@brainervirus/workit-codex 8.24.0 → 8.26.0

package/dist/launch-mcp.js

@@ -14864,6 +14864,7 @@ var workspaceConfigSchema = object({
   trailers: boolean2().optional(),
   liveSessionGuard: boolean2().optional(),
   fanout: object({ tierModels: unknown().optional() }).passthrough().optional(),
+  models: object({ roles: unknown().optional() }).passthrough().optional(),
   autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
     kind,
     union([boolean2(), literal("verified")]).optional()
@@ -14890,7 +14891,10 @@ var workspaceConfigSchema = object({
     });
   }
 });
-var workspacesFileSchema = object({ workspaces: array(workspaceConfigSchema).optional() }).passthrough().superRefine((file, context) => {
+var workspacesFileSchema = object({
+  workspaces: array(workspaceConfigSchema).optional(),
+  models: object({ roles: unknown().optional() }).passthrough().optional()
+}).passthrough().superRefine((file, context) => {
   const names = new Set;
   for (const [index, workspace] of (file.workspaces ?? []).entries()) {
     if (names.has(workspace.name)) {
@@ -15180,6 +15184,34 @@ var resolveRuntimeReleaseTracks = (cwd) => {
   const matched = matchRuntimeWorkspace(cwd);
   return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
 };
+var modelSources = (cwd, dir) => {
+  const out = [];
+  try {
+    const matched = matchRuntimeWorkspace(cwd, dir);
+    if (matched) {
+      const enclosing = matched.matches.filter((entry) => entry !== matched.selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
+      for (const entry of [matched.selected, ...enclosing])
+        out.push({
+          name: entry.name,
+          global: false,
+          models: entry.models,
+          tierModels: entry.fanout?.tierModels
+        });
+    }
+  } catch {}
+  try {
+    const document = JSON.parse(readFileSync2(path4.join(dir ?? configDir(), "workspaces.json"), "utf8"));
+    if (document && typeof document === "object" && !Array.isArray(document))
+      out.push({
+        name: "global",
+        global: true,
+        models: document.models,
+        tierModels: undefined
+      });
+  } catch {}
+  return out;
+};
+var hostFamily = (host) => host.replace(/_(?:cli|desktop)$/u, "");
 var TIER_KEYS = new Set(["mundane", "standard", "hard"]);
 var TIER_HOSTS = new Set([
   "claude_code",
@@ -15400,6 +15432,26 @@ function resolveRef(cwd, ref) {
     return null;
   return line(git(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]));
 }
+function originHeadRef(cwd) {
+  return line(git(cwd, ["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"]));
+}
+function ownChangeDrift(cwd, range) {
+  const before = diffRaw(cwd, range.fromFork, range.from);
+  const after = diffRaw(cwd, range.toFork, range.to);
+  if (!before || !after)
+    return null;
+  const judged = new Map(before.map((entry) => [entry.path, entry]));
+  const current = new Map(after.map((entry) => [entry.path, entry]));
+  const same = (a, b) => a !== undefined && b !== undefined && a.oldMode === b.oldMode && a.oldBlob === b.oldBlob && a.newMode === b.newMode && a.newBlob === b.newBlob;
+  return [...new Set([...judged.keys(), ...current.keys()])].filter((file) => !same(judged.get(file), current.get(file))).toSorted();
+}
+function sameOwnChange(cwd, range) {
+  const fromFork = mergeBase(cwd, range.fromBase, range.from);
+  const toFork = mergeBase(cwd, range.toBase, range.to);
+  if (!fromFork || !toFork)
+    return false;
+  return ownChangeDrift(cwd, { from: range.from, to: range.to, fromFork, toFork })?.length === 0;
+}
 var LANE_DIFF = [
   "-c",
   "core.quotePath=false",
@@ -19026,9 +19078,9 @@ var workerBlocksTransition = (transition, state) => transition === "pause" ? fal
 
 // packages/workit-core/src/core/task-evaluation.ts
 import { createHash as createHash10 } from "node:crypto";
-import * as fs14 from "node:fs";
-import { spawnSync as spawnSync11 } from "node:child_process";
-import path18 from "node:path";
+import * as fs13 from "node:fs";
+import { spawnSync as spawnSync10 } from "node:child_process";
+import path17 from "node:path";
 
 // packages/workit-core/src/check-config.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
@@ -19249,68 +19301,20 @@ function checkCommand(args, version, onPath = workitAvailable()) {
 
 // packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync5 } from "node:fs";
-import path17 from "node:path";
+import path16 from "node:path";
 
 // packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
 import { createHash as createHash9, randomBytes as randomBytes3 } from "node:crypto";
 import fs12 from "node:fs";
+import path15 from "node:path";
+
+// packages/workit-core/src/core/policy/lane.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
 import path14 from "node:path";
-var LEDGER_VERSION = 1;
-var MAX_LINE_BYTES = 4096;
-var PASSING = new Set(["verified", "tests-verified", "type-check-only"]);
-var FAILING = new Set(["failed", "blocked"]);
-var STRONG_RESULTS = new Set(["verified", "tests-verified"]);
-var PR_ROW_TYPES = new Set([
-  "pr.created",
-  "pr.status",
-  "pr.merged",
-  "pr.linked"
-]);
-var err = (code, error, unblock) => ({
-  ok: false,
-  code,
-  error,
-  ...unblock ? { unblock } : {}
-});
-var gitRun2 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync9("git", args, {
-    cwd,
-    encoding: "utf8",
-    timeout: timeoutMs,
-    killSignal: "SIGKILL",
-    windowsHide: true,
-    maxBuffer: 256 * 1024 * 1024,
-    env: {
-      ...process.env,
-      GIT_TERMINAL_PROMPT: "0",
-      GIT_OPTIONAL_LOCKS: "0",
-      LC_ALL: "C",
-      LANGUAGE: "C"
-    }
-  });
-  return {
-    ok: run.status === 0,
-    stdout: run.stdout ?? "",
-    stderr: run.error ? String(run.error.message) : run.stderr ?? ""
-  };
-};
-var git4 = (cwd, args) => {
-  const run = gitRun2(cwd, args);
-  const value = run.ok ? run.stdout.trim() : "";
-  return value ? value : null;
-};
+
+// packages/workit-core/src/git/default-base.ts
 var safeRef = (value) => value.length > 0 && !value.startsWith("-");
-function resolveCommit(cwd, ref) {
-  if (!safeRef(ref))
-    return null;
-  return git4(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]);
-}
-function branchHead(cwd, branch) {
-  if (!safeRef(branch))
-    return null;
-  return resolveCommit(cwd, `refs/heads/${branch}`) ?? resolveCommit(cwd, `refs/remotes/origin/${branch}`);
-}
 var trackTrunk = (cwd) => {
   try {
     const resolved = vcsConfig("resolve", cwd);
@@ -19326,11 +19330,11 @@ function defaultBase(cwd) {
   const trunk = trackTrunk(cwd);
   if (trunk) {
     for (const candidate of [`origin/${trunk}`, trunk])
-      if (resolveCommit(cwd, candidate))
+      if (resolveRef(cwd, candidate))
         return candidate;
   }
-  const originHead = git4(cwd, ["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"]);
-  if (originHead && resolveCommit(cwd, originHead))
+  const originHead = originHeadRef(cwd);
+  if (originHead && resolveRef(cwd, originHead))
     return originHead;
   for (const candidate of [
     "origin/main",
@@ -19340,1489 +19344,1611 @@ function defaultBase(cwd) {
     "origin/develop",
     "develop"
   ])
-    if (resolveCommit(cwd, candidate))
+    if (resolveRef(cwd, candidate))
       return candidate;
   return null;
 }
-function diffHash(cwd, base, head) {
-  if (!safeRef(base) || !safeRef(head))
+
+// packages/workit-core/src/core/policy/attributes.ts
+function patternRegex(dir, pattern) {
+  if (!pattern || pattern.endsWith("/") || pattern.startsWith('"') || pattern.startsWith("!"))
     return null;
-  const diff = gitRun2(cwd, [
-    "diff",
-    "-U3",
-    "--diff-algorithm=myers",
-    "--indent-heuristic",
-    "--no-color",
-    "--no-ext-diff",
-    "--no-textconv",
-    "--no-renames",
-    "--full-index",
-    "--binary",
-    "--src-prefix=a/",
-    "--dst-prefix=b/",
-    `${base}...${head}`,
-    "--"
-  ], GIT_TIMEOUTS.worktree);
-  if (!diff.ok || !diff.stdout)
+  const anchored = pattern.includes("/");
+  const body = pattern.replace(/^\//u, "");
+  let source = "";
+  for (let index = 0;index < body.length; index += 1) {
+    const char = body[index];
+    if (char === "*" && body[index + 1] === "*") {
+      const slash = body[index + 2] === "/";
+      source += slash ? "(?:.*/)?" : ".*";
+      index += slash ? 2 : 1;
+    } else if (char === "*")
+      source += "[^/]*";
+    else if (char === "?")
+      source += "[^/]";
+    else if (char === "[") {
+      const end = body.indexOf("]", index + 2);
+      if (end < 0)
+        return null;
+      const set = body.slice(index + 1, end).replace(/^!/u, "^").replace(/\\/gu, "\\\\");
+      source += `[${set}]`;
+      index = end;
+    } else if (char === "\\" && index + 1 < body.length) {
+      source += body[index + 1].replace(/[.*+?^${}()|[\]\\/]/gu, "\\$&");
+      index += 1;
+    } else
+      source += char.replace(/[.*+?^${}()|[\]\\/]/gu, "\\$&");
+  }
+  const prefix = dir ? `${dir.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}/` : "";
+  try {
+    return new RegExp(anchored ? `^${prefix}${source}$` : `^${prefix}(?:.*/)?${source}$`, "u");
+  } catch {
     return null;
-  const hash = createHash9("sha256");
-  for (const line of diff.stdout.split(`
+  }
+}
+function rulesOf(dir, text) {
+  const out = [];
+  for (const raw of text.split(`
 `)) {
-    if (line.startsWith("index "))
+    const line = raw.trim();
+    if (!line || line.startsWith("#") || line.startsWith("[attr]"))
       continue;
-    hash.update(line.startsWith("@@ ") ? "@@" : line);
-    hash.update(`
-`);
+    const [pattern, ...attributes] = line.split(/\s+/u);
+    let generated = null;
+    for (const attribute of attributes) {
+      if (attribute === "linguist-generated" || attribute === "linguist-generated=true")
+        generated = true;
+      else if (attribute === "-linguist-generated" || attribute === "!linguist-generated" || attribute.startsWith("linguist-generated="))
+        generated = false;
+    }
+    if (generated === null)
+      continue;
+    const regex = patternRegex(dir, pattern);
+    if (regex)
+      out.push({ regex, generated });
   }
-  return `sha256:${hash.digest("hex")}`;
-}
-function storeRoot(cwd) {
-  const location = resolveStore(path14.resolve(cwd));
-  if (location instanceof Error)
-    return err("unavailable", location.message.replace(/; fix the repository.*$/u, ""), "fix the repository (git status should work here) or run from a non-git directory");
-  return { ok: true, value: { root: location.dir, shared: location.shared } };
+  return out;
 }
-function ledgerPath(cwd) {
-  const root = storeRoot(cwd);
-  return root.ok ? { ok: true, value: path14.join(root.value.root, "ledger", "ledger.jsonl") } : root;
+function generatedByAttributes(files, paths) {
+  const rules = [...files].map(([file, text]) => {
+    const dir = file.includes("/") ? file.slice(0, file.lastIndexOf("/")) : "";
+    return {
+      depth: dir ? dir.split("/").length : 0,
+      rules: rulesOf(dir, text)
+    };
+  }).toSorted((left, right) => left.depth - right.depth).flatMap((entry) => entry.rules);
+  const out = new Set;
+  for (const file of paths) {
+    const last = rules.findLast((rule) => rule.regex.test(file));
+    if (last?.generated)
+      out.add(file);
+  }
+  return out;
 }
-var newId2 = () => `${Date.now().toString(36)}-${randomBytes3(6).toString("hex")}`;
-var NETWORK_FS_TYPES = new Set([
-  26985,
-  20859,
-  4266872130,
-  4283649346,
-  1702057286,
-  1397113167,
-  12805120,
-  16914839,
-  1196443219,
-  198183888
+
+// packages/workit-core/src/core/policy/substance.ts
+var SLASH_BLOCK = [["/*", "*/"]];
+var C_LIKE = { line: ["//"], block: SLASH_BLOCK, quotes: `"'` };
+var SYNTAXES = Object.fromEntries([
+  ...["ts", "mts", "cts", "js", "mjs", "cjs"].map((ext) => [ext, { ...C_LIKE, js: true }]),
+  ...["java", "kt", "kts", "scala", "swift", "dart", "groovy"].map((ext) => [
+    ext,
+    { ...C_LIKE, triple: true }
+  ]),
+  ["go", { ...C_LIKE, rawBacktick: true }],
+  ...["css", "scss", "less"].map((ext) => [
+    ext,
+    { line: [], block: SLASH_BLOCK, quotes: `"'`, cssUrl: true }
+  ]),
+  ...["py", "pyi"].map((ext) => [
+    ext,
+    { line: ["#"], block: [], quotes: `"'`, triple: true, indented: true, fstring: true }
+  ]),
+  ["toml", { line: ["#"], block: [], quotes: `"`, literal: "'", triple: true }],
+  ...["html", "htm", "xml", "svg", "xhtml"].map((ext) => [
+    ext,
+    { line: [], block: [["<!--", "-->"]], quotes: "", indented: true }
+  ])
 ]);
-var isNetworkFsType = (type) => NETWORK_FS_TYPES.has(type >>> 0);
-var onNetworkFs = (dir) => {
-  if (process.platform !== "linux")
-    return false;
-  try {
-    return isNetworkFsType(fs12.statfsSync(dir).type);
-  } catch {
-    return false;
-  }
-};
-var LOCK_WAIT_MS = 5000;
-var LOCK_STALE_MS = 30000;
-var LOCK_OWNER = "owner";
-var lockToken = (lock) => {
-  try {
-    return fs12.readFileSync(path14.join(lock, LOCK_OWNER), "utf8");
-  } catch {
-    return null;
-  }
-};
-var lockAgeMs = (lock) => {
-  for (const target of [path14.join(lock, LOCK_OWNER), lock]) {
-    try {
-      return Date.now() - fs12.statSync(target).mtimeMs;
-    } catch {}
-  }
-  return null;
+var DIRECTIVE = /@ts-|eslint|prettier|biome|oxlint|istanbul|\bc8\b|\bv8\b|@jsx|@flow|@vite|webpack|__PURE__|__NO_SIDE_EFFECTS__|source(?:Mapping)?URL|^\/\s*<|go:|\+build|nolint|noqa|type:|pyright|mypy|pylint|pragma|coding[:=]|fmt:|NOSONAR|@license|@preserve|@refresh|environment|language=|cython|ruff|isort|deno-|@vitest|@jest|swiftlint|ktlint|checkstyle|suppress|nullable|#(?:end)?region/iu;
+var extensionOf = (file) => {
+  const name = file.slice(file.lastIndexOf("/") + 1);
+  const dot = name.lastIndexOf(".");
+  return dot > 0 ? name.slice(dot + 1).toLowerCase() : "";
 };
-var ledgerLock = {
-  acquire(lock) {
-    try {
-      fs12.mkdirSync(lock);
-    } catch (error) {
-      if (error.code === "EEXIST")
-        return null;
-      throw error;
-    }
-    const token = `${process.pid}-${randomBytes3(8).toString("hex")}`;
-    fs12.writeFileSync(path14.join(lock, LOCK_OWNER), token);
-    return token;
-  },
-  release(lock, token) {
-    if (lockToken(lock) !== token)
-      return false;
-    const tomb = `${lock}.release-${randomBytes3(6).toString("hex")}`;
-    try {
-      fs12.renameSync(lock, tomb);
-    } catch {
-      return false;
+var CI_PATH = /^\.github\/|(?:^|\/)(?:\.gitlab-ci\.ya?ml|Jenkinsfile|azure-pipelines\.ya?ml|\.pre-commit-config\.ya?ml|\.circleci\/.*)$/u;
+var syntaxOf = (file) => CI_PATH.test(file) ? null : SYNTAXES[extensionOf(file)] ?? null;
+var SPACE = /[ \t\r\f\v]/u;
+var WORD = /[\w$]/u;
+var NO_SPACE_AFTER = "([{,;";
+var NO_SPACE_BEFORE = ")]},;";
+var REGEX_AFTER = "(,=:[!&|?{};+-*%<>~^";
+var REGEX_KEYWORDS = new Set([
+  "return",
+  "typeof",
+  "instanceof",
+  "case",
+  "do",
+  "else",
+  "in",
+  "of",
+  "new",
+  "delete",
+  "void",
+  "throw",
+  "yield",
+  "await"
+]);
+function substanceOf(file, text) {
+  const syntax = syntaxOf(file);
+  if (!syntax)
+    return plainSubstance(text);
+  const markup = syntax.block.some(([open]) => open === "<!--");
+  if (markup && (/<(?:script|style)\b|<!\[CDATA\[|<\?/iu.test(text) || /[^>\s][ \t]*<!--/u.test(text)))
+    return plainSubstance(text);
+  return lex(syntax, text);
+}
+function plainSubstance(text) {
+  return text.split(`
+`).map((line) => line.replace(/[ \t\r\f\v]+$/u, "")).filter(Boolean).join(`
+`);
+}
+function lex(syntax, text) {
+  const collapse = !syntax.indented;
+  let out = "";
+  let lineStart = 0;
+  let kept = 0;
+  let pendingSpace = false;
+  const frames = [{ kind: "code", braces: 0 }];
+  let index = 0;
+  if (text.startsWith("#!")) {
+    const end = text.indexOf(`
+`);
+    out = end < 0 ? text : text.slice(0, end);
+    kept = out.length;
+    index = end < 0 ? text.length : end;
+  }
+  const emitCode = (chunk) => {
+    if (collapse && pendingSpace && out.length > lineStart) {
+      const before = out[out.length - 1];
+      if (!NO_SPACE_AFTER.includes(before) && !NO_SPACE_BEFORE.includes(chunk[0]))
+        out += " ";
     }
-    if (lockToken(tomb) !== token) {
-      try {
-        fs12.renameSync(tomb, lock);
-      } catch {}
-      return false;
+    pendingSpace = false;
+    out += chunk;
+  };
+  const emitVerbatim = (chunk) => {
+    emitCode(chunk);
+    kept = out.length;
+  };
+  const newline = () => {
+    if (!collapse) {
+      let end = out.length;
+      while (end > Math.max(lineStart, kept) && SPACE.test(out[end - 1]))
+        end -= 1;
+      out = out.slice(0, end);
     }
-    fs12.rmSync(tomb, { recursive: true, force: true });
-    return true;
-  },
-  token: lockToken,
-  reap(lock, observed) {
-    const tomb = `${lock}.reap-${randomBytes3(6).toString("hex")}`;
-    try {
-      fs12.renameSync(lock, tomb);
-    } catch {
-      return false;
+    pendingSpace = false;
+    if (out.length > lineStart) {
+      out += `
+`;
+      lineStart = out.length;
     }
-    if (lockToken(tomb) === observed) {
-      fs12.rmSync(tomb, { recursive: true, force: true });
+  };
+  const regexAllowed = () => {
+    let end = out.length;
+    while (end > 0 && /\s/u.test(out[end - 1]))
+      end -= 1;
+    if (end === 0 || REGEX_AFTER.includes(out[end - 1]))
       return true;
-    }
-    try {
-      fs12.renameSync(tomb, lock);
-    } catch {
-      fs12.rmSync(tomb, { recursive: true, force: true });
+    let start = end;
+    while (start > 0 && WORD.test(out[start - 1]))
+      start -= 1;
+    return REGEX_KEYWORDS.has(out.slice(start, end));
+  };
+  const scanString = (quote, escapes, multiline) => {
+    const prefix = text.slice(Math.max(0, index - 2), index).match(/[a-z]*$/iu)?.[0] ?? "";
+    const fstring = syntax.fstring === true && /f/iu.test(prefix);
+    let end = index + quote.length;
+    while (end < text.length) {
+      const char = text[end];
+      if (escapes && char === "\\") {
+        end += 2;
+        continue;
+      }
+      if (text.startsWith(quote, end)) {
+        if (fstring && unbalanced(text.slice(index + quote.length, end)))
+          return false;
+        emitVerbatim(text.slice(index, end + quote.length));
+        index = end + quote.length;
+        return true;
+      }
+      if (char === `
+` && !multiline)
+        return false;
+      end += 1;
     }
     return false;
-  }
-};
-function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
-  const lock = `${file}.lock`;
-  const deadline = Date.now() + waitMs;
-  let token = null;
-  for (;; ) {
-    token = ledgerLock.acquire(lock);
-    if (token)
-      break;
-    const observed = lockToken(lock);
-    const age = lockAgeMs(lock);
-    if (age !== null && age > LOCK_STALE_MS && ledgerLock.reap(lock, observed))
+  };
+  while (index < text.length) {
+    const frame = frames[frames.length - 1];
+    const char = text[index];
+    if (frame.kind === "template") {
+      if (char === "\\") {
+        emitVerbatim(text.slice(index, index + 2));
+        index += 2;
+      } else if (char === "`") {
+        emitVerbatim(char);
+        frames.pop();
+        index += 1;
+      } else if (text.startsWith("${", index)) {
+        emitVerbatim("${");
+        frames.push({ kind: "code", braces: 0 });
+        index += 2;
+      } else {
+        out += char;
+        kept = out.length;
+        index += 1;
+      }
       continue;
-    if (Date.now() >= deadline)
-      return null;
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
-  }
-  try {
-    return fn();
-  } finally {
-    ledgerLock.release(lock, token);
-  }
-}
-var sha2562 = (text) => createHash9("sha256").update(text).digest("hex");
-var chainHash = (prevHash, body) => sha2562(`${prevHash ?? ""}
-${body}`);
-var TAIL_BYTES = 64 * 1024;
-var lastLine = (fd, size) => {
-  for (let span = Math.min(size, TAIL_BYTES);span > 0; span = Math.min(size, span * 2)) {
-    const buffer = Buffer.alloc(span);
-    fs12.readSync(fd, buffer, 0, span, size - span);
-    const end = buffer.lastIndexOf(10);
-    if (end < 0) {
-      if (span === size)
+    }
+    if (char === `
+`) {
+      newline();
+      index += 1;
+      continue;
+    }
+    if (SPACE.test(char)) {
+      if (collapse)
+        pendingSpace = true;
+      else
+        out += char;
+      index += 1;
+      continue;
+    }
+    const lineOpener = syntax.line.find((opener) => text.startsWith(opener, index));
+    if (lineOpener) {
+      const end = text.indexOf(`
+`, index);
+      const comment = text.slice(index, end < 0 ? text.length : end);
+      if (DIRECTIVE.test(comment.slice(lineOpener.length)))
+        emitVerbatim(comment);
+      else
+        pendingSpace = true;
+      index = end < 0 ? text.length : end;
+      continue;
+    }
+    const block = syntax.block.find(([open]) => text.startsWith(open, index));
+    if (block) {
+      const end = text.indexOf(block[1], index + block[0].length);
+      if (end < 0)
         return null;
+      const comment = text.slice(index, end + block[1].length);
+      if (DIRECTIVE.test(comment.slice(block[0].length, -block[1].length)))
+        emitVerbatim(comment);
+      else
+        pendingSpace = true;
+      if (comment.includes(`
+`))
+        newline();
+      index = end + block[1].length;
       continue;
     }
-    let stop = end;
-    let text = "";
-    while (stop >= 0) {
-      const start = buffer.lastIndexOf(10, stop - 1);
-      text = buffer.toString("utf8", start + 1, stop).trim();
-      if (text) {
-        if (start >= 0 || span === size)
-          return text;
-        break;
-      }
-      if (start < 0) {
-        if (span === size)
-          return null;
-        break;
-      }
-      stop = start;
+    if (syntax.triple && (char === '"' || char === "'") && text.startsWith(char.repeat(3), index)) {
+      if (!scanString(char.repeat(3), !syntax.literal?.includes(char), true))
+        return null;
+      continue;
     }
-    if (span === size)
-      return text || null;
-  }
-  return null;
-};
-var tighten = (fd) => {
-  try {
-    if ((fs12.fstatSync(fd).mode & 63) !== 0)
-      fs12.fchmodSync(fd, 384);
-  } catch {}
-};
-function appendLine(file, build, options) {
-  const write = () => {
-    const fd = fs12.openSync(file, "a+", 384);
-    try {
-      if (process.platform !== "win32")
-        tighten(fd);
-      const size = fs12.fstatSync(fd).size;
-      let fence = "";
-      if (size > 0) {
-        const last = Buffer.alloc(1);
-        fs12.readSync(fd, last, 0, 1, size - 1);
-        if (last[0] !== 10)
-          fence = `
-`;
-      }
-      const line = build(lastLine(fd, size));
-      if (!line.ok)
-        return line;
-      const bytes = Buffer.from(fence + line.value);
-      const written = fs12.writeSync(fd, bytes);
-      if (written !== bytes.length)
-        return err("unavailable", `short write to ${file}: ${written} of ${bytes.length} bytes; the row is torn and will be skipped`);
-      return { ok: true, value: undefined };
-    } finally {
-      fs12.closeSync(fd);
+    if (syntax.quotes.includes(char)) {
+      if (!scanString(char, true, Boolean(syntax.multiline)))
+        return null;
+      continue;
     }
-  };
-  try {
-    fs12.mkdirSync(path14.dirname(file), { recursive: true });
-    if (!options.forceLock && !onNetworkFs(path14.dirname(file)))
-      return write();
-    const locked = withLedgerLock(file, write);
-    return locked ?? err("busy", `ledger lock ${file}.lock is held`, "retry; remove the .lock directory if no workit process is running");
-  } catch (error) {
-    return err("unavailable", `cannot append to ${file}: ${error.message}`);
-  }
-}
-var sealed = (row, id, at, previous) => {
-  const { prevHash: _prev, rowHash: _row, ...fields } = row;
-  const prevHash = previous === null ? null : sha2562(previous);
-  const body = { v: LEDGER_VERSION, id, at, ...fields, prevHash };
-  const full = { ...body, rowHash: chainHash(prevHash, JSON.stringify(body)) };
-  return { full, line: `${JSON.stringify(full)}
-` };
-};
-function appendRaw(cwd, row, options) {
-  const file = ledgerPath(cwd);
-  if (!file.ok)
-    return file;
-  const id = newId2();
-  const at = (options.now ?? new Date).toISOString();
-  let full = null;
-  const written = appendLine(file.value, (previous) => {
-    const next = sealed(row, id, at, previous);
-    const bytes = Buffer.byteLength(next.line);
-    if (bytes > MAX_LINE_BYTES)
-      return err("invalid_input", `ledger row is ${bytes} bytes; the limit is ${MAX_LINE_BYTES}. Shorten the text and pass details by --ref <path|url>`);
-    full = next.full;
-    return { ok: true, value: next.line };
-  }, options);
-  return written.ok ? { ok: true, value: full } : written;
-}
-function observedRowBytes(row) {
-  const sample = sealed({ ...row, observer: "workit_cli" }, newId2(), new Date().toISOString(), "");
-  return Buffer.byteLength(sample.line);
-}
-function appendObserved(cwd, row, options = {}) {
-  return appendRaw(cwd, { ...row, observer: "workit_cli" }, options);
-}
-var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var str2 = (value) => typeof value === "string" ? value : null;
-var normalizeActor = (value) => {
-  const actor = isRecord3(value) ? value : {};
-  return {
-    host: str2(actor.host) ?? "unknown",
-    session: str2(actor.session),
-    agentId: str2(actor.agentId)
-  };
-};
-function supersedeAllowed(by, target, onBranch = (row) => (by.branch ?? null) === (row.branch ?? null)) {
-  if (by.type !== target.type)
-    return `a ${by.type} row cannot supersede a ${target.type} row`;
-  if (!by.actor.session || by.actor.session !== target.actor.session)
-    return "only the session that wrote a row can supersede it";
-  if (!onBranch(target))
-    return `the row is on another branch (${String(target.branch ?? "none")}); a row supersedes only one on its own branch`;
-  if (by.type === "verdict" && (by.kind ?? "review") !== (target.kind ?? "review"))
-    return `a ${String(by.kind ?? "review")} verdict cannot supersede a ${String(target.kind ?? "review")} verdict; record it with --kind ${String(target.kind ?? "review")}`;
-  if (by.type === "verdict" && by.self === true && target.self !== true)
-    return "a self verdict cannot replace an independent verdict";
-  return null;
-}
-function readLedger(cwd, options = {}) {
-  const file = ledgerPath(cwd);
-  if (!file.ok)
-    return file;
-  let text = "";
-  let stat = null;
-  try {
-    stat = fs12.statSync(file.value);
-    text = fs12.readFileSync(file.value, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return {
-        ok: true,
-        value: {
-          path: file.value,
-          rows: [],
-          skipped: 0,
-          integrity: options.integrity ? { chained: 0, legacy: 0, unverified: [] } : null
-        }
-      };
-    return err("unavailable", `cannot read ${file.value}: ${error.message}`);
-  }
-  const rows = [];
-  let skipped = 0;
-  const integrity = { chained: 0, legacy: 0, unverified: [] };
-  const earlier = new Set([null]);
-  let chainStarted = false;
-  const ids = new Set;
-  for (const raw of text.split(`
-`)) {
-    const trimmed = raw.trim();
-    if (!trimmed)
+    if (syntax.literal?.includes(char)) {
+      if (!scanString(char, false, false))
+        return null;
       continue;
-    const linked = (prevHash) => earlier.has(prevHash);
-    if (options.integrity)
-      earlier.add(sha2562(trimmed));
-    let parsed;
-    try {
-      parsed = JSON.parse(trimmed);
-    } catch {
-      skipped += 1;
+    }
+    if (syntax.rawBacktick && char === "`") {
+      if (!scanString("`", false, true))
+        return null;
       continue;
     }
-    if (!isRecord3(parsed) || !str2(parsed.id) || !str2(parsed.type) || !str2(parsed.at)) {
-      skipped += 1;
+    if (syntax.js && char === "`") {
+      emitVerbatim(char);
+      frames.push({ kind: "template" });
+      index += 1;
       continue;
     }
-    let rowIntegrity = options.integrity ? "verified" : undefined;
-    let reason = null;
-    if (!options.integrity) {} else if (typeof parsed.rowHash === "string") {
-      chainStarted = true;
-      const { rowHash, ...body } = parsed;
-      const prevHash = str2(parsed.prevHash);
-      if (chainHash(prevHash, JSON.stringify(body)) !== rowHash)
-        reason = "hash_mismatch";
-      else if (!linked(prevHash))
-        reason = "broken_link";
-    } else if (chainStarted)
-      reason = "unsigned";
-    else
-      rowIntegrity = "legacy";
-    if (options.integrity && !reason && ids.has(parsed.id))
-      reason = "duplicate_id";
-    if (options.integrity)
-      ids.add(parsed.id);
-    if (reason)
-      rowIntegrity = "unverified";
-    const pr = typeof parsed.pr === "number" && Number.isInteger(parsed.pr) ? parsed.pr : undefined;
-    const row = {
-      ...parsed,
-      v: typeof parsed.v === "number" ? parsed.v : LEDGER_VERSION,
-      id: parsed.id,
-      at: parsed.at,
-      type: parsed.type,
-      actor: normalizeActor(parsed.actor),
-      branch: str2(parsed.branch),
-      head: str2(parsed.head),
-      base: str2(parsed.base),
-      baseSha: str2(parsed.baseSha),
-      patchId: str2(parsed.patchId),
-      diffHash: str2(parsed.diffHash),
-      tree: str2(parsed.tree),
-      dirty: typeof parsed.dirty === "boolean" ? parsed.dirty : null,
-      ...pr === undefined ? {} : { pr },
-      ...str2(parsed.supersedes) ? { supersedes: parsed.supersedes } : {},
-      seq: rows.length + 1,
-      superseded: false,
-      supersedeIgnored: false,
-      ...rowIntegrity ? { integrity: rowIntegrity } : {},
-      ...reason ? { integrityReason: reason } : {}
-    };
-    rows.push(row);
-    if (!options.integrity)
+    if (syntax.cssUrl && /^url\(\s*[^"')\s]/iu.test(text.slice(index, index + 64)))
+      return null;
+    if (syntax.js && char === "/" && !regexAllowed() && out.trimEnd().endsWith(")")) {
+      const lineEnd = text.indexOf(`
+`, index);
+      if (text.slice(index + 1, lineEnd < 0 ? text.length : lineEnd).includes("/"))
+        return null;
+    }
+    if (syntax.js && char === "/" && regexAllowed()) {
+      let end = index + 1;
+      let inClass = false;
+      while (end < text.length && (inClass || text[end] !== "/")) {
+        if (text[end] === `
+`)
+          return null;
+        if (text[end] === "\\")
+          end += 1;
+        else if (text[end] === "[")
+          inClass = true;
+        else if (text[end] === "]")
+          inClass = false;
+        end += 1;
+      }
+      if (end >= text.length)
+        return null;
+      emitVerbatim(text.slice(index, end + 1));
+      index = end + 1;
       continue;
-    if (rowIntegrity === "verified")
-      integrity.chained += 1;
-    else if (rowIntegrity === "legacy")
-      integrity.legacy += 1;
-    else if (reason)
-      integrity.unverified.push({
-        seq: row.seq,
-        id: row.id,
-        type: row.type,
-        branch: row.branch,
-        reason
-      });
+    }
+    if (frames.length > 1 && frame.kind === "code") {
+      if (char === "{")
+        frame.braces += 1;
+      else if (char === "}") {
+        if (frame.braces === 0) {
+          emitVerbatim(char);
+          frames.pop();
+          index += 1;
+          continue;
+        }
+        frame.braces -= 1;
+      }
+    }
+    emitCode(char);
+    index += 1;
   }
-  const scopes = new Map;
-  const scopeOf = (branch) => {
-    let scope = scopes.get(branch);
-    if (!scope)
-      scopes.set(branch, scope = branchScope(cwd, branch));
-    return scope;
-  };
-  const byId = new Map;
-  for (const row of rows) {
-    const target = row.supersedes ? byId.get(row.supersedes) : undefined;
-    if (target && row.integrity !== "unverified" && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
-      target.superseded = true;
-    else if (row.supersedes)
-      row.supersedeIgnored = true;
-    if (!byId.has(row.id))
-      byId.set(row.id, row);
+  if (frames.length !== 1)
+    return null;
+  newline();
+  return out;
+}
+function unbalanced(body) {
+  let depth = 0;
+  for (const part of body.replaceAll("{{", "").replaceAll("}}", "")) {
+    if (part === "{")
+      depth += 1;
+    else if (part === "}")
+      depth = Math.max(0, depth - 1);
   }
-  if (options.integrity && stat && Buffer.byteLength(text) === stat.size)
-    tamperCache.set(file.value, {
-      size: stat.size,
-      stamp: fileStamp(stat),
-      breaks: integrity.unverified.filter((row) => TAMPER_REASONS.has(row.reason))
-    });
-  return {
-    ok: true,
-    value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null }
-  };
+  return depth > 0;
 }
-var TAMPER_REASONS = new Set(["hash_mismatch", "broken_link"]);
-var tamperCache = new Map;
-var fileStamp = (stat) => `${stat.ino}:${stat.mtimeMs}:${stat.ctimeMs}`;
-function ledgerTampering(cwd) {
-  const file = ledgerPath(cwd);
-  if (!file.ok)
-    return [];
+function hasOpaqueLineBreak(text) {
+  return /\r(?!\n)|[\u2028\u2029]/u.test(text);
+}
+var decoder = new TextDecoder("utf-8", { fatal: true });
+function textOf(bytes) {
+  if (bytes.includes(0))
+    return null;
   try {
-    const stat = fs12.statSync(file.value);
-    const cached = tamperCache.get(file.value);
-    if (cached && cached.size === stat.size && cached.stamp === fileStamp(stat))
-      return cached.breaks;
+    return decoder.decode(bytes);
   } catch {
-    return [];
+    return null;
   }
-  const read = readLedger(cwd, { integrity: true });
-  return read.ok ? (read.value.integrity?.unverified ?? []).filter((row) => TAMPER_REASONS.has(row.reason)) : [];
-}
-function tamperedUnblock(cwd) {
-  const file = ledgerPath(cwd);
-  const where = file.ok ? file.value : "the ledger file";
-  return `workit ledger verify-integrity  # lists the edited or missing rows; if the edit is understood, move ${where} aside (mv ${where} ${where}.tampered-<date>) and record the verdicts again`;
 }
-var tamperedWarning = (cwd, breaks) => `the ledger was edited, or a row was removed or moved (${breaks.slice(0, 3).map((row) => `${row.reason} at row ${row.seq}`).join(", ")}${breaks.length > 3 ? ", …" : ""}): no verdict is accepted until it is repaired. ${tamperedUnblock(cwd)}`;
-function verdictBasis(verdict, current) {
-  if (verdict.head && verdict.head === current.head)
-    return "fresh";
-  if (verdict.patchId && verdict.patchId === current.patchId && verdict.diffHash && verdict.diffHash === current.diffHash)
-    return "carried";
-  return "stale";
+function cosmeticChange(file, before, after) {
+  const left = textOf(before);
+  const right = textOf(after);
+  if (left === null || right === null)
+    return false;
+  if (hasOpaqueLineBreak(left) || hasOpaqueLineBreak(right))
+    return false;
+  const a = substanceOf(file, left);
+  return a !== null && a === substanceOf(file, right);
 }
-var isLiveVerdict = (row, retired) => row.type === "verdict" && typeof row.result === "string" && !retired.has(row.id);
-function trailerSessions(cwd, base, head) {
-  if (!base || !head || !safeRef(base) || !safeRef(head))
-    return [];
-  const out = git4(cwd, [
-    "log",
-    "--format=%(trailers:key=Workit-Session,valueonly,separator=%x00)",
-    `${base}..${head}`
-  ]);
-  return (out ?? "").split(/[\0\n]/u).map((value) => value.trim()).filter(Boolean);
+
+// packages/workit-core/src/core/policy/lane.ts
+var LANE_THRESHOLDS = {
+  selfMaxLines: 100,
+  selfMaxFiles: 5,
+  fullMinLines: 500
+};
+var RISK_TOKENS = new Set([
+  "auth",
+  "authn",
+  "authz",
+  "oauth",
+  "security",
+  "permission",
+  "permissions",
+  "secret",
+  "secrets",
+  "crypto",
+  "gate",
+  "gates",
+  "policy",
+  "policies",
+  "hook",
+  "hooks",
+  "husky",
+  "lefthook",
+  "release",
+  "releases",
+  "migration",
+  "migrations",
+  "migrate",
+  "workflows"
+]);
+var RISK_FILES = new Set([
+  ".gitlab-ci.yml",
+  "Jenkinsfile",
+  "azure-pipelines.yml",
+  ".pre-commit-config.yaml",
+  ".workit/risk-paths"
+]);
+var RISK_NAMES = new Set([".gitattributes"]);
+var RISK_PATHS_FILE = ".workit/risk-paths";
+var LOCKFILES = new Set([
+  "bun.lock",
+  "bun.lockb",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "Cargo.lock",
+  "go.sum",
+  "poetry.lock",
+  "uv.lock",
+  "Pipfile.lock",
+  "Gemfile.lock",
+  "composer.lock"
+]);
+var DOC_EXT = /\.(?:md|mdx|markdown|rst|adoc)$/iu;
+var DOC_NAMES = /^(?:license|licence|notice|authors|changelog|changes|contributors)$/iu;
+var INSTRUCTIONS = /(?:^|\/)(?:AGENTS|CLAUDE|GEMINI|SKILL)\.md$|(?:^|\/)(?:skills|agents|commands|rules|prompts)\/[^/]+/iu;
+var TEST_PATH = /(?:^|\/)(?:test|tests|__tests__)\/|\.(?:test|spec)\.[^/]+$|_test\.[^/]+$/iu;
+var basename = (file) => file.slice(file.lastIndexOf("/") + 1);
+var isDoc = (file) => !INSTRUCTIONS.test(file) && (DOC_EXT.test(file) || DOC_NAMES.test(basename(file)));
+function kindOf(file) {
+  if (file.binary)
+    return "behavior";
+  if (file.generated)
+    return "generated";
+  if (LOCKFILES.has(basename(file.path)))
+    return "lockfile";
+  if (isDoc(file.path))
+    return "doc";
+  if (file.cosmetic)
+    return "cosmetic";
+  return TEST_PATH.test(file.path) ? "test" : "behavior";
 }
-var RENAMED = /^branch: renamed refs\/heads\/(.+) to refs\/heads\/(.+)$/iu;
-function branchScope(cwd, branch) {
-  const renamedAt = new Map;
-  let since = Number.NEGATIVE_INFINITY;
-  if (safeRef(branch)) {
-    const log = git4(cwd, [
-      "log",
-      "-g",
-      "--date=unix",
-      "--format=%gd%x09%gs",
-      `refs/heads/${branch}`,
-      "--"
-    ]);
-    for (const line of (log ?? "").split(`
-`)) {
-      const [selector = "", subject = ""] = line.split("\t");
-      const seconds = Number(/@\{(\d+)\}$/u.exec(selector)?.[1]);
-      if (!Number.isFinite(seconds))
-        continue;
-      since = seconds * 1000;
-      const match = RENAMED.exec(subject);
-      if (!match || match[1] === branch)
-        continue;
-      const until = (seconds + 1) * 1000;
-      renamedAt.set(match[1], Math.max(renamedAt.get(match[1]) ?? 0, until));
+var globCache = new Map;
+function globMatch(pattern, file) {
+  let regex = globCache.get(pattern);
+  if (!regex) {
+    let source = "";
+    for (let index = 0;index < pattern.length; index += 1) {
+      const char = pattern[index];
+      if (char === "*" && pattern[index + 1] === "*") {
+        source += pattern[index + 2] === "/" ? "(?:[^/]*/)*" : ".*";
+        index += pattern[index + 2] === "/" ? 2 : 1;
+      } else if (char === "*")
+        source += "[^/]*";
+      else if (char === "?")
+        source += "[^/]";
+      else
+        source += char.replace(/[.+^${}()|[\]\\]/gu, "\\$&");
     }
+    regex = new RegExp(`^${source}$`, "u");
+    globCache.set(pattern, regex);
   }
-  return (row) => {
-    if (row.branch === branch)
-      return true;
-    const until = row.branch === null ? undefined : renamedAt.get(row.branch);
-    if (until === undefined)
-      return false;
-    const at = Date.parse(row.at);
-    return at >= since && at <= until;
-  };
-}
-var renameAwareBranch = (scopeOf, branch) => {
-  return (target) => {
-    const own = typeof branch === "string" ? branch : null;
-    const theirs = typeof target.branch === "string" ? target.branch : null;
-    if (own === theirs)
-      return true;
-    if (own === null || theirs === null || typeof target.at !== "string")
-      return false;
-    return scopeOf(own)({ branch: theirs, at: target.at });
-  };
-};
-function authorSessions(cwd, rows, branch, range = { base: null, head: null }, scope = branchScope(cwd, branch)) {
-  const sessions = new Set;
-  for (const row of rows) {
-    if (!scope(row) || row.type !== "commit.recorded" && row.type !== "task.opened")
-      continue;
-    const session = str2(row.session) ?? row.actor.session;
-    if (session)
-      sessions.add(session);
-  }
-  for (const session of trailerSessions(cwd, range.base, range.head))
-    sessions.add(session);
-  return sessions;
+  return regex.test(file) || file.startsWith(`${pattern.replace(/\/$/u, "")}/`);
 }
-var derivesFrom = (derived, bare) => !bare.includes(":") && derived.endsWith(`:${bare}`);
-var authoredBy = (authors, session) => {
-  if (authors.has(session))
+function isRiskPath(file, extra = []) {
+  if (extra.some((pattern) => globMatch(pattern, file)))
     return true;
-  for (const author of authors)
-    if (derivesFrom(author, session) || derivesFrom(session, author))
-      return true;
-  return false;
-};
-var TRUST_REASONS = new Set([
-  "unsigned",
-  "hash_mismatch",
-  "broken_link",
-  "duplicate_id",
-  "unissued_session",
-  "unbound_session"
-]);
-var SHELL_VOUCHED_HOSTS = new Set([
-  "cli",
-  "opencode",
-  "pi",
-  "codex_cli",
-  "codex_desktop"
-]);
-function sessionTrust(cwd, row) {
-  const session = row.actor.session;
-  if (!session || row.self === true)
-    return null;
-  const source = typeof row.sessionSource === "string" ? row.sessionSource : "env";
-  const host = row.actor.host;
-  const issuedOnly = source === "flag" ? host !== "cli" : source === "env" && session.includes(":") && !SHELL_VOUCHED_HOSTS.has(host);
-  if (!issuedOnly)
-    return null;
-  const binding = issuedBinding(cwd, session);
-  if (binding === null)
-    return "unissued_session";
-  return binding === "token" && row.sessionBound !== true ? "unbound_session" : null;
-}
-function trustReasons(cwd, row) {
-  if (row.integrity === "unverified")
-    return [row.integrityReason ?? "unsigned"];
-  if (row.integrity !== "verified")
-    return ["unsigned"];
-  const session = sessionTrust(cwd, row);
-  return session ? [session] : [];
+  if (RISK_FILES.has(file) || RISK_NAMES.has(basename(file)))
+    return true;
+  if (TEST_PATH.test(file) || isDoc(file))
+    return false;
+  return file.split("/").map((segment, index, all) => index === all.length - 1 ? segment.replace(/\.[^.]+$/u, "") : segment).some((segment) => segment.toLowerCase().split(/[-_.]/u).some((token) => RISK_TOKENS.has(token)));
 }
-function withIntegrity(cwd, rows) {
-  if (rows.every((row) => row.integrity !== undefined))
-    return rows;
-  const read = readLedger(cwd, { integrity: true });
-  const bySeq = new Map(read.ok ? read.value.rows.map((row) => [row.seq, row]) : []);
-  return rows.map((row) => {
-    if (row.integrity !== undefined)
-      return row;
-    const fresh = bySeq.get(row.seq);
-    return fresh && fresh.id === row.id && fresh.at === row.at ? fresh : row;
+var parseRiskPaths = (text) => text.split(`
+`).map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).map((line) => line.replace(/^\//u, ""));
+function computeLane(input) {
+  const riskFiles = input.files.filter((file) => isRiskPath(file.path, input.riskPaths)).map((file) => file.path);
+  const risky = new Set(riskFiles);
+  const kinds = input.files.map((file) => ({
+    file,
+    kind: risky.has(file.path) ? "behavior" : kindOf(file)
+  }));
+  const behavior = kinds.filter((entry) => entry.kind === "behavior" || entry.kind === "test" || entry.kind === "lockfile");
+  const lines = behavior.filter((entry) => entry.kind !== "lockfile").reduce((sum, entry) => sum + entry.file.added + entry.file.deleted, 0);
+  const opaque = behavior.filter((entry) => entry.kind === "lockfile" || entry.file.binary);
+  const result = (lane, reasons) => ({
+    lane,
+    reasons,
+    lines,
+    files: behavior.length,
+    riskFiles
   });
+  const { selfMaxLines, selfMaxFiles, fullMinLines } = LANE_THRESHOLDS;
+  if (input.riskTier === "high")
+    return result("full", ["the task judgment records high risk"]);
+  if (riskFiles.length)
+    return result("full", [
+      `touches a risk path: ${riskFiles.slice(0, 3).join(", ")}${riskFiles.length > 3 ? ", …" : ""}`
+    ]);
+  if (!behavior.length)
+    return result("none", [
+      input.files.length ? "only docs, comments, formatting or generated copies changed" : "no changes"
+    ]);
+  if (lines >= fullMinLines)
+    return result("full", [`large diff: ${lines} lines (≥ ${fullMinLines})`]);
+  if (lines > selfMaxLines)
+    return result("focused", [`${lines} lines changed (> ${selfMaxLines})`]);
+  if (behavior.length > selfMaxFiles)
+    return result("focused", [`${behavior.length} behavior files changed (> ${selfMaxFiles})`]);
+  if (opaque.length)
+    return result("focused", [
+      `a lockfile or binary changed: ${opaque.slice(0, 3).map((entry) => entry.file.path).join(", ")}${opaque.length > 3 ? ", …" : ""}`
+    ]);
+  return result("self", [
+    `small change: ${lines} line${lines === 1 ? "" : "s"} in ${behavior.length} file${behavior.length === 1 ? "" : "s"}, no risk path`
+  ]);
 }
-var untrusted = (reasons) => reasons.some((reason) => TRUST_REASONS.has(reason));
-var independenceReasons = (row, authors) => {
-  const reasons = [];
-  if (!row.actor.session)
-    reasons.push("no_session");
-  else if (authoredBy(authors, row.actor.session))
-    reasons.push("author_session");
-  if (row.self === true && !reasons.includes("no_session"))
-    reasons.push("self");
-  return reasons;
-};
-function effectiveOf(rows, reasonsOf, sameCode, isCurrent) {
-  let effective = null;
-  for (const row of rows) {
-    if (!effective) {
-      effective = row;
-      continue;
-    }
-    if (untrusted(reasonsOf(row)) && !untrusted(reasonsOf(effective)))
-      continue;
-    const rowIndependent = reasonsOf(row).length === 0;
-    const effIndependent = reasonsOf(effective).length === 0;
-    if (effIndependent && !rowIndependent && isCurrent(effective))
-      continue;
-    if (effIndependent && FAILING.has(String(effective.result)) && row.actor.session === effective.actor.session && sameCode(effective, row))
-      continue;
-    effective = row;
+function untrackedStat(cwd, file) {
+  try {
+    const bytes = readFileSync4(path14.join(cwd, file));
+    if (bytes.includes(0))
+      return { path: file, added: 0, deleted: 0, binary: true };
+    const text = bytes.toString("utf8");
+    if (hasOpaqueLineBreak(text))
+      return { path: file, added: 0, deleted: 0, binary: true };
+    const lines = text.split(`
+`).length - (text.endsWith(`
+`) ? 1 : 0);
+    return { path: file, added: lines, deleted: 0 };
+  } catch {
+    return { path: file, added: 0, deleted: 0, binary: true };
   }
-  return effective;
 }
-function restackCarries(rows, branch, from, to) {
-  if (!from || !to)
-    return false;
-  const edges = new Map;
-  for (const row of rows)
-    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.integrity === "verified" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
-      edges.set(row.fromHead, [...edges.get(row.fromHead) ?? [], row.head]);
-  const seen = new Set([from]);
-  const queue = [from];
-  while (queue.length) {
-    const next = queue.shift();
-    if (next === to)
-      return true;
-    for (const target of edges.get(next) ?? [])
-      if (!seen.has(target)) {
-        seen.add(target);
-        queue.push(target);
+var REGULAR = new Set(["100644", "100755"]);
+var ABSENT = /^0+$/u;
+function cosmeticFiles(cwd, fork, head) {
+  const raw = diffRaw(cwd, fork, head);
+  if (!raw)
+    return null;
+  const candidates = raw.filter((entry) => REGULAR.has(entry.oldMode) && entry.oldMode === entry.newMode && !ABSENT.test(entry.oldBlob) && (head === null || !ABSENT.test(entry.newBlob)));
+  const blobs = readBlobs(cwd, candidates.flatMap((entry) => [entry.oldBlob, entry.newBlob]));
+  if (!blobs)
+    return null;
+  const out = new Set;
+  const opaque = new Set;
+  for (const entry of candidates) {
+    const before = blobs.get(entry.oldBlob);
+    let after = blobs.get(entry.newBlob);
+    if (!after && head === null && ABSENT.test(entry.newBlob))
+      try {
+        after = readFileSync4(path14.join(cwd, entry.path));
+      } catch {
+        after = undefined;
       }
+    if (before && after && cosmeticChange(entry.path, before, after))
+      out.add(entry.path);
+    else if ([before, after].some((bytes) => bytes && hasOpaqueLineBreak(bytes.toString("utf8"))))
+      opaque.add(entry.path);
   }
-  return false;
+  return { cosmetic: out, opaque };
 }
-function checkVerdicts(cwd, branch, ledgerRows) {
-  const rows = withIntegrity(cwd, ledgerRows);
-  const head = branchHead(cwd, branch);
-  const fallbackBase = defaultBase(cwd);
-  const scope = branchScope(cwd, branch);
-  const keyCache = new Map;
-  const keysAt = (base, at) => {
-    if (!base || !at)
-      return { patchId: null, diffHash: null };
-    const cacheKey = `${base}\x00${at}`;
-    let key = keyCache.get(cacheKey);
-    if (!key) {
-      key = { patchId: patchId(cwd, base, at), diffHash: diffHash(cwd, base, at) };
-      keyCache.set(cacheKey, key);
-    }
-    return key;
-  };
-  const keyFor = (base) => keysAt(base, head);
-  const basisOf = (row) => {
-    const basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
-    return basis === "stale" && restackCarries(rows, branch, row.head, head) ? "carried" : basis;
-  };
-  const sameCode = (failed, row) => {
-    if (failed.head && failed.head === row.head)
-      return true;
-    const base = failed.base ?? fallbackBase;
-    const stored = (row.base ?? fallbackBase) === base && row.baseSha !== null && row.baseSha === failed.baseSha;
-    const keys = stored ? { patchId: row.patchId, diffHash: row.diffHash } : keysAt(base, row.head);
-    return verdictBasis(failed, { head: row.head, ...keys }) !== "stale" || restackCarries(rows, branch, failed.head, row.head);
-  };
-  const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head }, scope);
-  const failureAuthorCache = new Map;
-  const failureAuthors = (row) => {
-    let set = failureAuthorCache.get(row.seq);
-    if (!set) {
-      set = authorSessions(cwd, rows.filter((other) => other.integrity === "verified" && other.seq < row.seq), branch, { base: null, head: null }, scope);
-      failureAuthorCache.set(row.seq, set);
-    }
-    return set;
-  };
-  const reasonCache = new Map;
-  const reasonsOf = (row) => {
-    let reasons = reasonCache.get(row);
-    if (!reasons) {
-      const failing = FAILING.has(String(row.result));
-      reasons = [
-        ...trustReasons(cwd, row),
-        ...independenceReasons(row, failing ? failureAuthors(row) : authors)
-      ];
-      reasonCache.set(row, reasons);
-    }
-    return reasons;
-  };
-  const retired = new Set;
-  for (const row of rows)
-    if (row.type === "verdict" && row.supersedes && !row.supersedeIgnored && trustReasons(cwd, row).length === 0)
-      retired.add(row.supersedes);
-  const byKind = new Map;
-  for (const row of rows)
-    if (isLiveVerdict(row, retired) && scope(row)) {
-      const kind = typeof row.kind === "string" ? row.kind : "review";
-      byKind.set(kind, [...byKind.get(kind) ?? [], row]);
-    }
-  const verdicts = [];
-  const warnings = [];
-  for (const [kind, list] of byKind) {
-    const row = effectiveOf(list, reasonsOf, sameCode, (candidate) => basisOf(candidate) !== "stale");
-    if (!row)
-      continue;
-    const basis = basisOf(row);
-    const current = basis !== "stale";
-    const independence = reasonsOf(row);
-    const reasons = [
-      ...current ? [] : ["stale"],
-      ...PASSING.has(String(row.result)) ? [] : ["not_passing"],
-      ...independence
-    ];
-    verdicts.push({
-      kind,
-      basis,
-      current,
-      independent: independence.length === 0,
-      accepted: reasons.length === 0,
-      reasons,
-      verdict: row
-    });
-    if (reasons.length === 0) {
-      for (const later of list)
-        if (later.seq > row.seq && reasonsOf(later).length > 0 && !untrusted(reasonsOf(later)) && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
-          warnings.push(`the author's own (self) ${String(later.result)} ${kind} verdict ${later.id} by ${later.actor.session ?? "no session"} on the current code is newer than the accepted pass ${row.id}: read it before merging`);
-    }
-  }
-  for (const row of rows)
-    if (row.integrity === "unverified" && scope(row))
-      warnings.push(`ledger row ${row.id} (${row.type}) on ${row.branch ?? branch} is unverified: the workit CLI did not write it or it changed afterwards (workit ledger verify-integrity)`);
-  const tampered = ledgerTampering(cwd);
-  if (tampered.length) {
-    warnings.push(tamperedWarning(cwd, tampered));
-    for (const entry of verdicts) {
-      entry.accepted = false;
-      entry.reasons = [...entry.reasons, "ledger_tampered"];
-    }
-  }
-  verdicts.sort((a, b) => a.verdict.seq - b.verdict.seq);
-  const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
-  const failing = verdicts.find((entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)));
-  const newestAccepted = verdicts.findLast((entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result))) ?? null;
-  const accepted = tampered.length ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
-    accepted: false,
-    verdict: failing?.verdict ?? null,
-    reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
-  };
-  const latestSelf = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && !untrusted(entry.reasons) && (STRONG_RESULTS.has(String(entry.verdict.result)) || FAILING.has(String(entry.verdict.result))));
-  const selfEntry = latestSelf && STRONG_RESULTS.has(String(latestSelf.verdict.result)) ? latestSelf : undefined;
-  return {
-    branch,
-    head,
-    review: accepted.accepted ? "verified" : selfEntry ? "self-reviewed" : "unreviewed",
-    selfVerdict: accepted.accepted ? null : selfEntry?.verdict ?? null,
-    base: newestCurrent?.verdict.base ?? fallbackBase,
-    patchId: keyFor(newestCurrent?.verdict.base ?? fallbackBase).patchId,
-    current: { basis: newestCurrent?.basis ?? "none", verdict: newestCurrent?.verdict ?? null },
-    accepted,
-    verdicts,
-    authors: [...authors].toSorted(),
-    warnings
+function generatedAt(cwd, fork, paths) {
+  const files = treeFilesNamed(cwd, fork, ".gitattributes");
+  const blobs = files?.size ? readBlobs(cwd, [...files.values()]) : null;
+  if (!files || !blobs)
+    return new Set;
+  const texts = new Map;
+  for (const [file, id] of files) {
+    const bytes = blobs.get(id);
+    if (bytes)
+      texts.set(file, bytes.toString("utf8"));
+  }
+  return generatedByAttributes(texts, paths);
+}
+var forkOf = (cwd, base, head) => mergeBase(cwd, base, head ?? "HEAD");
+function laneFiles(cwd, fork, head, attributesAt = fork) {
+  const stats = diffNumstat(cwd, fork, head);
+  const cosmetic = stats ? cosmeticFiles(cwd, fork, head) : null;
+  if (!stats || !cosmetic)
+    return null;
+  const files = [
+    ...stats.map((entry) => ({
+      ...entry,
+      ...cosmetic.opaque.has(entry.path) ? { binary: true } : {},
+      cosmetic: !entry.binary && cosmetic.cosmetic.has(entry.path)
+    })),
+    ...head === null ? untrackedFiles(cwd).map((file) => untrackedStat(cwd, file)) : []
+  ];
+  const generated = generatedAt(cwd, attributesAt, files.map((entry) => entry.path));
+  return files.map((entry) => ({
+    ...entry,
+    generated: generated.has(entry.path)
+  }));
+}
+function driftFiles(cwd, range) {
+  if (range.fromFork === range.toFork)
+    return laneFiles(cwd, range.from, range.to, range.toFork);
+  const drifted = ownChangeDrift(cwd, range);
+  const stats = drifted ? diffNumstat(cwd, range.from, range.to) : null;
+  if (!drifted || !stats)
+    return null;
+  const byPath = new Map(stats.map((entry) => [entry.path, entry]));
+  const generated = generatedAt(cwd, range.toFork, drifted);
+  return drifted.map((file) => ({
+    path: file,
+    added: byPath.get(file)?.added ?? 0,
+    deleted: byPath.get(file)?.deleted ?? 0,
+    ...byPath.get(file)?.binary ? { binary: true } : {},
+    cosmetic: false,
+    generated: generated.has(file)
+  }));
+}
+function branchLane(cwd, options) {
+  const candidates = options.base ? [`origin/${options.base}`, options.base] : [];
+  const base = candidates.find((ref) => resolveRef(cwd, ref) !== null) ?? defaultBase(cwd) ?? null;
+  const head = options.workingTree ? null : options.head;
+  const fork = base && (options.workingTree || options.head) ? forkOf(cwd, base, head) : null;
+  const files = fork ? laneFiles(cwd, fork, head) : null;
+  const riskTier = options.judgment?.riskTier ?? null;
+  if (!fork || !files) {
+    const high = riskTier === "high";
+    return {
+      lane: high ? "full" : "focused",
+      reasons: [
+        `the diff of ${options.head?.slice(0, 12) ?? "(no head)"} against ${base ?? "(no base)"} cannot be read`,
+        ...high ? ["the task judgment records high risk"] : []
+      ],
+      lines: 0,
+      files: 0,
+      riskFiles: [],
+      base,
+      head: options.head
+    };
+  }
+  const repoRisk = parseRiskPaths(fileAt(cwd, fork, RISK_PATHS_FILE) ?? "");
+  return {
+    ...computeLane({
+      files,
+      riskTier,
+      riskPaths: [...repoRisk, ...options.riskPaths ?? []]
+    }),
+    base,
+    head: options.head
   };
 }
-var OBSERVED_ONLY = new Set([
-  "check",
-  "merge.unverified",
-  "policy.judged",
-  ...PR_ROW_TYPES
-]);
-
-// packages/workit-core/src/core/policy/lane.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
-import path16 from "node:path";
+var laneNeed = (lane) => lane === "none" ? "none" : lane === "self" ? "self" : "non-author";
 
