@brainervirus/workit-codex 8.23.0 → 8.25.0

package/dist/launch-mcp.js

@@ -6621,14 +6621,14 @@ var require_dist = __commonJS(function(exports, module) {
 });
 
 // packages/workit-codex/scripts/launch-mcp.ts
-import { existsSync as existsSync10, realpathSync as realpathSync7, statSync as statSync3 } from "node:fs";
-import path25 from "node:path";
+import { existsSync as existsSync11, realpathSync as realpathSync7, statSync as statSync3 } from "node:fs";
+import path26 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // packages/workit-core/src/core.ts
 import { spawnSync as spawnSync14 } from "node:child_process";
-import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
-import path21 from "node:path";
+import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
+import path22 from "node:path";
 
 // packages/workit-core/src/core/task-contract.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -14859,7 +14859,7 @@ var workspaceConfigSchema = object({
   }).passthrough().optional(),
   autoApprove: union([boolean2(), array(nonBlank)]).optional(),
   defaultEndpoint: unknown().optional(),
-  verification: _enum(["self", "independent"]).optional(),
+  verification: _enum(["proportional", "self", "independent"]).optional(),
   delegation: unknown().optional(),
   trailers: boolean2().optional(),
   liveSessionGuard: boolean2().optional(),
@@ -15400,6 +15400,144 @@ function resolveRef(cwd, ref) {
     return null;
   return line(git(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]));
 }
+function originHeadRef(cwd) {
+  return line(git(cwd, ["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"]));
+}
+function ownChangeDrift(cwd, range) {
+  const before = diffRaw(cwd, range.fromFork, range.from);
+  const after = diffRaw(cwd, range.toFork, range.to);
+  if (!before || !after)
+    return null;
+  const judged = new Map(before.map((entry) => [entry.path, entry]));
+  const current = new Map(after.map((entry) => [entry.path, entry]));
+  const same = (a, b) => a !== undefined && b !== undefined && a.oldMode === b.oldMode && a.oldBlob === b.oldBlob && a.newMode === b.newMode && a.newBlob === b.newBlob;
+  return [...new Set([...judged.keys(), ...current.keys()])].filter((file) => !same(judged.get(file), current.get(file))).toSorted();
+}
+function sameOwnChange(cwd, range) {
+  const fromFork = mergeBase(cwd, range.fromBase, range.from);
+  const toFork = mergeBase(cwd, range.toBase, range.to);
+  if (!fromFork || !toFork)
+    return false;
+  return ownChangeDrift(cwd, { from: range.from, to: range.to, fromFork, toFork })?.length === 0;
+}
+var LANE_DIFF = [
+  "-c",
+  "core.quotePath=false",
+  "diff",
+  "--no-color",
+  "--no-ext-diff",
+  "--no-textconv",
+  "--no-renames"
+];
+var laneRange = (fork, head) => {
+  if (!safeArg(fork) || head !== null && !safeArg(head))
+    return null;
+  return head === null ? [fork] : [fork, head];
+};
+function diffNumstat(cwd, fork, head) {
+  const range = laneRange(fork, head);
+  if (!range)
+    return null;
+  const run = git(cwd, [...LANE_DIFF, "--numstat", "-z", ...range, "--"]);
+  if (!run.ok)
+    return null;
+  const out = [];
+  for (const record of run.stdout.split("\x00")) {
+    const match = /^(-|\d+)\t(-|\d+)\t(.+)$/su.exec(record.replace(/^\n/u, ""));
+    if (!match)
+      continue;
+    const binary = match[1] === "-";
+    out.push({
+      path: match[3],
+      added: binary ? 0 : Number(match[1]),
+      deleted: binary ? 0 : Number(match[2]),
+      binary
+    });
+  }
+  return out;
+}
+function diffRaw(cwd, fork, head) {
+  const range = laneRange(fork, head);
+  if (!range)
+    return null;
+  const run = git(cwd, [...LANE_DIFF, "--raw", "-z", "--no-abbrev", ...range, "--"]);
+  if (!run.ok)
+    return null;
+  const fields = run.stdout.split("\x00");
+  const out = [];
+  for (let index = 0;index + 1 < fields.length; index += 2) {
+    const meta = /^:(\d{6}) (\d{6}) ([0-9a-f]+) ([0-9a-f]+) [A-Z]\d*$/u.exec(fields[index].replace(/^\n/u, ""));
+    if (!meta)
+      return null;
+    out.push({
+      path: fields[index + 1],
+      oldMode: meta[1],
+      newMode: meta[2],
+      oldBlob: meta[3],
+      newBlob: meta[4]
+    });
+  }
+  return out;
+}
+function readBlobs(cwd, ids) {
+  const out = new Map;
+  const wanted = [...new Set(ids)].filter((id) => /^[0-9a-f]{40,64}$/u.test(id));
+  if (!wanted.length)
+    return out;
+  const run = spawnSync3("git", ["cat-file", "--batch"], {
+    cwd,
+    input: `${wanted.join(`
+`)}
+`,
+    maxBuffer: MAX_BUFFER,
+    timeout: GIT_TIMEOUTS.local,
+    killSignal: "SIGKILL",
+    windowsHide: true
+  });
+  if (run.status !== 0 || !run.stdout)
+    return null;
+  const bytes = run.stdout;
+  let at = 0;
+  for (const id of wanted) {
+    const end = bytes.indexOf(10, at);
+    if (end < 0)
+      return null;
+    const header = bytes.subarray(at, end).toString("utf8").split(" ");
+    at = end + 1;
+    if (header[1] === "missing")
+      continue;
+    const size = Number(header[2]);
+    if (header[0] !== id || !Number.isSafeInteger(size))
+      return null;
+    out.set(id, bytes.subarray(at, at + size));
+    at += size + 1;
+  }
+  return out;
+}
+function treeFilesNamed(cwd, rev, name) {
+  if (!safeArg(rev))
+    return null;
+  const run = git(cwd, ["ls-tree", "-r", "-z", "--full-tree", rev]);
+  if (!run.ok)
+    return null;
+  const out = new Map;
+  for (const record of run.stdout.split("\x00")) {
+    const match = /^\d{6} blob ([0-9a-f]+)\t(.+)$/su.exec(record);
+    if (match && (match[2] === name || match[2].endsWith(`/${name}`)))
+      out.set(match[2], match[1]);
+  }
+  return out;
+}
+function fileAt(cwd, rev, file) {
+  if (!safeArg(rev))
+    return null;
+  const run = git(cwd, ["cat-file", "blob", `${rev}:${file}`]);
+  return run.ok ? run.stdout : null;
+}
+function untrackedFiles(cwd) {
+  const run = git(cwd, ["ls-files", "-z", "--others", "--exclude-standard"]);
+  return run.ok ? run.stdout.split("\x00").filter(Boolean) : [];
+}
 var config2 = (cwd, key) => line(git(cwd, ["config", "--get", key]));
 function currentBranch(cwd) {
   return line(git(cwd, ["symbolic-ref", "--short", "-q", "HEAD"]));
@@ -18910,7 +19048,7 @@ var workerBlocksTransition = (transition, state) => transition === "pause" ? fal
 import { createHash as createHash10 } from "node:crypto";
 import * as fs13 from "node:fs";
 import { spawnSync as spawnSync10 } from "node:child_process";
-import path16 from "node:path";
+import path17 from "node:path";
 
 // packages/workit-core/src/check-config.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
@@ -19130,14 +19268,757 @@ function checkCommand(args, version, onPath = workitAvailable()) {
 }
 
 // packages/workit-core/src/core/policy/derive.ts
-import { existsSync as existsSync4 } from "node:fs";
-import path15 from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import path16 from "node:path";
 
 // packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
 import { createHash as createHash9, randomBytes as randomBytes3 } from "node:crypto";
 import fs12 from "node:fs";
+import path15 from "node:path";
+
+// packages/workit-core/src/core/policy/lane.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
 import path14 from "node:path";
+
+// packages/workit-core/src/git/default-base.ts
+var safeRef = (value) => value.length > 0 && !value.startsWith("-");
+var trackTrunk = (cwd) => {
+  try {
+    const resolved = vcsConfig("resolve", cwd);
+    if (resolved.ok === false || !resolved.releaseTrack || resolved.releaseTrack.blocking)
+      return null;
+    const target = String(resolved.defaultTargetBranch ?? "").trim();
+    return target && safeRef(target) ? target : null;
+  } catch {
+    return null;
+  }
+};
+function defaultBase(cwd) {
+  const trunk = trackTrunk(cwd);
+  if (trunk) {
+    for (const candidate of [`origin/${trunk}`, trunk])
+      if (resolveRef(cwd, candidate))
+        return candidate;
+  }
+  const originHead = originHeadRef(cwd);
+  if (originHead && resolveRef(cwd, originHead))
+    return originHead;
+  for (const candidate of [
+    "origin/main",
+    "origin/master",
+    "main",
+    "master",
+    "origin/develop",
+    "develop"
+  ])
+    if (resolveRef(cwd, candidate))
+      return candidate;
+  return null;
+}
+
+// packages/workit-core/src/core/policy/attributes.ts
+function patternRegex(dir, pattern) {
+  if (!pattern || pattern.endsWith("/") || pattern.startsWith('"') || pattern.startsWith("!"))
+    return null;
+  const anchored = pattern.includes("/");
+  const body = pattern.replace(/^\//u, "");
+  let source = "";
+  for (let index = 0;index < body.length; index += 1) {
+    const char = body[index];
+    if (char === "*" && body[index + 1] === "*") {
+      const slash = body[index + 2] === "/";
+      source += slash ? "(?:.*/)?" : ".*";
+      index += slash ? 2 : 1;
+    } else if (char === "*")
+      source += "[^/]*";
+    else if (char === "?")
+      source += "[^/]";
+    else if (char === "[") {
+      const end = body.indexOf("]", index + 2);
+      if (end < 0)
+        return null;
+      const set = body.slice(index + 1, end).replace(/^!/u, "^").replace(/\\/gu, "\\\\");
+      source += `[${set}]`;
+      index = end;
+    } else if (char === "\\" && index + 1 < body.length) {
+      source += body[index + 1].replace(/[.*+?^${}()|[\]\\/]/gu, "\\$&");
+      index += 1;
+    } else
+      source += char.replace(/[.*+?^${}()|[\]\\/]/gu, "\\$&");
+  }
+  const prefix = dir ? `${dir.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}/` : "";
+  try {
+    return new RegExp(anchored ? `^${prefix}${source}$` : `^${prefix}(?:.*/)?${source}$`, "u");
+  } catch {
+    return null;
+  }
+}
+function rulesOf(dir, text) {
+  const out = [];
+  for (const raw of text.split(`
+`)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#") || line.startsWith("[attr]"))
+      continue;
+    const [pattern, ...attributes] = line.split(/\s+/u);
+    let generated = null;
+    for (const attribute of attributes) {
+      if (attribute === "linguist-generated" || attribute === "linguist-generated=true")
+        generated = true;
+      else if (attribute === "-linguist-generated" || attribute === "!linguist-generated" || attribute.startsWith("linguist-generated="))
+        generated = false;
+    }
+    if (generated === null)
+      continue;
+    const regex = patternRegex(dir, pattern);
+    if (regex)
+      out.push({ regex, generated });
+  }
+  return out;
+}
+function generatedByAttributes(files, paths) {
+  const rules = [...files].map(([file, text]) => {
+    const dir = file.includes("/") ? file.slice(0, file.lastIndexOf("/")) : "";
+    return {
+      depth: dir ? dir.split("/").length : 0,
+      rules: rulesOf(dir, text)
+    };
+  }).toSorted((left, right) => left.depth - right.depth).flatMap((entry) => entry.rules);
+  const out = new Set;
+  for (const file of paths) {
+    const last = rules.findLast((rule) => rule.regex.test(file));
+    if (last?.generated)
+      out.add(file);
+  }
+  return out;
+}
+
+// packages/workit-core/src/core/policy/substance.ts
+var SLASH_BLOCK = [["/*", "*/"]];
+var C_LIKE = { line: ["//"], block: SLASH_BLOCK, quotes: `"'` };
+var SYNTAXES = Object.fromEntries([
+  ...["ts", "mts", "cts", "js", "mjs", "cjs"].map((ext) => [ext, { ...C_LIKE, js: true }]),
+  ...["java", "kt", "kts", "scala", "swift", "dart", "groovy"].map((ext) => [
+    ext,
+    { ...C_LIKE, triple: true }
+  ]),
+  ["go", { ...C_LIKE, rawBacktick: true }],
+  ...["css", "scss", "less"].map((ext) => [
+    ext,
+    { line: [], block: SLASH_BLOCK, quotes: `"'`, cssUrl: true }
+  ]),
+  ...["py", "pyi"].map((ext) => [
+    ext,
+    { line: ["#"], block: [], quotes: `"'`, triple: true, indented: true, fstring: true }
+  ]),
+  ["toml", { line: ["#"], block: [], quotes: `"`, literal: "'", triple: true }],
+  ...["html", "htm", "xml", "svg", "xhtml"].map((ext) => [
+    ext,
+    { line: [], block: [["<!--", "-->"]], quotes: "", indented: true }
+  ])
+]);
+var DIRECTIVE = /@ts-|eslint|prettier|biome|oxlint|istanbul|\bc8\b|\bv8\b|@jsx|@flow|@vite|webpack|__PURE__|__NO_SIDE_EFFECTS__|source(?:Mapping)?URL|^\/\s*<|go:|\+build|nolint|noqa|type:|pyright|mypy|pylint|pragma|coding[:=]|fmt:|NOSONAR|@license|@preserve|@refresh|environment|language=|cython|ruff|isort|deno-|@vitest|@jest|swiftlint|ktlint|checkstyle|suppress|nullable|#(?:end)?region/iu;
+var extensionOf = (file) => {
+  const name = file.slice(file.lastIndexOf("/") + 1);
+  const dot = name.lastIndexOf(".");
+  return dot > 0 ? name.slice(dot + 1).toLowerCase() : "";
+};
+var CI_PATH = /^\.github\/|(?:^|\/)(?:\.gitlab-ci\.ya?ml|Jenkinsfile|azure-pipelines\.ya?ml|\.pre-commit-config\.ya?ml|\.circleci\/.*)$/u;
+var syntaxOf = (file) => CI_PATH.test(file) ? null : SYNTAXES[extensionOf(file)] ?? null;
+var SPACE = /[ \t\r\f\v]/u;
+var WORD = /[\w$]/u;
+var NO_SPACE_AFTER = "([{,;";
+var NO_SPACE_BEFORE = ")]},;";
+var REGEX_AFTER = "(,=:[!&|?{};+-*%<>~^";
+var REGEX_KEYWORDS = new Set([
+  "return",
+  "typeof",
+  "instanceof",
+  "case",
+  "do",
+  "else",
+  "in",
+  "of",
+  "new",
+  "delete",
+  "void",
+  "throw",
+  "yield",
+  "await"
+]);
+function substanceOf(file, text) {
+  const syntax = syntaxOf(file);
+  if (!syntax)
+    return plainSubstance(text);
+  const markup = syntax.block.some(([open]) => open === "<!--");
+  if (markup && (/<(?:script|style)\b|<!\[CDATA\[|<\?/iu.test(text) || /[^>\s][ \t]*<!--/u.test(text)))
+    return plainSubstance(text);
+  return lex(syntax, text);
+}
+function plainSubstance(text) {
+  return text.split(`
+`).map((line) => line.replace(/[ \t\r\f\v]+$/u, "")).filter(Boolean).join(`
+`);
+}
+function lex(syntax, text) {
+  const collapse = !syntax.indented;
+  let out = "";
+  let lineStart = 0;
+  let kept = 0;
+  let pendingSpace = false;
+  const frames = [{ kind: "code", braces: 0 }];
+  let index = 0;
+  if (text.startsWith("#!")) {
+    const end = text.indexOf(`
+`);
+    out = end < 0 ? text : text.slice(0, end);
+    kept = out.length;
+    index = end < 0 ? text.length : end;
+  }
+  const emitCode = (chunk) => {
+    if (collapse && pendingSpace && out.length > lineStart) {
+      const before = out[out.length - 1];
+      if (!NO_SPACE_AFTER.includes(before) && !NO_SPACE_BEFORE.includes(chunk[0]))
+        out += " ";
+    }
+    pendingSpace = false;
+    out += chunk;
+  };
+  const emitVerbatim = (chunk) => {
+    emitCode(chunk);
+    kept = out.length;
+  };
+  const newline = () => {
+    if (!collapse) {
+      let end = out.length;
+      while (end > Math.max(lineStart, kept) && SPACE.test(out[end - 1]))
+        end -= 1;
+      out = out.slice(0, end);
+    }
+    pendingSpace = false;
+    if (out.length > lineStart) {
+      out += `
+`;
+      lineStart = out.length;
+    }
+  };
+  const regexAllowed = () => {
+    let end = out.length;
+    while (end > 0 && /\s/u.test(out[end - 1]))
+      end -= 1;
+    if (end === 0 || REGEX_AFTER.includes(out[end - 1]))
+      return true;
+    let start = end;
+    while (start > 0 && WORD.test(out[start - 1]))
+      start -= 1;
+    return REGEX_KEYWORDS.has(out.slice(start, end));
+  };
+  const scanString = (quote, escapes, multiline) => {
+    const prefix = text.slice(Math.max(0, index - 2), index).match(/[a-z]*$/iu)?.[0] ?? "";
+    const fstring = syntax.fstring === true && /f/iu.test(prefix);
+    let end = index + quote.length;
+    while (end < text.length) {
+      const char = text[end];
+      if (escapes && char === "\\") {
+        end += 2;
+        continue;
+      }
+      if (text.startsWith(quote, end)) {
+        if (fstring && unbalanced(text.slice(index + quote.length, end)))
+          return false;
+        emitVerbatim(text.slice(index, end + quote.length));
+        index = end + quote.length;
+        return true;
+      }
+      if (char === `
+` && !multiline)
+        return false;
+      end += 1;
+    }
+    return false;
+  };
+  while (index < text.length) {
+    const frame = frames[frames.length - 1];
+    const char = text[index];
+    if (frame.kind === "template") {
+      if (char === "\\") {
+        emitVerbatim(text.slice(index, index + 2));
+        index += 2;
+      } else if (char === "`") {
+        emitVerbatim(char);
+        frames.pop();
+        index += 1;
+      } else if (text.startsWith("${", index)) {
+        emitVerbatim("${");
+        frames.push({ kind: "code", braces: 0 });
+        index += 2;
+      } else {
+        out += char;
+        kept = out.length;
+        index += 1;
+      }
+      continue;
+    }
+    if (char === `
+`) {
+      newline();
+      index += 1;
+      continue;
+    }
+    if (SPACE.test(char)) {
+      if (collapse)
+        pendingSpace = true;
+      else
+        out += char;
+      index += 1;
+      continue;
+    }
+    const lineOpener = syntax.line.find((opener) => text.startsWith(opener, index));
+    if (lineOpener) {
+      const end = text.indexOf(`
+`, index);
+      const comment = text.slice(index, end < 0 ? text.length : end);
+      if (DIRECTIVE.test(comment.slice(lineOpener.length)))
+        emitVerbatim(comment);
+      else
+        pendingSpace = true;
+      index = end < 0 ? text.length : end;
+      continue;
+    }
+    const block = syntax.block.find(([open]) => text.startsWith(open, index));
+    if (block) {
+      const end = text.indexOf(block[1], index + block[0].length);
+      if (end < 0)
+        return null;
+      const comment = text.slice(index, end + block[1].length);
+      if (DIRECTIVE.test(comment.slice(block[0].length, -block[1].length)))
+        emitVerbatim(comment);
+      else
+        pendingSpace = true;
+      if (comment.includes(`
+`))
+        newline();
+      index = end + block[1].length;
+      continue;
+    }
+    if (syntax.triple && (char === '"' || char === "'") && text.startsWith(char.repeat(3), index)) {
+      if (!scanString(char.repeat(3), !syntax.literal?.includes(char), true))
+        return null;
+      continue;
+    }
+    if (syntax.quotes.includes(char)) {
+      if (!scanString(char, true, Boolean(syntax.multiline)))
+        return null;
+      continue;
+    }
+    if (syntax.literal?.includes(char)) {
+      if (!scanString(char, false, false))
+        return null;
+      continue;
+    }
+    if (syntax.rawBacktick && char === "`") {
+      if (!scanString("`", false, true))
+        return null;
+      continue;
+    }
+    if (syntax.js && char === "`") {
+      emitVerbatim(char);
+      frames.push({ kind: "template" });
+      index += 1;
+      continue;
+    }
+    if (syntax.cssUrl && /^url\(\s*[^"')\s]/iu.test(text.slice(index, index + 64)))
+      return null;
+    if (syntax.js && char === "/" && !regexAllowed() && out.trimEnd().endsWith(")")) {
+      const lineEnd = text.indexOf(`
+`, index);
+      if (text.slice(index + 1, lineEnd < 0 ? text.length : lineEnd).includes("/"))
+        return null;
+    }
+    if (syntax.js && char === "/" && regexAllowed()) {
+      let end = index + 1;
+      let inClass = false;
+      while (end < text.length && (inClass || text[end] !== "/")) {
+        if (text[end] === `
+`)
+          return null;
+        if (text[end] === "\\")
+          end += 1;
+        else if (text[end] === "[")
+          inClass = true;
+        else if (text[end] === "]")
+          inClass = false;
+        end += 1;
+      }
+      if (end >= text.length)
+        return null;
+      emitVerbatim(text.slice(index, end + 1));
+      index = end + 1;
+      continue;
+    }
+    if (frames.length > 1 && frame.kind === "code") {
+      if (char === "{")
+        frame.braces += 1;
+      else if (char === "}") {
+        if (frame.braces === 0) {
+          emitVerbatim(char);
+          frames.pop();
+          index += 1;
+          continue;
+        }
+        frame.braces -= 1;
+      }
+    }
+    emitCode(char);
+    index += 1;
+  }
+  if (frames.length !== 1)
+    return null;
+  newline();
+  return out;
+}
+function unbalanced(body) {
+  let depth = 0;
+  for (const part of body.replaceAll("{{", "").replaceAll("}}", "")) {
+    if (part === "{")
+      depth += 1;
+    else if (part === "}")
+      depth = Math.max(0, depth - 1);
+  }
+  return depth > 0;
+}
+function hasOpaqueLineBreak(text) {
+  return /\r(?!\n)|[\u2028\u2029]/u.test(text);
+}
+var decoder = new TextDecoder("utf-8", { fatal: true });
+function textOf(bytes) {
+  if (bytes.includes(0))
+    return null;
+  try {
+    return decoder.decode(bytes);
+  } catch {
+    return null;
+  }
+}
+function cosmeticChange(file, before, after) {
+  const left = textOf(before);
+  const right = textOf(after);
+  if (left === null || right === null)
+    return false;
+  if (hasOpaqueLineBreak(left) || hasOpaqueLineBreak(right))
+    return false;
+  const a = substanceOf(file, left);
+  return a !== null && a === substanceOf(file, right);
+}
+
+// packages/workit-core/src/core/policy/lane.ts
+var LANE_THRESHOLDS = {
+  selfMaxLines: 100,
+  selfMaxFiles: 5,
+  fullMinLines: 500
+};
+var RISK_TOKENS = new Set([
+  "auth",
+  "authn",
+  "authz",
+  "oauth",
+  "security",
+  "permission",
+  "permissions",
+  "secret",
+  "secrets",
+  "crypto",
+  "gate",
+  "gates",
+  "policy",
+  "policies",
+  "hook",
+  "hooks",
+  "husky",
+  "lefthook",
+  "release",
+  "releases",
+  "migration",
+  "migrations",
+  "migrate",
+  "workflows"
+]);
+var RISK_FILES = new Set([
+  ".gitlab-ci.yml",
+  "Jenkinsfile",
+  "azure-pipelines.yml",
+  ".pre-commit-config.yaml",
+  ".workit/risk-paths"
+]);
+var RISK_NAMES = new Set([".gitattributes"]);
+var RISK_PATHS_FILE = ".workit/risk-paths";
+var LOCKFILES = new Set([
+  "bun.lock",
+  "bun.lockb",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "Cargo.lock",
+  "go.sum",
+  "poetry.lock",
+  "uv.lock",
+  "Pipfile.lock",
+  "Gemfile.lock",
+  "composer.lock"
+]);
+var DOC_EXT = /\.(?:md|mdx|markdown|rst|adoc)$/iu;
+var DOC_NAMES = /^(?:license|licence|notice|authors|changelog|changes|contributors)$/iu;
+var INSTRUCTIONS = /(?:^|\/)(?:AGENTS|CLAUDE|GEMINI|SKILL)\.md$|(?:^|\/)(?:skills|agents|commands|rules|prompts)\/[^/]+/iu;
+var TEST_PATH = /(?:^|\/)(?:test|tests|__tests__)\/|\.(?:test|spec)\.[^/]+$|_test\.[^/]+$/iu;
+var basename = (file) => file.slice(file.lastIndexOf("/") + 1);
+var isDoc = (file) => !INSTRUCTIONS.test(file) && (DOC_EXT.test(file) || DOC_NAMES.test(basename(file)));
+function kindOf(file) {
+  if (file.binary)
+    return "behavior";
+  if (file.generated)
+    return "generated";
+  if (LOCKFILES.has(basename(file.path)))
+    return "lockfile";
+  if (isDoc(file.path))
+    return "doc";
+  if (file.cosmetic)
+    return "cosmetic";
+  return TEST_PATH.test(file.path) ? "test" : "behavior";
+}
+var globCache = new Map;
+function globMatch(pattern, file) {
+  let regex = globCache.get(pattern);
+  if (!regex) {
+    let source = "";
+    for (let index = 0;index < pattern.length; index += 1) {
+      const char = pattern[index];
+      if (char === "*" && pattern[index + 1] === "*") {
+        source += pattern[index + 2] === "/" ? "(?:[^/]*/)*" : ".*";
+        index += pattern[index + 2] === "/" ? 2 : 1;
+      } else if (char === "*")
+        source += "[^/]*";
+      else if (char === "?")
+        source += "[^/]";
+      else
+        source += char.replace(/[.+^${}()|[\]\\]/gu, "\\$&");
+    }
+    regex = new RegExp(`^${source}$`, "u");
+    globCache.set(pattern, regex);
+  }
+  return regex.test(file) || file.startsWith(`${pattern.replace(/\/$/u, "")}/`);
+}
+function isRiskPath(file, extra = []) {
+  if (extra.some((pattern) => globMatch(pattern, file)))
+    return true;
+  if (RISK_FILES.has(file) || RISK_NAMES.has(basename(file)))
+    return true;
+  if (TEST_PATH.test(file) || isDoc(file))
+    return false;
+  return file.split("/").map((segment, index, all) => index === all.length - 1 ? segment.replace(/\.[^.]+$/u, "") : segment).some((segment) => segment.toLowerCase().split(/[-_.]/u).some((token) => RISK_TOKENS.has(token)));
+}
+var parseRiskPaths = (text) => text.split(`
+`).map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).map((line) => line.replace(/^\//u, ""));
+function computeLane(input) {
+  const riskFiles = input.files.filter((file) => isRiskPath(file.path, input.riskPaths)).map((file) => file.path);
+  const risky = new Set(riskFiles);
+  const kinds = input.files.map((file) => ({
+    file,
+    kind: risky.has(file.path) ? "behavior" : kindOf(file)
+  }));
+  const behavior = kinds.filter((entry) => entry.kind === "behavior" || entry.kind === "test" || entry.kind === "lockfile");
+  const lines = behavior.filter((entry) => entry.kind !== "lockfile").reduce((sum, entry) => sum + entry.file.added + entry.file.deleted, 0);
+  const opaque = behavior.filter((entry) => entry.kind === "lockfile" || entry.file.binary);
+  const result = (lane, reasons) => ({
+    lane,
+    reasons,
+    lines,
+    files: behavior.length,
+    riskFiles
+  });
+  const { selfMaxLines, selfMaxFiles, fullMinLines } = LANE_THRESHOLDS;
+  if (input.riskTier === "high")
+    return result("full", ["the task judgment records high risk"]);
+  if (riskFiles.length)
+    return result("full", [
+      `touches a risk path: ${riskFiles.slice(0, 3).join(", ")}${riskFiles.length > 3 ? ", …" : ""}`
+    ]);
+  if (!behavior.length)
+    return result("none", [
+      input.files.length ? "only docs, comments, formatting or generated copies changed" : "no changes"
+    ]);
+  if (lines >= fullMinLines)
+    return result("full", [`large diff: ${lines} lines (≥ ${fullMinLines})`]);
+  if (lines > selfMaxLines)
+    return result("focused", [`${lines} lines changed (> ${selfMaxLines})`]);
+  if (behavior.length > selfMaxFiles)
+    return result("focused", [`${behavior.length} behavior files changed (> ${selfMaxFiles})`]);
+  if (opaque.length)
+    return result("focused", [
+      `a lockfile or binary changed: ${opaque.slice(0, 3).map((entry) => entry.file.path).join(", ")}${opaque.length > 3 ? ", …" : ""}`
+    ]);
+  return result("self", [
+    `small change: ${lines} line${lines === 1 ? "" : "s"} in ${behavior.length} file${behavior.length === 1 ? "" : "s"}, no risk path`
+  ]);
+}
+function untrackedStat(cwd, file) {
+  try {
+    const bytes = readFileSync4(path14.join(cwd, file));
+    if (bytes.includes(0))
+      return { path: file, added: 0, deleted: 0, binary: true };
+    const text = bytes.toString("utf8");
+    if (hasOpaqueLineBreak(text))
+      return { path: file, added: 0, deleted: 0, binary: true };
+    const lines = text.split(`
+`).length - (text.endsWith(`
+`) ? 1 : 0);
+    return { path: file, added: lines, deleted: 0 };
+  } catch {
+    return { path: file, added: 0, deleted: 0, binary: true };
+  }
+}
+var REGULAR = new Set(["100644", "100755"]);
+var ABSENT = /^0+$/u;
+function cosmeticFiles(cwd, fork, head) {
+  const raw = diffRaw(cwd, fork, head);
+  if (!raw)
+    return null;
+  const candidates = raw.filter((entry) => REGULAR.has(entry.oldMode) && entry.oldMode === entry.newMode && !ABSENT.test(entry.oldBlob) && (head === null || !ABSENT.test(entry.newBlob)));
+  const blobs = readBlobs(cwd, candidates.flatMap((entry) => [entry.oldBlob, entry.newBlob]));
+  if (!blobs)
+    return null;
+  const out = new Set;
+  const opaque = new Set;
+  for (const entry of candidates) {
+    const before = blobs.get(entry.oldBlob);
+    let after = blobs.get(entry.newBlob);
+    if (!after && head === null && ABSENT.test(entry.newBlob))
+      try {
+        after = readFileSync4(path14.join(cwd, entry.path));
+      } catch {
+        after = undefined;
+      }
+    if (before && after && cosmeticChange(entry.path, before, after))
+      out.add(entry.path);
+    else if ([before, after].some((bytes) => bytes && hasOpaqueLineBreak(bytes.toString("utf8"))))
+      opaque.add(entry.path);
+  }
+  return { cosmetic: out, opaque };
+}
+function generatedAt(cwd, fork, paths) {
+  const files = treeFilesNamed(cwd, fork, ".gitattributes");
+  const blobs = files?.size ? readBlobs(cwd, [...files.values()]) : null;
+  if (!files || !blobs)
+    return new Set;
+  const texts = new Map;
+  for (const [file, id] of files) {
+    const bytes = blobs.get(id);
