@brainervirus/workit-codex 2.5.0 → 2.7.0

package/dist/workit-hook.js

@@ -26,7 +26,7 @@ var capabilitiesFor = (descriptor, observed = {}) => descriptor.capabilities.map
   };
 });
 // packages/workit-core/src/hooks/context.ts
-import path11 from "node:path";
+import path13 from "node:path";
 
 // packages/workit-core/src/core/methods.ts
 var METHODS = {
@@ -105,8 +105,11 @@ policy, and reapplies the call, returning busy under persistent contention. A
 revision_conflict means a revision you passed is stale: re-read the record
 before deciding whether to retry.
 A solo edit does not need writer acquisition; use it when concurrent checkout
-writers need coordination. Record only observed facts and checks. Evidence can
-become stale when its bound candidate changes; reconcile findings against the
+writers need coordination. Record only observed facts and checks. Close-time
+testing and verification gates accept only a configured check the CLI ran:
+\`workit check <name>\` (\`npx -y @brainervirus/workit-cli check <name>\` when
+\`workit\` is not on PATH); a recorded check result is a note and an ad-hoc
+\`workit check -- <cmd>\` never satisfies a gate. Evidence can become stale when its bound candidate or tree changes; reconcile findings against the
 current candidate before recording completion.
 
 Workit validates domain policy against the actual action target, configured
@@ -8057,7 +8060,37 @@ var candidateSchema = object({
       path: ["id"]
     });
 });
-var evidenceSchema = object({
+var checkObservationSchema = object({
+  observer: literal("workit_cli"),
+  name: nonEmpty.nullable(),
+  configured: boolean2(),
+  argv: array(text).min(1),
+  shell: boolean2(),
+  cwd: nonEmpty,
+  exitCode: safeInteger,
+  durationMs: safeInteger.min(0),
+  timedOut: boolean2(),
+  head: text.nullable(),
+  tree: text.nullable(),
+  dirty: boolean2().nullable(),
+  signal: text.nullable(),
+  treeAfter: text.nullable(),
+  modifiedWorktree: boolean2(),
+  base: text.nullable(),
+  patchId: text.nullable(),
+  environment: object({
+    platform: nonEmpty,
+    arch: nonEmpty,
+    vars: record(nonEmpty, text.nullable())
+  }).strict(),
+  logDigest: text.nullable(),
+  logRef: text.nullable(),
+  logTail: array(text).max(40),
+  ledgerRowId: text.nullable(),
+  attestation: object({ host: nonEmpty, session: text.nullable(), agentId: text.nullable() }).strict().nullable()
+}).strict();
+var CHECK_OBSERVATION_PATH = "evidence.*.data.observation";
+var evidenceFields = {
   kind: _enum(["check", "review", "investigation", "artifact"]),
   claim: text,
   requirementIds: array(digest),
@@ -8068,7 +8101,9 @@ var evidenceSchema = object({
   refs: array(refSchema),
   exitCode: safeInteger.nullable(),
   reviewContext: refSchema.nullable()
-}).strict();
+};
+var evidenceSchema = object({ ...evidenceFields, observation: checkObservationSchema.optional() }).strict();
+var reportedEvidenceSchema = object(evidenceFields).strict();
 var evidenceEvaluationSchema = object({
   evidenceId: id,
   status: _enum(["passed", "failed", "missing", "skipped", "stale"]),
@@ -8379,7 +8414,7 @@ var evidenceOperations = {
     action: literal("record"),
     ...taskId,
     expectedRevision: revision.optional(),
-    evidence: evidenceSchema
+    evidence: reportedEvidenceSchema
   })
 };
 var findingOperations = {
@@ -8614,8 +8649,11 @@ function requirementId(input) {
   });
 }
 
-// packages/workit-core/src/core/task-engine.ts
-import { realpathSync as realpathSync6 } from "node:fs";
+// packages/workit-core/src/core/task-evaluation.ts
+import { createHash as createHash8 } from "node:crypto";
+import * as fs10 from "node:fs";
+import { spawnSync as spawnSync5 } from "node:child_process";
+import path12 from "node:path";
 
 // packages/workit-core/src/core/authority.ts
 import { createHash as createHash6 } from "node:crypto";
@@ -12292,18 +12330,371 @@ function reconcileAction(input) {
 var bindingCovers = scopeCovers;
 var verifyDecisionContent = verifyContentRefs;
 
-// packages/workit-core/src/core/policy-resolver.ts
-var resolverInputSchema = object({
-  intent: intentSchema,
-  assessment: assessmentSchema,
-  constraints: array(constraintSchema),
-  prior: object({
-    decisions: array(decisionSchema),
-    findings: array(findingSchema),
-    requirements: array(requirementSchema)
-  }).strict(),
-  preferences: object({ fast: boolean2().optional(), thorough: boolean2().optional() }).strict().optional()
-}).strict();
+// packages/workit-core/src/check-config.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
+import fs8 from "node:fs";
+import path10 from "node:path";
+var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
+var CHECKS_FILE = "workit.checks.json";
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var SHELL_META = /[|&;<>()$`\\*?[\]{}~!#]/u;
+function splitCommand(command) {
+  const argv = [];
+  let current = "";
+  let quote = null;
+  let started = false;
+  for (const char of command) {
+    if (quote) {
+      if (char === quote)
+        quote = null;
+      else
+        current += char;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      started = true;
+      continue;
+    }
+    if (/\s/u.test(char)) {
+      if (started)
+        argv.push(current);
+      current = "";
+      started = false;
+      continue;
+    }
+    if (SHELL_META.test(char))
+      return new Error(`"${command}" uses shell syntax (${char}); configure an argv array instead`);
+    current += char;
+    started = true;
+  }
+  if (quote)
+    return new Error(`"${command}" has an unterminated quote`);
+  if (started)
+    argv.push(current);
+  return argv.length ? argv : new Error("empty command");
+}
+var git = (cwd, args) => {
+  const run = spawnSync3("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: 20000,
+    killSignal: "SIGKILL",
+    windowsHide: true
+  });
+  const value = run.status === 0 ? (run.stdout ?? "").trim() : "";
+  return value || null;
+};
+function checkRoot(cwd) {
+  return path10.resolve(git(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
+}
+var packageManager = (root) => {
+  const has = (file) => fs8.existsSync(path10.join(root, file));
+  if (has("bun.lock") || has("bun.lockb"))
+    return "bun";
+  if (has("pnpm-lock.yaml"))
+    return "pnpm";
+  if (has("yarn.lock"))
+    return "yarn";
+  return "npm";
+};
+var scriptCheck = (pm, name) => {
+  const argv = [pm, "run", name];
+  const accepts = [argv];
+  if (pm === "pnpm" || pm === "yarn" || pm === "npm" && name === "test")
+    accepts.push([pm, name]);
+  return { name, argv, accepts };
+};
+var CHECK_NAME = /^[a-z0-9][a-z0-9:._-]{0,63}$/u;
+function detectedChecks(root) {
+  const read = (file) => {
+    try {
+      return fs8.readFileSync(path10.join(root, file), "utf8");
+    } catch {
+      return null;
+    }
+  };
+  const checks = [];
+  const add = (check) => {
+    if (!checks.some((item) => item.name === check.name))
+      checks.push(check);
+  };
+  const manifestText = read("package.json");
+  if (manifestText !== null) {
+    let manifest = null;
+    try {
+      manifest = JSON.parse(manifestText);
+    } catch {}
+    const scripts = isRecord2(manifest) && isRecord2(manifest.scripts) ? manifest.scripts : {};
+    const pm = packageManager(root);
+    for (const name of SCRIPT_CHECKS) {
+      const script = scripts[name];
+      if (typeof script === "string" && script.trim() !== "")
+        add(scriptCheck(pm, name));
+    }
+  }
+  const plain = (name, argv) => ({ name, argv, accepts: [argv] });
+  if (read("go.mod") !== null)
+    add(plain("test", ["go", "test", "./..."]));
+  if (read("Cargo.toml") !== null)
+    add(plain("test", ["cargo", "test"]));
+  if (read("pytest.ini") !== null || /\bpytest\b/u.test(read("pyproject.toml") ?? ""))
+    add(plain("test", ["pytest"]));
+  const makefile = read("Makefile") ?? read("makefile") ?? read("GNUmakefile");
+  if (makefile !== null && /^test\s*:(?!=)/mu.test(makefile))
+    add(plain("test", ["make", "test"]));
+  return checks;
+}
+var GATES = ["testing", "verification"];
+function loadCheckConfig(cwd) {
+  const root = checkRoot(cwd);
+  const file = path10.join(root, CHECKS_FILE);
+  const none = (error = null) => ({
+    source: error ? CHECKS_FILE : "none",
+    root,
+    checks: [],
+    gates: {},
+    error
+  });
+  let text = null;
+  try {
+    text = fs8.readFileSync(file, "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
+  }
+  if (text === null) {
+    const checks = detectedChecks(root);
+    return checks.length ? { source: "defaults", root, checks, gates: {}, error: null } : none();
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return none(`${CHECKS_FILE} is not valid JSON`);
+  }
+  if (!isRecord2(parsed) || !isRecord2(parsed.checks))
+    return none(`${CHECKS_FILE} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
+  const checks = [];
+  for (const [name, value] of Object.entries(parsed.checks)) {
+    if (!CHECK_NAME.test(name))
+      return none(`${CHECKS_FILE}: check name "${name}" must match ${CHECK_NAME.source}`);
+    const argv = typeof value === "string" ? splitCommand(value) : Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string" && item.length > 0) ? value : new Error("expected a command string or a non-empty argv array");
+    if (argv instanceof Error)
+      return none(`${CHECKS_FILE}: check "${name}": ${argv.message}`);
+    checks.push({ name, argv, accepts: [argv] });
+  }
+  const gates = {};
+  if (parsed.gates !== undefined) {
+    if (!isRecord2(parsed.gates))
+      return none(`${CHECKS_FILE}: gates must be {"testing":"<name>"|["<name>",…]}`);
+    for (const [gate, value] of Object.entries(parsed.gates)) {
+      if (!GATES.includes(gate))
+        return none(`${CHECKS_FILE}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
+      const names = typeof value === "string" ? [value] : value;
+      if (!Array.isArray(names) || names.length === 0 || !names.every((name) => typeof name === "string" && checks.some((c) => c.name === name)))
+        return none(`${CHECKS_FILE}: gates.${gate} must name configured checks`);
+      gates[gate] = names;
+    }
+  }
+  return { source: CHECKS_FILE, root, checks, gates, error: null };
+}
+var sameArgv = (left, right) => left.length === right.length && left.every((item, index) => item === right[index]);
+function matchesNamedCheck(config, name, argv, cwd) {
+  if (config.error || name === null || cwd !== ".")
