          requirementId: requirement.id,
-          status: "satisfied",
-          evidenceIds: withRed.map(({ entry }) => entry.id),
-          decisionIds: [],
-          reason: "fresh applicable evidence passed"
-        };
-      if (requirement.dimension === "testing")
-        return {
-          requirementId: requirement.id,
-          status: "unsatisfied",
-          evidenceIds: [],
-          decisionIds: [],
-          reason: "testing requirement has GREEN evidence but no preceding RED"
-        };
-    }
-    if (requirement.dimension === "delegation") {
-      const dot = (scope) => scope.paths.length > 0 ? scope : { ...scope, paths: ["."] };
-      const reconciled = task.workers.some((worker) => worker.data.report?.outcome === "completed" && (worker.data.assignment.requirementIds.includes(requirement.id) || scopeCovers2(dot(requirement.scope), dot(worker.data.assignment.scope))));
-      if (reconciled)
-        return {
-          requirementId: requirement.id,
-          status: "satisfied",
-          evidenceIds: [],
-          decisionIds: [],
-          reason: "bounded helper completed and its result is recorded"
-        };
-    }
-    const decisions = requirement.dimension === "decisions" ? applicableRequirementDecision(task, workspace, requirement, checkoutRoot) : [];
-    if (decisions.length)
-      return {
-        requirementId: requirement.id,
-        status: "satisfied",
-        evidenceIds: [],
-        decisionIds: decisions.map((decision) => decision.id),
-        reason: "an applicable approved or stated decision satisfies the requirement"
-      };
-    const limitations = requirement.acceptanceAllowed ? applicableDecision2(task, workspace, requirement, checkoutRoot) : [];
-    if (limitations.length)
-      return {
-        requirementId: requirement.id,
-        status: "accepted_limitation",
-        evidenceIds: [],
-        decisionIds: limitations.map((decision) => task.decisions.find((entry) => entry.data === decision).id),
-        reason: "an applicable approved limitation permits the missing evidence"
-      };
-    const unavailable = capabilities.some((capability) => capability.assurance === "unavailable" && (capability.name === requirement.dimension || capability.surface === requirement.dimension));
-    if (!unavailable && related.length > 0 && !passed.length)
-      return {
-        requirementId: requirement.id,
-        status: "unsatisfied",
-        evidenceIds: related.map(({ entry }) => entry.id),
-        decisionIds: [],
-        reason: `no passing evidence (needs kind:${expectedKinds(requirement.dimension, requirement.ruleId)})`
-      };
-    return {
-      requirementId: requirement.id,
-      status: unavailable ? "unavailable" : "unsatisfied",
-      evidenceIds: related.map(({ entry }) => entry.id),
-      decisionIds: [],
-      reason: unavailable ? "required capability is unavailable" : "no fresh passing evidence"
-    };
-  });
+  const parsed = policySchema.safeParse(policy);
+  if (!parsed.success)
+    return failure("invalid_input", "resolved policy is invalid", invalidFields(parsed.error));
+  return success(null, null, parsed.data);
 }
-function evaluateClosure(requestedOutcome, view) {
-  if (requestedOutcome !== "stopped" && !view.task.policy)
-    return failure("requirements_unsatisfied", "task has not been assessed");
-  if (view.task.policy && view.task.policy.policyVersion !== POLICY_VERSION)
-    return failure("requirements_unsatisfied", "stored policy version is unsupported; reassessment is required");
-  const evaluations = view.requirements;
-  const openFindings = view.task.findings.filter((entry) => entry.data.disposition === "open");
-  if (requestedOutcome !== "stopped" && openFindings.length)
-    return failure("requirements_unsatisfied", "open findings must be resolved before closure");
-  if (requestedOutcome !== "stopped") {
-    const evidenceById = new Map(view.evidence.map((entry) => [entry.evidenceId, entry.status]));
-    for (const entry of view.task.findings) {
-      if (entry.data.disposition === "fixed") {
-        const verified = entry.data.resolution?.evidenceIds.some((id) => {
-          const evidence = view.task.evidence.find((item) => item.id === id);
-          if (!evidence)
-            return false;
-          return findingVerificationPasses(entry.data.candidateId, {
-            kind: evidence.data.kind,
-            candidateId: evidence.data.candidateId,
-            status: evidenceById.get(id) ?? "missing"
-          });
-        });
-        if (!verified)
-          return failure("requirements_unsatisfied", "fixed findings require current verification");
-      }
-      if (entry.data.disposition === "deferred") {
-        const valid = entry.data.resolution?.decisionIds.some((id) => {
-          const decisionEntry = view.task.decisions.find((item) => item.id === id);
-          const decision = decisionEntry?.data;
-          return Boolean(decision && decisionEntry?.provenance.kind !== "imported" && decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.digest === decisionDigest(decision) && verifyDecisionContentAtRoot(view.workspace.root, decision.binding).ok && decision.binding.taskId === view.task.id && decision.binding.workspaceId === view.workspace.id && scopeCovers2(decision.binding.scope, entry.data.scope) && decision.requirementIds.some((requirementId) => view.task.policy?.requirements.some((requirement) => requirement.id === requirementId && requirement.acceptanceAllowed)));
-        });
-        if (!valid)
-          return failure("requirements_unsatisfied", "deferred findings require an approved limitation decision that references an acceptanceAllowed requirement and covers the finding scope");
-      }
-    }
-  }
-  const blocking = evaluations.filter((item) => {
-    if (item.status !== "unsatisfied" && item.status !== "unavailable")
-      return false;
-    const requirement = view.task.policy?.requirements.find((candidate) => candidate.id === item.requirementId);
-    return !requirement || requirement.before === "close";
-  });
-  if (requestedOutcome !== "stopped" && blocking.length)
-    return failure("requirements_unsatisfied", "applicable requirements are unsatisfied", {
-      requirementIds: blocking.map((item) => item.requirementId),
-      requirements: blocking.map((item) => {
-        const requirement = view.task.policy?.requirements.find((candidate) => candidate.id === item.requirementId);
-        return {
-          requirementId: item.requirementId,
-          ruleId: requirement?.ruleId ?? "unknown",
-          reason: item.reason,
-          satisfaction: requirement?.satisfaction ?? "",
-          dependentAction: requirement?.dependentAction ?? null
-        };
-      })
-    });
-  const accepted = evaluations.filter((item) => item.status === "accepted_limitation");
-  if (requestedOutcome === "verified" && accepted.length)
-    return failure("requirements_unsatisfied", "accepted limitations cannot be reported as verified", {
-      requirementIds: accepted.map((item) => item.requirementId)
-    });
-  const evidenceIds = [
-    ...new Set([
-      ...evaluations.flatMap((item) => item.evidenceIds),
-      ...view.task.findings.flatMap((item) => item.data.resolution?.evidenceIds ?? [])
-    ])
-  ];
-  const decisionIds = [
-    ...new Set([
-      ...evaluations.flatMap((item) => item.decisionIds),
-      ...view.task.findings.flatMap((item) => item.data.resolution?.decisionIds ?? [])
-    ])
-  ];
-  return success(null, null, {
-    outcome: requestedOutcome === "stopped" ? "stopped" : accepted.length ? "accepted_limitations" : "verified",
-    evidenceIds,
-    decisionIds,
-    requirementIds: evaluations.map((item) => item.requirementId)
-  });
+function diffPolicy(previous, next, reason, now) {
+  if (!policySchema.safeParse(previous).success && previous !== null)
+    throw new TypeError("previous policy is invalid");
+  if (!policySchema.safeParse(next).success)
+    throw new TypeError("next policy is invalid");
+  const oldIds = new Set(previous?.requirements.map((requirement) => requirement.id) ?? []);
+  const newIds = new Set(next.requirements.map((requirement) => requirement.id));
+  const added = [...newIds].filter((id) => !oldIds.has(id)).sort(compareCodeUnits2);
+  const retired = [...oldIds].filter((id) => !newIds.has(id)).sort(compareCodeUnits2);
+  if (added.length === 0 && retired.length === 0)
+    return null;
+  const normalizedReason = reason.trim();
+  const changeReason = retired.length ? `${normalizedReason || "policy reassessed"} (retired: ${retired.join(",")})` : normalizedReason || "policy reassessed";
+  const change = {
+    recordedAt: now,
+    fromInputDigest: previous?.inputDigest ?? null,
+    toInputDigest: next.inputDigest,
+    added,
+    retired,
+    reason: changeReason
+  };
+  const parsed = policyChangeSchema.safeParse(change);
+  if (!parsed.success)
+    throw new TypeError("policy change is invalid");
+  return parsed.data;
 }
 
-// packages/workit-core/src/core/methods.ts
-var METHODS = {
-  "workit-challenge": { dimensions: ["challenge", "decisions"] },
-  "workit-behavioral-tdd": { dimensions: ["testing"], ruleIds: ["mechanical-existing-checks"] },
-  "workit-review": { dimensions: ["review"], ruleIds: ["fresh-context-review", "self-review"] },
-  "workit-plan": { dimensions: ["artifacts", "continuity"] },
-  "workit-implement": { dimensions: ["delegation"] },
-  "workit-debug": {},
-  "workit-handoff": {},
-  "workit-deslop": { ruleIds: ["pre-pr-cleanup"] }
+// packages/workit-core/src/core/task-evaluation.ts
+import { createHash as createHash7 } from "node:crypto";
+import * as fs7 from "node:fs";
+import { spawnSync as spawnSync2 } from "node:child_process";
+import path10 from "node:path";
+var digestBytes3 = (value) => createHash7("sha256").update(value).digest("hex");
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path10.sep}`);
+var relative = (root, candidate) => path10.relative(root, candidate).split(path10.sep).join("/") || ".";
+var canonicalPath = (value) => {
+  if (typeof value !== "string" || !value)
+    return null;
+  if (value.includes("\\") || value.split("/").includes(".."))