-// packages/workit-core/src/core/pr-create.ts
-import fs13 from "node:fs";
-import path15 from "node:path";
-import { spawnSync as spawnSync10 } from "node:child_process";
-// packages/workit-core/src/forge/pr-body.ts
-function parseGhIssue(value) {
-  const m = /issues\/(\d+)/.exec(value);
-  return m ? m[1] : String(value).trim().replace(/^#/, "");
+// packages/workit-core/src/core/policy/carry.ts
+var TEST_ONLY_KINDS = new Set(["doc", "cosmetic", "generated", "test"]);
+function verdictDrift(cwd, input) {
+  const since = input.from;
+  const stale = (reason, files = null, focused = false) => ({
+    carries: false,
+    since,
+    files,
+    focused,
+    reason
+  });
+  const fromFork = mergeBase(cwd, input.fromBase, input.from);
+  const toFork = mergeBase(cwd, input.toBase, input.to);
+  const files = fromFork && toFork ? driftFiles(cwd, { from: input.from, to: input.to, fromFork, toFork }) : null;
+  if (!fromFork || !toFork || !files)
+    return stale(`the change since ${since.slice(0, 12)} cannot be read`);
+  const riskPaths = [fromFork, toFork].flatMap((fork) => parseRiskPaths(fileAt(cwd, fork, RISK_PATHS_FILE) ?? ""));
+  const lane = computeLane({ files, riskPaths });
+  const paths = files.map((file) => file.path);
+  if (lane.lane === "none")
+    return { carries: true, rule: "lane-none", since, files: paths };
+  if (input.kind === "unit" && lane.lane === "self" && files.every((file) => TEST_ONLY_KINDS.has(kindOf(file))))
+    return { carries: true, rule: "tests-only", since, files: paths };
+  return stale(lane.reasons[0] ?? `lane ${lane.lane}`, paths, lane.lane === "self");
 }
 