+    return false;
+  const check = config.checks.find((item) => item.name === name);
+  return Boolean(check?.accepts.some((accepted) => sameArgv(accepted, argv)));
+}
+function gateCheckNames(config, dimension) {
+  const explicit = config.gates[dimension];
+  if (explicit)
+    return explicit;
+  const names = config.checks.map((check) => check.name);
+  if (dimension === "testing")
+    return names.includes("test") ? ["test"] : [];
+  return names;
+}
+var workitOnPath;
+function workitAvailable(env = process.env) {
+  if (workitOnPath !== undefined)
+    return workitOnPath;
+  const windows = process.platform === "win32";
+  const exts = windows ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  const dirs = (env.PATH ?? env.Path ?? "").split(path10.delimiter).filter(Boolean);
+  workitOnPath = dirs.some((dir) => exts.some((ext) => {
+    try {
+      return fs8.statSync(path10.join(dir, `workit${ext}`)).isFile();
+    } catch {
+      return false;
+    }
+  }));
+  return workitOnPath;
+}
+function checkCommand(args, version, onPath = workitAvailable()) {
+  return onPath ? `workit check ${args}` : `npx -y @brainervirus/workit-cli@${version} check ${args}`;
+}
+
+// packages/workit-core/src/git/rev.ts
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { createHash as createHash7 } from "node:crypto";
+import fs9 from "node:fs";
+import os2 from "node:os";
+import path11 from "node:path";
+var MAX_BUFFER = 256 * 1024 * 1024;
+var GIT_TIMEOUTS = { local: 20000, worktree: 120000, network: 15000 };
+var git2 = (cwd, args, options = {}) => {
+  const result = spawnSync4("git", args, {
+    cwd,
+    encoding: "utf8",
+    env: options.env ?? process.env,
+    input: options.input,
+    maxBuffer: MAX_BUFFER,
+    timeout: options.timeoutMs ?? GIT_TIMEOUTS.local,
+    killSignal: "SIGKILL",
+    windowsHide: true
+  });
+  const error = result.error;
+  return {
+    ok: result.status === 0,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? "",
+    timedOut: error?.code === "ETIMEDOUT"
+  };
+};
+var line = (run) => {
+  if (!run.ok)
+    return null;
+  const value = run.stdout.trim();
+  return value ? value : null;
+};
+function headSha(cwd) {
+  return line(git2(cwd, ["rev-parse", "--verify", "-q", "HEAD^{commit}"]));
+}
+var emptyTree = (cwd) => line(git2(cwd, ["mktree"], { input: "" }));
+var MAX_UNTRACKED_BYTES = 5 * 1024 * 1024;
+var seedIndex = (from, to) => {
+  fs9.copyFileSync(from, to);
+  const { atimeNs, mtimeNs } = fs9.statSync(from, { bigint: true });
+  const seconds = (ns) => (Number(ns / 1000n) - 1) / 1e6;
+  fs9.utimesSync(to, seconds(atimeNs), seconds(mtimeNs));
+};
+function worktreeTree(cwd, options = {}) {
+  const top = line(git2(cwd, ["rev-parse", "--show-toplevel"]));
+  const indexPath = line(git2(cwd, ["rev-parse", "--path-format=absolute", "--git-path", "index"]));
+  if (!top || !indexPath)
+    return null;
+  const cap = options.maxUntrackedBytes ?? MAX_UNTRACKED_BYTES;
+  const timeoutMs = options.timeoutMs ?? GIT_TIMEOUTS.worktree;
+  const scratch = fs9.mkdtempSync(path11.join(os2.tmpdir(), "workit-tree-"));
+  try {
+    const tempIndex = path11.join(scratch, "index");
+    if (fs9.existsSync(indexPath))
+      seedIndex(indexPath, tempIndex);
+    const env = { ...process.env, GIT_INDEX_FILE: tempIndex };
+    const untracked = git2(top, ["ls-files", "--others", "--exclude-standard", "-z"], {
+      env,
+      timeoutMs
+    });
+    if (!untracked.ok)
+      return null;
+    const skipped = [];
+    for (const file of untracked.stdout.split("\x00").filter(Boolean)) {
+      try {
+        const stat = fs9.statSync(path11.join(top, file));
+        if (stat.isFile() && stat.size > cap)
+          skipped.push({ path: file, size: stat.size, mtimeMs: Math.trunc(stat.mtimeMs) });
+      } catch {}
+    }
+    skipped.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    const added = skipped.length ? git2(top, ["add", "-A", "--pathspec-from-file=-", "--pathspec-file-nul"], {
+      env,
+      timeoutMs,
+      input: [".", ...skipped.map((file) => `:(exclude,literal)${file.path}`)].join("\x00")
+    }) : git2(top, ["add", "-A"], { env, timeoutMs });
+    if (!added.ok)
+      return null;
+    const tree = line(git2(top, ["write-tree"], { env, timeoutMs }));
+    if (!tree)
+      return null;
+    const base = line(git2(top, ["rev-parse", "--verify", "-q", "HEAD^{tree}"])) ?? emptyTree(top);
+    const key = skipped.length ? `sha256:${createHash7("sha256").update(JSON.stringify({ tree, skipped })).digest("hex")}` : tree;
+    return { tree, key, dirty: tree !== base || skipped.length > 0, skipped };
+  } finally {
+    fs9.rmSync(scratch, { recursive: true, force: true });
+  }
+}
+function worktreeSignal(cwd, options = {}) {
+  const top = line(git2(cwd, ["rev-parse", "--show-toplevel"]));
+  if (!top)
+    return null;
+  const status = git2(top, [
+    "status",
+    "--porcelain=v1",
+    "-z",
+    "--untracked-files=all",
+    "--no-renames",
+    "--ignore-submodules=dirty"
+  ], {
+    env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" },
+    timeoutMs: options.timeoutMs ?? GIT_TIMEOUTS.worktree
+  });
+  if (!status.ok)
+    return null;
+  const hash = createHash7("sha256");
+  hash.update(`${headSha(top) ?? "unborn"}\x00`);
+  for (const entry of status.stdout.split("\x00")) {
+    if (entry.length < 4)
+      continue;
+    const file = entry.slice(3);
+    const absolute = path11.join(top, file);
+    let stat = "-";
+    try {
+      const info = fs9.lstatSync(absolute, { bigint: true });
+      stat = `${info.mode.toString(8)}:${info.size}:${info.mtimeNs}`;
+      if (info.isDirectory())
+        stat += `:${headSha(absolute) ?? "-"}`;
+    } catch {}
+    hash.update(`${entry.slice(0, 2)}\x00${file}\x00${stat}\x00`);
+  }
+  return `sig:${hash.digest("hex")}`;
+}
+
+// packages/workit-core/src/core/task-evaluation.ts
+var digestBytes3 = (value) => createHash8("sha256").update(value).digest("hex");
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path12.sep}`);
+var relative = (root, candidate) => path12.relative(root, candidate).split(path12.sep).join("/") || ".";
+var canonicalPath = (value) => {
+  if (typeof value !== "string" || !value)
+    return null;
+  if (value.includes("\\") || value.split("/").includes(".."))
+    return null;
+  const normalized = path12.posix.normalize(value);
+  if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
+    return null;
+  return normalized === "." ? "." : normalized.replace(/\/$/, "");
+};
+var canonicalScope = (scope) => {
+  const paths = scope.paths.length ? scope.paths : ["."];
+  const normalizedPaths = paths.map(canonicalPath);
+  const normalizedExclusions = scope.exclusions.map(canonicalPath);
+  if (normalizedPaths.some((value) => value === null) || normalizedExclusions.some((value) => value === null))
+    return null;
+  return {
+    description: scope.description,
+    paths: [...new Set(normalizedPaths)],
+    exclusions: [...new Set(normalizedExclusions)]
+  };
+};
+var excluded = (value, exclusions) => exclusions.some((item) => item === value || item !== "." && value.startsWith(`${item}/`));
+var scopeMatches = (value, scope) => {
+  const normalized = canonicalScope(scope);
+  if (!normalized)
+    return false;
+  const paths = normalized.paths;
+  return paths.some((item) => item === "." || value === item || value.startsWith(`${item}/`)) && !excluded(value, normalized.exclusions);
+};
+var pathRelevant = (value, scope) => scopeMatches(value, scope);
 var compareCodeUnits2 = (left, right) => {
   const length = Math.min(left.length, right.length);
   for (let index = 0;index < length; index += 1) {
@@ -12313,506 +12704,152 @@ var compareCodeUnits2 = (left, right) => {
   }
   return left.length - right.length;
 };
-var stableUnique = (values) => [...new Set(values)].toSorted(compareCodeUnits2);
-var stableList = (values) => [...values].toSorted((left, right) => compareCodeUnits2(canonicalJson(left), canonicalJson(right)));
-var normalizedScope = (scope) => ({
-  description: scope.description,
-  paths: stableUnique(scope.paths),
-  exclusions: stableUnique(scope.exclusions)
-});
-var normalizedRefList = (values) => stableList(values);
-var normalizeAssessment = (assessment) => ({
-  facts: stableList(assessment.facts.map((fact) => ({ ...fact, refs: normalizedRefList(fact.refs) }))),
-  signals: Object.fromEntries(Object.entries(assessment.signals).map(([name, signal]) => [
-    name,
-    { ...signal, refs: normalizedRefList(signal.refs) }
-  ])),
-  consequences: stableList(assessment.consequences.map((consequence) => ({
-    ...consequence,
-    fact: { ...consequence.fact, refs: normalizedRefList(consequence.fact.refs) }
-  }))),
-  verification: stableList(assessment.verification.map((verification) => ({
-    ...verification,
-    scope: normalizedScope(verification.scope),
-    availableChecks: normalizedRefList(verification.availableChecks),
-    gaps: stableUnique(verification.gaps)
-  })))
-});
-var normalizeConstraint = (constraint) => ({
-  ...constraint,
-  source: constraint.source,
-  requires: stableList(constraint.requires.map((requirement) => ({
-    ...requirement,
-    scope: normalizedScope(requirement.scope),
-    refs: normalizedRefList(requirement.refs)
-  })))
-});
-var normalizeDecision = (decision) => ({
-  ...decision,
-  binding: {
-    ...decision.binding,
-    scope: normalizedScope(decision.binding.scope),
-    contentRefs: normalizedRefList(decision.binding.contentRefs)
-  },
-  requirementIds: stableUnique(decision.requirementIds)
-});
-var normalizeIntent = (intent) => ({
-  ...intent,
-  scope: normalizedScope(intent.scope),
-  authorityRefs: normalizedRefList(intent.authorityRefs)
-});
-var normalizePrior = (prior) => ({
-  decisions: stableList(prior.decisions.map(normalizeDecision)),
-  findings: stableList(prior.findings.map((finding) => ({
-    ...finding,
-    scope: normalizedScope(finding.scope),
-    refs: normalizedRefList(finding.refs),
-    resolution: finding.resolution ? {
-      ...finding.resolution,
-      evidenceIds: stableUnique(finding.resolution.evidenceIds),
-      decisionIds: stableUnique(finding.resolution.decisionIds)
-    } : null
-  }))),
-  requirements: stableList(prior.requirements.map((requirement) => ({
-    ...requirement,
-    scope: normalizedScope(requirement.scope)
-  })))
-});
-var invalidFields = (error) => ({
-  fields: error.issues.map((issue) => ({
-    path: issue.code === "unrecognized_keys" ? issue.keys.join(".") : issue.path.join("."),
-    reason: issue.message
-  }))
-});
-function normalizeResolverInput(input) {
-  const parsed = resolverInputSchema.safeParse(input);
-  if (!parsed.success)
-    return failure2("invalid_input", "resolver input is invalid", invalidFields(parsed.error));
-  const value = parsed.data;
-  const signals = value.assessment.signals;
-  if (signals.behaviorChange.value === true && signals.mechanicalLowRisk.value === true)
-    return failure2("invalid_input", "behavioral change cannot be wholly mechanical", {
-      fields: [
-        {
-          path: "assessment.signals",
-          reason: "contradictory behaviorChange and mechanicalLowRisk"