+    return null;
+  const normalized = path10.posix.normalize(value);
+  if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
+    return null;
+  return normalized === "." ? "." : normalized.replace(/\/$/, "");
 };
-var methodMatches = (definition, requirement) => definition.dimensions?.includes(requirement.dimension) === true || definition.ruleIds?.includes(requirement.ruleId) === true;
-var assuranceFor = (id, definition, capabilities) => {
-  const keys = new Set([
-    id,
-    ...definition.dimensions ?? [],
-    ...definition.ruleIds ?? []
-  ]);
-  const matches = capabilities.filter((capability) => keys.has(capability.name) || keys.has(capability.surface));
-  if (id === "workit-review" && matches.length === 0)
-    return { assurance: "unavailable", reasons: ["independent review capability is unavailable"] };
-  if (matches.some((capability) => capability.assurance === "unavailable"))
-    return {
-      assurance: "unavailable",
-      reasons: matches.filter((capability) => capability.assurance === "unavailable").map((capability) => capability.reason)
-    };
-  if (matches.some((capability) => capability.assurance === "enforced"))
-    return { assurance: "enforced", reasons: matches.map((capability) => capability.reason) };
-  return { assurance: "agent_guided", reasons: matches.map((capability) => capability.reason) };
+var canonicalScope = (scope) => {
+  const paths = scope.paths.length ? scope.paths : ["."];
+  const normalizedPaths = paths.map(canonicalPath);
+  const normalizedExclusions = scope.exclusions.map(canonicalPath);
+  if (normalizedPaths.some((value) => value === null) || normalizedExclusions.some((value) => value === null))
+    return null;
+  return {
+    description: scope.description,
+    paths: [...new Set(normalizedPaths)],
+    exclusions: [...new Set(normalizedExclusions)]
+  };
 };
-function selectMethods(policy, capabilities) {
-  return Object.entries(METHODS).flatMap(([id, definition]) => {
-    const requirements = policy.requirements.filter((requirement) => methodMatches(definition, requirement));
-    if (requirements.length === 0)
-      return [];
-    const capability = assuranceFor(id, definition, capabilities);
-    const reasons = [
-      ...new Set(requirements.map((requirement) => requirement.reason)),
-      ...capability.reasons
-    ];
-    if (capability.assurance === "unavailable")
-      reasons.unshift("required capability is unavailable");
-    return [{ id, reason: reasons.join("; "), assurance: capability.assurance }];
-  });
-}
-var invariantBootstrap = () => `
-Workit is optional coordination and repository-policy tooling around the host,
-not a permission system or a mandatory workflow. Native host allow/ask/deny,
-sandbox, plan/read-only mode, and organization rules remain authoritative.
-Ordinary investigation, questions, non-Git work, and routine reversible edits
-need zero Workit task, assessment, or writer calls. Use one compact tracked
-record only when handoff, dependent steps, concurrent actors, or meaningful
-decisions make continuity useful; similar titles alone never merge tasks.
-
-For a routine user-authorized branch or commit, prefer native host Git/shell
-tools from the outset when managed coordination or outcome reconciliation is
-not needed. Inspect the actual target checkout and its configured conventions;
-use Workit's read-only context/policy tools when needed. Do not start a task,
-acquire a writer, or mint a decision receipt solely for a native Git action.
-Native permissions still apply. Never switch execution paths to evade a denial
-or repeat an uncertain managed effect. A local-commit endpoint does not imply
-PR readiness, a fresh review, or post-commit assessment/closure paperwork.
-
-For tracked work, inspect its current state and use the shared operations for
-task, policy, evidence, finding, decision, worker, writer, and state changes.
-Start a record once for an explicit tracked objective; assess or reassess only
-when policy selection or changed evidence/constraints requires it. Omitted
-expectedRevision and expectedWorkspaceRevision use current values; explicit
-values are still concurrency-checked, so never copy revisions between calls.
-A solo edit does not need writer acquisition; use it when concurrent checkout
-writers need coordination. Record only observed facts and checks. Evidence can
-become stale when its bound candidate changes; reconcile findings against the
-current candidate before recording completion.
-
-Workit validates domain policy against the actual action target, configured
-account, branch and commit conventions, protected refs, and current repository
-state. The task directory is coordination state, not a boundary on which
-repository may be changed. Use an action-time cwd target where a managed
-Git/hosting action supports it; a non-Git directory remains valid for OS work.
-GitHub/GitLab use the active gh/glab CLI identity; YouTrack uses its own token.
-Preserve uncertain external outcomes and reconcile repository/provider state
-before retrying. Internal reservations prevent duplicate or ambiguous effects;
-they are not permission tickets for every edit.
-
-On OpenCode V1 and V2, use native host tools for external mutations. Workit
-provides read-only workit_context; it has no managed external-action executor.
-Do not create proposals or request Workit approvals merely to invoke native
-tools. Old uncertain managed effects still require evidence before any retry.
-
-Use host-native authorization through the host's supported path. A native
-question receipt records an actual question interaction; it is not automatic
-host permission. Record a meaningful user choice once with provenance when
-future retrieval helps. Never fabricate a receipt, re-ask only to mint one, or
-let imported decisions grant authority. Never turn a host deny into allow or
-claim enforcement/evidence a host cannot provide. A precise request with settled
-constraints does not need an interview. Present genuine unresolved options with
-evidence and a recommendation, then continue toward the requested delivery
-endpoint: investigation, implementation, branch/commit/push, PR/MR-ready,
-merge, or release. Run
-applicable checks and safe repairs without repeated continuation questions;
-stop for missing host authority, a new consequential choice, a conflicting edit,
-or an unresolved blocker. A tracked record may close when actual evidence
-supports its outcome; no final human closure ceremony is required.
-
-A completed native subagent run stops its bound worker by itself; if a worker
-strands in cancelling with its run verifiably over, repeat worker.cancel to
-confirm the stop. Preserve unresolved requirements, gaps, and uncertain workers.
-When context changes, distinguish a quick question, same-task adjustment, and
-separate request. Answer a quick question without pausing/resuming task state;
-park a concise checkpoint only when substantial work needs to continue later.
-For work spanning repositories, bind each unfinished item to its actual checkout,
-branch, requested deliverables, and delivery endpoint. Preserve held items with
-an explicit resume condition. Resolve competing plausible targets before a
-mutation; ask only when available context cannot settle that consequential choice.
-Before reporting delivery, reconcile every requested item and observe the actual
-target result; a local commit alone is not evidence of a requested remote push.
-
-Skill routing: slash aliases /wk-* load on demand. Use workit-steer for a
-substantial interruption or change of direction, workit-deslop when relevant
-to a PR-ready endpoint, workit-green-run for failing CI, workit-blast-radius
-when impact is uncertain, and workit-challenge for genuinely open consequential
-choices. Load workit-plan when dependencies or handoff need durable next actions.
-Load the skill; never act from memory of it.
-`.trim();
-
-// packages/workit-core/src/core/task-context.ts
-function reconcileResume(view, observations = []) {
-  if (observations.length > 0)
-    return failure("permission_denied", "worker observations require native host verification");
-  const candidate = captureCandidate(view.workspace.root, view.task.intent.data.scope, []);
-  if (!candidate.ok)
-    return candidate;
-  const staleEvidenceIds = evaluateEvidence(view.task, candidate.data).filter((entry) => entry.status === "stale").map((entry) => entry.evidenceId);
-  const blockers = [...view.task.progress.blockers];
-  if (view.task.workers.some((entry) => isUncertainWorker(entry.data.state)))
-    blockers.push({
-      reason: "worker state requires reconciliation",
-      dependentAction: "resume",
-      refs: []
-    });
-  return success(null, null, {
-    candidate: candidate.data,
-    staleEvidenceIds,
-    workerUpdates: [],
-    blockers,
-    reassessmentRequired: view.task.policy?.policyVersion !== POLICY_VERSION
-  });
-}
-var COMPACT_MAX_BYTES = 4096;
-var COMPACT_MAX_ITEMS = 8;
-var COMPACT_TEXT_BYTES = 128;
-var sensitiveUrl = /\bhttps?:\/\/[^/\s:@]+:[^@\s]+@/gi;
-var sensitiveValue = /(?:token|secret|password|passwd|api[-_ ]?key|private[-_ ]?key|authorization)\s*[:=]\s*(?:bearer\s+)?\S+|\bbearer\s+\S+/gi;
-var privateKey = /-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/gi;
-var compactText = (value, limit) => value === null ? null : value.replace(privateKey, "<redacted-private-key>").replace(sensitiveUrl, "<redacted-url>").replace(sensitiveValue, (match) => {
-  const separator = match.search(/[:=]/u);
-  if (separator >= 0)
-    return `${match.slice(0, separator)}=<redacted>`;
-  const space = match.search(/\s/u);
-  return `${match.slice(0, space)} <redacted>`;
-}).slice(0, limit);
-var compactBytes = (value) => new TextEncoder().encode(value).byteLength;
-var compactTimestamp = (value) => `${value.slice(0, 19)}.${value.slice(20, -1).padEnd(9, "0")}`;
-var compactDecisionChoice = (entry) => {
-  const stated = entry.data.binding.statedChoice?.text;
-  const approved = entry.data.response === "approved" ? entry.data.binding.approvedContent : "";
-  const source = stated?.trim() || approved.trim() || null;
-  return compactText(source, COMPACT_TEXT_BYTES);
+var excluded = (value, exclusions) => exclusions.some((item) => item === value || item !== "." && value.startsWith(`${item}/`));
+var scopeMatches = (value, scope) => {
+  const normalized = canonicalScope(scope);
+  if (!normalized)
+    return false;
+  const paths = normalized.paths;
+  return paths.some((item) => item === "." || value === item || value.startsWith(`${item}/`)) && !excluded(value, normalized.exclusions);
 };
-var compactReference = (ref) => {
-  if (ref.kind === "file")
-    return {
-      kind: "file",
-      path: compactText(ref.path, COMPACT_TEXT_BYTES) ?? ""
-    };
-  if (ref.kind === "record")
+var pathRelevant = (value, scope) => scopeMatches(value, scope);
+var compareCodeUnits3 = (left, right) => {
+  const length = Math.min(left.length, right.length);
+  for (let index = 0;index < length; index += 1) {
+    const difference = left.charCodeAt(index) - right.charCodeAt(index);
+    if (difference !== 0)
+      return difference;
+  }
+  return left.length - right.length;
+};
+var gitPaths = (root) => {
+  const result = spawnSync2("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    cwd: root,
+    encoding: "buffer"
+  });
+  if (result.status !== 0) {