-// packages/workit-core/src/core/pr-create.ts
-function whichOnPath(tool) {
-  const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
-  for (const dir of (process.env.PATH ?? "").split(path15.delimiter)) {
-    if (!dir)
-      continue;
-    for (const name of names) {
-      const candidate = path15.join(dir, name);
-      try {
-        fs13.accessSync(candidate, fs13.constants.X_OK);
-        return candidate;
-      } catch {}
-    }
-  }
-  return null;
-}
-var hostingCliAvailable = (provider) => whichOnPath(provider === "gitlab" ? "glab" : "gh") !== null;
-var pushRemote = (cwd) => {
-  const result = spawnSync10("git", ["remote", "get-url", "--push", "--all", "origin"], {
+// packages/workit-core/src/ledger.ts
+var LEDGER_VERSION = 1;
+var MAX_LINE_BYTES = 4096;
+var PASSING = new Set(["verified", "tests-verified", "type-check-only"]);
+var FAILING = new Set(["failed", "blocked"]);
+var STRONG_RESULTS = new Set(["verified", "tests-verified"]);
+var PR_ROW_TYPES = new Set([
+  "pr.created",
+  "pr.status",
+  "pr.merged",
+  "pr.linked"
+]);
+var err = (code, error, unblock) => ({
+  ok: false,
+  code,
+  error,
+  ...unblock ? { unblock } : {}
+});
+var gitRun2 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
+  const run = spawnSync9("git", args, {
     cwd,
-    encoding: "utf8"
+    encoding: "utf8",
+    timeout: timeoutMs,
+    killSignal: "SIGKILL",
+    windowsHide: true,
+    maxBuffer: 256 * 1024 * 1024,
+    env: {
+      ...process.env,
+      GIT_TERMINAL_PROMPT: "0",
+      GIT_OPTIONAL_LOCKS: "0",
+      LC_ALL: "C",
+      LANGUAGE: "C"
+    }
   });
-  if (result.status !== 0)
-    return null;
-  const urls = (result.stdout ?? "").split(/\r?\n/u).map((url) => url.trim()).filter(Boolean);
-  return urls.length === 1 ? urls[0] : null;
+  return {
+    ok: run.status === 0,
+    stdout: run.stdout ?? "",
+    stderr: run.error ? String(run.error.message) : run.stderr ?? ""
+  };
 };
-
-// packages/workit-core/src/forge/redact.ts
-var KEY = String.raw`[A-Za-z0-9_.-]*?(?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|account[_-]?key|private[_-]?key|client[_-]?secret|credentials?|authorization|cookie|signature)[A-Za-z0-9_.-]*`;
-var ASSIGNMENT = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*["']?)((?:bearer|basic|token|digest)\s+)?([^\s"',;&]+)`, "giu");
-var QUOTED_ASSIGNMENT = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*)(["'])([^"'\n]*[^\s"'][^"'\n]*)\2`, "giu");
-var ANSI = new RegExp(String.raw`\u001b\[[0-9;?]*[ -/]*[@-~]|\u001b\][^\u0007]*\u0007`, "gu");
-
-// packages/workit-core/src/git/ops.ts
-var COMMIT_TIMEOUT_MS = 10 * 60000;
-
-// packages/workit-core/src/core/policy/attributes.ts
-function patternRegex(dir, pattern) {
-  if (!pattern || pattern.endsWith("/") || pattern.startsWith('"') || pattern.startsWith("!"))
+var git4 = (cwd, args) => {
+  const run = gitRun2(cwd, args);
+  const value = run.ok ? run.stdout.trim() : "";
+  return value ? value : null;
+};
+var safeRef2 = (value) => value.length > 0 && !value.startsWith("-");
+function resolveCommit(cwd, ref) {
+  if (!safeRef2(ref))
     return null;
-  const anchored = pattern.includes("/");
-  const body = pattern.replace(/^\//u, "");
-  let source = "";
-  for (let index = 0;index < body.length; index += 1) {
-    const char = body[index];
-    if (char === "*" && body[index + 1] === "*") {
-      const slash = body[index + 2] === "/";
-      source += slash ? "(?:.*/)?" : ".*";
-      index += slash ? 2 : 1;
-    } else if (char === "*")
-      source += "[^/]*";
-    else if (char === "?")
-      source += "[^/]";
-    else if (char === "[") {
-      const end = body.indexOf("]", index + 2);
-      if (end < 0)
-        return null;
-      const set = body.slice(index + 1, end).replace(/^!/u, "^").replace(/\\/gu, "\\\\");
-      source += `[${set}]`;
-      index = end;
-    } else if (char === "\\" && index + 1 < body.length) {
-      source += body[index + 1].replace(/[.*+?^${}()|[\]\\/]/gu, "\\$&");
-      index += 1;
-    } else
-      source += char.replace(/[.*+?^${}()|[\]\\/]/gu, "\\$&");
-  }
-  const prefix = dir ? `${dir.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}/` : "";
-  try {
-    return new RegExp(anchored ? `^${prefix}${source}$` : `^${prefix}(?:.*/)?${source}$`, "u");
-  } catch {
+  return git4(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]);
+}
+function branchHead(cwd, branch) {
+  if (!safeRef2(branch))
     return null;
-  }
+  return resolveCommit(cwd, `refs/heads/${branch}`) ?? resolveCommit(cwd, `refs/remotes/origin/${branch}`);
 }
-function rulesOf(dir, text) {
-  const out = [];
-  for (const raw of text.split(`
+function diffHash(cwd, base, head) {
+  if (!safeRef2(base) || !safeRef2(head))
+    return null;
+  const diff = gitRun2(cwd, [
+    "diff",
+    "-U3",
+    "--diff-algorithm=myers",
+    "--indent-heuristic",
+    "--no-color",
+    "--no-ext-diff",
+    "--no-textconv",
+    "--no-renames",
+    "--full-index",
+    "--binary",
+    "--src-prefix=a/",
+    "--dst-prefix=b/",
+    `${base}...${head}`,
+    "--"
+  ], GIT_TIMEOUTS.worktree);
+  if (!diff.ok || !diff.stdout)
+    return null;
+  const hash = createHash9("sha256");
+  for (const line of diff.stdout.split(`
 `)) {
-    const line = raw.trim();
-    if (!line || line.startsWith("#") || line.startsWith("[attr]"))
+    if (line.startsWith("index "))
       continue;
-    const [pattern, ...attributes] = line.split(/\s+/u);
-    let generated = null;
-    for (const attribute of attributes) {
-      if (attribute === "linguist-generated" || attribute === "linguist-generated=true")
-        generated = true;
-      else if (attribute === "-linguist-generated" || attribute === "!linguist-generated" || attribute.startsWith("linguist-generated="))
-        generated = false;
-    }
-    if (generated === null)
-      continue;
-    const regex = patternRegex(dir, pattern);
-    if (regex)
-      out.push({ regex, generated });
+    hash.update(line.startsWith("@@ ") ? "@@" : line);
+    hash.update(`
+`);
   }
-  return out;
+  return `sha256:${hash.digest("hex")}`;
 }
-function generatedByAttributes(files, paths) {
-  const rules = [...files].map(([file, text]) => {
-    const dir = file.includes("/") ? file.slice(0, file.lastIndexOf("/")) : "";
-    return {
-      depth: dir ? dir.split("/").length : 0,
-      rules: rulesOf(dir, text)
-    };
-  }).toSorted((left, right) => left.depth - right.depth).flatMap((entry) => entry.rules);
-  const out = new Set;
-  for (const file of paths) {
-    const last = rules.findLast((rule) => rule.regex.test(file));
-    if (last?.generated)
-      out.add(file);
-  }
-  return out;
+function storeRoot(cwd) {
+  const location = resolveStore(path15.resolve(cwd));
+  if (location instanceof Error)
+    return err("unavailable", location.message.replace(/; fix the repository.*$/u, ""), "fix the repository (git status should work here) or run from a non-git directory");
+  return { ok: true, value: { root: location.dir, shared: location.shared } };
 }
-
-// packages/workit-core/src/core/policy/substance.ts
-var SLASH_BLOCK = [["/*", "*/"]];
-var C_LIKE = { line: ["//"], block: SLASH_BLOCK, quotes: `"'` };
-var SYNTAXES = Object.fromEntries([
-  ...["ts", "mts", "cts", "js", "mjs", "cjs"].map((ext) => [ext, { ...C_LIKE, js: true }]),
-  ...["java", "kt", "kts", "scala", "swift", "dart", "groovy"].map((ext) => [
-    ext,
-    { ...C_LIKE, triple: true }
-  ]),
-  ["go", { ...C_LIKE, rawBacktick: true }],
-  ...["css", "scss", "less"].map((ext) => [
-    ext,
-    { line: [], block: SLASH_BLOCK, quotes: `"'`, cssUrl: true }
-  ]),
-  ...["py", "pyi"].map((ext) => [
-    ext,
-    { line: ["#"], block: [], quotes: `"'`, triple: true, indented: true, fstring: true }
-  ]),
-  ["toml", { line: ["#"], block: [], quotes: `"`, literal: "'", triple: true }],
-  ...["html", "htm", "xml", "svg", "xhtml"].map((ext) => [
-    ext,
-    { line: [], block: [["<!--", "-->"]], quotes: "", indented: true }
-  ])
+function ledgerPath(cwd) {
+  const root = storeRoot(cwd);
+  return root.ok ? { ok: true, value: path15.join(root.value.root, "ledger", "ledger.jsonl") } : root;
+}
+var newId2 = () => `${Date.now().toString(36)}-${randomBytes3(6).toString("hex")}`;
+var NETWORK_FS_TYPES = new Set([
+  26985,
+  20859,
+  4266872130,
+  4283649346,
+  1702057286,
+  1397113167,
+  12805120,
+  16914839,
+  1196443219,
+  198183888
 ]);
-var DIRECTIVE = /@ts-|eslint|prettier|biome|oxlint|istanbul|\bc8\b|\bv8\b|@jsx|@flow|@vite|webpack|__PURE__|__NO_SIDE_EFFECTS__|source(?:Mapping)?URL|^\/\s*<|go:|\+build|nolint|noqa|type:|pyright|mypy|pylint|pragma|coding[:=]|fmt:|NOSONAR|@license|@preserve|@refresh|environment|language=|cython|ruff|isort|deno-|@vitest|@jest|swiftlint|ktlint|checkstyle|suppress|nullable|#(?:end)?region/iu;
-var extensionOf = (file) => {
-  const name = file.slice(file.lastIndexOf("/") + 1);
-  const dot = name.lastIndexOf(".");
-  return dot > 0 ? name.slice(dot + 1).toLowerCase() : "";
+var isNetworkFsType = (type) => NETWORK_FS_TYPES.has(type >>> 0);
+var onNetworkFs = (dir) => {
+  if (process.platform !== "linux")
+    return false;
+  try {
+    return isNetworkFsType(fs12.statfsSync(dir).type);
+  } catch {
+    return false;
+  }
 };
-var CI_PATH = /^\.github\/|(?:^|\/)(?:\.gitlab-ci\.ya?ml|Jenkinsfile|azure-pipelines\.ya?ml|\.pre-commit-config\.ya?ml|\.circleci\/.*)$/u;
-var syntaxOf = (file) => CI_PATH.test(file) ? null : SYNTAXES[extensionOf(file)] ?? null;
-var SPACE = /[ \t\r\f\v]/u;
-var WORD = /[\w$]/u;
-var NO_SPACE_AFTER = "([{,;";
-var NO_SPACE_BEFORE = ")]},;";
-var REGEX_AFTER = "(,=:[!&|?{};+-*%<>~^";
-var REGEX_KEYWORDS = new Set([
-  "return",
-  "typeof",
-  "instanceof",
-  "case",
-  "do",
-  "else",
-  "in",
-  "of",
-  "new",
-  "delete",
-  "void",
-  "throw",
-  "yield",
-  "await"
-]);
-function substanceOf(file, text) {
-  const syntax = syntaxOf(file);
-  if (!syntax)
-    return plainSubstance(text);
-  const markup = syntax.block.some(([open]) => open === "<!--");
-  if (markup && (/<(?:script|style)\b|<!\[CDATA\[|<\?/iu.test(text) || /[^>\s][ \t]*<!--/u.test(text)))
-    return plainSubstance(text);
-  return lex(syntax, text);
-}
-function plainSubstance(text) {
-  return text.split(`
-`).map((line) => line.replace(/[ \t\r\f\v]+$/u, "")).filter(Boolean).join(`
-`);
-}
-function lex(syntax, text) {
-  const collapse = !syntax.indented;
-  let out = "";
-  let lineStart = 0;
-  let kept = 0;
-  let pendingSpace = false;
-  const frames = [{ kind: "code", braces: 0 }];
-  let index = 0;
-  if (text.startsWith("#!")) {
-    const end = text.indexOf(`
-`);
-    out = end < 0 ? text : text.slice(0, end);
-    kept = out.length;
-    index = end < 0 ? text.length : end;
+var LOCK_WAIT_MS = 5000;
+var LOCK_STALE_MS = 30000;
+var LOCK_OWNER = "owner";
+var lockToken = (lock) => {
+  try {
+    return fs12.readFileSync(path15.join(lock, LOCK_OWNER), "utf8");
+  } catch {
+    return null;
   }
-  const emitCode = (chunk) => {
-    if (collapse && pendingSpace && out.length > lineStart) {
-      const before = out[out.length - 1];
-      if (!NO_SPACE_AFTER.includes(before) && !NO_SPACE_BEFORE.includes(chunk[0]))
-        out += " ";
+};
+var lockAgeMs = (lock) => {
+  for (const target of [path15.join(lock, LOCK_OWNER), lock]) {
+    try {
+      return Date.now() - fs12.statSync(target).mtimeMs;
+    } catch {}
+  }
+  return null;
+};
+var ledgerLock = {
+  acquire(lock) {
+    try {
+      fs12.mkdirSync(lock);
+    } catch (error) {
+      if (error.code === "EEXIST")
+        return null;
+      throw error;
     }
-    pendingSpace = false;
-    out += chunk;
-  };
-  const emitVerbatim = (chunk) => {
-    emitCode(chunk);
-    kept = out.length;
-  };
-  const newline = () => {
-    if (!collapse) {
-      let end = out.length;
-      while (end > Math.max(lineStart, kept) && SPACE.test(out[end - 1]))
-        end -= 1;
-      out = out.slice(0, end);
+    const token = `${process.pid}-${randomBytes3(8).toString("hex")}`;
+    fs12.writeFileSync(path15.join(lock, LOCK_OWNER), token);
+    return token;
+  },
+  release(lock, token) {
+    if (lockToken(lock) !== token)
+      return false;
+    const tomb = `${lock}.release-${randomBytes3(6).toString("hex")}`;
+    try {
+      fs12.renameSync(lock, tomb);
+    } catch {
+      return false;
     }
-    pendingSpace = false;
-    if (out.length > lineStart) {
-      out += `
-`;
-      lineStart = out.length;
+    if (lockToken(tomb) !== token) {
+      try {
+        fs12.renameSync(tomb, lock);
+      } catch {}
+      return false;
     }
-  };
-  const regexAllowed = () => {
-    let end = out.length;
-    while (end > 0 && /\s/u.test(out[end - 1]))
-      end -= 1;
-    if (end === 0 || REGEX_AFTER.includes(out[end - 1]))
+    fs12.rmSync(tomb, { recursive: true, force: true });
+    return true;
+  },
+  token: lockToken,
+  reap(lock, observed) {
+    const tomb = `${lock}.reap-${randomBytes3(6).toString("hex")}`;
+    try {
+      fs12.renameSync(lock, tomb);
+    } catch {
+      return false;
+    }
+    if (lockToken(tomb) === observed) {
+      fs12.rmSync(tomb, { recursive: true, force: true });
       return true;
-    let start = end;
-    while (start > 0 && WORD.test(out[start - 1]))
-      start -= 1;
-    return REGEX_KEYWORDS.has(out.slice(start, end));
-  };
-  const scanString = (quote, escapes, multiline) => {
-    const prefix = text.slice(Math.max(0, index - 2), index).match(/[a-z]*$/iu)?.[0] ?? "";
-    const fstring = syntax.fstring === true && /f/iu.test(prefix);
-    let end = index + quote.length;
-    while (end < text.length) {
-      const char = text[end];
-      if (escapes && char === "\\") {
-        end += 2;
-        continue;
-      }
-      if (text.startsWith(quote, end)) {
-        if (fstring && unbalanced(text.slice(index + quote.length, end)))
-          return false;
-        emitVerbatim(text.slice(index, end + quote.length));
-        index = end + quote.length;
-        return true;
-      }
-      if (char === `
-` && !multiline)
-        return false;
-      end += 1;
+    }
+    try {
+      fs12.renameSync(tomb, lock);
+    } catch {
+      fs12.rmSync(tomb, { recursive: true, force: true });
     }
     return false;
-  };
-  while (index < text.length) {
-    const frame = frames[frames.length - 1];
-    const char = text[index];
-    if (frame.kind === "template") {
-      if (char === "\\") {
-        emitVerbatim(text.slice(index, index + 2));
-        index += 2;
-      } else if (char === "`") {
-        emitVerbatim(char);
-        frames.pop();
-        index += 1;
-      } else if (text.startsWith("${", index)) {
-        emitVerbatim("${");
-        frames.push({ kind: "code", braces: 0 });
-        index += 2;
-      } else {
-        out += char;
-        kept = out.length;
-        index += 1;
-      }
-      continue;
-    }
-    if (char === `
-`) {
-      newline();
-      index += 1;
-      continue;
-    }
-    if (SPACE.test(char)) {
-      if (collapse)
-        pendingSpace = true;
-      else
-        out += char;
-      index += 1;
-      continue;
-    }
-    const lineOpener = syntax.line.find((opener) => text.startsWith(opener, index));
-    if (lineOpener) {
-      const end = text.indexOf(`
-`, index);
-      const comment = text.slice(index, end < 0 ? text.length : end);
-      if (DIRECTIVE.test(comment.slice(lineOpener.length)))
-        emitVerbatim(comment);
-      else
-        pendingSpace = true;
-      index = end < 0 ? text.length : end;
-      continue;
-    }
-    const block = syntax.block.find(([open]) => text.startsWith(open, index));
-    if (block) {
-      const end = text.indexOf(block[1], index + block[0].length);
-      if (end < 0)
-        return null;
-      const comment = text.slice(index, end + block[1].length);
-      if (DIRECTIVE.test(comment.slice(block[0].length, -block[1].length)))
-        emitVerbatim(comment);
-      else
-        pendingSpace = true;
-      if (comment.includes(`
-`))
-        newline();
-      index = end + block[1].length;
-      continue;
-    }
-    if (syntax.triple && (char === '"' || char === "'") && text.startsWith(char.repeat(3), index)) {
-      if (!scanString(char.repeat(3), !syntax.literal?.includes(char), true))
-        return null;
-      continue;
-    }
-    if (syntax.quotes.includes(char)) {
-      if (!scanString(char, true, Boolean(syntax.multiline)))
-        return null;
-      continue;
-    }
-    if (syntax.literal?.includes(char)) {
-      if (!scanString(char, false, false))
-        return null;
-      continue;
-    }
-    if (syntax.rawBacktick && char === "`") {
-      if (!scanString("`", false, true))
-        return null;
-      continue;
-    }
-    if (syntax.js && char === "`") {
-      emitVerbatim(char);
-      frames.push({ kind: "template" });
-      index += 1;
+  }
+};
+function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
+  const lock = `${file}.lock`;
+  const deadline = Date.now() + waitMs;
+  let token = null;
+  for (;; ) {
+    token = ledgerLock.acquire(lock);
+    if (token)
+      break;
+    const observed = lockToken(lock);
+    const age = lockAgeMs(lock);
+    if (age !== null && age > LOCK_STALE_MS && ledgerLock.reap(lock, observed))
       continue;
-    }
-    if (syntax.cssUrl && /^url\(\s*[^"')\s]/iu.test(text.slice(index, index + 64)))
+    if (Date.now() >= deadline)
       return null;
-    if (syntax.js && char === "/" && !regexAllowed() && out.trimEnd().endsWith(")")) {
-      const lineEnd = text.indexOf(`
-`, index);
-      if (text.slice(index + 1, lineEnd < 0 ? text.length : lineEnd).includes("/"))
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+  }
+  try {
+    return fn();
+  } finally {
+    ledgerLock.release(lock, token);
+  }
+}
+var sha2562 = (text) => createHash9("sha256").update(text).digest("hex");
+var chainHash = (prevHash, body) => sha2562(`${prevHash ?? ""}
+${body}`);
+var TAIL_BYTES = 64 * 1024;
+var lastLine = (fd, size) => {
+  for (let span = Math.min(size, TAIL_BYTES);span > 0; span = Math.min(size, span * 2)) {
+    const buffer = Buffer.alloc(span);
+    fs12.readSync(fd, buffer, 0, span, size - span);
+    const end = buffer.lastIndexOf(10);
+    if (end < 0) {
+      if (span === size)
         return null;
+      continue;
     }
-    if (syntax.js && char === "/" && regexAllowed()) {
-      let end = index + 1;
-      let inClass = false;
-      while (end < text.length && (inClass || text[end] !== "/")) {
-        if (text[end] === `
-`)
+    let stop = end;
+    let text = "";
+    while (stop >= 0) {
+      const start = buffer.lastIndexOf(10, stop - 1);
+      text = buffer.toString("utf8", start + 1, stop).trim();
+      if (text) {
+        if (start >= 0 || span === size)
+          return text;
+        break;
+      }
+      if (start < 0) {
+        if (span === size)
           return null;
-        if (text[end] === "\\")
-          end += 1;
-        else if (text[end] === "[")
-          inClass = true;
-        else if (text[end] === "]")
-          inClass = false;
-        end += 1;
+        break;
       }
-      if (end >= text.length)
-        return null;
-      emitVerbatim(text.slice(index, end + 1));
-      index = end + 1;
-      continue;
+      stop = start;
     }
-    if (frames.length > 1 && frame.kind === "code") {
-      if (char === "{")
-        frame.braces += 1;
-      else if (char === "}") {
-        if (frame.braces === 0) {
-          emitVerbatim(char);
-          frames.pop();
-          index += 1;
-          continue;
-        }
-        frame.braces -= 1;
+    if (span === size)
+      return text || null;
+  }
+  return null;
+};
+var tighten = (fd) => {
+  try {
+    if ((fs12.fstatSync(fd).mode & 63) !== 0)
+      fs12.fchmodSync(fd, 384);
+  } catch {}
+};
+function appendLine(file, build, options) {
+  const write = () => {
+    const fd = fs12.openSync(file, "a+", 384);
+    try {
+      if (process.platform !== "win32")
+        tighten(fd);
+      const size = fs12.fstatSync(fd).size;
+      let fence = "";
+      if (size > 0) {
+        const last = Buffer.alloc(1);
+        fs12.readSync(fd, last, 0, 1, size - 1);
+        if (last[0] !== 10)
+          fence = `
+`;
       }
+      const line = build(lastLine(fd, size));
+      if (!line.ok)
+        return line;
+      const bytes = Buffer.from(fence + line.value);
+      const written = fs12.writeSync(fd, bytes);
+      if (written !== bytes.length)
+        return err("unavailable", `short write to ${file}: ${written} of ${bytes.length} bytes; the row is torn and will be skipped`);
+      return { ok: true, value: undefined };
+    } finally {
+      fs12.closeSync(fd);
     }
-    emitCode(char);
-    index += 1;
+  };
+  try {
+    fs12.mkdirSync(path15.dirname(file), { recursive: true });
+    if (!options.forceLock && !onNetworkFs(path15.dirname(file)))
+      return write();
+    const locked = withLedgerLock(file, write);
+    return locked ?? err("busy", `ledger lock ${file}.lock is held`, "retry; remove the .lock directory if no workit process is running");
+  } catch (error) {
+    return err("unavailable", `cannot append to ${file}: ${error.message}`);
   }
-  if (frames.length !== 1)
-    return null;
-  newline();
-  return out;
 }
-function unbalanced(body) {
-  let depth = 0;
-  for (const part of body.replaceAll("{{", "").replaceAll("}}", "")) {
-    if (part === "{")
-      depth += 1;
-    else if (part === "}")
-      depth = Math.max(0, depth - 1);
-  }
-  return depth > 0;
+var sealed = (row, id, at, previous) => {
+  const { prevHash: _prev, rowHash: _row, ...fields } = row;
+  const prevHash = previous === null ? null : sha2562(previous);
+  const body = { v: LEDGER_VERSION, id, at, ...fields, prevHash };
+  const full = { ...body, rowHash: chainHash(prevHash, JSON.stringify(body)) };
+  return { full, line: `${JSON.stringify(full)}
+` };
+};
+function appendRaw(cwd, row, options) {
+  const file = ledgerPath(cwd);
+  if (!file.ok)
+    return file;
+  const id = newId2();
+  const at = (options.now ?? new Date).toISOString();
+  let full = null;
+  const written = appendLine(file.value, (previous) => {
+    const next = sealed(row, id, at, previous);
+    const bytes = Buffer.byteLength(next.line);
+    if (bytes > MAX_LINE_BYTES)
+      return err("invalid_input", `ledger row is ${bytes} bytes; the limit is ${MAX_LINE_BYTES}. Shorten the text and pass details by --ref <path|url>`);
+    full = next.full;
+    return { ok: true, value: next.line };
+  }, options);
+  return written.ok ? { ok: true, value: full } : written;
 }
-function hasOpaqueLineBreak(text) {
-  return /\r(?!\n)|[\u2028\u2029]/u.test(text);
+function observedRowBytes(row) {
+  const sample = sealed({ ...row, observer: "workit_cli" }, newId2(), new Date().toISOString(), "");
+  return Buffer.byteLength(sample.line);
 }
-var decoder = new TextDecoder("utf-8", { fatal: true });
-function textOf(bytes) {
-  if (bytes.includes(0))
-    return null;
-  try {
-    return decoder.decode(bytes);
-  } catch {
-    return null;
-  }
-}
-function cosmeticChange(file, before, after) {
-  const left = textOf(before);
-  const right = textOf(after);
-  if (left === null || right === null)
-    return false;
-  if (hasOpaqueLineBreak(left) || hasOpaqueLineBreak(right))
-    return false;
-  const a = substanceOf(file, left);
-  return a !== null && a === substanceOf(file, right);
+function appendObserved(cwd, row, options = {}) {
+  return appendRaw(cwd, { ...row, observer: "workit_cli" }, options);
 }
-
-// packages/workit-core/src/core/policy/lane.ts
-var LANE_THRESHOLDS = {
-  selfMaxLines: 100,
-  selfMaxFiles: 5,
-  fullMinLines: 500
+var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var str2 = (value) => typeof value === "string" ? value : null;
+var normalizeActor = (value) => {
+  const actor = isRecord3(value) ? value : {};
+  return {
+    host: str2(actor.host) ?? "unknown",
+    session: str2(actor.session),
+    agentId: str2(actor.agentId)
+  };
 };
-var RISK_TOKENS = new Set([
-  "auth",
-  "authn",
-  "authz",
-  "oauth",
-  "security",
-  "permission",
-  "permissions",
-  "secret",
-  "secrets",
-  "crypto",
-  "gate",
-  "gates",
-  "policy",
-  "policies",
-  "hook",
-  "hooks",
-  "husky",
-  "lefthook",
-  "release",
-  "releases",
-  "migration",
-  "migrations",
-  "migrate",
-  "workflows"
-]);
-var RISK_FILES = new Set([
-  ".gitlab-ci.yml",
-  "Jenkinsfile",
-  "azure-pipelines.yml",
-  ".pre-commit-config.yaml",
-  ".workit/risk-paths"
-]);
-var RISK_NAMES = new Set([".gitattributes"]);
-var RISK_PATHS_FILE = ".workit/risk-paths";
-var LOCKFILES = new Set([
-  "bun.lock",
-  "bun.lockb",
-  "package-lock.json",
-  "npm-shrinkwrap.json",
-  "yarn.lock",
-  "pnpm-lock.yaml",
-  "Cargo.lock",
-  "go.sum",
-  "poetry.lock",
-  "uv.lock",
-  "Pipfile.lock",
-  "Gemfile.lock",
-  "composer.lock"
-]);
-var DOC_EXT = /\.(?:md|mdx|markdown|rst|adoc|txt)$/iu;
-var DOC_NAMES = /^(?:license|licence|notice|authors|changelog|changes|contributors)$/iu;
-var INSTRUCTIONS = /(?:^|\/)(?:AGENTS|CLAUDE|GEMINI|SKILL)\.md$|(?:^|\/)(?:skills|agents|commands|rules|prompts)\/[^/]+/iu;
-var TEST_PATH = /(?:^|\/)(?:test|tests|__tests__|spec|specs|fixtures)\/|\.(?:test|spec)\.[^/]+$/iu;
-var basename = (file) => file.slice(file.lastIndexOf("/") + 1);
-var isDoc = (file) => !INSTRUCTIONS.test(file) && (DOC_EXT.test(file) || DOC_NAMES.test(basename(file)));
-function kindOf(file) {
-  if (file.binary)
-    return "behavior";
-  if (file.generated)
-    return "generated";
-  if (LOCKFILES.has(basename(file.path)))
-    return "lockfile";
-  if (isDoc(file.path))
-    return "doc";
-  if (file.cosmetic)
-    return "cosmetic";
-  return TEST_PATH.test(file.path) ? "test" : "behavior";
+function supersedeAllowed(by, target, onBranch = (row) => (by.branch ?? null) === (row.branch ?? null)) {
+  if (by.type !== target.type)
+    return `a ${by.type} row cannot supersede a ${target.type} row`;
+  if (!by.actor.session || by.actor.session !== target.actor.session)
+    return "only the session that wrote a row can supersede it";
+  if (!onBranch(target))
+    return `the row is on another branch (${String(target.branch ?? "none")}); a row supersedes only one on its own branch`;
+  if (by.type === "verdict" && (by.kind ?? "review") !== (target.kind ?? "review"))
+    return `a ${String(by.kind ?? "review")} verdict cannot supersede a ${String(target.kind ?? "review")} verdict; record it with --kind ${String(target.kind ?? "review")}`;
+  if (by.type === "verdict" && by.self === true && target.self !== true)
+    return "a self verdict cannot replace an independent verdict";
+  return null;
 }
-var globCache = new Map;
-function globMatch(pattern, file) {
-  let regex = globCache.get(pattern);
-  if (!regex) {
-    let source = "";
-    for (let index = 0;index < pattern.length; index += 1) {
-      const char = pattern[index];
-      if (char === "*" && pattern[index + 1] === "*") {
-        source += pattern[index + 2] === "/" ? "(?:[^/]*/)*" : ".*";
-        index += pattern[index + 2] === "/" ? 2 : 1;
-      } else if (char === "*")
-        source += "[^/]*";
-      else if (char === "?")
-        source += "[^/]";
-      else
-        source += char.replace(/[.+^${}()|[\]\\]/gu, "\\$&");
+function readLedger(cwd, options = {}) {
+  const file = ledgerPath(cwd);
+  if (!file.ok)
+    return file;
+  let text = "";
+  let stat = null;
+  try {
+    stat = fs12.statSync(file.value);
+    text = fs12.readFileSync(file.value, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return {
+        ok: true,