-        }
-      ]
-    });
-  const ids = value.constraints.map((constraint) => constraint.id);
-  if (new Set(ids).size !== ids.length)
-    return failure2("invalid_input", "constraint IDs must be unique", {
-      fields: [{ path: "constraints", reason: "duplicate constraint id" }]
-    });
-  if (value.preferences?.fast && value.preferences.thorough)
-    return failure2("invalid_input", "fast and thorough preferences contradict", {
-      fields: [{ path: "preferences", reason: "fast and thorough cannot both be enabled" }]
-    });
-  const normalized = {
-    intent: normalizeIntent(value.intent),
-    assessment: normalizeAssessment(value.assessment),
-    constraints: stableList(value.constraints.map(normalizeConstraint)),
-    prior: normalizePrior(value.prior),
-    ...value.preferences ? { preferences: { ...value.preferences } } : {},
-    policyVersion: POLICY_VERSION
-  };
-  return success(null, null, normalized);
-}
-var requirement = (spec) => ({
-  ...spec,
-  id: requirementId({
-    ruleId: spec.ruleId,
-    scope: spec.scope,
-    satisfaction: spec.satisfaction,
-    before: spec.before,
-    dependentAction: spec.dependentAction
-  })
-});
-var signalReason = (input, name) => input.assessment.signals[name].reason;
-function resolveRequirements(input) {
-  const { signals } = input.assessment;
-  const scope = input.intent.scope;
-  const requirements = [];
-  const hasUnknownSignal = Object.values(signals).some((signal) => signal.value === "unknown");
-  const hasUnknownFact = [
-    ...input.assessment.facts,
-    ...input.assessment.consequences.map(({ fact }) => fact)
-  ].some((fact) => fact.basis === "unknown");
-  if (hasUnknownSignal || hasUnknownFact)
-    requirements.push(requirement({
-      ruleId: "consequential-unknown",
-      dimension: "investigation",
-      scope,
-      reason: `Resolve consequential uncertainty before the dependent action: ${[
-        ...Object.entries(signals).filter(([, signal]) => signal.value === "unknown").map(([name]) => name),
-        ...hasUnknownFact ? ["unknown fact"] : []
-      ].join(", ")}`,
-      satisfaction: "An observed or inferred fact resolves the uncertainty and records its supporting references.",
-      before: "dependent_action",
-      dependentAction: null,
-      acceptanceAllowed: false
-    }));
-  if (signals.productChoiceOpen.value === true)
-    requirements.push(requirement({
-      ruleId: "product-decision",
-      dimension: "decisions",
-      scope,
-      reason: `A consequential product choice remains open: ${signalReason(input, "productChoiceOpen")}`,
-      satisfaction: "Present the material alternatives and record the user's decision before the dependent action.",
-      before: "dependent_action",
-      dependentAction: null,
-      acceptanceAllowed: false
-    }));
-  const independentBehaviorReview = input.preferences?.thorough === true || input.assessment.consequences.some((consequence) => ["security", "data", "public_contract", "operations"].includes(consequence.area));
-  if (signals.behaviorChange.value === true)
-    requirements.push(requirement({
-      ruleId: "behavioral-verification",
-      dimension: "testing",
-      scope,
-      reason: `Behavior, side effects, permissions, or data handling may change: ${signalReason(input, "behaviorChange")}`,
-      satisfaction: "A useful behavioral check passes against the affected behavior and current candidate.",
-      before: "close",
-      dependentAction: null,
-      acceptanceAllowed: false
-    }), requirement({
-      ruleId: independentBehaviorReview ? "fresh-context-review" : "self-review",
-      dimension: "review",
-      scope,
-      reason: independentBehaviorReview ? "Consequential behavior or the thorough preference requires fresh-context review." : "Bounded behavior changes use self-review unless consequential risks or trusted rules require more.",
-      satisfaction: independentBehaviorReview ? "A separate review context examines the current candidate and records its result." : "The lead reviews the resulting diff and records the relevant scope and checks.",
-      before: "close",
-      dependentAction: null,
-      acceptanceAllowed: !independentBehaviorReview
-    }));
-  else if (signals.mechanicalLowRisk.value === true)
-    requirements.push(requirement({
-      ruleId: "mechanical-existing-checks",
-      dimension: "verification",
-      scope,
-      reason: `The change is demonstrably mechanical and low-risk: ${signalReason(input, "mechanicalLowRisk")}`,
-      satisfaction: "Run the relevant existing checks for affected consumers; do not add tautological tests.",
-      before: "close",
-      dependentAction: null,
-      acceptanceAllowed: true
-    }), requirement({
-      ruleId: input.preferences?.thorough ? "fresh-context-review" : "self-review",
-      dimension: "review",
-      scope,
-      reason: input.preferences?.thorough ? "The thorough preference upgrades mechanical self-review to fresh-context review." : "Mechanical low-risk work uses self-review rather than mandatory fresh-context review.",
-      satisfaction: input.preferences?.thorough ? "A separate review context examines the current candidate and records its result." : "The lead reviews the resulting diff and records the relevant scope and checks.",
-      before: "close",
-      dependentAction: null,
-      acceptanceAllowed: !input.preferences?.thorough
-    }));
-  if (signals.behaviorChange.value === true || signals.mechanicalLowRisk.value === true)
-    requirements.push(requirement({
-      ruleId: "pre-pr-cleanup",
-      dimension: "verification",
-      scope,
-      reason: "Implementation output must be deslopped before it is delivered.",
-      satisfaction: "Run the workit-deslop pass and record passing check evidence, or record an approved limitation decision waiving cleanup.",
-      before: "dependent_action",
-      dependentAction: "hosting.pull_request",
-      acceptanceAllowed: true
-    }));
-  if (signals.durableAgreementNeeded.value === true)
-    requirements.push(requirement({
-      ruleId: "durable-spec",
-      dimension: "artifacts",
-      scope,
-      reason: `The work needs a durable agreement about intended behavior: ${signalReason(input, "durableAgreementNeeded")}`,
-      satisfaction: "Record the agreed behavior in a durable specification before implementation writes.",
-      before: "write",
-      dependentAction: null,
-      acceptanceAllowed: true
-    }));
-  if (signals.coordinationPlanNeeded.value === true)
-    requirements.push(requirement({
-      ruleId: "coordination-plan",
-      dimension: "continuity",
-      scope,
-      reason: `Dependencies, sequencing, or resumption need durable coordination: ${signalReason(input, "coordinationPlanNeeded")}`,
-      satisfaction: "Record useful sequencing, dependencies, and the next action in a compact plan.",
-      before: "dependent_action",
-      dependentAction: null,
-      acceptanceAllowed: true
-    }));
-  if (signals.helperUseful.value === true && !input.preferences?.fast)
-    requirements.push(requirement({
-      ruleId: "helper-usefulness",
-      dimension: "delegation",
-      scope,
-      reason: `Independent judgment or investigation justifies a scoped helper: ${signalReason(input, "helperUseful")}`,
-      satisfaction: "Use a bounded helper only for the independent objective and reconcile its result.",
-      before: "dependent_action",
-      dependentAction: null,
-      acceptanceAllowed: true
-    }));
-  for (const constraint of input.constraints)
-    for (const obligation of constraint.requires) {
-      const dimension = obligation.method ?? (obligation.kind === "check" ? "verification" : obligation.kind === "decision" ? "decisions" : "challenge");
-      requirements.push(requirement({
-        ruleId: `project-constraint:${constraint.id}:${obligation.kind}:${sha256({
-          kind: obligation.kind,
-          scope: normalizedScope(obligation.scope),
-          refs: normalizedRefList(obligation.refs),
-          method: obligation.method,
-          before: obligation.before,
-          dependentAction: obligation.dependentAction
-        })}`,
-        dimension,
-        scope: obligation.scope,
-        reason: `${constraint.kind} constraint requires ${obligation.kind}: ${constraint.statement}`,
-        satisfaction: `Satisfy the constraint obligation using its referenced ${obligation.kind}.`,
-        before: obligation.before,
-        dependentAction: obligation.dependentAction,
-        acceptanceAllowed: constraint.acceptanceAllowed && obligation.kind !== "decision"
-      }));
-    }
-  const seen = new Set;
-  return requirements.filter((item) => {
-    if (seen.has(item.id))
-      return false;
-    seen.add(item.id);
-    return true;
-  });
-}
-function resolvePolicy(input) {
-  const normalized = normalizeResolverInput(input);
-  if (!normalized.ok)
-    return normalized;
-  const requirements = resolveRequirements(normalized.data);
-  const policy = {
-    policyVersion: POLICY_VERSION,
-    inputDigest: sha256(canonicalJson(normalized.data)),
-    requirements
-  };
-  const parsed = policySchema.safeParse(policy);
-  if (!parsed.success)
-    return failure2("invalid_input", "resolved policy is invalid", invalidFields(parsed.error));
-  return success(null, null, parsed.data);
-}
-function diffPolicy(previous, next, reason, now) {
-  if (!policySchema.safeParse(previous).success && previous !== null)
-    throw new TypeError("previous policy is invalid");
-  if (!policySchema.safeParse(next).success)
-    throw new TypeError("next policy is invalid");
-  const oldIds = new Set(previous?.requirements.map((item) => item.id) ?? []);
-  const newIds = new Set(next.requirements.map((item) => item.id));
-  const added = [...newIds].filter((id) => !oldIds.has(id)).toSorted(compareCodeUnits2);
-  const retired = [...oldIds].filter((id) => !newIds.has(id)).toSorted(compareCodeUnits2);
-  if (added.length === 0 && retired.length === 0)
-    return null;
-  const normalizedReason = reason.trim();
-  const changeReason = retired.length ? `${normalizedReason || "policy reassessed"} (retired: ${retired.join(",")})` : normalizedReason || "policy reassessed";
-  const change = {
-    recordedAt: now,
-    fromInputDigest: previous?.inputDigest ?? null,
-    toInputDigest: next.inputDigest,
-    added,
-    retired,
-    reason: changeReason
-  };
-  const parsed = policyChangeSchema.safeParse(change);
-  if (!parsed.success)
-    throw new TypeError("policy change is invalid");
-  return parsed.data;
-}
-
-// packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash7 } from "node:crypto";
-import * as fs8 from "node:fs";
-import { spawnSync as spawnSync3 } from "node:child_process";
-import path10 from "node:path";
-var digestBytes3 = (value) => createHash7("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path10.sep}`);
-var relative = (root, candidate) => path10.relative(root, candidate).split(path10.sep).join("/") || ".";
-var canonicalPath = (value) => {
-  if (typeof value !== "string" || !value)
-    return null;
-  if (value.includes("\\") || value.split("/").includes(".."))