+    if (bytes)
+      texts.set(file, bytes.toString("utf8"));
+  }
+  return generatedByAttributes(texts, paths);
+}
+var forkOf = (cwd, base, head) => mergeBase(cwd, base, head ?? "HEAD");
+function laneFiles(cwd, fork, head, attributesAt = fork) {
+  const stats = diffNumstat(cwd, fork, head);
+  const cosmetic = stats ? cosmeticFiles(cwd, fork, head) : null;
+  if (!stats || !cosmetic)
+    return null;
+  const files = [
+    ...stats.map((entry) => ({
+      ...entry,
+      ...cosmetic.opaque.has(entry.path) ? { binary: true } : {},
+      cosmetic: !entry.binary && cosmetic.cosmetic.has(entry.path)
+    })),
+    ...head === null ? untrackedFiles(cwd).map((file) => untrackedStat(cwd, file)) : []
+  ];
+  const generated = generatedAt(cwd, attributesAt, files.map((entry) => entry.path));
+  return files.map((entry) => ({
+    ...entry,
+    generated: generated.has(entry.path)
+  }));
+}
+function driftFiles(cwd, range) {
+  if (range.fromFork === range.toFork)
+    return laneFiles(cwd, range.from, range.to, range.toFork);
+  const drifted = ownChangeDrift(cwd, range);
+  const stats = drifted ? diffNumstat(cwd, range.from, range.to) : null;
+  if (!drifted || !stats)
+    return null;
+  const byPath = new Map(stats.map((entry) => [entry.path, entry]));
+  const generated = generatedAt(cwd, range.toFork, drifted);
+  return drifted.map((file) => ({
+    path: file,
+    added: byPath.get(file)?.added ?? 0,
+    deleted: byPath.get(file)?.deleted ?? 0,
+    ...byPath.get(file)?.binary ? { binary: true } : {},
+    cosmetic: false,
+    generated: generated.has(file)
+  }));
+}
+function branchLane(cwd, options) {
+  const candidates = options.base ? [`origin/${options.base}`, options.base] : [];
+  const base = candidates.find((ref) => resolveRef(cwd, ref) !== null) ?? defaultBase(cwd) ?? null;
+  const head = options.workingTree ? null : options.head;
+  const fork = base && (options.workingTree || options.head) ? forkOf(cwd, base, head) : null;
+  const files = fork ? laneFiles(cwd, fork, head) : null;
+  const riskTier = options.judgment?.riskTier ?? null;
+  if (!fork || !files) {
+    const high = riskTier === "high";
+    return {
+      lane: high ? "full" : "focused",
+      reasons: [
+        `the diff of ${options.head?.slice(0, 12) ?? "(no head)"} against ${base ?? "(no base)"} cannot be read`,
+        ...high ? ["the task judgment records high risk"] : []
+      ],
+      lines: 0,
+      files: 0,
+      riskFiles: [],
+      base,
+      head: options.head
+    };
+  }
+  const repoRisk = parseRiskPaths(fileAt(cwd, fork, RISK_PATHS_FILE) ?? "");
+  return {
+    ...computeLane({
+      files,
+      riskTier,
+      riskPaths: [...repoRisk, ...options.riskPaths ?? []]
+    }),
+    base,
+    head: options.head
+  };
+}
+var laneNeed = (lane) => lane === "none" ? "none" : lane === "self" ? "self" : "non-author";
+
+// packages/workit-core/src/core/policy/carry.ts
+var TEST_ONLY_KINDS = new Set(["doc", "cosmetic", "generated", "test"]);
+function verdictDrift(cwd, input) {
+  const since = input.from;
+  const stale = (reason, files = null, focused = false) => ({
+    carries: false,
+    since,
+    files,
+    focused,
+    reason
+  });
+  const fromFork = mergeBase(cwd, input.fromBase, input.from);
+  const toFork = mergeBase(cwd, input.toBase, input.to);
+  const files = fromFork && toFork ? driftFiles(cwd, { from: input.from, to: input.to, fromFork, toFork }) : null;
+  if (!fromFork || !toFork || !files)
+    return stale(`the change since ${since.slice(0, 12)} cannot be read`);
+  const riskPaths = [fromFork, toFork].flatMap((fork) => parseRiskPaths(fileAt(cwd, fork, RISK_PATHS_FILE) ?? ""));
+  const lane = computeLane({ files, riskPaths });
+  const paths = files.map((file) => file.path);
+  if (lane.lane === "none")
+    return { carries: true, rule: "lane-none", since, files: paths };
+  if (input.kind === "unit" && lane.lane === "self" && files.every((file) => TEST_ONLY_KINDS.has(kindOf(file))))
+    return { carries: true, rule: "tests-only", since, files: paths };
+  return stale(lane.reasons[0] ?? `lane ${lane.lane}`, paths, lane.lane === "self");
+}
+
+// packages/workit-core/src/ledger.ts
 var LEDGER_VERSION = 1;
 var MAX_LINE_BYTES = 4096;
 var PASSING = new Set(["verified", "tests-verified", "type-check-only"]);
@@ -19182,52 +20063,19 @@ var git4 = (cwd, args) => {
   const value = run.ok ? run.stdout.trim() : "";
   return value ? value : null;
 };
-var safeRef = (value) => value.length > 0 && !value.startsWith("-");
+var safeRef2 = (value) => value.length > 0 && !value.startsWith("-");
 function resolveCommit(cwd, ref) {
-  if (!safeRef(ref))
+  if (!safeRef2(ref))
     return null;
   return git4(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]);
 }
 function branchHead(cwd, branch) {
-  if (!safeRef(branch))
+  if (!safeRef2(branch))
     return null;
   return resolveCommit(cwd, `refs/heads/${branch}`) ?? resolveCommit(cwd, `refs/remotes/origin/${branch}`);
 }
-var trackTrunk = (cwd) => {
-  try {
-    const resolved = vcsConfig("resolve", cwd);
-    if (resolved.ok === false || !resolved.releaseTrack || resolved.releaseTrack.blocking)
-      return null;
-    const target = String(resolved.defaultTargetBranch ?? "").trim();
-    return target && safeRef(target) ? target : null;
-  } catch {
-    return null;
-  }
-};
-function defaultBase(cwd) {
-  const trunk = trackTrunk(cwd);
-  if (trunk) {
-    for (const candidate of [`origin/${trunk}`, trunk])
-      if (resolveCommit(cwd, candidate))
-        return candidate;
-  }
-  const originHead = git4(cwd, ["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"]);
-  if (originHead && resolveCommit(cwd, originHead))
-    return originHead;
-  for (const candidate of [
-    "origin/main",
-    "origin/master",
-    "main",
-    "master",
-    "origin/develop",
-    "develop"
-  ])
-    if (resolveCommit(cwd, candidate))
-      return candidate;
-  return null;
-}
 function diffHash(cwd, base, head) {
-  if (!safeRef(base) || !safeRef(head))
+  if (!safeRef2(base) || !safeRef2(head))
     return null;
   const diff = gitRun2(cwd, [
     "diff",
@@ -19259,14 +20107,14 @@ function diffHash(cwd, base, head) {
   return `sha256:${hash.digest("hex")}`;
 }
 function storeRoot(cwd) {
-  const location = resolveStore(path14.resolve(cwd));
+  const location = resolveStore(path15.resolve(cwd));
   if (location instanceof Error)
     return err("unavailable", location.message.replace(/; fix the repository.*$/u, ""), "fix the repository (git status should work here) or run from a non-git directory");
   return { ok: true, value: { root: location.dir, shared: location.shared } };
 }
 function ledgerPath(cwd) {
   const root = storeRoot(cwd);
-  return root.ok ? { ok: true, value: path14.join(root.value.root, "ledger", "ledger.jsonl") } : root;
+  return root.ok ? { ok: true, value: path15.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
 var newId2 = () => `${Date.now().toString(36)}-${randomBytes3(6).toString("hex")}`;
 var NETWORK_FS_TYPES = new Set([
@@ -19296,13 +20144,13 @@ var LOCK_STALE_MS = 30000;
 var LOCK_OWNER = "owner";
 var lockToken = (lock) => {
   try {
-    return fs12.readFileSync(path14.join(lock, LOCK_OWNER), "utf8");
+    return fs12.readFileSync(path15.join(lock, LOCK_OWNER), "utf8");
   } catch {
     return null;
   }
 };
 var lockAgeMs = (lock) => {
-  for (const target of [path14.join(lock, LOCK_OWNER), lock]) {
+  for (const target of [path15.join(lock, LOCK_OWNER), lock]) {
     try {
       return Date.now() - fs12.statSync(target).mtimeMs;
     } catch {}
@@ -19319,7 +20167,7 @@ var ledgerLock = {
       throw error;
     }
     const token = `${process.pid}-${randomBytes3(8).toString("hex")}`;
-    fs12.writeFileSync(path14.join(lock, LOCK_OWNER), token);
+    fs12.writeFileSync(path15.join(lock, LOCK_OWNER), token);
     return token;
   },
   release(lock, token) {
@@ -19452,8 +20300,8 @@ function appendLine(file, build, options) {
     }
   };
   try {
-    fs12.mkdirSync(path14.dirname(file), { recursive: true });
-    if (!options.forceLock && !onNetworkFs(path14.dirname(file)))
+    fs12.mkdirSync(path15.dirname(file), { recursive: true });
+    if (!options.forceLock && !onNetworkFs(path15.dirname(file)))
       return write();
     const locked = withLedgerLock(file, write);
     return locked ?? err("busy", `ledger lock ${file}.lock is held`, "retry; remove the .lock directory if no workit process is running");
@@ -19684,7 +20532,7 @@ function verdictBasis(verdict, current) {
 }
 var isLiveVerdict = (row, retired) => row.type === "verdict" && typeof row.result === "string" && !retired.has(row.id);
 function trailerSessions(cwd, base, head) {
-  if (!base || !head || !safeRef(base) || !safeRef(head))
+  if (!base || !head || !safeRef2(base) || !safeRef2(head))
     return [];
   const out = git4(cwd, [
     "log",
@@ -19697,7 +20545,7 @@ var RENAMED = /^branch: renamed refs\/heads\/(.+) to refs\/heads\/(.+)$/iu;
 function branchScope(cwd, branch) {
   const renamedAt = new Map;
   let since = Number.NEGATIVE_INFINITY;
-  if (safeRef(branch)) {
+  if (safeRef2(branch)) {
     const log = git4(cwd, [
       "log",
       "-g",
@@ -19842,12 +20690,29 @@ function effectiveOf(rows, reasonsOf, sameCode, isCurrent) {
   }
   return effective;
 }
-function restackCarries(rows, branch, from, to) {
+var restackExact = new WeakMap;
+function restackCarries(exactIn, rows, branch, from, to) {
   if (!from || !to)
     return false;
+  const exact = (row, fromHead, head) => {
+    if (exactIn === null)
+      return true;
+    const cwd = exactIn;
+    let known = restackExact.get(row);
+    if (known === undefined) {
+      known = typeof row.fromBase === "string" && typeof row.toBase === "string" && sameOwnChange(cwd, {
+        from: fromHead,
+        to: head,
+        fromBase: row.fromBase,
+        toBase: row.toBase
+      });
+      restackExact.set(row, known);
+    }
+    return known;
+  };
   const edges = new Map;
   for (const row of rows)
-    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.integrity === "verified" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
+    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.integrity === "verified" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head && exact(row, row.fromHead, row.head))
       edges.set(row.fromHead, [...edges.get(row.fromHead) ?? [], row.head]);
   const seen = new Set([from]);
   const queue = [from];
@@ -19881,9 +20746,57 @@ function checkVerdicts(cwd, branch, ledgerRows) {
     return key;
   };
   const keyFor = (base) => keysAt(base, head);
-  const basisOf = (row) => {
+  const driftCache = new Map;
+  const driftOf = (row) => {
+    if (driftCache.has(row))
+      return driftCache.get(row) ?? null;
+    let drift = null;
+    const toBase = row.base ?? fallbackBase;
+    const toBaseSha = toBase ? resolveCommit(cwd, toBase) : null;
+    const fromBase = row.baseSha ?? toBaseSha;
+    if (row.head && head && row.head !== head && toBaseSha && fromBase && !untrusted(reasonsOf(row)))
+      drift = verdictDrift(cwd, {
+        from: row.head,
+        to: head,
+        fromBase,
+        toBase: toBaseSha,
+        kind: typeof row.kind === "string" ? row.kind : "review"
+      });
+    driftCache.set(row, drift);
+    return drift;
+  };
+  const exactCache = new Map;
+  const exactCarry = (row) => {
+    if (FAILING.has(String(row.result)))
+      return true;
+    let exact = exactCache.get(row);
+    if (exact === undefined) {
+      const toBase = row.base ?? fallbackBase;
+      const toBaseSha = toBase ? resolveCommit(cwd, toBase) : null;
+      const fromBase = row.baseSha ?? toBaseSha;
+      exact = Boolean(row.head && head && toBaseSha && fromBase && sameOwnChange(cwd, { from: row.head, to: head, fromBase, toBase: toBaseSha }));
+      exactCache.set(row, exact);
+    }
+    return exact;
+  };
+  const keyBasis = (row) => {
     const basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
-    return basis === "stale" && restackCarries(rows, branch, row.head, head) ? "carried" : basis;
+    return basis === "carried" && !exactCarry(row) ? "stale" : basis;
+  };
+  const restacked = (row) => restackCarries(FAILING.has(String(row.result)) ? null : cwd, rows, branch, row.head, head);
+  const carryOf = (row) => {
+    if (keyBasis(row) !== "stale")
+      return null;
+    if (restacked(row))
+      return null;
+    const drift = driftOf(row);
+    return drift?.carries ? { rule: drift.rule, since: drift.since, files: drift.files } : null;
+  };
+  const basisOf = (row) => {
+    const basis = keyBasis(row);
+    if (basis !== "stale")
+      return basis;
+    return restacked(row) || carryOf(row) ? "carried" : basis;
   };
   const sameCode = (failed, row) => {
     if (failed.head && failed.head === row.head)
@@ -19891,7 +20804,7 @@ function checkVerdicts(cwd, branch, ledgerRows) {
     const base = failed.base ?? fallbackBase;
     const stored = (row.base ?? fallbackBase) === base && row.baseSha !== null && row.baseSha === failed.baseSha;
     const keys = stored ? { patchId: row.patchId, diffHash: row.diffHash } : keysAt(base, row.head);
-    return verdictBasis(failed, { head: row.head, ...keys }) !== "stale" || restackCarries(rows, branch, failed.head, row.head);
+    return verdictBasis(failed, { head: row.head, ...keys }) !== "stale" || restackCarries(null, rows, branch, failed.head, row.head);
   };
   const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head }, scope);
   const failureAuthorCache = new Map;
@@ -19947,6 +20860,7 @@ function checkVerdicts(cwd, branch, ledgerRows) {
       independent: independence.length === 0,
       accepted: reasons.length === 0,
       reasons,
+      carry: basis === "carried" ? carryOf(row) : null,
       verdict: row
     });
     if (reasons.length === 0) {
@@ -19975,7 +20889,12 @@ function checkVerdicts(cwd, branch, ledgerRows) {
     verdict: failing?.verdict ?? null,
     reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
   };
-  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && !untrusted(entry.reasons) && STRONG_RESULTS.has(String(entry.verdict.result)));
+  const latestSelf = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && !untrusted(entry.reasons) && (STRONG_RESULTS.has(String(entry.verdict.result)) || FAILING.has(String(entry.verdict.result))));
+  const selfEntry = latestSelf && STRONG_RESULTS.has(String(latestSelf.verdict.result)) ? latestSelf : undefined;
+  const carryEntry = verdicts.find((entry) => entry.verdict === accepted.verdict && entry.accepted) ?? newestCurrent;
+  const lastPass = accepted.accepted || failing || tampered.length ? undefined : verdicts.findLast((entry) => !entry.current && !untrusted(entry.reasons) && STRONG_RESULTS.has(String(entry.verdict.result)));
+  const drift = lastPass ? driftOf(lastPass.verdict) : null;
+  const reverify = drift && !drift.carries && drift.focused && drift.files ? { scope: "focused", since: drift.since, files: drift.files } : null;
   return {
     branch,
     head,
@@ -19984,6 +20903,8 @@ function checkVerdicts(cwd, branch, ledgerRows) {
     base: newestCurrent?.verdict.base ?? fallbackBase,
     patchId: keyFor(newestCurrent?.verdict.base ?? fallbackBase).patchId,
     current: { basis: newestCurrent?.basis ?? "none", verdict: newestCurrent?.verdict ?? null },
+    carry: carryEntry?.carry ?? null,
+    reverify,
     accepted,
     verdicts,
     authors: [...authors].toSorted(),
@@ -20003,6 +20924,7 @@ var RULES = {
   self: "verdict:self",
   nonAuthor: "verdict:non-author",
   verified: "verdict:verified",
+  lane: "verdict:lane",
   product: "decision:product",
   plan: "plan"
 };
@@ -20025,6 +20947,7 @@ var normalizedScope = (scope) => ({
 function deriveRequirements(judgment, scope, constraints, verification = "self") {
   const out = [];
   const base = { scope, dependentAction: null };
+  const proportional = verification === "proportional";
   if (judgment.behaviorChange)
     out.push(derived2({
       ...base,
@@ -20035,7 +20958,17 @@ function deriveRequirements(judgment, scope, constraints, verification = "self")
       before: "close",
       acceptanceAllowed: false
     }));
-  if (judgment.behaviorChange && judgment.riskTier === "normal")
+  if (proportional && judgment.riskTier === "normal")
+    out.push(derived2({
+      ...base,
+      ruleId: RULES.lane,
+      dimension: "review",
+      reason: "The review lane computed from the diff decides the verdict: none needs none, self the author's own (shown as self-reviewed), focused and full a non-author one.",
+      satisfaction: "Read the lane in `workit policy assess` or `workit pr status`; record what it asks: `workit ledger verdict tests-verified --self --how <what you ran>` for self, or hand focused and full to a verifier.",
+      before: "close",
+      acceptanceAllowed: false
+    }));
+  if (!proportional && judgment.behaviorChange && judgment.riskTier === "normal")
     out.push(verification === "independent" ? derived2({
       ...base,
       ruleId: RULES.nonAuthor,
@@ -20138,7 +21071,7 @@ var productDecision = (task, ledger) => {
   };
 };
 var planRecorded = (task, root) => {
-  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync4(path15.resolve(root, ref.path)));
+  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync5(path16.resolve(root, ref.path)));
   if (cited)
     return {
       met: true,
@@ -20152,14 +21085,30 @@ var planRecorded = (task, root) => {
     decisionIds: []
   };
 };
-var verdict = (requirement, root, ledger) => {
+var workingLane = (task, root) => branchLane(root, { head: null, workingTree: true, judgment: latestJudgment(task) });
+var laneVerdict = (task, root, ledger) => {
+  if (!ledger.branch() && latestJudgment(task)?.behaviorChange === false)
+    return {
+      met: true,
+      reason: "no branch to read a lane from, and the judgment records no behavior change",
+      decisionIds: []
+    };
+  const lane = workingLane(task, root);
+  const label = `lane ${lane.lane} (${lane.reasons.join("; ")})`;
+  const need = laneNeed(lane.lane);
+  if (need === "none")
+    return { met: true, reason: `${label}: no verdict needed`, decisionIds: [] };
+  const status = verdict(need === "self" ? RULES.self : RULES.nonAuthor, root, ledger);
+  return { ...status, reason: `${label}: ${status.reason}` };
+};
+var verdict = (ruleId, root, ledger) => {
   const branch = ledger.branch();
   if (!branch)
     return { met: false, reason: "no branch is checked out to hold a verdict", decisionIds: [] };
   const check = checkVerdicts(root, branch, ledger.rows());
   const failing = check.accepted.reasons.includes("failing_verdict");
   const strong = (entry) => STRONG_RESULTS.has(String(entry.verdict.result));
-  const met = !failing && (requirement.ruleId === RULES.verified ? check.verdicts.find((entry) => entry.accepted && entry.kind === "live" && String(entry.verdict.result) === "verified") : requirement.ruleId === RULES.nonAuthor ? check.verdicts.find((entry) => entry.accepted && strong(entry)) : check.verdicts.find((entry) => entry.current && strong(entry)));
+  const met = !failing && (ruleId === RULES.verified ? check.verdicts.find((entry) => entry.accepted && entry.kind === "live" && String(entry.verdict.result) === "verified") : ruleId === RULES.nonAuthor ? check.verdicts.find((entry) => entry.accepted && strong(entry)) : check.verdicts.find((entry) => entry.current && strong(entry)));
   if (met)
     return {
       met: true,
@@ -20167,7 +21116,7 @@ var verdict = (requirement, root, ledger) => {
       decisionIds: []
     };
   const why = failing ? "a current independent verdict fails" : check.verdicts.some((entry) => entry.current && entry.verdict.result === "type-check-only") ? "type-check-only does not prove a behavior change" : (check.accepted.reasons.join(", ") || "no_verdict").replace(/_/g, " ");
-  const unblock = requirement.ruleId === RULES.self ? "record your own verdict after an observed `workit check test`: `workit ledger verdict tests-verified --self --how <what you ran>` (shown as self-reviewed), or have a verifier record one" : `an independent session records \`workit ledger verdict verified${requirement.ruleId === RULES.verified ? " --kind live" : ""} --how <what it exercised>\``;
+  const unblock = ruleId === RULES.self ? "record your own verdict after an observed `workit check test`: `workit ledger verdict tests-verified --self --how <what you ran>` (shown as self-reviewed), or have a verifier record one" : `an independent session records \`workit ledger verdict verified${ruleId === RULES.verified ? " --kind live" : ""} --how <what it exercised>\``;
   return { met: false, reason: `${why}: ${unblock}`, decisionIds: [] };
 };
 function derivedRuleStatus(task, requirement, root, ledger) {
@@ -20179,7 +21128,9 @@ function derivedRuleStatus(task, requirement, root, ledger) {
     case RULES.self:
     case RULES.nonAuthor:
     case RULES.verified:
-      return verdict(requirement, root, ledger);
+      return verdict(requirement.ruleId, root, ledger);
+    case RULES.lane:
+      return laneVerdict(task, root, ledger);
     default:
       return null;
   }
@@ -20187,14 +21138,14 @@ function derivedRuleStatus(task, requirement, root, ledger) {
 