+    const stderr = result.stderr?.toString("utf8") ?? "";
     return {
-      kind: "record",
-      collection: ref.collection,
-      id: ref.id
+      paths: [],
+      uncertain: !/not a git repository/i.test(stderr),
+      git: /not a git repository/i.test(stderr) ? false : true
     };
-  return { kind: ref.kind };
-};
-function compactTaskContext(view) {
-  const decisions = view.task.decisions.slice().sort((left, right) => {
-    const leftAt = compactTimestamp(left.recordedAt);
-    const rightAt = compactTimestamp(right.recordedAt);
-    if (leftAt !== rightAt)
-      return leftAt > rightAt ? -1 : 1;
-    return left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
-  }).slice(0, COMPACT_MAX_ITEMS).map((entry) => ({
-    id: entry.id,
-    purpose: entry.data.purpose,
-    status: entry.data.response,
-    digest: entry.data.digest,
-    choice: compactDecisionChoice(entry) || `task.inspect taskId=${view.task.id} view=full; decision=${entry.id}`,
-    references: entry.data.binding.contentRefs.slice(0, 1).map(compactReference)
-  }));
-  const methods = view.task.policy ? selectMethods(view.task.policy, view.capabilities).map((method) => ({
-    id: method.id,
-    assurance: method.assurance,
-    reason: compactText(method.reason, COMPACT_TEXT_BYTES) ?? ""
-  })) : [];
-  const gaps = Array.from(new Set([
-    ...view.evidence.filter((entry) => entry.status === "stale").map((entry) => `stale evidence: ${entry.evidenceId}`),
-    ...view.requirements.filter((entry) => entry.status !== "satisfied").map((entry) => entry.reason),
-    ...view.task.progress.blockers.map((entry) => entry.reason)
-  ])).sort().slice(0, COMPACT_MAX_ITEMS).map((gap) => compactText(gap, COMPACT_TEXT_BYTES));
-  const context = {
-    objective: compactText(view.task.intent.data.objective, COMPACT_TEXT_BYTES) ?? "",
-    status: view.task.status,
-    decisions,
-    methods,
-    gaps,
-    nextAction: compactText(view.task.progress.nextAction, COMPACT_TEXT_BYTES)
-  };
-  let encoded = JSON.stringify(context);
-  while (compactBytes(encoded) > COMPACT_MAX_BYTES && (context.decisions.length || context.methods.length || context.gaps.length)) {
-    if (context.gaps.length)
-      context.gaps.pop();
-    else if (context.decisions.length)
-      context.decisions.pop();
-    else
-      context.methods.pop();
-    encoded = JSON.stringify(context);
   }
-  if (compactBytes(encoded) > COMPACT_MAX_BYTES) {
-    context.objective = compactText(context.objective, 64) ?? "";
-    context.nextAction = compactText(context.nextAction, 64);
-    encoded = JSON.stringify(context);
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path10.sep).join("/")) : [];
+  const stagedDeleted = spawnSync2("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
+  if (stagedDeleted.status !== 0) {
+    const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
+    if (!/not a git repository/i.test(stderr))
+      return { paths, uncertain: true, git: true };
+  } else if (stagedDeleted.stdout) {
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path10.sep).join("/")));
   }
-  return encoded;
-}
-var exportDigest = (bundle) => sha256({
-  schemaVersion: bundle.schemaVersion,
-  exportedAt: bundle.exportedAt,
-  sourceWorkspaceId: bundle.sourceWorkspaceId,
-  task: bundle.task
-});
-// packages/workit-core/src/core/route-intent.ts
-var shellBranchTarget = (command) => {
-  if (!command.trim() || /[\r\n;&|<>`'"$()\\*?{}~!#]/u.test(command) || command.includes("[") || command.includes("]"))
-    return null;
-  const args = command.trim().split(/\s+/u);
-  if (args[0] !== "git")
-    return null;
-  const option = args[2];
-  const target = args[1] === "switch" && ["-c", "--create", "-C", "--force-create"].includes(option ?? "") && (args.length === 4 || args.length === 5) ? args[3] : args[1] === "checkout" && ["-b", "-B"].includes(option ?? "") && (args.length === 4 || args.length === 5) ? args[3] : args[1] === "branch" && (args.length === 3 || args.length === 4) ? args[2] : null;
-  return target && !target.startsWith("-") ? target : null;
-};
-var shellBranchPolicyViolation = (root, command) => {
-  const target = shellBranchTarget(command);
-  return target === null ? null : validateBranchNameFor(root, target);
+  return { paths: [...new Set(paths)], uncertain: false, git: true };
 };
-// packages/workit-core/src/core/external-action.ts
-var chainStepSchema = union([
-  string2().min(1),
-  object({ branch: string2().min(1) }).strict(),
-  object({ pr: literal(true) }).strict()
-]);
-var externalActionSchema = discriminatedUnion("operation", [
-  object({
-    operation: literal("git.branch_setup"),
-    payload: object({
-      action: _enum(["setup", "reapply_stash"]).optional(),
-      sdd_dir: string2().optional(),
-      target_branch: string2().optional(),
-      stash: _enum(["yes", "no"]).optional(),
-      cwd: string2().min(1).optional()
-    }).strict()
-  }).strict(),
-  object({
-    operation: literal("git.commit"),
-    payload: object({
-      message: string2().min(1).optional(),
-      plan_steps: array(chainStepSchema).min(1).max(32).optional(),
-      plan_branch: string2().min(1).optional(),
-      cwd: string2().min(1).optional()
-    }).strict()
-  }).strict(),
-  object({
-    operation: literal("git.push"),
-    payload: object({ branch: string2().min(1).optional(), cwd: string2().min(1).optional() }).strict()
-  }).strict(),
-  object({
-    operation: literal("hosting.pull_request"),
-    payload: object({
-      title: string2().min(1),
-      body: string2().optional(),
-      draft: boolean2().optional(),
-      target_branch: string2().optional(),
-      babysit: boolean2().optional(),
-      cwd: string2().min(1).optional()
-    }).strict()
-  }).strict(),
-  object({
-    operation: literal("hosting.merge"),
-    payload: object({
-      target_branch: string2().min(1).optional(),
-      source_branch: string2().min(1).optional(),
-      cwd: string2().min(1).optional()
-    }).strict()
-  }).strict(),
-  object({
-    operation: literal("hosting.delete_branch"),
-    payload: object({ branch: string2().min(1), cwd: string2().min(1).optional() }).strict()
-  }).strict(),
-  object({
-    operation: literal("youtrack.update"),
-    payload: object({
-      issueId: string2().min(1),
-      markdown: string2().min(1),
-      minutes: number2().positive().optional()
-    }).strict()
-  }).strict(),
-  object({
-    operation: literal("youtrack.time"),
-    payload: object({
-      issueId: string2().min(1),
-      minutes: number2().positive(),
-      text: string2().optional(),
-      dateMs: number2().finite().optional()
-    }).strict()
-  }).strict(),
-  object({
-    operation: literal("youtrack.meeting"),
-    payload: object({
-      issueId: string2().min(1),
-      minutes: number2().positive(),
-      text: string2().min(1)
-    }).strict()
-  }).strict(),
-  object({
-    operation: literal("changelog.apply"),
-    payload: object({
-      entries: union([
-        record(string2(), array(string2())),
-        array(object({ category: string2().min(1), text: string2().min(1) }).strict())
-      ]).optional(),
-      path: string2().optional(),
-      normalize_only: boolean2().optional()
-    }).strict()
-  }).strict(),
-  object({
-    operation: literal("context.read"),
-    payload: object({
-      kind: _enum([
-        "git",
-        "pr",
-        "youtrack",
-        "github_issue",
-        "gitlab_issue",
-        "changelog",
-        "release",
-        "affected"
-      ]),
-      range: string2().optional(),
-      issueId: string2().optional(),
-      issueUrl: string2().optional(),
-      issueRef: string2().optional(),
-      mode: string2().optional(),
-      specPath: string2().optional(),
-      planPath: string2().optional(),
-      cwd: string2().min(1).optional()
-    }).strict()
-  }).strict()
-]);
-// packages/workit-core/src/core/task-engine.ts
-import { realpathSync as realpathSync6 } from "node:fs";
-
-// packages/workit-core/src/core/policy-resolver.ts
-var resolverInputSchema = object({
-  intent: intentSchema,
-  assessment: assessmentSchema,
-  constraints: array(constraintSchema),
-  prior: object({
-    decisions: array(decisionSchema),
-    findings: array(findingSchema),
-    requirements: array(requirementSchema)
-  }).strict(),
-  preferences: object({ fast: boolean2().optional(), thorough: boolean2().optional() }).strict().optional()
-}).strict();
-var compareCodeUnits3 = (left, right) => {
-  const length = Math.min(left.length, right.length);
-  for (let index = 0;index < length; index += 1) {
-    const difference = left.charCodeAt(index) - right.charCodeAt(index);
-    if (difference !== 0)
-      return difference;
+var walk = (root, directory, output) => {
+  let names;
+  try {
+    names = fs7.readdirSync(directory);
+  } catch {
+    return true;
   }
-  return left.length - right.length;
+  let uncertain = false;
+  for (const name of names) {
+    if (name === ".git" || name === ".workit")
+      continue;
+    const target = path10.join(directory, name);
+    let stat;
+    try {
+      stat = fs7.lstatSync(target);
+    } catch {
+      uncertain = true;
+      continue;
+    }
+    const item = relative(root, target);
+    output.add(item);
+    if (stat.isDirectory() && !stat.isSymbolicLink())
+      uncertain = walk(root, target, output) || uncertain;
+  }
+  return uncertain;
 };
-var stableUnique = (values) => [...new Set(values)].sort(compareCodeUnits3);
-var stableList = (values) => [...values].sort((left, right) => compareCodeUnits3(canonicalJson(left), canonicalJson(right)));
-var normalizedScope = (scope) => ({
-  description: scope.description,
-  paths: stableUnique(scope.paths),
-  exclusions: stableUnique(scope.exclusions)
-});
-var normalizedRefList = (values) => stableList(values);
-var normalizeAssessment = (assessment) => ({
-  facts: stableList(assessment.facts.map((fact) => ({ ...fact, refs: normalizedRefList(fact.refs) }))),
-  signals: Object.fromEntries(Object.entries(assessment.signals).map(([name, signal]) => [
+var scopeRoots = (root, scope) => {
+  const roots = [];
+  for (const item of scope.paths.length ? scope.paths : ["."]) {
+    const target = path10.resolve(root, item);
+    if (!inside(root, target))
+      return failure("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
+    let ancestor = target;
+    while (!fs7.existsSync(ancestor) && ancestor !== root)
+      ancestor = path10.dirname(ancestor);
+    try {
+      if (!inside(root, fs7.realpathSync(ancestor)))
+        return failure("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
+    } catch {
+      return failure("invalid_input", `candidate scope cannot be inspected: ${item}`);
+    }
+    roots.push(target);
+  }
+  return success(null, null, roots);
+};
+function captureCandidate(root, scope, environment = []) {
+  let checkout;
+  try {
+    checkout = fs7.realpathSync(root);
+  } catch {
+    return failure("invalid_input", "candidate root does not exist");
+  }
+  const normalizedScope = canonicalScope(scope);
+  if (!normalizedScope)
+    return failure("invalid_input", "candidate scope is invalid: paths must be checkout-relative — to work in another repository, keep this task here and coordinate a separate linked task in that checkout", { fields: [{ path: "scope.paths", reason: "must be checkout-relative" }] });