-    return null;
-  const normalized = path10.posix.normalize(value);
-  if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
-    return null;
-  return normalized === "." ? "." : normalized.replace(/\/$/, "");
-};
-var canonicalScope = (scope) => {
-  const paths = scope.paths.length ? scope.paths : ["."];
-  const normalizedPaths = paths.map(canonicalPath);
-  const normalizedExclusions = scope.exclusions.map(canonicalPath);
-  if (normalizedPaths.some((value) => value === null) || normalizedExclusions.some((value) => value === null))
-    return null;
-  return {
-    description: scope.description,
-    paths: [...new Set(normalizedPaths)],
-    exclusions: [...new Set(normalizedExclusions)]
-  };
-};
-var excluded = (value, exclusions) => exclusions.some((item) => item === value || item !== "." && value.startsWith(`${item}/`));
-var scopeMatches = (value, scope) => {
-  const normalized = canonicalScope(scope);
-  if (!normalized)
-    return false;
-  const paths = normalized.paths;
-  return paths.some((item) => item === "." || value === item || value.startsWith(`${item}/`)) && !excluded(value, normalized.exclusions);
-};
-var pathRelevant = (value, scope) => scopeMatches(value, scope);
-var compareCodeUnits3 = (left, right) => {
-  const length = Math.min(left.length, right.length);
-  for (let index = 0;index < length; index += 1) {
-    const difference = left.charCodeAt(index) - right.charCodeAt(index);
-    if (difference !== 0)
-      return difference;
-  }
-  return left.length - right.length;
-};
-var gitPaths = (root) => {
-  const result = spawnSync3("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
-    cwd: root,
-    encoding: "buffer"
-  });
-  if (result.status !== 0) {
-    const stderr = result.stderr?.toString("utf8") ?? "";
-    return {
-      paths: [],
-      uncertain: !/not a git repository/i.test(stderr),
-      git: !/not a git repository/i.test(stderr)
-    };
-  }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path10.sep).join("/")) : [];
-  const stagedDeleted = spawnSync3("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
-  if (stagedDeleted.status !== 0) {
-    const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
-    if (!/not a git repository/i.test(stderr))
-      return { paths, uncertain: true, git: true };
-  } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path10.sep).join("/")));
-  }
-  return { paths: [...new Set(paths)], uncertain: false, git: true };
-};
-var walk = (root, directory, output) => {
-  let names;
-  try {
-    names = fs8.readdirSync(directory);
-  } catch {
-    return true;
-  }
-  let uncertain = false;
-  for (const name of names) {
-    if (name === ".git" || name === ".workit")
-      continue;
-    const target = path10.join(directory, name);
-    let stat;
-    try {
-      stat = fs8.lstatSync(target);
-    } catch {
-      uncertain = true;
-      continue;
-    }
-    const item = relative(root, target);
-    output.add(item);
-    if (stat.isDirectory() && !stat.isSymbolicLink())
-      uncertain = walk(root, target, output) || uncertain;
-  }
-  return uncertain;
-};
-var scopeRoots = (root, scope) => {
-  const roots = [];
-  for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path10.resolve(root, item);
-    if (!inside(root, target))
-      return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
-    let ancestor = target;
-    while (!fs8.existsSync(ancestor) && ancestor !== root)
-      ancestor = path10.dirname(ancestor);
-    try {
-      if (!inside(root, fs8.realpathSync(ancestor)))
-        return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
-    } catch {
-      return failure2("invalid_input", `candidate scope cannot be inspected: ${item}`);
-    }
-    roots.push(target);
-  }
-  return success(null, null, roots);
-};
-function captureCandidate(root, scope, environment = []) {
-  let checkout;
-  try {
-    checkout = fs8.realpathSync(root);
-  } catch {
-    return failure2("invalid_input", "candidate root does not exist");
-  }
-  const normalizedScope = canonicalScope(scope);
-  if (!normalizedScope)
-    return failure2("invalid_input", "candidate scope is invalid: paths must be checkout-relative — to work in another repository, keep this task here and coordinate a separate linked task in that checkout", { fields: [{ path: "scope.paths", reason: "must be checkout-relative" }] });
-  const roots = scopeRoots(checkout, normalizedScope);
-  if (!roots.ok)
-    return roots;
-  const git = gitPaths(checkout);
-  const names = new Set;
-  let uncertain = git.uncertain;
-  for (const target of roots.data) {
-    const item = relative(checkout, target);
-    if (item === ".git" || item === ".workit")
-      continue;
-    names.add(item);
-    if (!fs8.existsSync(target))
-      continue;
-    let stat;
-    try {
-      stat = fs8.lstatSync(target);
-    } catch {
-      uncertain = true;
-      continue;
-    }
-    if (!git.git && stat.isDirectory() && !stat.isSymbolicLink())
-      uncertain = walk(checkout, target, names) || uncertain;
-  }
-  for (const item of git.paths)
-    if (scopeMatches(item, normalizedScope))
-      names.add(item);
-  const files = [];
-  let completeness = uncertain ? "uncertain" : "known";
-  for (const item of [...names].toSorted()) {
-    if (!scopeMatches(item, normalizedScope))
-      continue;
-    const target = path10.join(checkout, item);
-    try {
-      const stat = fs8.lstatSync(target);
-      if (stat.isSymbolicLink()) {
-        const link = fs8.readlinkSync(target);
-        files.push({ path: item, kind: "symlink", digest: digestBytes3(link), executable: null });
-      } else if (stat.isFile()) {
-        files.push({
-          path: item,
-          kind: "file",
-          digest: digestBytes3(fs8.readFileSync(target)),
-          executable: (stat.mode & 73) !== 0
-        });
-      } else if (!stat.isDirectory()) {
-        completeness = "uncertain";
-      } else if (git.git && git.paths.includes(item)) {
-        completeness = "uncertain";
-      }
-    } catch (error) {
-      if (error?.code === "ENOENT") {
-        files.push({ path: item, kind: "absent", digest: null, executable: null });
-      } else
-        completeness = "uncertain";
-    }
-  }
-  const supplied = Array.isArray(environment) ? environment.map((value) => typeof value === "string" ? { name: value, value: process.env[value] ?? null } : { name: value.name, value: value.value ?? null }) : Object.keys(environment).map((name) => ({
+var gitPaths = (root) => {
+  const result = spawnSync5("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    cwd: root,
+    encoding: "buffer"
+  });
+  if (result.status !== 0) {
+    const stderr = result.stderr?.toString("utf8") ?? "";
+    return {
+      paths: [],
+      uncertain: !/not a git repository/i.test(stderr),
+      git: !/not a git repository/i.test(stderr)
+    };
+  }
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path12.sep).join("/")) : [];
+  const stagedDeleted = spawnSync5("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
+  if (stagedDeleted.status !== 0) {
+    const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
+    if (!/not a git repository/i.test(stderr))
+      return { paths, uncertain: true, git: true };
+  } else if (stagedDeleted.stdout) {
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path12.sep).join("/")));
+  }
+  return { paths: [...new Set(paths)], uncertain: false, git: true };
+};
+var walk = (root, directory, output) => {
+  let names;
+  try {
+    names = fs10.readdirSync(directory);
+  } catch {
+    return true;
+  }
+  let uncertain = false;
+  for (const name of names) {
+    if (name === ".git" || name === ".workit")
+      continue;
+    const target = path12.join(directory, name);
+    let stat;
+    try {
+      stat = fs10.lstatSync(target);
+    } catch {
+      uncertain = true;
+      continue;
+    }
+    const item = relative(root, target);
+    output.add(item);
+    if (stat.isDirectory() && !stat.isSymbolicLink())
+      uncertain = walk(root, target, output) || uncertain;
+  }
+  return uncertain;
+};
+var scopeRoots = (root, scope) => {
+  const roots = [];
+  for (const item of scope.paths.length ? scope.paths : ["."]) {
+    const target = path12.resolve(root, item);
+    if (!inside(root, target))
+      return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
+    let ancestor = target;
+    while (!fs10.existsSync(ancestor) && ancestor !== root)
+      ancestor = path12.dirname(ancestor);
+    try {
+      if (!inside(root, fs10.realpathSync(ancestor)))
+        return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
+    } catch {
+      return failure2("invalid_input", `candidate scope cannot be inspected: ${item}`);
+    }
+    roots.push(target);
+  }
+  return success(null, null, roots);
+};
+function captureCandidate(root, scope, environment = []) {
+  let checkout;
+  try {
+    checkout = fs10.realpathSync(root);
+  } catch {
+    return failure2("invalid_input", "candidate root does not exist");
+  }
+  const normalizedScope = canonicalScope(scope);
+  if (!normalizedScope)
+    return failure2("invalid_input", "candidate scope is invalid: paths must be checkout-relative — to work in another repository, keep this task here and coordinate a separate linked task in that checkout", { fields: [{ path: "scope.paths", reason: "must be checkout-relative" }] });
+  const roots = scopeRoots(checkout, normalizedScope);
+  if (!roots.ok)
+    return roots;
+  const git = gitPaths(checkout);
+  const names = new Set;
+  let uncertain = git.uncertain;
+  for (const target of roots.data) {
+    const item = relative(checkout, target);
+    if (item === ".git" || item === ".workit")
+      continue;
+    names.add(item);
+    if (!fs10.existsSync(target))
+      continue;
+    let stat;
+    try {
+      stat = fs10.lstatSync(target);
+    } catch {
+      uncertain = true;
+      continue;
+    }
+    if (!git.git && stat.isDirectory() && !stat.isSymbolicLink())
+      uncertain = walk(checkout, target, names) || uncertain;
+  }
+  for (const item of git.paths)
+    if (scopeMatches(item, normalizedScope))
+      names.add(item);
+  const files = [];
+  let completeness = uncertain ? "uncertain" : "known";
+  for (const item of [...names].toSorted()) {
+    if (!scopeMatches(item, normalizedScope))
+      continue;
+    const target = path12.join(checkout, item);
+    try {
+      const stat = fs10.lstatSync(target);
+      if (stat.isSymbolicLink()) {
+        const link = fs10.readlinkSync(target);
+        files.push({ path: item, kind: "symlink", digest: digestBytes3(link), executable: null });
+      } else if (stat.isFile()) {
+        files.push({
+          path: item,
+          kind: "file",
+          digest: digestBytes3(fs10.readFileSync(target)),
+          executable: (stat.mode & 73) !== 0
+        });
+      } else if (!stat.isDirectory()) {
+        completeness = "uncertain";
+      } else if (git.git && git.paths.includes(item)) {
+        completeness = "uncertain";
+      }
+    } catch (error) {
+      if (error?.code === "ENOENT") {
+        files.push({ path: item, kind: "absent", digest: null, executable: null });
+      } else
+        completeness = "uncertain";
+    }
+  }
+  const supplied = Array.isArray(environment) ? environment.map((value) => typeof value === "string" ? { name: value, value: process.env[value] ?? null } : { name: value.name, value: value.value ?? null }) : Object.keys(environment).map((name) => ({