 // packages/workit-core/src/core/task-evaluation.ts
 var digestBytes = (value) => createHash10("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path16.sep}`);
-var relative = (root, candidate) => path16.relative(root, candidate).split(path16.sep).join("/") || ".";
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path17.sep}`);
+var relative = (root, candidate) => path17.relative(root, candidate).split(path17.sep).join("/") || ".";
 var canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path16.posix.normalize(value);
+  const normalized = path17.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -20242,14 +21193,14 @@ var gitPaths = (root) => {
       git: !/not a git repository/i.test(stderr)
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path16.sep).join("/")) : [];
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")) : [];
   const stagedDeleted = spawnSync10("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path16.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 };
@@ -20264,7 +21215,7 @@ var walk = (root, directory, output) => {
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path16.join(directory, name);
+    const target = path17.join(directory, name);
     let stat;
     try {
       stat = fs13.lstatSync(target);
@@ -20282,12 +21233,12 @@ var walk = (root, directory, output) => {
 var scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path16.resolve(root, item);
+    const target = path17.resolve(root, item);
     if (!inside(root, target))
       return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
     while (!fs13.existsSync(ancestor) && ancestor !== root)
-      ancestor = path16.dirname(ancestor);
+      ancestor = path17.dirname(ancestor);
     try {
       if (!inside(root, fs13.realpathSync(ancestor)))
         return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
@@ -20339,7 +21290,7 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path16.join(checkout, item);
+    const target = path17.join(checkout, item);
     try {
       const stat = fs13.lstatSync(target);
       if (stat.isSymbolicLink()) {
@@ -20523,23 +21474,23 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
       continue;
     if (!reference.digest)
       return failure2("invalid_input", "document references require a byte digest");
-    const target = path16.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path16.sep}`))
+    const target = path17.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path17.sep}`))
       return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const below = path16.relative(root, target);
+      const below = path17.relative(root, target);
       let current = root;
-      for (const segment of below.split(path16.sep)) {
+      for (const segment of below.split(path17.sep)) {
         if (!segment)
           continue;
-        current = path16.join(current, segment);
+        current = path17.join(current, segment);
         const stat = fs13.lstatSync(current);
         const real = fs13.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path16.sep}`))
+        if (real !== root && !real.startsWith(`${root}${path17.sep}`))
           return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -21398,7 +22349,7 @@ var judgeInputSummary = (raw) => {
 