+  const roots = scopeRoots(checkout, normalizedScope);
+  if (!roots.ok)
+    return roots;
+  const git = gitPaths(checkout);
+  const names = new Set;
+  let uncertain = git.uncertain;
+  for (const target of roots.data) {
+    const item = relative(checkout, target);
+    if (item === ".git" || item === ".workit")
+      continue;
+    names.add(item);
+    if (!fs7.existsSync(target))
+      continue;
+    let stat;
+    try {
+      stat = fs7.lstatSync(target);
+    } catch {
+      uncertain = true;
+      continue;
+    }
+    if (!git.git && stat.isDirectory() && !stat.isSymbolicLink())
+      uncertain = walk(checkout, target, names) || uncertain;
+  }
+  for (const item of git.paths)
+    if (scopeMatches(item, normalizedScope))
+      names.add(item);
+  const files = [];
+  let completeness = uncertain ? "uncertain" : "known";
+  for (const item of [...names].sort()) {
+    if (!scopeMatches(item, normalizedScope))
+      continue;
+    const target = path10.join(checkout, item);
+    try {
+      const stat = fs7.lstatSync(target);
+      if (stat.isSymbolicLink()) {
+        const link = fs7.readlinkSync(target);
+        files.push({ path: item, kind: "symlink", digest: digestBytes3(link), executable: null });
+      } else if (stat.isFile()) {
+        files.push({
+          path: item,
+          kind: "file",
+          digest: digestBytes3(fs7.readFileSync(target)),
+          executable: (stat.mode & 73) !== 0
+        });
+      } else if (!stat.isDirectory()) {
+        completeness = "uncertain";
+      } else if (git.git && git.paths.includes(item)) {
+        completeness = "uncertain";
+      }
+    } catch (error) {
+      if (error?.code === "ENOENT") {
+        files.push({ path: item, kind: "absent", digest: null, executable: null });
+      } else
+        completeness = "uncertain";
+    }
+  }
+  const supplied = Array.isArray(environment) ? environment.map((value) => typeof value === "string" ? { name: value, value: process.env[value] ?? null } : { name: value.name, value: value.value ?? null }) : Object.keys(environment).map((name) => ({
     name,
-    { ...signal, refs: normalizedRefList(signal.refs) }
-  ])),
-  consequences: stableList(assessment.consequences.map((consequence) => ({
-    ...consequence,
-    fact: { ...consequence.fact, refs: normalizedRefList(consequence.fact.refs) }
-  }))),
-  verification: stableList(assessment.verification.map((verification) => ({
-    ...verification,
-    scope: normalizedScope(verification.scope),
-    availableChecks: normalizedRefList(verification.availableChecks),
-    gaps: stableUnique(verification.gaps)
-  })))
-});
-var normalizeConstraint = (constraint) => ({
-  ...constraint,
-  source: constraint.source,
-  requires: stableList(constraint.requires.map((requirement) => ({
-    ...requirement,
-    scope: normalizedScope(requirement.scope),
-    refs: normalizedRefList(requirement.refs)
-  })))
-});
-var normalizeDecision = (decision) => ({
-  ...decision,
-  binding: {
-    ...decision.binding,
-    scope: normalizedScope(decision.binding.scope),
-    contentRefs: normalizedRefList(decision.binding.contentRefs)
-  },
-  requirementIds: stableUnique(decision.requirementIds)
-});
-var normalizeIntent = (intent) => ({
-  ...intent,
-  scope: normalizedScope(intent.scope),
-  authorityRefs: normalizedRefList(intent.authorityRefs)
-});
-var normalizePrior = (prior) => ({
-  decisions: stableList(prior.decisions.map(normalizeDecision)),
-  findings: stableList(prior.findings.map((finding) => ({
-    ...finding,
-    scope: normalizedScope(finding.scope),
-    refs: normalizedRefList(finding.refs),
-    resolution: finding.resolution ? {
-      ...finding.resolution,
-      evidenceIds: stableUnique(finding.resolution.evidenceIds),
-      decisionIds: stableUnique(finding.resolution.decisionIds)
-    } : null
-  }))),
-  requirements: stableList(prior.requirements.map((requirement) => ({
-    ...requirement,
-    scope: normalizedScope(requirement.scope)
-  })))
-});
-var invalidFields = (error) => ({
-  fields: error.issues.map((issue) => ({
-    path: issue.code === "unrecognized_keys" ? issue.keys.join(".") : issue.path.join("."),
-    reason: issue.message
-  }))
-});
-function normalizeResolverInput(input) {
-  const parsed = resolverInputSchema.safeParse(input);
-  if (!parsed.success)
-    return failure("invalid_input", "resolver input is invalid", invalidFields(parsed.error));
-  const value = parsed.data;
-  const signals = value.assessment.signals;
-  if (signals.behaviorChange.value === true && signals.mechanicalLowRisk.value === true)
-    return failure("invalid_input", "behavioral change cannot be wholly mechanical", {
-      fields: [
-        {
-          path: "assessment.signals",
-          reason: "contradictory behaviorChange and mechanicalLowRisk"
-        }
-      ]
-    });
-  const ids = value.constraints.map((constraint) => constraint.id);
-  if (new Set(ids).size !== ids.length)
-    return failure("invalid_input", "constraint IDs must be unique", {
-      fields: [{ path: "constraints", reason: "duplicate constraint id" }]
-    });
-  if (value.preferences?.fast && value.preferences.thorough)
-    return failure("invalid_input", "fast and thorough preferences contradict", {
-      fields: [{ path: "preferences", reason: "fast and thorough cannot both be enabled" }]
-    });
-  const normalized = {
-    intent: normalizeIntent(value.intent),
-    assessment: normalizeAssessment(value.assessment),
-    constraints: stableList(value.constraints.map(normalizeConstraint)),
-    prior: normalizePrior(value.prior),
-    ...value.preferences ? { preferences: { ...value.preferences } } : {},
-    policyVersion: POLICY_VERSION
+    value: environment[name] ?? null
+  }));
+  const namesByEnvironment = supplied.map(({ name }) => name);
+  if (new Set(namesByEnvironment).size !== namesByEnvironment.length || namesByEnvironment.some((name) => typeof name !== "string" || !name))
+    return failure("invalid_input", "candidate environment names must be unique and non-empty");
+  const values = supplied.sort((left, right) => compareCodeUnits3(left.name, right.name)).map(({ name, value }) => ({ name, value, refs: [] }));
+  if (values.some(({ value }) => value === null))
+    completeness = "uncertain";
+  const headResult = spawnSync2("git", ["rev-parse", "HEAD"], { cwd: checkout, encoding: "utf8" });
+  if (headResult.status !== 0 && !/not a git repository/i.test(headResult.stderr ?? ""))
+    completeness = "uncertain";
+  const head = headResult.status === 0 ? headResult.stdout.trim() : null;
+  const partial = {
+    id: "0".repeat(64),
+    scope: normalizedScope,
+    completeness,
+    files,
+    environment: values,
+    head
   };
-  return success(null, null, normalized);
+  const candidate = { ...partial, id: candidateDigest(partial) };
+  const parsed = candidateSchema.safeParse(candidate);
+  return parsed.success ? success(null, null, parsed.data) : failure("invalid_input", "captured candidate is invalid");
 }
-var requirement = (spec) => ({
-  ...spec,
-  id: requirementId({
-    ruleId: spec.ruleId,
-    scope: spec.scope,
-    satisfaction: spec.satisfaction,
-    before: spec.before,
-    dependentAction: spec.dependentAction
-  })
-});
-var signalReason = (input, name) => input.assessment.signals[name].reason;
-function resolveRequirements(input) {
-  const { signals } = input.assessment;
-  const scope = input.intent.scope;
-  const requirements = [];
-  const hasUnknownSignal = Object.values(signals).some((signal) => signal.value === "unknown");
-  const hasUnknownFact = [
-    ...input.assessment.facts,
-    ...input.assessment.consequences.map(({ fact }) => fact)
-  ].some((fact) => fact.basis === "unknown");
-  if (hasUnknownSignal || hasUnknownFact)
-    requirements.push(requirement({
-      ruleId: "consequential-unknown",
-      dimension: "investigation",
-      scope,
-      reason: `Resolve consequential uncertainty before the dependent action: ${[
-        ...Object.entries(signals).filter(([, signal]) => signal.value === "unknown").map(([name]) => name),
-        ...hasUnknownFact ? ["unknown fact"] : []
-      ].join(", ")}`,
-      satisfaction: "An observed or inferred fact resolves the uncertainty and records its supporting references.",
-      before: "dependent_action",
-      dependentAction: null,
-      acceptanceAllowed: false
-    }));
-  if (signals.productChoiceOpen.value === true)
-    requirements.push(requirement({
-      ruleId: "product-decision",
-      dimension: "decisions",
-      scope,
-      reason: `A consequential product choice remains open: ${signalReason(input, "productChoiceOpen")}`,
-      satisfaction: "Present the material alternatives and record the user's decision before the dependent action.",
-      before: "dependent_action",
-      dependentAction: null,
-      acceptanceAllowed: false
-    }));
-  const independentBehaviorReview = input.preferences?.thorough === true || input.assessment.consequences.some((consequence) => ["security", "data", "public_contract", "operations"].includes(consequence.area));
-  if (signals.behaviorChange.value === true)
-    requirements.push(requirement({
-      ruleId: "behavioral-verification",
-      dimension: "testing",
-      scope,
-      reason: `Behavior, side effects, permissions, or data handling may change: ${signalReason(input, "behaviorChange")}`,
-      satisfaction: "A useful behavioral check passes against the affected behavior and current candidate.",
-      before: "close",
-      dependentAction: null,
-      acceptanceAllowed: false
-    }), requirement({
-      ruleId: independentBehaviorReview ? "fresh-context-review" : "self-review",
-      dimension: "review",
-      scope,
-      reason: independentBehaviorReview ? "Consequential behavior or the thorough preference requires fresh-context review." : "Bounded behavior changes use self-review unless consequential risks or trusted rules require more.",
-      satisfaction: independentBehaviorReview ? "A separate review context examines the current candidate and records its result." : "The lead reviews the resulting diff and records the relevant scope and checks.",
-      before: "close",
-      dependentAction: null,
-      acceptanceAllowed: !independentBehaviorReview
-    }));
-  else if (signals.mechanicalLowRisk.value === true)
-    requirements.push(requirement({
-      ruleId: "mechanical-existing-checks",
-      dimension: "verification",
-      scope,
-      reason: `The change is demonstrably mechanical and low-risk: ${signalReason(input, "mechanicalLowRisk")}`,
-      satisfaction: "Run the relevant existing checks for affected consumers; do not add tautological tests.",
-      before: "close",
-      dependentAction: null,
-      acceptanceAllowed: true
-    }), requirement({
-      ruleId: input.preferences?.thorough ? "fresh-context-review" : "self-review",
-      dimension: "review",
-      scope,
-      reason: input.preferences?.thorough ? "The thorough preference upgrades mechanical self-review to fresh-context review." : "Mechanical low-risk work uses self-review rather than mandatory fresh-context review.",
-      satisfaction: input.preferences?.thorough ? "A separate review context examines the current candidate and records its result." : "The lead reviews the resulting diff and records the relevant scope and checks.",