     name,
     value: environment[name] ?? null
   }));
   const namesByEnvironment = supplied.map(({ name }) => name);
   if (new Set(namesByEnvironment).size !== namesByEnvironment.length || namesByEnvironment.some((name) => typeof name !== "string" || !name))
     return failure2("invalid_input", "candidate environment names must be unique and non-empty");
-  const values = supplied.toSorted((left, right) => compareCodeUnits3(left.name, right.name)).map(({ name, value }) => ({ name, value, refs: [] }));
+  const values = supplied.toSorted((left, right) => compareCodeUnits2(left.name, right.name)).map(({ name, value }) => ({ name, value, refs: [] }));
   if (values.some(({ value }) => value === null))
     completeness = "uncertain";
-  const headResult = spawnSync3("git", ["rev-parse", "HEAD"], { cwd: checkout, encoding: "utf8" });
+  const headResult = spawnSync5("git", ["rev-parse", "HEAD"], { cwd: checkout, encoding: "utf8" });
   if (headResult.status !== 0 && !/not a git repository/i.test(headResult.stderr ?? ""))
     completeness = "uncertain";
   const head = headResult.status === 0 ? headResult.stdout.trim() : null;
@@ -12850,7 +12887,24 @@ var sameSession = (left, right) => {
   return left !== null && other !== null && left.host === other.host && left.handle === other.handle;
 };
 var evidenceScopes = (task, ids) => (task.policy?.requirements ?? []).filter((requirement) => ids.includes(requirement.id)).map((requirement) => requirement.scope);
-function evaluateEvidence(task, candidate) {
+var memo2 = (compute) => {
+  let value;
+  return () => {
+    if (value === undefined)
+      value = compute();
+    return value;
+  };
+};
+var treeFreshness = (root) => ({
+  mode: "tree",
+  current: memo2(() => worktreeTree(root)?.key ?? null)
+});
+var signalFreshness = (root) => ({
+  mode: "signal",
+  current: memo2(() => worktreeSignal(root))
+});
+var isObservedCheck = (entry) => entry.data.kind === "check" && entry.data.observation?.observer === "workit_cli" && entry.provenance?.kind === "host_observed" && entry.provenance.host === "workit_cli";
+function evaluateEvidence(task, candidate, freshness) {
   const current = candidate ?? task.candidates.at(-1) ?? null;
   return task.evidence.map((entry) => {
     const evidence = entry.data;
@@ -12860,6 +12914,25 @@ function evaluateEvidence(task, candidate) {
         status: "failed",
         reason: "failed evidence remains historical"
       };
+    const observation = isObservedCheck(entry) ? evidence.observation : undefined;
+    if (observation && observation.tree !== null) {
+      if (task.status === "closed")
+        return { evidenceId: entry.id, status: evidence.result, reason: "recorded before close" };
+      if (observation.modifiedWorktree)
+        return {
+          evidenceId: entry.id,
+          status: "stale",
+          reason: "the check changed the worktree while it ran; ignore or clean its outputs"
+        };
+      const recorded = freshness?.mode === "signal" ? observation.signal : observation.tree;
+      if (recorded !== null && freshness && recorded === freshness.current())
+        return { evidenceId: entry.id, status: evidence.result, reason: "worktree is unchanged" };
+      return {
+        evidenceId: entry.id,
+        status: "stale",
+        reason: freshness?.mode === "signal" ? "the worktree may have changed since the check ran (quick signal; inspect re-checks exactly)" : "the worktree changed since the check ran"
+      };
+    }
     if (evidence.kind === "check" || evidence.kind === "review") {
       if (!evidence.beforeCandidateId || !evidence.candidateId)
         return {
@@ -12943,8 +13016,45 @@ var expectedKinds = (dimension, ruleId) => {
     return "decision";
   return "worker report";
 };
-function evaluateRequirements(task, workspace, capabilities, candidate, checkoutRoot, _caller) {
-  const evidence = evaluateEvidence(task, candidate);
+var observedGate = (requirement) => (requirement.dimension === "testing" || requirement.dimension === "verification") && requirement.before === "close";
+function evaluateObservedGate(task, requirement, statuses, config) {
+  const names = gateCheckNames(config, requirement.dimension);
+  const observed = task.evidence.filter(isObservedCheck);
+  const fresh = observed.filter((entry) => statuses.get(entry.id) === "passed" && entry.data.observation?.exitCode === 0);
+  const named = (entry) => {
+    const observation = entry.data.observation;
+    return observation.configured && !observation.shell && names.includes(observation.name ?? "") && matchesNamedCheck(config, observation.name, observation.argv, observation.cwd);
+  };
+  const considered = observed.map((entry) => entry.id);
+  const run = checkCommand(names[0] ?? "<name>", runtimeVersion());
+  if (config.error)
+    return {
+      satisfied: [],
+      considered,
+      reason: `check config is invalid (${config.error}); fix it, then run ${run}`
+    };
+  if (!names.length)
+    return {
+      satisfied: [],
+      considered,
+      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE} (committed, so it shows in the diff), e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
+    };
+  const satisfied = fresh.filter(named);
+  if (satisfied.length)
+    return {
+      satisfied: satisfied.map((entry) => entry.id),
+      considered,
+      reason: `a fresh passing configured check (${names.join("|")}) was observed by workit check`
+    };
+  const reported = task.evidence.some((entry) => entry.data.kind === "check" && !isObservedCheck(entry) && entry.data.requirementIds.includes(requirement.id));
+  const reason = fresh.length ? `ad-hoc checks do not satisfy a configured gate; run ${run}` : observed.some((entry) => statuses.get(entry.id) === "stale") ? `observed checks are stale (the worktree changed); run ${run}` : observed.some((entry) => statuses.get(entry.id) === "failed") ? `the observed check failed; fix it and run ${run}` : reported ? `agent-reported checks are notes, not evidence; run ${run}` : `no CLI-observed check (needs kind:check observed by workit check); run ${run}`;
+  return { satisfied: [], considered, reason };
+}
+function evaluateRequirements(task, workspace, capabilities, candidate, checkoutRoot, _caller, freshness = treeFreshness(checkoutRoot)) {
+  const evidence = evaluateEvidence(task, candidate, freshness);
+  const statuses = new Map(evidence.map((item) => [item.evidenceId, item.status]));
+  let checkConfig;
+  const configFor = () => checkConfig ??= loadCheckConfig(checkoutRoot);
   if (task.policy && task.policy.policyVersion !== POLICY_VERSION)
     return task.policy.requirements.map((requirement) => ({
       requirementId: requirement.id,
@@ -12954,8 +13064,19 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
       reason: "stored policy version is unsupported; reassessment is required"
     }));
   return (task.policy?.requirements ?? []).map((requirement) => {
+    const gate = observedGate(requirement) ? evaluateObservedGate(task, requirement, statuses, configFor()) : null;
+    if (gate?.satisfied.length)
+      return {
+        requirementId: requirement.id,
+        status: "satisfied",
+        evidenceIds: gate.satisfied,
+        decisionIds: [],
+        reason: gate.reason
+      };
     const related = task.evidence.map((entry, index) => ({ entry, evaluation: evidence[index] })).filter(({ entry }) => entry.data.requirementIds.includes(requirement.id));
     const passed = related.filter(({ entry, evaluation }) => {
+      if (gate)
+        return false;
       if (!evidenceMatchesRequirement(evaluation.status, entry.data.kind, requirement.dimension, requirement.ruleId))
         return false;
       if ((entry.data.kind === "check" || entry.data.kind === "review") && (!entry.data.beforeCandidateId || !entry.data.candidateId || entry.data.beforeCandidateId !== entry.data.candidateId))
@@ -13018,6 +13139,14 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
         reason: "an applicable approved limitation permits the missing evidence"
       };
     const unavailable = capabilities.some((capability) => capability.assurance === "unavailable" && (capability.name === requirement.dimension || capability.surface === requirement.dimension));
+    if (gate)
+      return {
+        requirementId: requirement.id,
+        status: unavailable ? "unavailable" : "unsatisfied",
+        evidenceIds: [...new Set([...gate.considered, ...related.map(({ entry }) => entry.id)])],
+        decisionIds: [],
+        reason: unavailable ? "required capability is unavailable" : gate.reason
+      };
     if (!unavailable && related.length > 0 && !passed.length)
       return {
         requirementId: requirement.id,
@@ -13071,51 +13200,381 @@ function evaluateClosure(requestedOutcome, view) {
           return failure2("requirements_unsatisfied", "deferred findings require an approved limitation decision that references an acceptanceAllowed requirement and covers the finding scope");
       }
     }
-  }
-  const blocking = evaluations.filter((item) => {
-    if (item.status !== "unsatisfied" && item.status !== "unavailable")
+  }
+  const blocking = evaluations.filter((item) => {
+    if (item.status !== "unsatisfied" && item.status !== "unavailable")
+      return false;
+    const requirement = view.task.policy?.requirements.find((candidate) => candidate.id === item.requirementId);
+    return !requirement || requirement.before === "close";
+  });
+  if (requestedOutcome !== "stopped" && blocking.length)
+    return failure2("requirements_unsatisfied", "applicable requirements are unsatisfied", {
+      requirementIds: blocking.map((item) => item.requirementId),
+      requirements: blocking.map((item) => {
+        const requirement = view.task.policy?.requirements.find((candidate) => candidate.id === item.requirementId);
+        return {
+          requirementId: item.requirementId,
+          ruleId: requirement?.ruleId ?? "unknown",
+          reason: item.reason,
+          satisfaction: requirement?.satisfaction ?? "",
+          dependentAction: requirement?.dependentAction ?? null
+        };
+      })
+    });
+  const accepted = evaluations.filter((item) => item.status === "accepted_limitation");
+  if (requestedOutcome === "verified" && accepted.length)
+    return failure2("requirements_unsatisfied", "accepted limitations cannot be reported as verified", {
+      requirementIds: accepted.map((item) => item.requirementId)
+    });
+  const evidenceIds = [
+    ...new Set([
+      ...evaluations.flatMap((item) => item.evidenceIds),
+      ...view.task.findings.flatMap((item) => item.data.resolution?.evidenceIds ?? [])
+    ])
+  ];
+  const decisionIds = [
+    ...new Set([
+      ...evaluations.flatMap((item) => item.decisionIds),
+      ...view.task.findings.flatMap((item) => item.data.resolution?.decisionIds ?? [])
+    ])
+  ];
+  return success(null, null, {
+    outcome: requestedOutcome === "stopped" ? "stopped" : accepted.length ? "accepted_limitations" : "verified",
+    evidenceIds,
+    decisionIds,
+    requirementIds: evaluations.map((item) => item.requirementId)
+  });
+}
+
+// packages/workit-core/src/core/task-engine.ts
+import { realpathSync as realpathSync6 } from "node:fs";
+
+// packages/workit-core/src/core/policy-resolver.ts
+var resolverInputSchema = object({
+  intent: intentSchema,
+  assessment: assessmentSchema,
+  constraints: array(constraintSchema),
+  prior: object({
+    decisions: array(decisionSchema),