 // packages/workit-core/src/autonomy.ts
 import os4 from "node:os";
-import path17 from "node:path";
+import path18 from "node:path";
 var accountHome = () => {
   try {
     return os4.userInfo().homedir;
@@ -21407,10 +22358,10 @@ var accountHome = () => {
   }
 };
 var grantsHome = { resolve: accountHome };
-var grantsDir = () => path17.join(grantsHome.resolve(), ".config", "workit");
+var grantsDir = () => path18.join(grantsHome.resolve(), ".config", "workit");
 var grantsOverride = () => {
-  const configured = path17.resolve(resolveConfigDir());
-  return configured === path17.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path17.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
+  const configured = path18.resolve(resolveConfigDir());
+  return configured === path18.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path18.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
 };
 var GRANT_KINDS = ["push", "pr", "merge", "release", "rerun"];
 var DEFAULT_GRANTS = Object.freeze({
@@ -21463,8 +22414,16 @@ function endpointView(entry, context) {
     ...issue ? { endpointIssue: issue } : {}
   };
 }
-var DEFAULT_VERIFICATION = "self";
-var verificationOf = (entry) => entry?.verification === "independent" ? "independent" : "self";
+var VERIFICATION_MODES = [
+  "proportional",
+  "self",
+  "independent"
+];
+var DEFAULT_VERIFICATION = "proportional";
+var verificationOf = (entry) => {
+  const value = entry?.verification;
+  return VERIFICATION_MODES.includes(value) ? value : DEFAULT_VERIFICATION;
+};
 var isGrantValue = (value) => value === true || value === false || value === "verified";
 var normalized = (kind, value) => value === "verified" && kind !== "merge" ? true : value;
 var fromAutoApprove = (value) => {
@@ -23212,8 +24171,8 @@ class WorkitCore {
 }
 // packages/workit-core/src/core/repo-context.ts
 import { spawnSync as spawnSync11 } from "node:child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync as readdirSync4 } from "node:fs";
-import path18 from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync as readdirSync4 } from "node:fs";
+import path19 from "node:path";
 var isSafeContextRange = (value) => value.length <= 4096 && (() => {
   try {
     gitRevisionParts(value);
@@ -23347,7 +24306,7 @@ var findPrTemplate = (cwd) => {
   ]) {
     const parts = rel.split("/");
     const base = parts[parts.length - 1];
-    const dir = parts.length > 1 ? path18.join(cwd, ...parts.slice(0, -1)) : cwd;
+    const dir = parts.length > 1 ? path19.join(cwd, ...parts.slice(0, -1)) : cwd;
     const actual = probeCaseInsensitive(dir, base);
     if (actual)
       return [...parts.slice(0, -1), actual].join("/");
@@ -23378,11 +24337,11 @@ var diffStatForRange = (cwd, range) => {
   return runGit(cwd, ["diff", "--stat", "--"]).stdout;
 };
 var packageScripts = (cwd, keys) => {
-  const pkgPath = path18.join(cwd, "package.json");
-  if (!existsSync6(pkgPath))
+  const pkgPath = path19.join(cwd, "package.json");
+  if (!existsSync7(pkgPath))
     return [];
   try {
-    const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
+    const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
     return keys.filter((k) => pkg.scripts && typeof pkg.scripts[k] === "string").map((k) => `${k}: ${pkg.scripts?.[k]}`);
   } catch {
     return [];
@@ -23404,9 +24363,9 @@ var documentationFiles = (cwd) => {
       if (entry.isDirectory()) {
         if (excluded.has(entry.name))
           continue;
-        walk(path18.join(dir, entry.name), depth + 1);
+        walk(path19.join(dir, entry.name), depth + 1);
       } else if (entry.isFile() && (entry.name === "README.md" || entry.name.endsWith(".md"))) {
-        matches.push("./" + path18.relative(cwd, path18.join(dir, entry.name)).replaceAll("\\", "/"));
+        matches.push("./" + path19.relative(cwd, path19.join(dir, entry.name)).replaceAll("\\", "/"));
       }
     }
   };
@@ -23414,15 +24373,15 @@ var documentationFiles = (cwd) => {
   return matches.toSorted().slice(0, 200);
 };
 var readTrimmed2 = (file, maxLines) => {
-  if (!existsSync6(file))
+  if (!existsSync7(file))
     return "";
-  const lines = readFileSync5(file, "utf8").split(`
+  const lines = readFileSync6(file, "utf8").split(`
 `);
   return lines.slice(0, maxLines).join(`
 `);
 };
 function prReadyContext(root, range) {
-  const cwd = path18.resolve(repoRoot(root));
+  const cwd = path19.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   let stdout = "";
@@ -23480,7 +24439,7 @@ ${status.stderr}` : "");
     stdout += `template_path: ${template}
 