+        value: {
+          path: file.value,
+          rows: [],
+          skipped: 0,
+          integrity: options.integrity ? { chained: 0, legacy: 0, unverified: [] } : null
+        }
+      };
+    return err("unavailable", `cannot read ${file.value}: ${error.message}`);
+  }
+  const rows = [];
+  let skipped = 0;
+  const integrity = { chained: 0, legacy: 0, unverified: [] };
+  const earlier = new Set([null]);
+  let chainStarted = false;
+  const ids = new Set;
+  for (const raw of text.split(`
+`)) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+      continue;
+    const linked = (prevHash) => earlier.has(prevHash);
+    if (options.integrity)
+      earlier.add(sha2562(trimmed));
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      skipped += 1;
+      continue;
     }
-    regex = new RegExp(`^${source}$`, "u");
-    globCache.set(pattern, regex);
+    if (!isRecord3(parsed) || !str2(parsed.id) || !str2(parsed.type) || !str2(parsed.at)) {
+      skipped += 1;
+      continue;
+    }
+    let rowIntegrity = options.integrity ? "verified" : undefined;
+    let reason = null;
+    if (!options.integrity) {} else if (typeof parsed.rowHash === "string") {
+      chainStarted = true;
+      const { rowHash, ...body } = parsed;
+      const prevHash = str2(parsed.prevHash);
+      if (chainHash(prevHash, JSON.stringify(body)) !== rowHash)
+        reason = "hash_mismatch";
+      else if (!linked(prevHash))
+        reason = "broken_link";
+    } else if (chainStarted)
+      reason = "unsigned";
+    else
+      rowIntegrity = "legacy";
+    if (options.integrity && !reason && ids.has(parsed.id))
+      reason = "duplicate_id";
+    if (options.integrity)
+      ids.add(parsed.id);
+    if (reason)
+      rowIntegrity = "unverified";
+    const pr = typeof parsed.pr === "number" && Number.isInteger(parsed.pr) ? parsed.pr : undefined;
+    const row = {
+      ...parsed,
+      v: typeof parsed.v === "number" ? parsed.v : LEDGER_VERSION,
+      id: parsed.id,
+      at: parsed.at,
+      type: parsed.type,
+      actor: normalizeActor(parsed.actor),
+      branch: str2(parsed.branch),
+      head: str2(parsed.head),
+      base: str2(parsed.base),
+      baseSha: str2(parsed.baseSha),
+      patchId: str2(parsed.patchId),
+      diffHash: str2(parsed.diffHash),
+      tree: str2(parsed.tree),
+      dirty: typeof parsed.dirty === "boolean" ? parsed.dirty : null,
+      ...pr === undefined ? {} : { pr },
+      ...str2(parsed.supersedes) ? { supersedes: parsed.supersedes } : {},
+      seq: rows.length + 1,
+      superseded: false,
+      supersedeIgnored: false,
+      ...rowIntegrity ? { integrity: rowIntegrity } : {},
+      ...reason ? { integrityReason: reason } : {}
+    };
+    rows.push(row);
+    if (!options.integrity)
+      continue;
+    if (rowIntegrity === "verified")
+      integrity.chained += 1;
+    else if (rowIntegrity === "legacy")
+      integrity.legacy += 1;
+    else if (reason)
+      integrity.unverified.push({
+        seq: row.seq,
+        id: row.id,
+        type: row.type,
+        branch: row.branch,
+        reason
+      });
   }
-  return regex.test(file) || file.startsWith(`${pattern.replace(/\/$/u, "")}/`);
-}
-function isRiskPath(file, extra = []) {
-  if (extra.some((pattern) => globMatch(pattern, file)))
-    return true;
-  if (RISK_FILES.has(file) || RISK_NAMES.has(basename(file)))
-    return true;
-  if (TEST_PATH.test(file) || isDoc(file))
-    return false;
-  return file.split("/").map((segment, index, all) => index === all.length - 1 ? segment.replace(/\.[^.]+$/u, "") : segment).some((segment) => segment.toLowerCase().split(/[-_.]/u).some((token) => RISK_TOKENS.has(token)));
-}
-var parseRiskPaths = (text) => text.split(`
-`).map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).map((line) => line.replace(/^\//u, ""));
-function computeLane(input) {
-  const riskFiles = input.files.filter((file) => isRiskPath(file.path, input.riskPaths)).map((file) => file.path);
-  const risky = new Set(riskFiles);
-  const kinds = input.files.map((file) => ({
-    file,
-    kind: risky.has(file.path) ? "behavior" : kindOf(file)
-  }));
-  const behavior = kinds.filter((entry) => entry.kind === "behavior" || entry.kind === "test" || entry.kind === "lockfile");
-  const lines = behavior.filter((entry) => entry.kind !== "lockfile").reduce((sum, entry) => sum + entry.file.added + entry.file.deleted, 0);
-  const opaque = behavior.filter((entry) => entry.kind === "lockfile" || entry.file.binary);
-  const result = (lane, reasons) => ({
-    lane,
-    reasons,
-    lines,
-    files: behavior.length,
-    riskFiles
-  });
-  const { selfMaxLines, selfMaxFiles, fullMinLines } = LANE_THRESHOLDS;
-  if (input.riskTier === "high")
-    return result("full", ["the task judgment records high risk"]);
-  if (riskFiles.length)
-    return result("full", [
-      `touches a risk path: ${riskFiles.slice(0, 3).join(", ")}${riskFiles.length > 3 ? ", …" : ""}`
-    ]);
-  if (!behavior.length)
-    return result("none", [
-      input.files.length ? "only docs, comments, formatting or generated copies changed" : "no changes"
-    ]);
-  if (lines >= fullMinLines)
-    return result("full", [`large diff: ${lines} lines (≥ ${fullMinLines})`]);
-  if (lines > selfMaxLines)
-    return result("focused", [`${lines} lines changed (> ${selfMaxLines})`]);
-  if (behavior.length > selfMaxFiles)
-    return result("focused", [`${behavior.length} behavior files changed (> ${selfMaxFiles})`]);
-  if (opaque.length)
-    return result("focused", [
-      `a lockfile or binary changed: ${opaque.slice(0, 3).map((entry) => entry.file.path).join(", ")}${opaque.length > 3 ? ", …" : ""}`
-    ]);
-  return result("self", [
-    `small change: ${lines} line${lines === 1 ? "" : "s"} in ${behavior.length} file${behavior.length === 1 ? "" : "s"}, no risk path`
-  ]);
+  const scopes = new Map;
+  const scopeOf = (branch) => {
+    let scope = scopes.get(branch);
+    if (!scope)
+      scopes.set(branch, scope = branchScope(cwd, branch));
+    return scope;
+  };
+  const byId = new Map;
+  for (const row of rows) {
+    const target = row.supersedes ? byId.get(row.supersedes) : undefined;
+    if (target && row.integrity !== "unverified" && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
+      target.superseded = true;
+    else if (row.supersedes)
+      row.supersedeIgnored = true;
+    if (!byId.has(row.id))
+      byId.set(row.id, row);
+  }
+  if (options.integrity && stat && Buffer.byteLength(text) === stat.size)
+    tamperCache.set(file.value, {
+      size: stat.size,
+      stamp: fileStamp(stat),
+      breaks: integrity.unverified.filter((row) => TAMPER_REASONS.has(row.reason))
+    });
+  return {
+    ok: true,
+    value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null }
+  };
 }
-function untrackedStat(cwd, file) {
+var TAMPER_REASONS = new Set(["hash_mismatch", "broken_link"]);
+var tamperCache = new Map;
+var fileStamp = (stat) => `${stat.ino}:${stat.mtimeMs}:${stat.ctimeMs}`;
+function ledgerTampering(cwd) {
+  const file = ledgerPath(cwd);
+  if (!file.ok)
+    return [];
   try {
-    const bytes = readFileSync4(path16.join(cwd, file));
-    if (bytes.includes(0))
-      return { path: file, added: 0, deleted: 0, binary: true };
-    const text = bytes.toString("utf8");
-    if (hasOpaqueLineBreak(text))
-      return { path: file, added: 0, deleted: 0, binary: true };
-    const lines = text.split(`
-`).length - (text.endsWith(`
-`) ? 1 : 0);
-    return { path: file, added: lines, deleted: 0 };
+    const stat = fs12.statSync(file.value);
+    const cached = tamperCache.get(file.value);
+    if (cached && cached.size === stat.size && cached.stamp === fileStamp(stat))
+      return cached.breaks;
   } catch {
-    return { path: file, added: 0, deleted: 0, binary: true };
+    return [];
   }
+  const read = readLedger(cwd, { integrity: true });
+  return read.ok ? (read.value.integrity?.unverified ?? []).filter((row) => TAMPER_REASONS.has(row.reason)) : [];
 }
-var REGULAR = new Set(["100644", "100755"]);
-var ABSENT = /^0+$/u;
-function cosmeticFiles(cwd, fork, head) {
-  const raw = diffRaw(cwd, fork, head);
-  if (!raw)
-    return null;
-  const candidates = raw.filter((entry) => REGULAR.has(entry.oldMode) && entry.oldMode === entry.newMode && !ABSENT.test(entry.oldBlob) && (head === null || !ABSENT.test(entry.newBlob)));
-  const blobs = readBlobs(cwd, candidates.flatMap((entry) => [entry.oldBlob, entry.newBlob]));
-  if (!blobs)
-    return null;
-  const out = new Set;
-  const opaque = new Set;
-  for (const entry of candidates) {
-    const before = blobs.get(entry.oldBlob);
-    let after = blobs.get(entry.newBlob);
-    if (!after && head === null && ABSENT.test(entry.newBlob))
-      try {
-        after = readFileSync4(path16.join(cwd, entry.path));
-      } catch {
-        after = undefined;
-      }
-    if (before && after && cosmeticChange(entry.path, before, after))
-      out.add(entry.path);
-    else if ([before, after].some((bytes) => bytes && hasOpaqueLineBreak(bytes.toString("utf8"))))
-      opaque.add(entry.path);
+function tamperedUnblock(cwd) {
+  const file = ledgerPath(cwd);
+  const where = file.ok ? file.value : "the ledger file";
+  return `workit ledger verify-integrity  # lists the edited or missing rows; if the edit is understood, move ${where} aside (mv ${where} ${where}.tampered-<date>) and record the verdicts again`;
+}
+var tamperedWarning = (cwd, breaks) => `the ledger was edited, or a row was removed or moved (${breaks.slice(0, 3).map((row) => `${row.reason} at row ${row.seq}`).join(", ")}${breaks.length > 3 ? ", …" : ""}): no verdict is accepted until it is repaired. ${tamperedUnblock(cwd)}`;
+function verdictBasis(verdict, current) {
+  if (verdict.head && verdict.head === current.head)
+    return "fresh";
+  if (verdict.patchId && verdict.patchId === current.patchId && verdict.diffHash && verdict.diffHash === current.diffHash)
+    return "carried";
+  return "stale";
+}
+var isLiveVerdict = (row, retired) => row.type === "verdict" && typeof row.result === "string" && !retired.has(row.id);
+function trailerSessions(cwd, base, head) {
+  if (!base || !head || !safeRef2(base) || !safeRef2(head))
+    return [];
+  const out = git4(cwd, [
+    "log",
+    "--format=%(trailers:key=Workit-Session,valueonly,separator=%x00)",
+    `${base}..${head}`
+  ]);
+  return (out ?? "").split(/[\0\n]/u).map((value) => value.trim()).filter(Boolean);
+}
+var RENAMED = /^branch: renamed refs\/heads\/(.+) to refs\/heads\/(.+)$/iu;
+function branchScope(cwd, branch) {
+  const renamedAt = new Map;
+  let since = Number.NEGATIVE_INFINITY;
+  if (safeRef2(branch)) {
+    const log = git4(cwd, [
+      "log",
+      "-g",
+      "--date=unix",
+      "--format=%gd%x09%gs",
+      `refs/heads/${branch}`,
+      "--"
+    ]);
+    for (const line of (log ?? "").split(`
+`)) {
+      const [selector = "", subject = ""] = line.split("\t");
+      const seconds = Number(/@\{(\d+)\}$/u.exec(selector)?.[1]);
+      if (!Number.isFinite(seconds))
+        continue;
+      since = seconds * 1000;
+      const match = RENAMED.exec(subject);
+      if (!match || match[1] === branch)
+        continue;
+      const until = (seconds + 1) * 1000;
+      renamedAt.set(match[1], Math.max(renamedAt.get(match[1]) ?? 0, until));
+    }
   }
-  return { cosmetic: out, opaque };
+  return (row) => {
+    if (row.branch === branch)
+      return true;
+    const until = row.branch === null ? undefined : renamedAt.get(row.branch);
+    if (until === undefined)
+      return false;
+    const at = Date.parse(row.at);
+    return at >= since && at <= until;
+  };
 }
-function generatedAt(cwd, fork, paths) {
-  const files = treeFilesNamed(cwd, fork, ".gitattributes");
-  const blobs = files?.size ? readBlobs(cwd, [...files.values()]) : null;
-  if (!files || !blobs)
-    return new Set;
-  const texts = new Map;
-  for (const [file, id] of files) {
-    const bytes = blobs.get(id);
-    if (bytes)
-      texts.set(file, bytes.toString("utf8"));
+var renameAwareBranch = (scopeOf, branch) => {
+  return (target) => {
+    const own = typeof branch === "string" ? branch : null;
+    const theirs = typeof target.branch === "string" ? target.branch : null;
+    if (own === theirs)
+      return true;
+    if (own === null || theirs === null || typeof target.at !== "string")
+      return false;
+    return scopeOf(own)({ branch: theirs, at: target.at });
+  };
+};
+function authorSessions(cwd, rows, branch, range = { base: null, head: null }, scope = branchScope(cwd, branch)) {
+  const sessions = new Set;
+  for (const row of rows) {
+    if (!scope(row) || row.type !== "commit.recorded" && row.type !== "task.opened")
+      continue;
+    const session = str2(row.session) ?? row.actor.session;
+    if (session)
+      sessions.add(session);
   }
-  return generatedByAttributes(texts, paths);
+  for (const session of trailerSessions(cwd, range.base, range.head))
+    sessions.add(session);
+  return sessions;
 }
-var forkOf = (cwd, base, head) => mergeBase(cwd, base, head ?? "HEAD");
-function laneFiles(cwd, fork, head) {
-  const stats = diffNumstat(cwd, fork, head);
-  const cosmetic = stats ? cosmeticFiles(cwd, fork, head) : null;
-  if (!stats || !cosmetic)
+var derivesFrom = (derived, bare) => !bare.includes(":") && derived.endsWith(`:${bare}`);
+var authoredBy = (authors, session) => {
+  if (authors.has(session))
+    return true;
+  for (const author of authors)
+    if (derivesFrom(author, session) || derivesFrom(session, author))
+      return true;
+  return false;
+};
+var TRUST_REASONS = new Set([
+  "unsigned",
+  "hash_mismatch",
+  "broken_link",
+  "duplicate_id",
+  "unissued_session",
+  "unbound_session"
+]);
+var SHELL_VOUCHED_HOSTS = new Set([
+  "cli",
+  "opencode",
+  "pi",
+  "codex_cli",
+  "codex_desktop"
+]);
+function sessionTrust(cwd, row) {
+  const session = row.actor.session;
+  if (!session || row.self === true)
     return null;
-  const files = [
-    ...stats.map((entry) => ({
-      ...entry,
-      ...cosmetic.opaque.has(entry.path) ? { binary: true } : {},
-      cosmetic: !entry.binary && cosmetic.cosmetic.has(entry.path)
-    })),
-    ...head === null ? untrackedFiles(cwd).map((file) => untrackedStat(cwd, file)) : []
-  ];
-  const generated = generatedAt(cwd, fork, files.map((entry) => entry.path));
-  return files.map((entry) => ({
-    ...entry,
-    generated: generated.has(entry.path)
-  }));
+  const source = typeof row.sessionSource === "string" ? row.sessionSource : "env";
+  const host = row.actor.host;
+  const issuedOnly = source === "flag" ? host !== "cli" : source === "env" && session.includes(":") && !SHELL_VOUCHED_HOSTS.has(host);
+  if (!issuedOnly)
+    return null;
+  const binding = issuedBinding(cwd, session);
+  if (binding === null)
+    return "unissued_session";
+  return binding === "token" && row.sessionBound !== true ? "unbound_session" : null;
+}
+function trustReasons(cwd, row) {
+  if (row.integrity === "unverified")
+    return [row.integrityReason ?? "unsigned"];
+  if (row.integrity !== "verified")
+    return ["unsigned"];
+  const session = sessionTrust(cwd, row);
+  return session ? [session] : [];
+}
+function withIntegrity(cwd, rows) {
+  if (rows.every((row) => row.integrity !== undefined))
+    return rows;
+  const read = readLedger(cwd, { integrity: true });
+  const bySeq = new Map(read.ok ? read.value.rows.map((row) => [row.seq, row]) : []);
+  return rows.map((row) => {
+    if (row.integrity !== undefined)
+      return row;
+    const fresh = bySeq.get(row.seq);
+    return fresh && fresh.id === row.id && fresh.at === row.at ? fresh : row;
+  });
+}
+var untrusted = (reasons) => reasons.some((reason) => TRUST_REASONS.has(reason));
+var independenceReasons = (row, authors) => {
+  const reasons = [];
+  if (!row.actor.session)
+    reasons.push("no_session");
+  else if (authoredBy(authors, row.actor.session))
+    reasons.push("author_session");
+  if (row.self === true && !reasons.includes("no_session"))
+    reasons.push("self");
+  return reasons;
+};
+function effectiveOf(rows, reasonsOf, sameCode, isCurrent) {
+  let effective = null;
+  for (const row of rows) {
+    if (!effective) {
+      effective = row;
+      continue;
+    }
+    if (untrusted(reasonsOf(row)) && !untrusted(reasonsOf(effective)))
+      continue;
+    const rowIndependent = reasonsOf(row).length === 0;
+    const effIndependent = reasonsOf(effective).length === 0;
+    if (effIndependent && !rowIndependent && isCurrent(effective))
+      continue;
+    if (effIndependent && FAILING.has(String(effective.result)) && row.actor.session === effective.actor.session && sameCode(effective, row))
+      continue;
+    effective = row;
+  }
+  return effective;
+}
+var restackExact = new WeakMap;
+function restackCarries(exactIn, rows, branch, from, to) {
+  if (!from || !to)
+    return false;
+  const exact = (row, fromHead, head) => {
+    if (exactIn === null)
+      return true;
+    const cwd = exactIn;
+    let known = restackExact.get(row);
+    if (known === undefined) {
+      known = typeof row.fromBase === "string" && typeof row.toBase === "string" && sameOwnChange(cwd, {
+        from: fromHead,
+        to: head,
+        fromBase: row.fromBase,
+        toBase: row.toBase
+      });
+      restackExact.set(row, known);
+    }
+    return known;
+  };
+  const edges = new Map;
+  for (const row of rows)
+    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.integrity === "verified" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head && exact(row, row.fromHead, row.head))
+      edges.set(row.fromHead, [...edges.get(row.fromHead) ?? [], row.head]);
+  const seen = new Set([from]);
+  const queue = [from];
+  while (queue.length) {
+    const next = queue.shift();
+    if (next === to)
+      return true;
+    for (const target of edges.get(next) ?? [])
+      if (!seen.has(target)) {
+        seen.add(target);
+        queue.push(target);
+      }
+  }
+  return false;
 }
-function branchLane(cwd, options) {
-  const candidates = options.base ? [`origin/${options.base}`, options.base] : [];
-  const base = candidates.find((ref) => resolveRef(cwd, ref) !== null) ?? defaultBase(cwd) ?? null;
-  const head = options.workingTree ? null : options.head;
-  const fork = base && (options.workingTree || options.head) ? forkOf(cwd, base, head) : null;
-  const files = fork ? laneFiles(cwd, fork, head) : null;
-  const riskTier = options.judgment?.riskTier ?? null;
-  if (!fork || !files) {
-    const high = riskTier === "high";
-    return {
-      lane: high ? "full" : "focused",
-      reasons: [
-        `the diff of ${options.head?.slice(0, 12) ?? "(no head)"} against ${base ?? "(no base)"} cannot be read`,
-        ...high ? ["the task judgment records high risk"] : []
-      ],
-      lines: 0,
-      files: 0,
-      riskFiles: [],
-      base,
-      head: options.head
-    };
+function checkVerdicts(cwd, branch, ledgerRows) {
+  const rows = withIntegrity(cwd, ledgerRows);
+  const head = branchHead(cwd, branch);
+  const fallbackBase = defaultBase(cwd);
+  const scope = branchScope(cwd, branch);
+  const keyCache = new Map;
+  const keysAt = (base, at) => {
+    if (!base || !at)
+      return { patchId: null, diffHash: null };
+    const cacheKey = `${base}\x00${at}`;
+    let key = keyCache.get(cacheKey);
+    if (!key) {
+      key = { patchId: patchId(cwd, base, at), diffHash: diffHash(cwd, base, at) };
+      keyCache.set(cacheKey, key);
+    }
+    return key;
+  };
+  const keyFor = (base) => keysAt(base, head);
+  const driftCache = new Map;
+  const driftOf = (row) => {
+    if (driftCache.has(row))
+      return driftCache.get(row) ?? null;
+    let drift = null;
+    const toBase = row.base ?? fallbackBase;
+    const toBaseSha = toBase ? resolveCommit(cwd, toBase) : null;
+    const fromBase = row.baseSha ?? toBaseSha;
+    if (row.head && head && row.head !== head && toBaseSha && fromBase && !untrusted(reasonsOf(row)))
+      drift = verdictDrift(cwd, {
+        from: row.head,
+        to: head,
+        fromBase,
+        toBase: toBaseSha,
+        kind: typeof row.kind === "string" ? row.kind : "review"
+      });
+    driftCache.set(row, drift);
+    return drift;
+  };
+  const exactCache = new Map;
+  const exactCarry = (row) => {
+    if (FAILING.has(String(row.result)))
+      return true;
+    let exact = exactCache.get(row);
+    if (exact === undefined) {
+      const toBase = row.base ?? fallbackBase;
+      const toBaseSha = toBase ? resolveCommit(cwd, toBase) : null;
+      const fromBase = row.baseSha ?? toBaseSha;
+      exact = Boolean(row.head && head && toBaseSha && fromBase && sameOwnChange(cwd, { from: row.head, to: head, fromBase, toBase: toBaseSha }));
+      exactCache.set(row, exact);
+    }
+    return exact;
+  };
+  const keyBasis = (row) => {
+    const basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
+    return basis === "carried" && !exactCarry(row) ? "stale" : basis;
+  };
+  const restacked = (row) => restackCarries(FAILING.has(String(row.result)) ? null : cwd, rows, branch, row.head, head);
+  const carryOf = (row) => {
+    if (keyBasis(row) !== "stale")
+      return null;
+    if (restacked(row))
+      return null;
+    const drift = driftOf(row);
+    return drift?.carries ? { rule: drift.rule, since: drift.since, files: drift.files } : null;
+  };
+  const basisOf = (row) => {
+    const basis = keyBasis(row);
+    if (basis !== "stale")
+      return basis;
+    return restacked(row) || carryOf(row) ? "carried" : basis;
+  };
+  const sameCode = (failed, row) => {
+    if (failed.head && failed.head === row.head)
+      return true;
+    const base = failed.base ?? fallbackBase;
+    const stored = (row.base ?? fallbackBase) === base && row.baseSha !== null && row.baseSha === failed.baseSha;
+    const keys = stored ? { patchId: row.patchId, diffHash: row.diffHash } : keysAt(base, row.head);
+    return verdictBasis(failed, { head: row.head, ...keys }) !== "stale" || restackCarries(null, rows, branch, failed.head, row.head);
+  };
+  const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head }, scope);
+  const failureAuthorCache = new Map;
+  const failureAuthors = (row) => {
+    let set = failureAuthorCache.get(row.seq);
+    if (!set) {
+      set = authorSessions(cwd, rows.filter((other) => other.integrity === "verified" && other.seq < row.seq), branch, { base: null, head: null }, scope);
+      failureAuthorCache.set(row.seq, set);
+    }
+    return set;
+  };
+  const reasonCache = new Map;
+  const reasonsOf = (row) => {
+    let reasons = reasonCache.get(row);
+    if (!reasons) {
+      const failing = FAILING.has(String(row.result));
+      reasons = [
+        ...trustReasons(cwd, row),
+        ...independenceReasons(row, failing ? failureAuthors(row) : authors)
+      ];
+      reasonCache.set(row, reasons);
+    }
+    return reasons;
+  };
+  const retired = new Set;
+  for (const row of rows)
+    if (row.type === "verdict" && row.supersedes && !row.supersedeIgnored && trustReasons(cwd, row).length === 0)
+      retired.add(row.supersedes);
+  const byKind = new Map;
+  for (const row of rows)
+    if (isLiveVerdict(row, retired) && scope(row)) {
+      const kind = typeof row.kind === "string" ? row.kind : "review";
+      byKind.set(kind, [...byKind.get(kind) ?? [], row]);
+    }
+  const verdicts = [];
+  const warnings = [];
+  for (const [kind, list] of byKind) {
+    const row = effectiveOf(list, reasonsOf, sameCode, (candidate) => basisOf(candidate) !== "stale");
+    if (!row)
+      continue;
+    const basis = basisOf(row);
+    const current = basis !== "stale";
+    const independence = reasonsOf(row);
+    const reasons = [
+      ...current ? [] : ["stale"],
+      ...PASSING.has(String(row.result)) ? [] : ["not_passing"],
+      ...independence
+    ];
+    verdicts.push({
+      kind,
+      basis,
+      current,
+      independent: independence.length === 0,
+      accepted: reasons.length === 0,
+      reasons,
+      carry: basis === "carried" ? carryOf(row) : null,
+      verdict: row
+    });
+    if (reasons.length === 0) {
+      for (const later of list)
+        if (later.seq > row.seq && reasonsOf(later).length > 0 && !untrusted(reasonsOf(later)) && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
+          warnings.push(`the author's own (self) ${String(later.result)} ${kind} verdict ${later.id} by ${later.actor.session ?? "no session"} on the current code is newer than the accepted pass ${row.id}: read it before merging`);
+    }
   }
-  const repoRisk = parseRiskPaths(fileAt(cwd, fork, RISK_PATHS_FILE) ?? "");
+  for (const row of rows)
+    if (row.integrity === "unverified" && scope(row))
+      warnings.push(`ledger row ${row.id} (${row.type}) on ${row.branch ?? branch} is unverified: the workit CLI did not write it or it changed afterwards (workit ledger verify-integrity)`);
+  const tampered = ledgerTampering(cwd);
+  if (tampered.length) {
+    warnings.push(tamperedWarning(cwd, tampered));
+    for (const entry of verdicts) {
+      entry.accepted = false;
+      entry.reasons = [...entry.reasons, "ledger_tampered"];
+    }
+  }
+  verdicts.sort((a, b) => a.verdict.seq - b.verdict.seq);
+  const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
+  const failing = verdicts.find((entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)));
+  const newestAccepted = verdicts.findLast((entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result))) ?? null;
+  const accepted = tampered.length ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
+    accepted: false,
+    verdict: failing?.verdict ?? null,
+    reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
+  };
+  const latestSelf = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && !untrusted(entry.reasons) && (STRONG_RESULTS.has(String(entry.verdict.result)) || FAILING.has(String(entry.verdict.result))));
+  const selfEntry = latestSelf && STRONG_RESULTS.has(String(latestSelf.verdict.result)) ? latestSelf : undefined;
+  const carryEntry = verdicts.find((entry) => entry.verdict === accepted.verdict && entry.accepted) ?? newestCurrent;
+  const lastPass = accepted.accepted || failing || tampered.length ? undefined : verdicts.findLast((entry) => !entry.current && !untrusted(entry.reasons) && STRONG_RESULTS.has(String(entry.verdict.result)));
+  const drift = lastPass ? driftOf(lastPass.verdict) : null;
+  const reverify = drift && !drift.carries && drift.focused && drift.files ? { scope: "focused", since: drift.since, files: drift.files } : null;
   return {
-    ...computeLane({
-      files,
-      riskTier,
-      riskPaths: [...repoRisk, ...options.riskPaths ?? []]
-    }),
-    base,
-    head: options.head
+    branch,
+    head,
+    review: accepted.accepted ? "verified" : selfEntry ? "self-reviewed" : "unreviewed",
+    selfVerdict: accepted.accepted ? null : selfEntry?.verdict ?? null,
+    base: newestCurrent?.verdict.base ?? fallbackBase,
+    patchId: keyFor(newestCurrent?.verdict.base ?? fallbackBase).patchId,
+    current: { basis: newestCurrent?.basis ?? "none", verdict: newestCurrent?.verdict ?? null },
+    carry: carryEntry?.carry ?? null,
+    reverify,
+    accepted,
+    verdicts,
+    authors: [...authors].toSorted(),
+    warnings
   };
 }
-var laneNeed = (lane) => lane === "none" ? "none" : lane === "self" ? "self" : "non-author";
+var OBSERVED_ONLY = new Set([
+  "check",
+  "merge.unverified",
+  "policy.judged",
+  ...PR_ROW_TYPES
+]);
 