+    findings: array(findingSchema),
+    requirements: array(requirementSchema)
+  }).strict(),
+  preferences: object({ fast: boolean2().optional(), thorough: boolean2().optional() }).strict().optional()
+}).strict();
+var compareCodeUnits3 = (left, right) => {
+  const length = Math.min(left.length, right.length);
+  for (let index = 0;index < length; index += 1) {
+    const difference = left.charCodeAt(index) - right.charCodeAt(index);
+    if (difference !== 0)
+      return difference;
+  }
+  return left.length - right.length;
+};
+var stableUnique = (values) => [...new Set(values)].toSorted(compareCodeUnits3);
+var stableList = (values) => [...values].toSorted((left, right) => compareCodeUnits3(canonicalJson(left), canonicalJson(right)));
+var normalizedScope = (scope) => ({
+  description: scope.description,
+  paths: stableUnique(scope.paths),
+  exclusions: stableUnique(scope.exclusions)
+});
+var normalizedRefList = (values) => stableList(values);
+var normalizeAssessment = (assessment) => ({
+  facts: stableList(assessment.facts.map((fact) => ({ ...fact, refs: normalizedRefList(fact.refs) }))),
+  signals: Object.fromEntries(Object.entries(assessment.signals).map(([name, signal]) => [
+    name,
+    { ...signal, refs: normalizedRefList(signal.refs) }
+  ])),
+  consequences: stableList(assessment.consequences.map((consequence) => ({
+    ...consequence,
+    fact: { ...consequence.fact, refs: normalizedRefList(consequence.fact.refs) }
+  }))),
+  verification: stableList(assessment.verification.map((verification) => ({
+    ...verification,
+    scope: normalizedScope(verification.scope),
+    availableChecks: normalizedRefList(verification.availableChecks),
+    gaps: stableUnique(verification.gaps)
+  })))
+});
+var normalizeConstraint = (constraint) => ({
+  ...constraint,
+  source: constraint.source,
+  requires: stableList(constraint.requires.map((requirement) => ({
+    ...requirement,
+    scope: normalizedScope(requirement.scope),
+    refs: normalizedRefList(requirement.refs)
+  })))
+});
+var normalizeDecision = (decision) => ({
+  ...decision,
+  binding: {
+    ...decision.binding,
+    scope: normalizedScope(decision.binding.scope),
+    contentRefs: normalizedRefList(decision.binding.contentRefs)
+  },
+  requirementIds: stableUnique(decision.requirementIds)
+});
+var normalizeIntent = (intent) => ({
+  ...intent,
+  scope: normalizedScope(intent.scope),
+  authorityRefs: normalizedRefList(intent.authorityRefs)
+});
+var normalizePrior = (prior) => ({
+  decisions: stableList(prior.decisions.map(normalizeDecision)),
+  findings: stableList(prior.findings.map((finding) => ({
+    ...finding,
+    scope: normalizedScope(finding.scope),
+    refs: normalizedRefList(finding.refs),
+    resolution: finding.resolution ? {
+      ...finding.resolution,
+      evidenceIds: stableUnique(finding.resolution.evidenceIds),
+      decisionIds: stableUnique(finding.resolution.decisionIds)
+    } : null
+  }))),
+  requirements: stableList(prior.requirements.map((requirement) => ({
+    ...requirement,
+    scope: normalizedScope(requirement.scope)
+  })))
+});
+var invalidFields = (error) => ({
+  fields: error.issues.map((issue) => ({
+    path: issue.code === "unrecognized_keys" ? issue.keys.join(".") : issue.path.join("."),
+    reason: issue.message
+  }))
+});
+function normalizeResolverInput(input) {
+  const parsed = resolverInputSchema.safeParse(input);
+  if (!parsed.success)
+    return failure2("invalid_input", "resolver input is invalid", invalidFields(parsed.error));
+  const value = parsed.data;
+  const signals = value.assessment.signals;
+  if (signals.behaviorChange.value === true && signals.mechanicalLowRisk.value === true)
+    return failure2("invalid_input", "behavioral change cannot be wholly mechanical", {
+      fields: [
+        {
+          path: "assessment.signals",
+          reason: "contradictory behaviorChange and mechanicalLowRisk"
+        }
+      ]
+    });
+  const ids = value.constraints.map((constraint) => constraint.id);
+  if (new Set(ids).size !== ids.length)
+    return failure2("invalid_input", "constraint IDs must be unique", {
+      fields: [{ path: "constraints", reason: "duplicate constraint id" }]
+    });
+  if (value.preferences?.fast && value.preferences.thorough)
+    return failure2("invalid_input", "fast and thorough preferences contradict", {
+      fields: [{ path: "preferences", reason: "fast and thorough cannot both be enabled" }]
+    });
+  const normalized = {
+    intent: normalizeIntent(value.intent),
+    assessment: normalizeAssessment(value.assessment),
+    constraints: stableList(value.constraints.map(normalizeConstraint)),
+    prior: normalizePrior(value.prior),
+    ...value.preferences ? { preferences: { ...value.preferences } } : {},
+    policyVersion: POLICY_VERSION
+  };
+  return success(null, null, normalized);
+}
+var requirement = (spec) => ({
+  ...spec,
+  id: requirementId({
+    ruleId: spec.ruleId,
+    scope: spec.scope,
+    satisfaction: spec.satisfaction,
+    before: spec.before,
+    dependentAction: spec.dependentAction
+  })
+});
+var signalReason = (input, name) => input.assessment.signals[name].reason;
+function resolveRequirements(input) {
+  const { signals } = input.assessment;
+  const scope = input.intent.scope;
+  const requirements = [];
+  const hasUnknownSignal = Object.values(signals).some((signal) => signal.value === "unknown");
+  const hasUnknownFact = [
+    ...input.assessment.facts,
+    ...input.assessment.consequences.map(({ fact }) => fact)
+  ].some((fact) => fact.basis === "unknown");
+  if (hasUnknownSignal || hasUnknownFact)
+    requirements.push(requirement({
+      ruleId: "consequential-unknown",
+      dimension: "investigation",
+      scope,
+      reason: `Resolve consequential uncertainty before the dependent action: ${[
+        ...Object.entries(signals).filter(([, signal]) => signal.value === "unknown").map(([name]) => name),
+        ...hasUnknownFact ? ["unknown fact"] : []
+      ].join(", ")}`,
+      satisfaction: "An observed or inferred fact resolves the uncertainty and records its supporting references.",
+      before: "dependent_action",
+      dependentAction: null,
+      acceptanceAllowed: false
+    }));
+  if (signals.productChoiceOpen.value === true)
+    requirements.push(requirement({
+      ruleId: "product-decision",
+      dimension: "decisions",
+      scope,
+      reason: `A consequential product choice remains open: ${signalReason(input, "productChoiceOpen")}`,
+      satisfaction: "Present the material alternatives and record the user's decision before the dependent action.",
+      before: "dependent_action",
+      dependentAction: null,
+      acceptanceAllowed: false
+    }));
+  const independentBehaviorReview = input.preferences?.thorough === true || input.assessment.consequences.some((consequence) => ["security", "data", "public_contract", "operations"].includes(consequence.area));
+  if (signals.behaviorChange.value === true)
+    requirements.push(requirement({
+      ruleId: "behavioral-verification",
+      dimension: "testing",
+      scope,
+      reason: `Behavior, side effects, permissions, or data handling may change: ${signalReason(input, "behaviorChange")}`,
+      satisfaction: "A useful behavioral check passes against the affected behavior and current candidate.",
+      before: "close",
+      dependentAction: null,
+      acceptanceAllowed: false
+    }), requirement({
+      ruleId: independentBehaviorReview ? "fresh-context-review" : "self-review",
+      dimension: "review",
+      scope,
+      reason: independentBehaviorReview ? "Consequential behavior or the thorough preference requires fresh-context review." : "Bounded behavior changes use self-review unless consequential risks or trusted rules require more.",
+      satisfaction: independentBehaviorReview ? "A separate review context examines the current candidate and records its result." : "The lead reviews the resulting diff and records the relevant scope and checks.",
+      before: "close",
+      dependentAction: null,
+      acceptanceAllowed: !independentBehaviorReview
+    }));
+  else if (signals.mechanicalLowRisk.value === true)
+    requirements.push(requirement({
+      ruleId: "mechanical-existing-checks",
+      dimension: "verification",
+      scope,
+      reason: `The change is demonstrably mechanical and low-risk: ${signalReason(input, "mechanicalLowRisk")}`,
+      satisfaction: "Run the relevant existing checks for affected consumers; do not add tautological tests.",
+      before: "close",
+      dependentAction: null,
+      acceptanceAllowed: true
+    }), requirement({
+      ruleId: input.preferences?.thorough ? "fresh-context-review" : "self-review",
+      dimension: "review",
+      scope,
+      reason: input.preferences?.thorough ? "The thorough preference upgrades mechanical self-review to fresh-context review." : "Mechanical low-risk work uses self-review rather than mandatory fresh-context review.",
+      satisfaction: input.preferences?.thorough ? "A separate review context examines the current candidate and records its result." : "The lead reviews the resulting diff and records the relevant scope and checks.",
+      before: "close",
+      dependentAction: null,
+      acceptanceAllowed: !input.preferences?.thorough
+    }));
+  if (signals.behaviorChange.value === true || signals.mechanicalLowRisk.value === true)
+    requirements.push(requirement({
+      ruleId: "pre-pr-cleanup",
+      dimension: "verification",
+      scope,
+      reason: "Implementation output must be deslopped before it is delivered.",
+      satisfaction: "Run the workit-deslop pass and record passing check evidence, or record an approved limitation decision waiving cleanup.",
+      before: "dependent_action",
+      dependentAction: "hosting.pull_request",
+      acceptanceAllowed: true
+    }));
+  if (signals.durableAgreementNeeded.value === true)
+    requirements.push(requirement({
+      ruleId: "durable-spec",
+      dimension: "artifacts",
+      scope,
+      reason: `The work needs a durable agreement about intended behavior: ${signalReason(input, "durableAgreementNeeded")}`,
+      satisfaction: "Record the agreed behavior in a durable specification before implementation writes.",
+      before: "write",
+      dependentAction: null,
+      acceptanceAllowed: true
+    }));
+  if (signals.coordinationPlanNeeded.value === true)
+    requirements.push(requirement({
+      ruleId: "coordination-plan",
+      dimension: "continuity",
+      scope,
+      reason: `Dependencies, sequencing, or resumption need durable coordination: ${signalReason(input, "coordinationPlanNeeded")}`,
+      satisfaction: "Record useful sequencing, dependencies, and the next action in a compact plan.",
+      before: "dependent_action",
+      dependentAction: null,
+      acceptanceAllowed: true
+    }));
+  if (signals.helperUseful.value === true && !input.preferences?.fast)
+    requirements.push(requirement({
+      ruleId: "helper-usefulness",
+      dimension: "delegation",
+      scope,
+      reason: `Independent judgment or investigation justifies a scoped helper: ${signalReason(input, "helperUseful")}`,
+      satisfaction: "Use a bounded helper only for the independent objective and reconcile its result.",
+      before: "dependent_action",
+      dependentAction: null,
+      acceptanceAllowed: true
+    }));
+  for (const constraint of input.constraints)