 `;
-    stdout += readTrimmed2(path18.join(cwd, template), 220);
+    stdout += readTrimmed2(path19.join(cwd, template), 220);
   } else {
     stdout += `template_path: none
 
@@ -23490,7 +24449,7 @@ ${status.stderr}` : "");
   stdout += `
 `;
   stdout += printSection("Recent Validation Signals");
-  if (existsSync6(path18.join(cwd, "package.json"))) {
+  if (existsSync7(path19.join(cwd, "package.json"))) {
     stdout += `package.json detected. Common scripts:
 `;
     const found = packageScripts(cwd, ["lint", "format:check", "test", "build"]);
@@ -23499,7 +24458,7 @@ ${status.stderr}` : "");
 `) + `
 `;
   }
-  if (existsSync6(path18.join(cwd, "Cargo.toml")) || existsSync6(path18.join(cwd, "src-tauri/Cargo.toml"))) {
+  if (existsSync7(path19.join(cwd, "Cargo.toml")) || existsSync7(path19.join(cwd, "src-tauri/Cargo.toml"))) {
     stdout += `Rust project detected.
 `;
   }
@@ -23532,7 +24491,7 @@ var CHANGELOG_RULES = `- Use an [Unreleased] section.
 - Apply with the host-native editor, preserving the repository changelog conventions.
 - If Unreleased already has duplicate category headings, normalize_only first.`;
 function changelogContext(root, range) {
-  const cwd = path18.resolve(repoRoot(root));
+  const cwd = path19.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -23550,8 +24509,8 @@ function changelogContext(root, range) {
   stdout += CHANGELOG_RULES + `
 `;
   stdout += printSection("Existing CHANGELOG.md");
-  const changelogPath = path18.join(cwd, "CHANGELOG.md");
-  if (existsSync6(changelogPath)) {
+  const changelogPath = path19.join(cwd, "CHANGELOG.md");
+  if (existsSync7(changelogPath)) {
     stdout += readTrimmed2(changelogPath, 260) + `
 `;
   } else {
@@ -23570,7 +24529,7 @@ function changelogContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function docsRefreshContext(root, range) {
-  const cwd = path18.resolve(repoRoot(root));
+  const cwd = path19.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -23592,8 +24551,8 @@ function docsRefreshContext(root, range) {
 `) + `
 `;
   stdout += printSection("README Preview");
-  const readme = path18.join(cwd, "README.md");
-  if (existsSync6(readme)) {
+  const readme = path19.join(cwd, "README.md");
+  if (existsSync7(readme)) {
     stdout += readTrimmed2(readme, 220) + `
 `;
   } else {
@@ -23601,10 +24560,10 @@ function docsRefreshContext(root, range) {
 `;
   }
   stdout += printSection("Package Scripts");
-  const pkgPath = path18.join(cwd, "package.json");
-  if (existsSync6(pkgPath)) {
+  const pkgPath = path19.join(cwd, "package.json");
+  if (existsSync7(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
+      const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
       stdout += JSON.stringify({ name: pkg.name, version: pkg.version, scripts: pkg.scripts }, null, 2) + `
 `;
     } catch {}
@@ -23615,7 +24574,7 @@ function docsRefreshContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function releaseNotesContext(root, rangeOrTag) {
-  const cwd = path18.resolve(repoRoot(root));
+  const cwd = path19.resolve(repoRoot(root));
   if (!rangeOrTag) {
     return { stdout: "", stderr: `ERROR: release tag or range required
 `, exitCode: 1, cwd };
@@ -23653,7 +24612,7 @@ function releaseNotesContext(root, rangeOrTag) {
 `;
   stdout += printSection("Existing Release Files");
   for (const rel of ["CHANGELOG.md", "RELEASE_NOTES.md", ".github/releases.md"]) {
-    if (existsSync6(path18.join(cwd, rel)))
+    if (existsSync7(path19.join(cwd, rel)))
       stdout += rel + `
 `;
   }
@@ -23685,7 +24644,7 @@ import { spawnSync as spawnSync13 } from "node:child_process";
 