 // packages/workit-core/src/core/policy/derive.ts
 var RULES = {
@@ -20977,7 +21103,7 @@ var productDecision = (task, ledger) => {
   };
 };
 var planRecorded = (task, root) => {
-  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync5(path17.resolve(root, ref.path)));
+  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync5(path16.resolve(root, ref.path)));
   if (cited)
     return {
       met: true,
@@ -21044,14 +21170,14 @@ function derivedRuleStatus(task, requirement, root, ledger) {
 
 // packages/workit-core/src/core/task-evaluation.ts
 var digestBytes = (value) => createHash10("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path18.sep}`);
-var relative = (root, candidate) => path18.relative(root, candidate).split(path18.sep).join("/") || ".";
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path17.sep}`);
+var relative = (root, candidate) => path17.relative(root, candidate).split(path17.sep).join("/") || ".";
 var canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path18.posix.normalize(value);
+  const normalized = path17.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -21087,7 +21213,7 @@ var compareCodeUnits2 = (left, right) => {
   return left.length - right.length;
 };
 var gitPaths = (root) => {
-  const result = spawnSync11("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const result = spawnSync10("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     encoding: "buffer"
   });
@@ -21099,21 +21225,21 @@ var gitPaths = (root) => {
       git: !/not a git repository/i.test(stderr)
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path18.sep).join("/")) : [];
-  const stagedDeleted = spawnSync11("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")) : [];
+  const stagedDeleted = spawnSync10("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path18.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 };
 var walk = (root, directory, output) => {
   let names;
   try {
-    names = fs14.readdirSync(directory);
+    names = fs13.readdirSync(directory);
   } catch {
     return true;
   }
@@ -21121,10 +21247,10 @@ var walk = (root, directory, output) => {
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path18.join(directory, name);
+    const target = path17.join(directory, name);
     let stat;
     try {
-      stat = fs14.lstatSync(target);
+      stat = fs13.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -21139,14 +21265,14 @@ var walk = (root, directory, output) => {
 var scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path18.resolve(root, item);
+    const target = path17.resolve(root, item);
     if (!inside(root, target))
       return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
-    while (!fs14.existsSync(ancestor) && ancestor !== root)
-      ancestor = path18.dirname(ancestor);
+    while (!fs13.existsSync(ancestor) && ancestor !== root)
+      ancestor = path17.dirname(ancestor);
     try {
-      if (!inside(root, fs14.realpathSync(ancestor)))
+      if (!inside(root, fs13.realpathSync(ancestor)))
         return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
     } catch {
       return failure2("invalid_input", `candidate scope cannot be inspected: ${item}`);
@@ -21158,7 +21284,7 @@ var scopeRoots = (root, scope) => {
 function captureCandidate(root, scope, environment = []) {
   let checkout;
   try {
-    checkout = fs14.realpathSync(root);
+    checkout = fs13.realpathSync(root);
   } catch {
     return failure2("invalid_input", "candidate root does not exist");
   }
@@ -21176,11 +21302,11 @@ function captureCandidate(root, scope, environment = []) {
     if (item === ".git" || item === ".workit")
       continue;
     names.add(item);
-    if (!fs14.existsSync(target))
+    if (!fs13.existsSync(target))
       continue;
     let stat;
     try {
-      stat = fs14.lstatSync(target);
+      stat = fs13.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -21196,17 +21322,17 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path18.join(checkout, item);
+    const target = path17.join(checkout, item);
     try {
-      const stat = fs14.lstatSync(target);
+      const stat = fs13.lstatSync(target);
       if (stat.isSymbolicLink()) {
-        const link = fs14.readlinkSync(target);
+        const link = fs13.readlinkSync(target);
         files.push({ path: item, kind: "symlink", digest: digestBytes(link), executable: null });
       } else if (stat.isFile()) {
         files.push({
           path: item,
           kind: "file",
-          digest: digestBytes(fs14.readFileSync(target)),
+          digest: digestBytes(fs13.readFileSync(target)),
           executable: (stat.mode & 73) !== 0
         });
       } else if (!stat.isDirectory()) {
@@ -21231,7 +21357,7 @@ function captureCandidate(root, scope, environment = []) {
   const values = supplied.toSorted((left, right) => compareCodeUnits2(left.name, right.name)).map(({ name, value }) => ({ name, value, refs: [] }));
   if (values.some(({ value }) => value === null))
     completeness = "uncertain";
-  const headResult = spawnSync11("git", ["rev-parse", "HEAD"], { cwd: checkout, encoding: "utf8" });
+  const headResult = spawnSync10("git", ["rev-parse", "HEAD"], { cwd: checkout, encoding: "utf8" });
   if (headResult.status !== 0 && !/not a git repository/i.test(headResult.stderr ?? ""))
     completeness = "uncertain";
   const head = headResult.status === 0 ? headResult.stdout.trim() : null;
@@ -21371,7 +21497,7 @@ var findingVerificationPasses = (findingCandidateId, evidence) => evidence.statu
 var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
   let root;
   try {
-    root = fs14.realpathSync(checkoutRoot);
+    root = fs13.realpathSync(checkoutRoot);
   } catch {
     return failure2("permission_denied", "checkout root is unavailable");
   }
@@ -21380,23 +21506,23 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
       continue;
     if (!reference.digest)
       return failure2("invalid_input", "document references require a byte digest");
-    const target = path18.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path18.sep}`))
+    const target = path17.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path17.sep}`))
       return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const below = path18.relative(root, target);
+      const below = path17.relative(root, target);
       let current = root;
-      for (const segment of below.split(path18.sep)) {
+      for (const segment of below.split(path17.sep)) {
         if (!segment)
           continue;
-        current = path18.join(current, segment);
-        const stat = fs14.lstatSync(current);
-        const real = fs14.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path18.sep}`))
+        current = path17.join(current, segment);
+        const stat = fs13.lstatSync(current);
+        const real = fs13.realpathSync(current);
+        if (real !== root && !real.startsWith(`${root}${path17.sep}`))
           return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -21412,7 +21538,7 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
         if (current !== target && !stat.isDirectory())
           return failure2("invalid_input", "document reference ancestor is not a directory");
       }
-      if (digestBytes(fs14.readFileSync(target)) !== reference.digest)
+      if (digestBytes(fs13.readFileSync(target)) !== reference.digest)
         return failure2("permission_denied", "decision document bytes have changed");
     } catch {
       return failure2("invalid_input", "decision document is unavailable");
@@ -22255,7 +22381,7 @@ var judgeInputSummary = (raw) => {
 