-      before: "close",
-      dependentAction: null,
-      acceptanceAllowed: !input.preferences?.thorough
-    }));
-  if (signals.behaviorChange.value === true || signals.mechanicalLowRisk.value === true)
-    requirements.push(requirement({
-      ruleId: "pre-pr-cleanup",
-      dimension: "verification",
-      scope,
-      reason: "Implementation output must be deslopped before it is delivered.",
-      satisfaction: "Run the workit-deslop pass and record passing check evidence, or record an approved limitation decision waiving cleanup.",
-      before: "dependent_action",
-      dependentAction: "hosting.pull_request",
-      acceptanceAllowed: true
-    }));
-  if (signals.durableAgreementNeeded.value === true)
-    requirements.push(requirement({
-      ruleId: "durable-spec",
-      dimension: "artifacts",
-      scope,
-      reason: `The work needs a durable agreement about intended behavior: ${signalReason(input, "durableAgreementNeeded")}`,
-      satisfaction: "Record the agreed behavior in a durable specification before implementation writes.",
-      before: "write",
-      dependentAction: null,
-      acceptanceAllowed: true
-    }));
-  if (signals.coordinationPlanNeeded.value === true)
-    requirements.push(requirement({
-      ruleId: "coordination-plan",
-      dimension: "continuity",
-      scope,
-      reason: `Dependencies, sequencing, or resumption need durable coordination: ${signalReason(input, "coordinationPlanNeeded")}`,
-      satisfaction: "Record useful sequencing, dependencies, and the next action in a compact plan.",
-      before: "dependent_action",
-      dependentAction: null,
-      acceptanceAllowed: true
-    }));
-  if (signals.helperUseful.value === true && !input.preferences?.fast)
-    requirements.push(requirement({
-      ruleId: "helper-usefulness",
-      dimension: "delegation",
-      scope,
-      reason: `Independent judgment or investigation justifies a scoped helper: ${signalReason(input, "helperUseful")}`,
-      satisfaction: "Use a bounded helper only for the independent objective and reconcile its result.",
-      before: "dependent_action",
-      dependentAction: null,
-      acceptanceAllowed: true
+var fileMap = (candidate) => new Map(candidate.files.map((file) => [file.path, file]));
+var changedPaths = (before, after) => {
+  const paths = new Set([...before.files, ...after.files].map((file) => file.path));
+  const left = fileMap(before);
+  const right = fileMap(after);
+  const changed = [...paths].filter((item) => JSON.stringify(left.get(item) ?? null) !== JSON.stringify(right.get(item) ?? null));
+  if (before.head !== after.head)
+    changed.push(".");
+  if (JSON.stringify(before.environment) !== JSON.stringify(after.environment))
+    changed.push(".");
+  return changed;
+};
+var sessionFromRef = (value) => {
+  if (typeof value !== "object" || value === null || value.kind !== "host")
+    return null;
+  return typeof value.host === "string" && typeof value.handle === "string" ? { host: value.host, handle: value.handle } : null;
+};
+var sameSession = (left, right) => {
+  const other = sessionFromRef(right);
+  return left !== null && other !== null && left.host === other.host && left.handle === other.handle;
+};
+var evidenceScopes = (task, ids) => (task.policy?.requirements ?? []).filter((requirement) => ids.includes(requirement.id)).map((requirement) => requirement.scope);
+function evaluateEvidence(task, candidate) {
+  const current = candidate ?? task.candidates.at(-1) ?? null;
+  return task.evidence.map((entry) => {
+    const evidence = entry.data;
+    if (evidence.result === "failed")
+      return {
+        evidenceId: entry.id,
+        status: "failed",
+        reason: "failed evidence remains historical"
+      };
+    if (evidence.kind === "check" || evidence.kind === "review") {
+      if (!evidence.beforeCandidateId || !evidence.candidateId)
+        return {
+          evidenceId: entry.id,
+          status: "stale",
+          reason: "check or review evidence lacks start and end candidates"
+        };
+      if (evidence.beforeCandidateId !== evidence.candidateId)
+        return {
+          evidenceId: entry.id,
+          status: "stale",
+          reason: "candidate changed during the check or review"
+        };
+    }
+    if (!evidence.candidateId || !current)
+      return {
+        evidenceId: entry.id,
+        status: evidence.result,
+        reason: "evidence has no candidate binding"
+      };
+    const observed = task.candidates.find((item) => item.id === evidence.candidateId) ?? (current.id === evidence.candidateId ? current : undefined);
+    if (!observed || observed.completeness === "uncertain" || current.completeness === "uncertain")
+      return { evidenceId: entry.id, status: "stale", reason: "candidate is missing or uncertain" };
+    if (observed.id === current.id)
+      return { evidenceId: entry.id, status: evidence.result, reason: "candidate is unchanged" };
+    const scopes = evidenceScopes(task, evidence.requirementIds);
+    const changed = changedPaths(observed, current);
+    const environmentChanged = JSON.stringify(observed.environment) !== JSON.stringify(current.environment);
+    if (!scopes.length || environmentChanged || changed.some((item) => scopes.some((scope) => pathRelevant(item, scope))))
+      return { evidenceId: entry.id, status: "stale", reason: "relevant candidate state changed" };
+    return {
+      evidenceId: entry.id,
+      status: evidence.result,
+      reason: "candidate changed outside evidence scope"
+    };
+  });
+}
+var scopeCovers2 = scopeCovers;
+var checkPin = (assignment, beforeCandidateId, candidateId) => {
+  const pin = assignment.candidateId ?? null;
+  if (pin === null)
+    return true;
+  return (beforeCandidateId ?? null) === pin || (candidateId ?? null) === pin;
+};
+var resolveBinding = (evidence, pin, currentCandidateId) => {
+  const bound = evidence.kind === "check" || evidence.kind === "review";
+  const fallback = bound ? pin ?? currentCandidateId : null;
+  return {
+    beforeCandidateId: evidence.beforeCandidateId ?? fallback,
+    candidateId: evidence.candidateId ?? fallback
+  };
+};
+var findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId != null);
+var applicableDecision2 = (task, workspace, requirement, checkoutRoot) => task.decisions.filter((entry) => entry.provenance.kind !== "imported").map((entry) => entry.data).filter((decision) => decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.binding.taskId === task.id && decision.binding.workspaceId === workspace.id && decision.requirementIds.includes(requirement.id) && decision.binding.scope && scopeCovers2(decision.binding.scope, requirement.scope) && decision.digest === decisionDigest(decision) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok : decision.binding.contentRefs.every((reference) => reference.kind !== "file")));
+var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && (data.response === "approved" || data.response === "stated") && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
+var evidenceMatchesRequirement = (kind, evidenceKind, dimension, ruleId) => {
+  if (kind !== "passed")
+    return false;
+  if (dimension === "testing" || dimension === "verification")
+    return evidenceKind === "check" || ruleId === "pre-pr-cleanup" && evidenceKind === "artifact";
+  if (dimension === "review")
+    return evidenceKind === "review";
+  if (dimension === "investigation" || dimension === "challenge")
+    return evidenceKind === "investigation";
+  if (dimension === "artifacts" || dimension === "continuity")
+    return evidenceKind === "artifact";
+  return false;
+};
+var expectedKinds = (dimension, ruleId) => {
+  if (dimension === "testing")
+    return "check";
+  if (dimension === "verification")
+    return ruleId === "pre-pr-cleanup" ? "check or artifact" : "check";
+  if (dimension === "review")
+    return "review";
+  if (dimension === "investigation" || dimension === "challenge")
+    return "investigation";
+  if (dimension === "artifacts" || dimension === "continuity")
+    return "artifact";
+  if (dimension === "decisions")
+    return "decision";
+  return "worker report";
+};
+function evaluateRequirements(task, workspace, capabilities, candidate, checkoutRoot, _caller) {
+  const evidence = evaluateEvidence(task, candidate);
+  if (task.policy && task.policy.policyVersion !== POLICY_VERSION)
+    return task.policy.requirements.map((requirement) => ({
+      requirementId: requirement.id,
+      status: "unsatisfied",
+      evidenceIds: [],
+      decisionIds: [],
+      reason: "stored policy version is unsupported; reassessment is required"
     }));
-  for (const constraint of input.constraints)
-    for (const obligation of constraint.requires) {
-      const dimension = obligation.method ?? (obligation.kind === "check" ? "verification" : obligation.kind === "decision" ? "decisions" : "challenge");
-      requirements.push(requirement({
-        ruleId: `project-constraint:${constraint.id}:${obligation.kind}:${sha256({
-          kind: obligation.kind,
-          scope: normalizedScope(obligation.scope),
-          refs: normalizedRefList(obligation.refs),
-          method: obligation.method,
-          before: obligation.before,
-          dependentAction: obligation.dependentAction
-        })}`,
-        dimension,
-        scope: obligation.scope,
-        reason: `${constraint.kind} constraint requires ${obligation.kind}: ${constraint.statement}`,
-        satisfaction: `Satisfy the constraint obligation using its referenced ${obligation.kind}.`,
-        before: obligation.before,
-        dependentAction: obligation.dependentAction,
-        acceptanceAllowed: constraint.acceptanceAllowed && obligation.kind !== "decision"
-      }));
+  return (task.policy?.requirements ?? []).map((requirement) => {
+    const related = task.evidence.map((entry, index) => ({ entry, evaluation: evidence[index] })).filter(({ entry }) => entry.data.requirementIds.includes(requirement.id));
+    const passed = related.filter(({ entry, evaluation }) => {
+      if (!evidenceMatchesRequirement(evaluation.status, entry.data.kind, requirement.dimension, requirement.ruleId))
+        return false;
+      if ((entry.data.kind === "check" || entry.data.kind === "review") && (!entry.data.beforeCandidateId || !entry.data.candidateId || entry.data.beforeCandidateId !== entry.data.candidateId))
+        return false;
+      if (requirement.dimension !== "review")
+        return true;
+      const reviewSession = sessionFromRef(entry.data.reviewContext);
+      const sameImplementation = sameSession(reviewSession, task.intent.provenance.session);
+      const sameEvidenceSession = related.some(({ entry: other }) => other.id !== entry.id && other.data.kind === "review" && other.data.candidateId !== null && other.data.candidateId === entry.data.candidateId && sameSession(reviewSession, other.provenance.session));
+      return entry.data.kind === "review" && reviewSession !== null && sameSession(reviewSession, entry.provenance.session) && (requirement.ruleId === "self-review" || !sameImplementation && !sameEvidenceSession);
+    });
+    if (passed.length) {
+      const currentId = candidate?.id ?? null;