+    for (const obligation of constraint.requires) {
+      const dimension = obligation.method ?? (obligation.kind === "check" ? "verification" : obligation.kind === "decision" ? "decisions" : "challenge");
+      requirements.push(requirement({
+        ruleId: `project-constraint:${constraint.id}:${obligation.kind}:${sha256({
+          kind: obligation.kind,
+          scope: normalizedScope(obligation.scope),
+          refs: normalizedRefList(obligation.refs),
+          method: obligation.method,
+          before: obligation.before,
+          dependentAction: obligation.dependentAction
+        })}`,
+        dimension,
+        scope: obligation.scope,
+        reason: `${constraint.kind} constraint requires ${obligation.kind}: ${constraint.statement}`,
+        satisfaction: `Satisfy the constraint obligation using its referenced ${obligation.kind}.`,
+        before: obligation.before,
+        dependentAction: obligation.dependentAction,
+        acceptanceAllowed: constraint.acceptanceAllowed && obligation.kind !== "decision"
+      }));
+    }
+  const seen = new Set;
+  return requirements.filter((item) => {
+    if (seen.has(item.id))
       return false;
-    const requirement = view.task.policy?.requirements.find((candidate) => candidate.id === item.requirementId);
-    return !requirement || requirement.before === "close";
-  });
-  if (requestedOutcome !== "stopped" && blocking.length)
-    return failure2("requirements_unsatisfied", "applicable requirements are unsatisfied", {
-      requirementIds: blocking.map((item) => item.requirementId),
-      requirements: blocking.map((item) => {
-        const requirement = view.task.policy?.requirements.find((candidate) => candidate.id === item.requirementId);
-        return {
-          requirementId: item.requirementId,
-          ruleId: requirement?.ruleId ?? "unknown",
-          reason: item.reason,
-          satisfaction: requirement?.satisfaction ?? "",
-          dependentAction: requirement?.dependentAction ?? null
-        };
-      })
-    });
-  const accepted = evaluations.filter((item) => item.status === "accepted_limitation");
-  if (requestedOutcome === "verified" && accepted.length)
-    return failure2("requirements_unsatisfied", "accepted limitations cannot be reported as verified", {
-      requirementIds: accepted.map((item) => item.requirementId)
-    });
-  const evidenceIds = [
-    ...new Set([
-      ...evaluations.flatMap((item) => item.evidenceIds),
-      ...view.task.findings.flatMap((item) => item.data.resolution?.evidenceIds ?? [])
-    ])
-  ];
-  const decisionIds = [
-    ...new Set([
-      ...evaluations.flatMap((item) => item.decisionIds),
-      ...view.task.findings.flatMap((item) => item.data.resolution?.decisionIds ?? [])
-    ])
-  ];
-  return success(null, null, {
-    outcome: requestedOutcome === "stopped" ? "stopped" : accepted.length ? "accepted_limitations" : "verified",
-    evidenceIds,
-    decisionIds,
-    requirementIds: evaluations.map((item) => item.requirementId)
+    seen.add(item.id);
+    return true;
   });
 }
+function resolvePolicy(input) {
+  const normalized = normalizeResolverInput(input);
+  if (!normalized.ok)
+    return normalized;
+  const requirements = resolveRequirements(normalized.data);
+  const policy = {
+    policyVersion: POLICY_VERSION,
+    inputDigest: sha256(canonicalJson(normalized.data)),
+    requirements
+  };
+  const parsed = policySchema.safeParse(policy);
+  if (!parsed.success)
+    return failure2("invalid_input", "resolved policy is invalid", invalidFields(parsed.error));
+  return success(null, null, parsed.data);
+}
+function diffPolicy(previous, next, reason, now) {
+  if (!policySchema.safeParse(previous).success && previous !== null)
+    throw new TypeError("previous policy is invalid");
+  if (!policySchema.safeParse(next).success)
+    throw new TypeError("next policy is invalid");
+  const oldIds = new Set(previous?.requirements.map((item) => item.id) ?? []);
+  const newIds = new Set(next.requirements.map((item) => item.id));
+  const added = [...newIds].filter((id) => !oldIds.has(id)).toSorted(compareCodeUnits3);
+  const retired = [...oldIds].filter((id) => !newIds.has(id)).toSorted(compareCodeUnits3);
+  if (added.length === 0 && retired.length === 0)
+    return null;
+  const normalizedReason = reason.trim();
+  const changeReason = retired.length ? `${normalizedReason || "policy reassessed"} (retired: ${retired.join(",")})` : normalizedReason || "policy reassessed";
+  const change = {
+    recordedAt: now,
+    fromInputDigest: previous?.inputDigest ?? null,
+    toInputDigest: next.inputDigest,
+    added,
+    retired,
+    reason: changeReason
+  };
+  const parsed = policyChangeSchema.safeParse(change);
+  if (!parsed.success)
+    throw new TypeError("policy change is invalid");
+  return parsed.data;
+}
 
 // packages/workit-core/src/core/task-context.ts
 function reconcileResume(view, observations = []) {
@@ -13124,7 +13583,7 @@ function reconcileResume(view, observations = []) {
   const candidate = captureCandidate(view.workspace.root, view.task.intent.data.scope, []);
   if (!candidate.ok)
     return candidate;
-  const staleEvidenceIds = evaluateEvidence(view.task, candidate.data).filter((entry) => entry.status === "stale").map((entry) => entry.evidenceId);
+  const staleEvidenceIds = evaluateEvidence(view.task, candidate.data, treeFreshness(view.workspace.root)).filter((entry) => entry.status === "stale").map((entry) => entry.evidenceId);
   const blockers = [...view.task.progress.blockers];
   if (view.task.workers.some((entry) => isUncertainWorker(entry.data.state)))
     blockers.push({
@@ -14022,10 +14481,7 @@ class WorkitCore {
           if (finding.data.disposition !== "fixed")
             return finding;
           const withEntry = { ...current, candidates, evidence: [...current.evidence, entry] };
-          const statuses = new Map(evaluateEvidence(withEntry, currentCandidate.data).map((item) => [
-            item.evidenceId,
-            item.status
-          ]));
+          const statuses = new Map(evaluateEvidence(withEntry, currentCandidate.data, treeFreshness(this.store.root)).map((item) => [item.evidenceId, item.status]));
           const verified = withEntry.evidence.some((item) => findingVerificationPasses(finding.data.candidateId, {
             kind: item.data.kind,
             candidateId: item.data.candidateId,
@@ -14040,6 +14496,71 @@ class WorkitCore {
       return changed;
     return success(changed.data.revision, null, changed.data.evidence.at(-1));
   }
+  observeCheck(request) {
+    return this.retryOmittedRevisions(request, () => this.observeCheckOnce(request));
+  }
+  observeCheckOnce(request) {
+    const root = this.contextRootError();
+    if (!root.ok)
+      return root;
+    if (this.context.caller.host !== "workit_cli" || (this.context.workerId ?? null) !== null)
+      return failure2("permission_denied", "only the workit CLI records observed checks");
+    const observation = checkObservationSchema.safeParse(request?.observation);
+    if (!observation.success)
+      return failure2("invalid_input", "check observation is invalid", {
+        fields: observation.error.issues.map((issue) => ({
+          path: issue.path.join("."),
+          reason: issue.message
+        }))
+      });
+    const task = this.store.readTask(request.taskId);
+    if (!task.ok)
+      return task;
+    if (task.data.status === "closed")
+      return failure2("invalid_transition", "closed task cannot record evidence");
+    const observed = observation.data;
+    let candidate = null;
+    if (observed.tree === null) {
+      const captured = captureCandidate(this.store.root, task.data.intent.data.scope, environment());
+      if (!captured.ok)
+        return captured;
+      candidate = captured.data;
+    }
+    const label = observed.name ?? observed.argv.join(" ");
+    const data = {
+      kind: "check",
+      claim: `workit check ${label}`.slice(0, 500),
+      requirementIds: [],
+      ...candidate ? { beforeCandidateId: candidate.id, candidateId: candidate.id } : {},
+      result: observed.exitCode === 0 ? "passed" : "failed",
+      summary: `${observed.configured ? "configured" : "ad-hoc"} check exited ${observed.exitCode}${observed.timedOut ? " (timed out)" : ""} in ${observed.durationMs} ms`,
+      refs: [],
+      exitCode: observed.exitCode,
+      reviewContext: null,
+      observation: observed
+    };
+    const changed = this.store.mutateTask(task.data.id, request.expectedRevision ?? task.data.revision, (current, mutation) => {
+      const candidates = candidate === null || current.candidates.some((item) => item.id === candidate.id) ? current.candidates : [...current.candidates, candidate];
+      const critical = [...new Set([...current.critical ?? [], CHECK_OBSERVATION_PATH])];
+      return success(mutation.revision, null, {
+        ...current,
+        critical,
+        candidates,
+        evidence: [
+          ...current.evidence,
+          {
+            id: newId(),
+            recordedAt: mutation.now,
+            provenance: provenance(this.context, "host_observed"),
+            data
+          }
+        ]
+      });
+    }, trustedNow(this.context));
+    if (!changed.ok)
+      return changed;
+    return success(changed.data.revision, null, changed.data.evidence.at(-1));
+  }
   decision(request) {
     return this.recordDecision(request);
   }
@@ -14275,7 +14796,7 @@ class WorkitCore {
       const current = captureCandidate(this.store.root, task.data.intent.data.scope, environment());
       if (!current.ok)
         return current;
-      const evaluations = evaluateEvidence(task.data, current.data);
+      const evaluations = evaluateEvidence(task.data, current.data, treeFreshness(this.store.root));
       const verified = evidence.some((entry) => {
         const evaluation = evaluations.find((item) => item.evidenceId === entry.id);
         return entry.recordedAt >= finding.recordedAt && findingVerificationPasses(finding.data.candidateId, {
@@ -14979,7 +15500,8 @@ class WorkitCore {
     if (!current.ok)
       return current;
     const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
-    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller);
+    const tree = treeFreshness(this.store.root);
+    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller, tree);
     return success(task.revision, workspace.data.revision, {
       id: task.id,
       revision: task.revision,
@@ -14996,7 +15518,7 @@ class WorkitCore {
       writer: evaluationWorkspace.writer
     });
   }
-  compactContext(taskId) {
+  compactContext(taskId, freshness) {
     const root = this.contextRootError();
     if (!root.ok)
       return root;
@@ -15006,12 +15528,12 @@ class WorkitCore {
     const helper = this.helperTaskGuard(task.data, true);
     if (!helper.ok)
       return helper;
-    const view = this.view(task.data, false);
+    const view = this.view(task.data, false, freshness ?? signalFreshness(this.store.root));
     if (!view.ok)
       return view;
     return success(view.revision, view.workspaceRevision, compactTaskContext(view.data));
   }
-  view(task, capture = true) {
+  view(task, capture = true, freshness = treeFreshness(this.store.root)) {
     const workspace = this.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
@@ -15022,13 +15544,14 @@ class WorkitCore {
     if (!current.ok)
       return current;
     const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