 // packages/workit-core/src/autonomy.ts
 import os4 from "node:os";
-import path19 from "node:path";
+import path18 from "node:path";
 var accountHome = () => {
   try {
     return os4.userInfo().homedir;
@@ -22264,10 +22390,10 @@ var accountHome = () => {
   }
 };
 var grantsHome = { resolve: accountHome };
-var grantsDir = () => path19.join(grantsHome.resolve(), ".config", "workit");
+var grantsDir = () => path18.join(grantsHome.resolve(), ".config", "workit");
 var grantsOverride = () => {
-  const configured = path19.resolve(resolveConfigDir());
-  return configured === path19.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path19.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
+  const configured = path18.resolve(resolveConfigDir());
+  return configured === path18.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path18.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
 };
 var GRANT_KINDS = ["push", "pr", "merge", "release", "rerun"];
 var DEFAULT_GRANTS = Object.freeze({
@@ -24076,9 +24202,9 @@ class WorkitCore {
   }
 }
 // packages/workit-core/src/core/repo-context.ts
-import { spawnSync as spawnSync12 } from "node:child_process";
+import { spawnSync as spawnSync11 } from "node:child_process";
 import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync as readdirSync4 } from "node:fs";
-import path20 from "node:path";
+import path19 from "node:path";
 var isSafeContextRange = (value) => value.length <= 4096 && (() => {
   try {
     gitRevisionParts(value);
@@ -24105,7 +24231,7 @@ var invalidRange = (cwd) => ({
   cwd
 });
 var runGit = (cwd, args) => {
-  const result = spawnSync12("git", args, { cwd, encoding: "utf8" });
+  const result = spawnSync11("git", args, { cwd, encoding: "utf8" });
   return {
     stdout: (result.stdout ?? "").trimEnd(),
     stderr: (result.stderr ?? "").trimEnd(),
@@ -24212,7 +24338,7 @@ var findPrTemplate = (cwd) => {
   ]) {
     const parts = rel.split("/");
     const base = parts[parts.length - 1];
-    const dir = parts.length > 1 ? path20.join(cwd, ...parts.slice(0, -1)) : cwd;
+    const dir = parts.length > 1 ? path19.join(cwd, ...parts.slice(0, -1)) : cwd;
     const actual = probeCaseInsensitive(dir, base);
     if (actual)
       return [...parts.slice(0, -1), actual].join("/");
@@ -24243,7 +24369,7 @@ var diffStatForRange = (cwd, range) => {
   return runGit(cwd, ["diff", "--stat", "--"]).stdout;
 };
 var packageScripts = (cwd, keys) => {
-  const pkgPath = path20.join(cwd, "package.json");
+  const pkgPath = path19.join(cwd, "package.json");
   if (!existsSync7(pkgPath))
     return [];
   try {
@@ -24269,9 +24395,9 @@ var documentationFiles = (cwd) => {
       if (entry.isDirectory()) {
         if (excluded.has(entry.name))
           continue;
-        walk(path20.join(dir, entry.name), depth + 1);
+        walk(path19.join(dir, entry.name), depth + 1);
       } else if (entry.isFile() && (entry.name === "README.md" || entry.name.endsWith(".md"))) {
-        matches.push("./" + path20.relative(cwd, path20.join(dir, entry.name)).replaceAll("\\", "/"));
+        matches.push("./" + path19.relative(cwd, path19.join(dir, entry.name)).replaceAll("\\", "/"));
       }
     }
   };
@@ -24287,7 +24413,7 @@ var readTrimmed2 = (file, maxLines) => {
 `);
 };
 function prReadyContext(root, range) {
-  const cwd = path20.resolve(repoRoot(root));
+  const cwd = path19.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   let stdout = "";
@@ -24345,7 +24471,7 @@ ${status.stderr}` : "");
     stdout += `template_path: ${template}
 