 // packages/workit-core/src/core/pr-create.ts
 import fs14 from "node:fs";
-import path19 from "node:path";
+import path20 from "node:path";
 import { spawnSync as spawnSync12 } from "node:child_process";
 // packages/workit-core/src/forge/pr-body.ts
 function parseGhIssue(value) {
@@ -23696,11 +24655,11 @@ function parseGhIssue(value) {
 // packages/workit-core/src/core/pr-create.ts
 function whichOnPath(tool) {
   const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
-  for (const dir of (process.env.PATH ?? "").split(path19.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(path20.delimiter)) {
     if (!dir)
       continue;
     for (const name of names) {
-      const candidate = path19.join(dir, name);
+      const candidate = path20.join(dir, name);
       try {
         fs14.accessSync(candidate, fs14.constants.X_OK);
         return candidate;
@@ -23821,7 +24780,7 @@ var fetchGitLabIssueBody = async (ref, root, deps = {}) => {
 
 // packages/workit-core/src/core/youtrack.ts
 import fs15 from "node:fs";
-import path20 from "node:path";
+import path21 from "node:path";
 
 // packages/workit-core/src/core/templates.ts
 var repoRoot2 = assetRoot();
@@ -23834,8 +24793,8 @@ var resolveWorkspaceRoot = (explicit) => explicit || process.cwd();
 // packages/workit-core/src/core/youtrack.ts
 var ISSUE_RE = /^[A-Z]+-\d+$/;
 var TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";
-var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path20.join(configDir(), "youtrack.json");
-var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path20.join(resolveConfigDir(), "youtrack.json");
+var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path21.join(configDir(), "youtrack.json");
+var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path21.join(resolveConfigDir(), "youtrack.json");
 var youTrackTokenModeOk = (p) => {
   if (process.platform === "win32")
     return true;
@@ -23903,7 +24862,7 @@ var youTrackToken = () => {
   if ("error" in loaded)
     return loaded;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path20.isAbsolute(tokenFile) ? path20.resolve(tokenFile) : path20.resolve(process.cwd(), tokenFile) : "";
+  const tokenPath = tokenFile ? path21.isAbsolute(tokenFile) ? path21.resolve(tokenFile) : path21.resolve(process.cwd(), tokenFile) : "";
   if (!tokenPath || !fs15.existsSync(tokenPath))
     return { error: "missing youtrack.token" };
   if (!youTrackTokenModeOk(tokenPath))
@@ -24245,15 +25204,15 @@ function resolveGitRevision(root, value) {
 }
 function resolveInside(root, candidate) {
   const base = realpathSync5(root);
-  const target = path21.resolve(base, candidate);
-  if (target !== base && !target.startsWith(base + path21.sep)) {
+  const target = path22.resolve(base, candidate);
+  if (target !== base && !target.startsWith(base + path22.sep)) {
     throw new Error("path must stay inside repository root");
   }
   let ancestor = target;
-  while (!existsSync7(ancestor))
-    ancestor = path21.dirname(ancestor);
+  while (!existsSync8(ancestor))
+    ancestor = path22.dirname(ancestor);
   const canonicalAncestor = realpathSync5(ancestor);
-  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path21.sep)) {
+  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path22.sep)) {
     throw new Error("path must stay inside repository root");
   }
   return target;
@@ -24284,8 +25243,8 @@ var SUPPORT_MATRIX = {
 };
 