+      const withRed = requirement.dimension === "testing" ? passed.filter(({ entry }) => related.some((other) => other.entry.data.kind === "check" && other.evaluation.status === "failed" && other.entry.data.requirementIds.includes(requirement.id) && other.entry.recordedAt <= entry.recordedAt) || related.some((baseline) => baseline.entry.id !== entry.id && baseline.entry.data.kind === "check" && baseline.entry.data.result === "passed" && baseline.entry.data.candidateId !== null && currentId !== null && baseline.entry.data.candidateId !== currentId)) : passed;
+      if (withRed.length)
+        return {
+          requirementId: requirement.id,
+          status: "satisfied",
+          evidenceIds: withRed.map(({ entry }) => entry.id),
+          decisionIds: [],
+          reason: "fresh applicable evidence passed"
+        };
+      if (requirement.dimension === "testing")
+        return {
+          requirementId: requirement.id,
+          status: "unsatisfied",
+          evidenceIds: [],
+          decisionIds: [],
+          reason: "testing requirement has GREEN evidence but no preceding RED"
+        };
+    }
+    if (requirement.dimension === "delegation") {
+      const dot = (scope) => scope.paths.length > 0 ? scope : { ...scope, paths: ["."] };
+      const reconciled = task.workers.some((worker) => worker.data.report?.outcome === "completed" && (worker.data.assignment.requirementIds.includes(requirement.id) || scopeCovers2(dot(requirement.scope), dot(worker.data.assignment.scope))));
+      if (reconciled)
+        return {
+          requirementId: requirement.id,
+          status: "satisfied",
+          evidenceIds: [],
+          decisionIds: [],
+          reason: "bounded helper completed and its result is recorded"
+        };
+    }
+    const decisions = requirement.dimension === "decisions" ? applicableRequirementDecision(task, workspace, requirement, checkoutRoot) : [];
+    if (decisions.length)
+      return {
+        requirementId: requirement.id,
+        status: "satisfied",
+        evidenceIds: [],
+        decisionIds: decisions.map((decision) => decision.id),
+        reason: "an applicable approved or stated decision satisfies the requirement"
+      };
+    const limitations = requirement.acceptanceAllowed ? applicableDecision2(task, workspace, requirement, checkoutRoot) : [];
+    if (limitations.length)
+      return {
+        requirementId: requirement.id,
+        status: "accepted_limitation",
+        evidenceIds: [],
+        decisionIds: limitations.map((decision) => task.decisions.find((entry) => entry.data === decision).id),
+        reason: "an applicable approved limitation permits the missing evidence"
+      };
+    const unavailable = capabilities.some((capability) => capability.assurance === "unavailable" && (capability.name === requirement.dimension || capability.surface === requirement.dimension));
+    if (!unavailable && related.length > 0 && !passed.length)
+      return {
+        requirementId: requirement.id,
+        status: "unsatisfied",
+        evidenceIds: related.map(({ entry }) => entry.id),
+        decisionIds: [],
+        reason: `no passing evidence (needs kind:${expectedKinds(requirement.dimension, requirement.ruleId)})`
+      };
+    return {
+      requirementId: requirement.id,
+      status: unavailable ? "unavailable" : "unsatisfied",
+      evidenceIds: related.map(({ entry }) => entry.id),
+      decisionIds: [],
+      reason: unavailable ? "required capability is unavailable" : "no fresh passing evidence"
+    };
+  });
+}
+function evaluateClosure(requestedOutcome, view) {
+  if (requestedOutcome !== "stopped" && !view.task.policy)
+    return failure("requirements_unsatisfied", "task has not been assessed");
+  if (view.task.policy && view.task.policy.policyVersion !== POLICY_VERSION)
+    return failure("requirements_unsatisfied", "stored policy version is unsupported; reassessment is required");
+  const evaluations = view.requirements;
+  const openFindings = view.task.findings.filter((entry) => entry.data.disposition === "open");
+  if (requestedOutcome !== "stopped" && openFindings.length)
+    return failure("requirements_unsatisfied", "open findings must be resolved before closure");
+  if (requestedOutcome !== "stopped") {
+    const evidenceById = new Map(view.evidence.map((entry) => [entry.evidenceId, entry.status]));
+    for (const entry of view.task.findings) {
+      if (entry.data.disposition === "fixed") {
+        const verified = entry.data.resolution?.evidenceIds.some((id) => {
+          const evidence = view.task.evidence.find((item) => item.id === id);
+          if (!evidence)
+            return false;
+          return findingVerificationPasses(entry.data.candidateId, {
+            kind: evidence.data.kind,
+            candidateId: evidence.data.candidateId,
+            status: evidenceById.get(id) ?? "missing"
+          });
+        });
+        if (!verified)
+          return failure("requirements_unsatisfied", "fixed findings require current verification");
+      }
+      if (entry.data.disposition === "deferred") {
+        const valid = entry.data.resolution?.decisionIds.some((id) => {
+          const decisionEntry = view.task.decisions.find((item) => item.id === id);
+          const decision = decisionEntry?.data;
+          return Boolean(decision && decisionEntry?.provenance.kind !== "imported" && decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.digest === decisionDigest(decision) && verifyDecisionContentAtRoot(view.workspace.root, decision.binding).ok && decision.binding.taskId === view.task.id && decision.binding.workspaceId === view.workspace.id && scopeCovers2(decision.binding.scope, entry.data.scope) && decision.requirementIds.some((requirementId) => view.task.policy?.requirements.some((requirement) => requirement.id === requirementId && requirement.acceptanceAllowed)));
+        });
+        if (!valid)
+          return failure("requirements_unsatisfied", "deferred findings require an approved limitation decision that references an acceptanceAllowed requirement and covers the finding scope");
+      }
     }
-  const seen = new Set;
-  return requirements.filter((item) => {
-    if (seen.has(item.id))
+  }
+  const blocking = evaluations.filter((item) => {
+    if (item.status !== "unsatisfied" && item.status !== "unavailable")
       return false;
-    seen.add(item.id);
-    return true;
+    const requirement = view.task.policy?.requirements.find((candidate) => candidate.id === item.requirementId);
+    return !requirement || requirement.before === "close";
+  });
+  if (requestedOutcome !== "stopped" && blocking.length)
+    return failure("requirements_unsatisfied", "applicable requirements are unsatisfied", {
+      requirementIds: blocking.map((item) => item.requirementId),
+      requirements: blocking.map((item) => {
+        const requirement = view.task.policy?.requirements.find((candidate) => candidate.id === item.requirementId);
+        return {
+          requirementId: item.requirementId,
+          ruleId: requirement?.ruleId ?? "unknown",
+          reason: item.reason,
+          satisfaction: requirement?.satisfaction ?? "",
+          dependentAction: requirement?.dependentAction ?? null
+        };
+      })
+    });
+  const accepted = evaluations.filter((item) => item.status === "accepted_limitation");
+  if (requestedOutcome === "verified" && accepted.length)
+    return failure("requirements_unsatisfied", "accepted limitations cannot be reported as verified", {
+      requirementIds: accepted.map((item) => item.requirementId)
+    });
+  const evidenceIds = [
+    ...new Set([
+      ...evaluations.flatMap((item) => item.evidenceIds),
+      ...view.task.findings.flatMap((item) => item.data.resolution?.evidenceIds ?? [])
+    ])
+  ];
+  const decisionIds = [
+    ...new Set([
+      ...evaluations.flatMap((item) => item.decisionIds),
+      ...view.task.findings.flatMap((item) => item.data.resolution?.decisionIds ?? [])
+    ])
+  ];
+  return success(null, null, {
+    outcome: requestedOutcome === "stopped" ? "stopped" : accepted.length ? "accepted_limitations" : "verified",
+    evidenceIds,
+    decisionIds,
+    requirementIds: evaluations.map((item) => item.requirementId)
   });
 }
-function resolvePolicy(input) {
-  const normalized = normalizeResolverInput(input);
-  if (!normalized.ok)
-    return normalized;
-  const requirements = resolveRequirements(normalized.data);
-  const policy = {
-    policyVersion: POLICY_VERSION,
-    inputDigest: sha256(canonicalJson(normalized.data)),
-    requirements
-  };
-  const parsed = policySchema.safeParse(policy);
-  if (!parsed.success)
-    return failure("invalid_input", "resolved policy is invalid", invalidFields(parsed.error));
-  return success(null, null, parsed.data);
+
+// packages/workit-core/src/core/methods.ts
+var METHODS = {
+  "workit-challenge": { dimensions: ["challenge", "decisions"] },
+  "workit-behavioral-tdd": { dimensions: ["testing"], ruleIds: ["mechanical-existing-checks"] },
+  "workit-review": { dimensions: ["review"], ruleIds: ["fresh-context-review", "self-review"] },
+  "workit-plan": { dimensions: ["artifacts", "continuity"] },
+  "workit-implement": { dimensions: ["delegation"] },
+  "workit-debug": {},
+  "workit-handoff": {},
+  "workit-deslop": { ruleIds: ["pre-pr-cleanup"] }
+};
+var methodMatches = (definition, requirement) => definition.dimensions?.includes(requirement.dimension) === true || definition.ruleIds?.includes(requirement.ruleId) === true;
+var assuranceFor = (id, definition, capabilities) => {
+  const keys = new Set([
+    id,
+    ...definition.dimensions ?? [],
+    ...definition.ruleIds ?? []
+  ]);
+  const matches = capabilities.filter((capability) => keys.has(capability.name) || keys.has(capability.surface));
+  if (id === "workit-review" && matches.length === 0)
+    return { assurance: "unavailable", reasons: ["independent review capability is unavailable"] };
+  if (matches.some((capability) => capability.assurance === "unavailable"))
+    return {
+      assurance: "unavailable",
+      reasons: matches.filter((capability) => capability.assurance === "unavailable").map((capability) => capability.reason)
+    };
+  if (matches.some((capability) => capability.assurance === "enforced"))
+    return { assurance: "enforced", reasons: matches.map((capability) => capability.reason) };
+  return { assurance: "agent_guided", reasons: matches.map((capability) => capability.reason) };
+};
+function selectMethods(policy, capabilities) {
+  return Object.entries(METHODS).flatMap(([id, definition]) => {
+    const requirements = policy.requirements.filter((requirement) => methodMatches(definition, requirement));
+    if (requirements.length === 0)
+      return [];
+    const capability = assuranceFor(id, definition, capabilities);
+    const reasons = [
+      ...new Set(requirements.map((requirement) => requirement.reason)),
+      ...capability.reasons
+    ];
+    if (capability.assurance === "unavailable")
+      reasons.unshift("required capability is unavailable");
+    return [{ id, reason: reasons.join("; "), assurance: capability.assurance }];
+  });
+}
+var invariantBootstrap = () => `
+Workit is optional coordination and repository-policy tooling around the host,
+not a permission system or a mandatory workflow. Native host allow/ask/deny,
+sandbox, plan/read-only mode, and organization rules remain authoritative.