-    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller);
+    const tree = freshness;
+    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller, tree);
     return success(task.revision, workspace.data.revision, {
       task,
       workspace: evaluationWorkspace,
       capabilities: this.context.capabilities,
       requirements,
-      evidence: evaluateEvidence(task, current.data)
+      evidence: evaluateEvidence(task, current.data, tree)
     });
   }
   reconcileResume(view, observations = []) {
@@ -15255,13 +15778,14 @@ class WorkitCore {
       return current;
     const withCandidate = current.data;
     const taskForView = withCandidate.id === task.data.candidates.at(-1)?.id ? task.data : { ...task.data, candidates: [...task.data.candidates, withCandidate] };
-    const requirements = evaluateRequirements(taskForView, workspace.data, this.context.capabilities, withCandidate, this.store.root, this.context.caller);
+    const tree = treeFreshness(this.store.root);
+    const requirements = evaluateRequirements(taskForView, workspace.data, this.context.capabilities, withCandidate, this.store.root, this.context.caller, tree);
     const view = {
       task: taskForView,
       workspace: workspace.data,
       capabilities: this.context.capabilities,
       requirements,
-      evidence: evaluateEvidence(taskForView, withCandidate)
+      evidence: evaluateEvidence(taskForView, withCandidate, tree)
     };
     const closure = evaluateClosure(input.outcome, view);
     if (!closure.ok)
@@ -15316,6 +15840,19 @@ var filesKey = (files) => {
   return signatures.some((item) => item !== "-" && racySignature(item)) ? null : signatures.join("\x00");
 };
 var CACHE_LIMIT = 64;
+var SIGNAL_TTL_MS = 1500;
+var signals = new Map;
+var recentSignal = (root) => {
+  const now = Date.now();
+  const cached = signals.get(root);
+  if (cached && now - cached.at < SIGNAL_TTL_MS)
+    return cached.value;
+  const value = worktreeSignal(root);
+  signals.set(root, { at: now, value });
+  if (signals.size > CACHE_LIMIT)
+    signals.delete(signals.keys().next().value);
+  return value;
+};
 var cache = new Map;
 function sessionCompactContext(store, session, context, selection = "session-bound") {
   const listed = store.listTaskIndex();
@@ -15339,18 +15876,26 @@ function entryCompactContext(store, entry, session, context) {
     capabilities: context.capabilities
   });
   const hit = cache.get(slot);
-  if (hit && hit.key === key && hit.filesKey !== null && hit.filesKey === filesKey(hit.files))
+  if (hit && hit.key === key && hit.filesKey !== null && hit.filesKey === filesKey(hit.files) && (hit.signal === null || hit.signal === recentSignal(store.root)))
     return hit.value;
   const task = store.readTask(entry.id);
   if (!task.ok)
     return null;
-  const files = task.data.decisions.flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path11.resolve(store.root, ref.path)] : []));
-  const observed = filesKey(files);
-  const compact = new WorkitCore(store, context).compactContext(entry.id);
+  const freshness = { mode: "signal", current: () => recentSignal(store.root) };
+  const observed = task.data.evidence.some(isObservedCheck);
+  const files = task.data.decisions.flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path13.resolve(store.root, ref.path)] : []));
+  const observedFiles = filesKey(files);
+  const compact = new WorkitCore(store, context).compactContext(entry.id, freshness);
   if (!compact.ok)
     return null;
   cache.delete(slot);
-  cache.set(slot, { key, files, filesKey: observed, value: compact.data });
+  cache.set(slot, {
+    key,
+    files,
+    filesKey: observedFiles,
+    signal: observed ? freshness.current() : null,
+    value: compact.data
+  });
   if (cache.size > CACHE_LIMIT)
     cache.delete(cache.keys().next().value);
   return compact.data;
@@ -15423,6 +15968,8 @@ var shellPolicy = (cwd, command) => {
 var usable2 = (value) => value === "native" || value === "partial";
 var NONE2 = { kind: "none" };
 var offered = new Set;
+var CLAUDE_WORKTREE_IMPLEMENTER = "workit:implementer";
+var subagentStartText = (host, descriptor, event) => host === "claude_code" && event.agentType === CLAUDE_WORKTREE_IMPLEMENTER ? `Workit observed ${descriptor.label} subagent ${event.agentId} (${event.agentType}) working in its own git worktree: it may edit and commit there, within its brief's scope. Before the first commit, switch to a policy-compliant branch (\`git switch -c <type>/<slug>\`, e.g. feature/<slug>); branch policy hooks still deny protected or non-compliant branches. Never push, open a PR, or merge unless the brief asks for it.` : `Workit observed ${descriptor.label} subagent ${event.agentId} (${event.agentType}) as read-only/agent-guided; writer delegation is unavailable.`;
 function handleHook(input, deps) {
   const { descriptor } = deps;
   const event = input.event;
@@ -15448,10 +15995,7 @@ function handleHook(input, deps) {
     case "shell.pre":
       return usable2(descriptor.shellPolicy.deny) ? shellPolicy(input.cwd, event.command) : NONE2;
     case "subagent.start":
-      return {
-        kind: "context",
-        text: `Workit observed ${descriptor.label} subagent ${event.agentId} (${event.agentType}) as read-only/agent-guided; writer delegation is unavailable.`
-      };
+      return { kind: "context", text: subagentStartText(input.host, descriptor, event) };
     case "compact.pre":
       return {
         kind: "notice",
@@ -15496,12 +16040,12 @@ var dispatchHook = (adapter, raw, env = process.env) => {
 };
 // packages/workit-core/src/hooks/hosts/fields.ts
 import { existsSync as existsSync5, realpathSync as realpathSync7, statSync as statSync2 } from "node:fs";
-import path12 from "node:path";
-var isRecord2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+import path14 from "node:path";
+var isRecord3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "";
 var optionalText = (value) => typeof value === "string" ? value : null;
 var existingDirectory = (value) => {
-  if (!nonEmpty2(value) || !path12.isAbsolute(value) || !existsSync5(value))
+  if (!nonEmpty2(value) || !path14.isAbsolute(value) || !existsSync5(value))
     return null;
   try {
     return statSync2(value).isDirectory() ? realpathSync7(value) : null;
@@ -15638,7 +16182,7 @@ var EVENTS = {
 };
 var SOURCES = new Set(["startup", "resume", "clear", "compact", "fork"]);
 var SHELL_TOOLS = new Set(["Bash", "PowerShell"]);
-var toolCommand = (value) => isRecord2(value.tool_input) ? commandText(value.tool_input.command) : null;
+var toolCommand = (value) => isRecord3(value.tool_input) ? commandText(value.tool_input.command) : null;
 var eventOf = (name, value) => {
   const toolUseId = optionalText(value.tool_use_id);
   switch (name) {
@@ -15658,7 +16202,7 @@ var eventOf = (name, value) => {
       const command = toolCommand(value);
       if (!SHELL_TOOLS.has(String(value.tool_name)) || !command)
         return { ok: false, error: "only shell PostToolUse is mapped" };
-      const response = isRecord2(value.tool_response) ? value.tool_response : {};
+      const response = isRecord3(value.tool_response) ? value.tool_response : {};
       return {
         ok: true,
         event: {
@@ -15734,14 +16278,14 @@ var render = (decision, native) => {
 var claudeCodeAdapter = {
   descriptor: CLAUDE_CODE_DESCRIPTOR,
   parse(raw) {
-    const native = isRecord2(raw) && Object.hasOwn(EVENTS, String(raw.hook_event_name)) ? raw.hook_event_name : null;
+    const native = isRecord3(raw) && Object.hasOwn(EVENTS, String(raw.hook_event_name)) ? raw.hook_event_name : null;
     const fail = (error) => ({
       ok: false,
       error,
       native,
       event: native ? EVENTS[native] : null
     });
-    if (!isRecord2(raw) || !native)
+    if (!isRecord3(raw) || !native)
       return fail("hook_event_name is required");
     if (!nonEmpty2(raw.session_id))
       return fail("session_id is required");
@@ -15891,7 +16435,7 @@ var SHELL_TOOLS2 = new Set(["bash", "unified-exec"]);
 var isShellTool = (name) => SHELL_TOOLS2.has(String(name).toLowerCase());
 var SOURCES2 = new Set(["startup", "resume", "clear", "compact"]);
 var parseCodexHookInput = (value) => {
-  if (!isRecord2(value) || !Object.hasOwn(EVENTS2, String(value.hook_event_name)))
+  if (!isRecord3(value) || !Object.hasOwn(EVENTS2, String(value.hook_event_name)))
     return { ok: false, error: "hook_event_name is required" };
   const event = value.hook_event_name;
   const cwd = existingDirectory(value.cwd);
@@ -15899,7 +16443,7 @@ var parseCodexHookInput = (value) => {
     return { ok: false, error: "cwd must be an existing absolute directory" };
   if (event === "PreToolUse" && !nonEmpty2(value.tool_name))
     return { ok: false, error: "tool_name is required" };
-  const command = isRecord2(value.tool_input) ? commandText(value.tool_input.command) : null;
+  const command = isRecord3(value.tool_input) ? commandText(value.tool_input.command) : null;
   if (event === "PreToolUse" && isShellTool(value.tool_name) && !command)
     return { ok: false, error: "tool_input.command is required for shell tools" };
   if (event === "SubagentStart" && !nonEmpty2(value.agent_id))
@@ -15982,7 +16526,7 @@ var codexAdapter = {
     const host = detectCodexSurface(env);
     const parsed = parseCodexHookInput(raw);
     if (!parsed.ok) {
-      const native = isRecord2(raw) && Object.hasOwn(EVENTS2, String(raw.hook_event_name)) ? raw.hook_event_name : null;
+      const native = isRecord3(raw) && Object.hasOwn(EVENTS2, String(raw.hook_event_name)) ? raw.hook_event_name : null;
       return { ok: false, error: parsed.error, native, event: native ? EVENTS2[native] : null };
     }
     const input = parsed.data;
@@ -16009,7 +16553,7 @@ var codexAdapter = {
 };
 
 // packages/workit-core/src/hooks/hosts/cursor.ts
-import path13 from "node:path";
+import path15 from "node:path";
 var undocumented2 = { support: "undocumented", native: null };
 var none = { support: "none", native: null };
 var CURSOR_DESCRIPTOR = {
@@ -16128,7 +16672,7 @@ var EVENTS3 = {
   preCompact: "compact.pre"
 };
 var parseCursorHookInput = (value) => {
-  if (!isRecord2(value) || !Object.hasOwn(EVENTS3, String(value.hook_event_name)))
+  if (!isRecord3(value) || !Object.hasOwn(EVENTS3, String(value.hook_event_name)))
     return { ok: false, error: "hook_event_name is required" };
   const roots = value.workspace_roots;
   if (!Array.isArray(roots) || roots.length === 0 || !roots.every(nonEmpty2))
@@ -16192,7 +16736,7 @@ var protocolEvent2 = (input) => {
       return { kind: "compact.pre", trigger: "auto" };
   }
 };
-var within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path13.sep) ? root : `${root}${path13.sep}`);
+var within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path15.sep) ? root : `${root}${path15.sep}`);
 var hookCwd = (input) => {
   const cwd = existingDirectory(input.cwd);
   if (cwd && input.hook_event_name === "beforeShellExecution")
@@ -16229,7 +16773,7 @@ var cursorAdapter = {
   parse(raw) {
     const parsed = parseCursorHookInput(raw);
     if (!parsed.ok) {
-      const native = isRecord2(raw) && Object.hasOwn(EVENTS3, String(raw.hook_event_name)) ? raw.hook_event_name : null;
+      const native = isRecord3(raw) && Object.hasOwn(EVENTS3, String(raw.hook_event_name)) ? raw.hook_event_name : null;
       return { ok: false, error: parsed.error, native, event: native ? EVENTS3[native] : null };
     }
     const input = parsed.data;