 // packages/workit-mcp/src/server.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6, realpathSync as realpathSync6 } from "node:fs";
-import path22 from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync7, realpathSync as realpathSync6 } from "node:fs";
+import path23 from "node:path";
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema = s;
@@ -26689,7 +27648,7 @@ var safeCapability = (value, allowed) => allowed.includes(value) ? value : "cont
 var TOOL_CAPABILITIES = [...CONTEXT_KINDS, "workspace", "native_caller_identity"];
 var VERSION = (() => {
   try {
-    const packageJson = JSON.parse(readFileSync6(new URL("../package.json", import.meta.url), "utf8"));
+    const packageJson = JSON.parse(readFileSync7(new URL("../package.json", import.meta.url), "utf8"));
     return typeof packageJson.version === "string" ? packageJson.version : "0.0.0";
   } catch {
     return "0.0.0";
@@ -26699,13 +27658,13 @@ var rootVariants = (workspaceRoot) => {
   if (!workspaceRoot)
     return [];
   const roots = new Set;
-  for (const candidate of [workspaceRoot, path22.resolve(workspaceRoot)]) {
-    if (path22.isAbsolute(candidate) && candidate !== path22.parse(candidate).root)
+  for (const candidate of [workspaceRoot, path23.resolve(workspaceRoot)]) {
+    if (path23.isAbsolute(candidate) && candidate !== path23.parse(candidate).root)
       roots.add(candidate);
   }
   try {
     const canonical = realpathSync6(workspaceRoot);
-    if (canonical !== path22.parse(canonical).root)
+    if (canonical !== path23.parse(canonical).root)
       roots.add(canonical);
   } catch {}
   return [...roots].toSorted((left, right) => right.length - left.length);
@@ -26787,12 +27746,12 @@ var thrownResult = (tool, error, workspaceRoot) => {
 };
 function createMcpServer(host, contextProvider) {
   assertMcpHost(host);
-  const here = path22.dirname(fileURLToPath2(import.meta.url));
+  const here = path23.dirname(fileURLToPath2(import.meta.url));
   const sourceMarker = markSourcesLoaded([
-    path22.join(here, "server.ts"),
-    path22.join(here, "..", "..", "workit-core", "src", "core", "task-contract.ts"),
-    path22.join(here, "..", "..", "workit-core", "src", "core", "task-engine.ts")
-  ].filter((file) => existsSync8(file)));
+    path23.join(here, "server.ts"),
+    path23.join(here, "..", "..", "workit-core", "src", "core", "task-contract.ts"),
+    path23.join(here, "..", "..", "workit-core", "src", "core", "task-engine.ts")
+  ].filter((file) => existsSync9(file)));
   let staleWarned = false;
   const server = new Server({ name: "workit", version: VERSION }, { capabilities: { tools: {}, resources: {} } });
   server.setRequestHandler(ListToolsRequestSchema, async () => {
@@ -26985,6 +27944,25 @@ var capabilitiesFor = (descriptor, observed = {}) => descriptor.capabilities.map
 var signals = new Map;
 var cache = new Map;
 var TURN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+// packages/workit-core/src/hooks/delivery-verbs.ts
+var WORKIT_ALLOWED_VERBS = [
+  "git",
+  "pr",
+  "ci",
+  "stack",
+  "release",
+  "task",
+  "ledger",
+  "evidence",
+  "finding",
+  "decision",
+  "worker",
+  "verify-delivery",
+  "policy",
+  "doctor",
+  "help"
+];
+var ALLOWED = new Set(WORKIT_ALLOWED_VERBS);
 // packages/workit-core/src/core/heavy.ts
 var INFO_FLAGS = new Set(["--version", "-v", "-V", "--help", "-h", "help", "version"]);
 var sub = (...names) => new Set(names);
@@ -27109,7 +28087,7 @@ var EXEC = new Set(["exec", "x", "dlx"]);
 // packages/workit-core/src/core/heavy-words.ts
 var HEAVY_WORDS = new Set(("npm npx pnpm pnpx yarn bun bunx deno corepack make gmake docker podman nerdctl " + "python python3 py uv poetry pdm pipenv hatch rye bundle rake nx " + "jest vitest mocha ava tap karma jasmine nyc c8 tsc vue-tsc svelte-check eslint stylelint " + "tslint webpack webpack-cli rollup parcel tsup vite next nuxt nuxi astro ng react-scripts " + "playwright cypress wdio testcafe turbo lerna sonar-scanner sonarless sonarless-mcp go " + "golangci-lint gotestsum staticcheck cargo mvn mvnw gradle gradlew ant sbt bazel bazelisk " + "buck2 dotnet msbuild pytest py.test tox nox mypy pyright pylint coverage maturin pip pip3 " + "rspec rails phpunit pest phpstan psalm composer mix swift xcodebuild flutter dart pod cmake " + "ninja meson ctest scons docker-compose buildah earthly").split(" "));
 // packages/workit-core/src/hooks/write-gate.ts
-import path23 from "node:path";
+import path24 from "node:path";
 
 // packages/workit-core/src/core/live-session.ts
 import { spawnSync as spawnSync15 } from "node:child_process";
@@ -27150,7 +28128,7 @@ var MUTATING_WORKIT_GIT = new Set(["commit", "branch"]);
 var CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
 var PUSHD2 = new Set(["pushd", "push-location"]);
 var POPD2 = new Set(["popd", "pop-location"]);
-var UNKNOWN_DIR = path23.resolve(path23.parse(process.cwd()).root, ".workit-unknown-dir");
+var UNKNOWN_DIR = path24.resolve(path24.parse(process.cwd()).root, ".workit-unknown-dir");
 // packages/workit-core/src/core/skill-manifests.ts
 if (false) {}
 
@@ -27193,6 +28171,10 @@ var WRITE_TOOLS = new Set([
 // packages/workit-core/src/hooks/standing.ts
 var sinceStart = new Map;
 // packages/workit-core/src/hooks/cwd-normalize.ts
+var DIR = String.raw`[A-Za-z0-9_./@%+:,=-]+|'[^'$${"`"}\\\n]*'|"[^"$${"`"}\\!\n]*"`;
+var COMPOUND = new RegExp(String.raw`^\s*cd\s+(${DIR})\s*&&\s*(workit(?:\s[\s\S]*)?)$`, "u");
+var GLOBALS_FIRST = new RegExp(String.raw`^(\s*workit)((?:\s+(?:--json|--cwd(?:=|\s+)(?:${DIR})))+)\s+([a-z][a-z-]*)(?=\s|$)`, "u");
+var VERBS = new Set(WORKIT_ALLOWED_VERBS);
 var FILTERS = new Set(["tail", "head", "grep"]);
 
 // packages/workit-core/src/hooks/worktree-confine.ts
@@ -27363,24 +28345,24 @@ if (false)
 
 // packages/workit-codex/scripts/agents.ts
 import {
-  existsSync as existsSync9,
+  existsSync as existsSync10,
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   renameSync as renameSync2,
   rmSync as rmSync2,
   writeFileSync as writeFileSync3
 } from "node:fs";
 import os5 from "node:os";
-import path24 from "node:path";
+import path25 from "node:path";
 var CODEX_AGENT_MARKER = "# Generated by Workit";
 var codexHomeOfInstall = (pluginRoot) => {
-  const parts = path24.resolve(pluginRoot).split(path24.sep);
+  const parts = path25.resolve(pluginRoot).split(path25.sep);
   const cache = parts.length - 4;
-  return cache >= 2 && parts[cache] === "cache" && parts[cache - 1] === "plugins" ? parts.slice(0, cache - 1).join(path24.sep) || path24.sep : null;
+  return cache >= 2 && parts[cache] === "cache" && parts[cache - 1] === "plugins" ? parts.slice(0, cache - 1).join(path25.sep) || path25.sep : null;
 };
-var codexHomeFor = (pluginRoot, env) => codexHomeOfInstall(pluginRoot) ?? (env.CODEX_HOME || path24.join(env.HOME || os5.homedir(), ".codex"));
+var codexHomeFor = (pluginRoot, env) => codexHomeOfInstall(pluginRoot) ?? (env.CODEX_HOME || path25.join(env.HOME || os5.homedir(), ".codex"));
 var MARKER_VERSION = /^# Generated by Workit (\d+\.\d+\.\d+)\b/;
 var agentMarkerVersion = (text) => MARKER_VERSION.exec(text)?.[1] ?? null;
 var stampCodexAgent = (content, version) => version && content.startsWith(CODEX_AGENT_MARKER) && !agentMarkerVersion(content) ? `${CODEX_AGENT_MARKER} ${version}${content.slice(CODEX_AGENT_MARKER.length)}` : content;
@@ -27394,7 +28376,7 @@ var versionAtLeast = (version, min) => {
 };
 var pluginVersion = (pluginRoot) => {
   try {
-    const version = JSON.parse(readFileSync7(path24.join(pluginRoot, "package.json"), "utf8")).version;
+    const version = JSON.parse(readFileSync8(path25.join(pluginRoot, "package.json"), "utf8")).version;
     return typeof version === "string" && /^\d+\.\d+\.\d+/.test(version) ? version.match(/^\d+\.\d+\.\d+/)[0] : null;
   } catch {
     return null;
@@ -27408,15 +28390,15 @@ var lstatOrNull = (file) => {
   }
 };
 var installCodexAgents = (pluginRoot, codexHome) => {
-  const source = path24.join(pluginRoot, "agents");
-  if (!existsSync9(source))
+  const source = path25.join(pluginRoot, "agents");
+  if (!existsSync10(source))
     return [];
   const version = pluginVersion(pluginRoot);
-  const target = path24.join(codexHome, "agents");
+  const target = path25.join(codexHome, "agents");
   const results = [];
   for (const file of readdirSync5(source).filter((name) => name.endsWith(".toml")).toSorted()) {
-    const content = stampCodexAgent(readFileSync7(path24.join(source, file), "utf8"), version);
-    const dest = path24.join(target, file);
+    const content = stampCodexAgent(readFileSync8(path25.join(source, file), "utf8"), version);
+    const dest = path25.join(target, file);
     const stat = lstatOrNull(dest);
     if (stat?.isSymbolicLink()) {
       results.push({ file: dest, action: "skipped-symlink" });
@@ -27438,7 +28420,7 @@ var installCodexAgents = (pluginRoot, codexHome) => {
       results.push({ file: dest, action: "kept-user-file" });
       continue;
     }
-    const current = readFileSync7(dest, "utf8");
+    const current = readFileSync8(dest, "utf8");
     if (current === content) {
       results.push({ file: dest, action: "current" });
       continue;
@@ -27452,7 +28434,7 @@ var installCodexAgents = (pluginRoot, codexHome) => {
       results.push({ file: dest, action: "kept-newer-version" });
       continue;
     }
-    const temp = path24.join(target, `.${file}.${process.pid}.${Date.now()}.tmp`);
+    const temp = path25.join(target, `.${file}.${process.pid}.${Date.now()}.tmp`);
     writeFileSync3(temp, content, { flag: "wx" });
     try {
       renameSync2(temp, dest);
@@ -27474,8 +28456,8 @@ var codexQualification = (host) => host === "codex_cli" ? { surface: host, cli:
 var resolveCodexWorkspaceRoot = (pluginRoot, env) => {
   const explicit = env.WORKFLOW_WORKSPACE_ROOT;
   const inherited = env.PWD;
-  const candidate = explicit ?? (inherited && path25.resolve(inherited) !== path25.resolve(pluginRoot) ? inherited : undefined);
-  if (!candidate || !path25.isAbsolute(candidate) || !existsSync10(candidate))
+  const candidate = explicit ?? (inherited && path26.resolve(inherited) !== path26.resolve(pluginRoot) ? inherited : undefined);
+  if (!candidate || !path26.isAbsolute(candidate) || !existsSync11(candidate))
     return null;
   try {
     if (!statSync3(candidate).isDirectory())
@@ -27514,7 +28496,7 @@ var codexContextProvider = (host = detectCodexSurface(process.env), root) => ({
     };
   }
 });
-var pluginRoot = () => path25.resolve(path25.dirname(fileURLToPath3(import.meta.url)), "..");
+var pluginRoot = () => path26.resolve(path26.dirname(fileURLToPath3(import.meta.url)), "..");
 var syncCodexAgents = (root) => {
   const codexHome = codexHomeOfInstall(root);
   if (!codexHome)