+Ordinary investigation, questions, non-Git work, and routine reversible edits
+need zero Workit task, assessment, or writer calls. Use one compact tracked
+record only when handoff, dependent steps, concurrent actors, or meaningful
+decisions make continuity useful; similar titles alone never merge tasks.
+
+For a routine user-authorized branch or commit, prefer native host Git/shell
+tools from the outset when managed coordination or outcome reconciliation is
+not needed. Inspect the actual target checkout and its configured conventions;
+use Workit's read-only context/policy tools when needed. Do not start a task,
+acquire a writer, or mint a decision receipt solely for a native Git action.
+Native permissions still apply. Never switch execution paths to evade a denial
+or repeat an uncertain managed effect. A local-commit endpoint does not imply
+PR readiness, a fresh review, or post-commit assessment/closure paperwork.
+
+For tracked work, inspect its current state and use the shared operations for
+task, policy, evidence, finding, decision, worker, writer, and state changes.
+Start a record once for an explicit tracked objective; assess or reassess only
+when policy selection or changed evidence/constraints requires it. Omitted
+expectedRevision and expectedWorkspaceRevision use current values; explicit
+values are still concurrency-checked, so never copy revisions between calls.
+A solo edit does not need writer acquisition; use it when concurrent checkout
+writers need coordination. Record only observed facts and checks. Evidence can
+become stale when its bound candidate changes; reconcile findings against the
+current candidate before recording completion.
+
+Workit validates domain policy against the actual action target, configured
+account, branch and commit conventions, protected refs, and current repository
+state. The task directory is coordination state, not a boundary on which
+repository may be changed. Use an action-time cwd target where a managed
+Git/hosting action supports it; a non-Git directory remains valid for OS work.
+GitHub/GitLab use the active gh/glab CLI identity; YouTrack uses its own token.
+Preserve uncertain external outcomes and reconcile repository/provider state
+before retrying. Internal reservations prevent duplicate or ambiguous effects;
+they are not permission tickets for every edit.
+
+On OpenCode V1 and V2, use native host tools for external mutations. Workit
+provides read-only workit_context; it has no managed external-action executor.
+Do not create proposals or request Workit approvals merely to invoke native
+tools. Old uncertain managed effects still require evidence before any retry.
+
+Use host-native authorization through the host's supported path. A native
+question receipt records an actual question interaction; it is not automatic
+host permission. Record a meaningful user choice once with provenance when
+future retrieval helps. Never fabricate a receipt, re-ask only to mint one, or
+let imported decisions grant authority. Never turn a host deny into allow or
+claim enforcement/evidence a host cannot provide. A precise request with settled
+constraints does not need an interview. Present genuine unresolved options with
+evidence and a recommendation, then continue toward the requested delivery
+endpoint: investigation, implementation, branch/commit/push, PR/MR-ready,
+merge, or release. Run
+applicable checks and safe repairs without repeated continuation questions;
+stop for missing host authority, a new consequential choice, a conflicting edit,
+or an unresolved blocker. A tracked record may close when actual evidence
+supports its outcome; no final human closure ceremony is required.
+
+A completed native subagent run stops its bound worker by itself; if a worker
+strands in cancelling with its run verifiably over, repeat worker.cancel to
+confirm the stop. Preserve unresolved requirements, gaps, and uncertain workers.
+When context changes, distinguish a quick question, same-task adjustment, and
+separate request. Answer a quick question without pausing/resuming task state;
+park a concise checkpoint only when substantial work needs to continue later.
+For work spanning repositories, bind each unfinished item to its actual checkout,
+branch, requested deliverables, and delivery endpoint. Preserve held items with
+an explicit resume condition. Resolve competing plausible targets before a
+mutation; ask only when available context cannot settle that consequential choice.
+Before reporting delivery, reconcile every requested item and observe the actual
+target result; a local commit alone is not evidence of a requested remote push.
+
+Skill routing: slash aliases /wk-* load on demand. Use workit-steer for a
+substantial interruption or change of direction, workit-deslop when relevant
+to a PR-ready endpoint, workit-green-run for failing CI, workit-blast-radius
+when impact is uncertain, and workit-challenge for genuinely open consequential
+choices. Load workit-plan when dependencies or handoff need durable next actions.
+Load the skill; never act from memory of it.
+`.trim();
+
+// packages/workit-core/src/core/task-context.ts
+function reconcileResume(view, observations = []) {
+  if (observations.length > 0)
+    return failure("permission_denied", "worker observations require native host verification");
+  const candidate = captureCandidate(view.workspace.root, view.task.intent.data.scope, []);
+  if (!candidate.ok)
+    return candidate;
+  const staleEvidenceIds = evaluateEvidence(view.task, candidate.data).filter((entry) => entry.status === "stale").map((entry) => entry.evidenceId);
+  const blockers = [...view.task.progress.blockers];
+  if (view.task.workers.some((entry) => isUncertainWorker(entry.data.state)))
+    blockers.push({
+      reason: "worker state requires reconciliation",
+      dependentAction: "resume",
+      refs: []
+    });
+  return success(null, null, {
+    candidate: candidate.data,
+    staleEvidenceIds,
+    workerUpdates: [],
+    blockers,
+    reassessmentRequired: view.task.policy?.policyVersion !== POLICY_VERSION
+  });
 }
-function diffPolicy(previous, next, reason, now) {
-  if (!policySchema.safeParse(previous).success && previous !== null)
-    throw new TypeError("previous policy is invalid");
-  if (!policySchema.safeParse(next).success)
-    throw new TypeError("next policy is invalid");
-  const oldIds = new Set(previous?.requirements.map((requirement) => requirement.id) ?? []);
-  const newIds = new Set(next.requirements.map((requirement) => requirement.id));
-  const added = [...newIds].filter((id) => !oldIds.has(id)).sort(compareCodeUnits3);
-  const retired = [...oldIds].filter((id) => !newIds.has(id)).sort(compareCodeUnits3);
-  if (added.length === 0 && retired.length === 0)
-    return null;
-  const normalizedReason = reason.trim();
-  const changeReason = retired.length ? `${normalizedReason || "policy reassessed"} (retired: ${retired.join(",")})` : normalizedReason || "policy reassessed";
-  const change = {
-    recordedAt: now,
-    fromInputDigest: previous?.inputDigest ?? null,
-    toInputDigest: next.inputDigest,
-    added,
-    retired,
-    reason: changeReason
+var COMPACT_MAX_BYTES = 4096;
+var COMPACT_MAX_ITEMS = 8;
+var COMPACT_TEXT_BYTES = 128;
+var sensitiveUrl = /\bhttps?:\/\/[^/\s:@]+:[^@\s]+@/gi;
+var sensitiveValue = /(?:token|secret|password|passwd|api[-_ ]?key|private[-_ ]?key|authorization)\s*[:=]\s*(?:bearer\s+)?\S+|\bbearer\s+\S+/gi;
+var privateKey = /-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/gi;
+var compactText = (value, limit) => value === null ? null : value.replace(privateKey, "<redacted-private-key>").replace(sensitiveUrl, "<redacted-url>").replace(sensitiveValue, (match) => {
+  const separator = match.search(/[:=]/u);
+  if (separator >= 0)
+    return `${match.slice(0, separator)}=<redacted>`;
+  const space = match.search(/\s/u);
+  return `${match.slice(0, space)} <redacted>`;
+}).slice(0, limit);
+var compactBytes = (value) => new TextEncoder().encode(value).byteLength;
+var compactTimestamp = (value) => `${value.slice(0, 19)}.${value.slice(20, -1).padEnd(9, "0")}`;
+var compactDecisionChoice = (entry) => {
+  const stated = entry.data.binding.statedChoice?.text;
+  const approved = entry.data.response === "approved" ? entry.data.binding.approvedContent : "";
+  const source = stated?.trim() || approved.trim() || null;
+  return compactText(source, COMPACT_TEXT_BYTES);
+};
+var compactReference = (ref) => {
+  if (ref.kind === "file")
+    return {
+      kind: "file",
+      path: compactText(ref.path, COMPACT_TEXT_BYTES) ?? ""
+    };
+  if (ref.kind === "record")
+    return {
+      kind: "record",
+      collection: ref.collection,
+      id: ref.id
+    };
+  return { kind: ref.kind };
+};
+function compactTaskContext(view) {
+  const decisions = view.task.decisions.slice().sort((left, right) => {
+    const leftAt = compactTimestamp(left.recordedAt);
+    const rightAt = compactTimestamp(right.recordedAt);
+    if (leftAt !== rightAt)
+      return leftAt > rightAt ? -1 : 1;
+    return left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+  }).slice(0, COMPACT_MAX_ITEMS).map((entry) => ({
+    id: entry.id,
+    purpose: entry.data.purpose,
+    status: entry.data.response,
+    digest: entry.data.digest,
+    choice: compactDecisionChoice(entry) || `task.inspect taskId=${view.task.id} view=full; decision=${entry.id}`,
+    references: entry.data.binding.contentRefs.slice(0, 1).map(compactReference)
+  }));
+  const methods = view.task.policy ? selectMethods(view.task.policy, view.capabilities).map((method) => ({
+    id: method.id,
+    assurance: method.assurance,
+    reason: compactText(method.reason, COMPACT_TEXT_BYTES) ?? ""
+  })) : [];
+  const gaps = Array.from(new Set([
+    ...view.evidence.filter((entry) => entry.status === "stale").map((entry) => `stale evidence: ${entry.evidenceId}`),
+    ...view.requirements.filter((entry) => entry.status !== "satisfied").map((entry) => entry.reason),
+    ...view.task.progress.blockers.map((entry) => entry.reason)
+  ])).sort().slice(0, COMPACT_MAX_ITEMS).map((gap) => compactText(gap, COMPACT_TEXT_BYTES));
+  const context = {
+    objective: compactText(view.task.intent.data.objective, COMPACT_TEXT_BYTES) ?? "",
+    status: view.task.status,
+    decisions,
+    methods,
+    gaps,
+    nextAction: compactText(view.task.progress.nextAction, COMPACT_TEXT_BYTES)
   };
-  const parsed = policyChangeSchema.safeParse(change);
-  if (!parsed.success)
-    throw new TypeError("policy change is invalid");
-  return parsed.data;
+  let encoded = JSON.stringify(context);
+  while (compactBytes(encoded) > COMPACT_MAX_BYTES && (context.decisions.length || context.methods.length || context.gaps.length)) {
+    if (context.gaps.length)
+      context.gaps.pop();
+    else if (context.decisions.length)
+      context.decisions.pop();
+    else
+      context.methods.pop();
+    encoded = JSON.stringify(context);
+  }
+  if (compactBytes(encoded) > COMPACT_MAX_BYTES) {
+    context.objective = compactText(context.objective, 64) ?? "";
+    context.nextAction = compactText(context.nextAction, 64);
+    encoded = JSON.stringify(context);
+  }
+  return encoded;
 }
+var exportDigest = (bundle) => sha256({
+  schemaVersion: bundle.schemaVersion,
+  exportedAt: bundle.exportedAt,
+  sourceWorkspaceId: bundle.sourceWorkspaceId,
+  task: bundle.task
+});
 
 // packages/workit-core/src/core/task-engine.ts
 var provenance = (context, kind = context.provenanceKind ?? "host_observed") => ({
@@ -14223,14 +14228,29 @@ class WorkitCore {
       writer: evaluationWorkspace.writer
     });
   }
-  view(task) {
+  compactContext(taskId) {
+    const root = this.contextRootError();
+    if (!root.ok)
+      return root;
+    const task = this.store.readTask(taskId);
+    if (!task.ok)
+      return task;
+    const helper = this.helperTaskGuard(task.data, true);
+    if (!helper.ok)
+      return helper;
+    const view = this.view(task.data, false);
+    if (!view.ok)
+      return view;
+    return success(view.revision, view.workspaceRevision, compactTaskContext(view.data));
+  }
+  view(task, capture = true) {
     const workspace = this.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
     if (!workspace.data)
       return failure("not_found", "workspace not found");
     const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
-    const current = historical ? success(null, null, historical) : captureCandidate(this.store.root, task.intent.data.scope, environment());
+    const current = historical ? success(null, null, historical) : capture ? captureCandidate(this.store.root, task.intent.data.scope, environment()) : success(null, null, task.candidates.at(-1) ?? null);
     if (!current.ok)
       return current;
     const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
@@ -14502,6 +14522,137 @@ class WorkitCore {
     return this.summary(changed.data.task);
   }
 }
+
+// packages/workit-core/src/core/session-context.ts
+var cache = new Map;
+// packages/workit-core/src/core/route-intent.ts
+var shellBranchTarget = (command) => {
+  if (!command.trim() || /[\r\n;&|<>`'"$()\\*?{}~!#]/u.test(command) || command.includes("[") || command.includes("]"))
+    return null;
+  const args = command.trim().split(/\s+/u);
+  if (args[0] !== "git")
+    return null;
+  const option = args[2];
+  const target = args[1] === "switch" && ["-c", "--create", "-C", "--force-create"].includes(option ?? "") && (args.length === 4 || args.length === 5) ? args[3] : args[1] === "checkout" && ["-b", "-B"].includes(option ?? "") && (args.length === 4 || args.length === 5) ? args[3] : args[1] === "branch" && (args.length === 3 || args.length === 4) ? args[2] : null;
+  return target && !target.startsWith("-") ? target : null;
+};
+var shellBranchPolicyViolation = (root, command) => {
+  const target = shellBranchTarget(command);
+  return target === null ? null : validateBranchNameFor(root, target);
+};
+// packages/workit-core/src/core/external-action.ts
+var chainStepSchema = union([
+  string2().min(1),
+  object({ branch: string2().min(1) }).strict(),
+  object({ pr: literal(true) }).strict()
+]);
+var externalActionSchema = discriminatedUnion("operation", [
+  object({
+    operation: literal("git.branch_setup"),
+    payload: object({
+      action: _enum(["setup", "reapply_stash"]).optional(),
+      sdd_dir: string2().optional(),
+      target_branch: string2().optional(),
+      stash: _enum(["yes", "no"]).optional(),
+      cwd: string2().min(1).optional()
+    }).strict()
+  }).strict(),
+  object({
+    operation: literal("git.commit"),
+    payload: object({
+      message: string2().min(1).optional(),
+      plan_steps: array(chainStepSchema).min(1).max(32).optional(),
+      plan_branch: string2().min(1).optional(),
+      cwd: string2().min(1).optional()
+    }).strict()
+  }).strict(),
+  object({
+    operation: literal("git.push"),
+    payload: object({ branch: string2().min(1).optional(), cwd: string2().min(1).optional() }).strict()
+  }).strict(),
+  object({
+    operation: literal("hosting.pull_request"),
+    payload: object({
+      title: string2().min(1),
+      body: string2().optional(),
+      draft: boolean2().optional(),
+      target_branch: string2().optional(),
+      babysit: boolean2().optional(),
+      cwd: string2().min(1).optional()
+    }).strict()
+  }).strict(),
+  object({
+    operation: literal("hosting.merge"),
+    payload: object({
+      target_branch: string2().min(1).optional(),
+      source_branch: string2().min(1).optional(),
+      cwd: string2().min(1).optional()
+    }).strict()
+  }).strict(),
+  object({
+    operation: literal("hosting.delete_branch"),
+    payload: object({ branch: string2().min(1), cwd: string2().min(1).optional() }).strict()
+  }).strict(),
+  object({
+    operation: literal("youtrack.update"),
+    payload: object({
+      issueId: string2().min(1),
+      markdown: string2().min(1),
+      minutes: number2().positive().optional()
+    }).strict()
+  }).strict(),
+  object({
+    operation: literal("youtrack.time"),
+    payload: object({
+      issueId: string2().min(1),
+      minutes: number2().positive(),
+      text: string2().optional(),
+      dateMs: number2().finite().optional()
+    }).strict()
+  }).strict(),
+  object({
+    operation: literal("youtrack.meeting"),
+    payload: object({
+      issueId: string2().min(1),
+      minutes: number2().positive(),
+      text: string2().min(1)
+    }).strict()
+  }).strict(),
+  object({
+    operation: literal("changelog.apply"),
+    payload: object({
+      entries: union([
+        record(string2(), array(string2())),
+        array(object({ category: string2().min(1), text: string2().min(1) }).strict())
+      ]).optional(),
+      path: string2().optional(),
+      normalize_only: boolean2().optional()
+    }).strict()
+  }).strict(),
+  object({
+    operation: literal("context.read"),
+    payload: object({
+      kind: _enum([
+        "git",
+        "pr",
+        "youtrack",
+        "github_issue",
+        "gitlab_issue",
+        "changelog",
+        "release",
+        "affected"
+      ]),
+      range: string2().optional(),
+      issueId: string2().optional(),
+      issueUrl: string2().optional(),
+      issueRef: string2().optional(),
+      mode: string2().optional(),
+      specPath: string2().optional(),
+      planPath: string2().optional(),
+      cwd: string2().min(1).optional()
+    }).strict()
+  }).strict()
+]);
 // packages/workit-codex/hooks/workit-hook.ts
 var ref = (host, handle) => ({ kind: "host", host, handle });
 function detectCodexSurface(env) {
@@ -14705,7 +14856,7 @@ var activeTask = (store) => {
   return { ok: true, task: active[0], workspace: workspace.data };
 };
 var historyOfferSessions = new Set;
-var unfinishedTaskOffer = (input, excludedTaskId) => {
+var unfinishedTaskOffer2 = (input, excludedTaskId) => {
   if (input.source !== "startup" || historyOfferSessions.has(input.session_id))
     return null;
   historyOfferSessions.add(input.session_id);
@@ -14740,21 +14891,16 @@ var sessionContext = (input) => {
         capabilities: codexCapabilities(detectCodexSurface(process.env), { sessionStart: true }),
         constraints: [],
         now: new Date().toISOString().replace(/\.\d{3}Z$/, "Z")
-      }).task({
-        schemaVersion: 1,
-        action: "inspect",
-        taskId: state.task.id,
-        view: "full"
-      });
+      }).compactContext(state.task.id);
       if (view.ok)
         compact = `
-<workit-task-context>${compactTaskContext(view.data)}</workit-task-context>`;
+<workit-task-context>${view.data}</workit-task-context>`;
     }
   } catch {
     compact = `
 [workit diagnostic: task state unavailable]`;
   }
-  const offer = unfinishedTaskOffer(input, currentTaskId);
+  const offer = unfinishedTaskOffer2(input, currentTaskId);
   return `<workit-contract>
 ${invariantBootstrap()}${compact}${offer ? `
 ${offer}` : ""}