 `;
-    stdout += readTrimmed2(path20.join(cwd, template), 220);
+    stdout += readTrimmed2(path19.join(cwd, template), 220);
   } else {
     stdout += `template_path: none
 
@@ -24355,7 +24481,7 @@ ${status.stderr}` : "");
   stdout += `
 `;
   stdout += printSection("Recent Validation Signals");
-  if (existsSync7(path20.join(cwd, "package.json"))) {
+  if (existsSync7(path19.join(cwd, "package.json"))) {
     stdout += `package.json detected. Common scripts:
 `;
     const found = packageScripts(cwd, ["lint", "format:check", "test", "build"]);
@@ -24364,7 +24490,7 @@ ${status.stderr}` : "");
 `) + `
 `;
   }
-  if (existsSync7(path20.join(cwd, "Cargo.toml")) || existsSync7(path20.join(cwd, "src-tauri/Cargo.toml"))) {
+  if (existsSync7(path19.join(cwd, "Cargo.toml")) || existsSync7(path19.join(cwd, "src-tauri/Cargo.toml"))) {
     stdout += `Rust project detected.
 `;
   }
@@ -24397,7 +24523,7 @@ var CHANGELOG_RULES = `- Use an [Unreleased] section.
 - Apply with the host-native editor, preserving the repository changelog conventions.
 - If Unreleased already has duplicate category headings, normalize_only first.`;
 function changelogContext(root, range) {
-  const cwd = path20.resolve(repoRoot(root));
+  const cwd = path19.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -24415,7 +24541,7 @@ function changelogContext(root, range) {
   stdout += CHANGELOG_RULES + `
 `;
   stdout += printSection("Existing CHANGELOG.md");
-  const changelogPath = path20.join(cwd, "CHANGELOG.md");
+  const changelogPath = path19.join(cwd, "CHANGELOG.md");
   if (existsSync7(changelogPath)) {
     stdout += readTrimmed2(changelogPath, 260) + `
 `;
@@ -24435,7 +24561,7 @@ function changelogContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function docsRefreshContext(root, range) {
-  const cwd = path20.resolve(repoRoot(root));
+  const cwd = path19.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -24457,7 +24583,7 @@ function docsRefreshContext(root, range) {
 `) + `
 `;
   stdout += printSection("README Preview");
-  const readme = path20.join(cwd, "README.md");
+  const readme = path19.join(cwd, "README.md");
   if (existsSync7(readme)) {
     stdout += readTrimmed2(readme, 220) + `
 `;
@@ -24466,7 +24592,7 @@ function docsRefreshContext(root, range) {
 `;
   }
   stdout += printSection("Package Scripts");
-  const pkgPath = path20.join(cwd, "package.json");
+  const pkgPath = path19.join(cwd, "package.json");
   if (existsSync7(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
@@ -24480,7 +24606,7 @@ function docsRefreshContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function releaseNotesContext(root, rangeOrTag) {
-  const cwd = path20.resolve(repoRoot(root));
+  const cwd = path19.resolve(repoRoot(root));
   if (!rangeOrTag) {
     return { stdout: "", stderr: `ERROR: release tag or range required
 `, exitCode: 1, cwd };
@@ -24518,7 +24644,7 @@ function releaseNotesContext(root, rangeOrTag) {
 `;
   stdout += printSection("Existing Release Files");
   for (const rel of ["CHANGELOG.md", "RELEASE_NOTES.md", ".github/releases.md"]) {
-    if (existsSync7(path20.join(cwd, rel)))
+    if (existsSync7(path19.join(cwd, rel)))
       stdout += rel + `
 `;
   }
@@ -24547,6 +24673,46 @@ function releaseNotesContext(root, rangeOrTag) {
 
 // packages/workit-core/src/core/tracker-issues.ts
 import { spawnSync as spawnSync13 } from "node:child_process";
+
+// packages/workit-core/src/core/pr-create.ts
+import fs14 from "node:fs";
+import path20 from "node:path";
+import { spawnSync as spawnSync12 } from "node:child_process";
+// packages/workit-core/src/forge/pr-body.ts
+function parseGhIssue(value) {
+  const m = /issues\/(\d+)/.exec(value);
+  return m ? m[1] : String(value).trim().replace(/^#/, "");
+}
+
+// packages/workit-core/src/core/pr-create.ts
+function whichOnPath(tool) {
+  const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
+  for (const dir of (process.env.PATH ?? "").split(path20.delimiter)) {
+    if (!dir)
+      continue;
+    for (const name of names) {
+      const candidate = path20.join(dir, name);
+      try {
+        fs14.accessSync(candidate, fs14.constants.X_OK);
+        return candidate;
+      } catch {}
+    }
+  }
+  return null;
+}
+var hostingCliAvailable = (provider) => whichOnPath(provider === "gitlab" ? "glab" : "gh") !== null;
+var pushRemote = (cwd) => {
+  const result = spawnSync12("git", ["remote", "get-url", "--push", "--all", "origin"], {
+    cwd,
+    encoding: "utf8"
+  });
+  if (result.status !== 0)
+    return null;
+  const urls = (result.stdout ?? "").split(/\r?\n/u).map((url) => url.trim()).filter(Boolean);
+  return urls.length === 1 ? urls[0] : null;
+};
+
+// packages/workit-core/src/core/tracker-issues.ts
 var repoPathFromRemote = (remote) => {
   let rest = (remote || "").trim().replace(/\/+$/, "");
   if (!rest)
@@ -27810,6 +27976,25 @@ var capabilitiesFor = (descriptor, observed = {}) => descriptor.capabilities.map
 var signals = new Map;
 var cache = new Map;
 var TURN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+// packages/workit-core/src/hooks/delivery-verbs.ts
+var WORKIT_ALLOWED_VERBS = [
+  "git",
+  "pr",
+  "ci",
+  "stack",
+  "release",
+  "task",
+  "ledger",
+  "evidence",
+  "finding",
+  "decision",
+  "worker",
+  "verify-delivery",
+  "policy",
+  "doctor",
+  "help"
+];
+var ALLOWED = new Set(WORKIT_ALLOWED_VERBS);
 // packages/workit-core/src/core/heavy.ts
 var INFO_FLAGS = new Set(["--version", "-v", "-V", "--help", "-h", "help", "version"]);
 var sub = (...names) => new Set(names);
@@ -28018,6 +28203,10 @@ var WRITE_TOOLS = new Set([
 // packages/workit-core/src/hooks/standing.ts
 var sinceStart = new Map;
 // packages/workit-core/src/hooks/cwd-normalize.ts
+var DIR = String.raw`[A-Za-z0-9_./@%+:,=-]+|'[^'$${"`"}\\\n]*'|"[^"$${"`"}\\!\n]*"`;
+var COMPOUND = new RegExp(String.raw`^\s*cd\s+(${DIR})\s*&&\s*(workit(?:\s[\s\S]*)?)$`, "u");
+var GLOBALS_FIRST = new RegExp(String.raw`^(\s*workit)((?:\s+(?:--json|--cwd(?:=|\s+)(?:${DIR})))+)\s+([a-z][a-z-]*)(?=\s|$)`, "u");
+var VERBS = new Set(WORKIT_ALLOWED_VERBS);
 var FILTERS = new Set(["tail", "head", "grep"]);
 
 // packages/workit-core/src/hooks/worktree-confine.ts
@@ -28186,6 +28375,92 @@ var codexCapabilities = (host, availability = {}) => capabilitiesFor(codexDescri
 if (false)
   ;
 
+// packages/workit-core/src/core/role-models.ts
+var MODEL_ROLES = [
+  "decider",
+  "implementer",
+  "verifier",
+  "reviewer",
+  "explore",
+  "babysit"
+];
+var MODEL_TIERS = ["mundane", "standard", "hard"];
+var HOST_KEYS = new Set([
+  "claude_code",
+  "opencode",
+  "codex",
+  "codex_cli",
+  "codex_desktop",
+  "cursor",
+  "pi",
+  "default"
+]);
+var BUILT_IN_CLAUDE_CODE = {
+  decider: { model: "fable", effort: "high" },
+  "implementer.hard": { model: "opus" },
+  "implementer.standard": { model: "sonnet" },
+  "implementer.mundane": { model: "haiku" },
+  verifier: { model: "sonnet" },
+  reviewer: { model: "opus" },
+  explore: { model: "haiku" },
+  babysit: { model: "haiku" }
+};
+var isObject7 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var name = (value) => typeof value === "string" && value.trim() ? value.trim() : null;
+var leaf = (value) => {
+  const text = name(value);
+  if (text)
+    return { model: text, effort: null };
+  if (!isObject7(value))
+    return null;
+  const model = name(value.model);
+  return model ? { model, effort: name(value.effort) } : null;
+};
+var isFlat = (value) => typeof value === "string" || isObject7(value) && Object.hasOwn(value, "model");
+var forHost = (value, host) => {
+  if (isFlat(value))
+    return leaf(value);
+  if (!isObject7(value))
+    return null;
+  const family = host ? hostFamily(host) : null;
+  for (const key of [family, host, "default"])
+    if (key && Object.hasOwn(value, key)) {
+      const found = leaf(value[key]);
+      if (found)
+        return found;
+    }
+  return null;
+};
+var rolesOf = (models) => isObject7(models) && isObject7(models.roles) ? models.roles : null;
+var resolveRoleModel = (cwd, selector, host, dir) => {
+  const { role, tier } = selector;
+  for (const source of modelSources(cwd, dir)) {
+    const where = source.global ? "the global default" : `workspace ${source.name}`;
+    const roles = rolesOf(source.models);
+    const configured = roles && Object.hasOwn(roles, role) ? roles[role] : undefined;
+    const fromRoles = role === "implementer" ? tier && isObject7(configured) && Object.hasOwn(configured, tier) ? forHost(configured[tier], host) : null : forHost(configured, host);
+    if (fromRoles)
+      return { ...fromRoles, source: `models.roles in ${where}` };
+    if (role === "implementer" && tier && isObject7(source.tierModels)) {
+      const fromTiers = Object.hasOwn(source.tierModels, tier) ? forHost(source.tierModels[tier], host) : null;
+      if (fromTiers)
+        return { model: fromTiers.model, effort: null, source: `fanout.tierModels in ${where}` };
+    }
+  }
+  if (host && hostFamily(host) === "claude_code") {
+    const builtIn = BUILT_IN_CLAUDE_CODE[tier ? `${role}.${tier}` : role];
+    if (builtIn)
+      return { model: builtIn.model, effort: builtIn.effort ?? null, source: "built-in" };
+  }
+  return null;
+};
+var uniformImplementerModel = (cwd, host, dir) => {
+  const tiers = MODEL_TIERS.map((tier) => resolveRoleModel(cwd, { role: "implementer", tier }, host, dir));
+  const [first] = tiers;
+  return first && tiers.every((t) => t?.model === first.model && t.effort === first.effort) ? first : null;
+};
+var ROLE_SELECTORS = MODEL_ROLES.flatMap((role) => role === "implementer" ? MODEL_TIERS.map((tier) => ({ role, tier })) : [{ role }]);
+
 // packages/workit-codex/scripts/agents.ts
 import {
   existsSync as existsSync10,
@@ -28199,13 +28474,26 @@ import {
 } from "node:fs";
 import os5 from "node:os";
 import path25 from "node:path";
+var CODEX_AGENT_ROLES = ["verifier", "reviewer", "implementer"];
 var CODEX_AGENT_MARKER = "# Generated by Workit";
+var codexAgentName = (role) => `workit-${role}`;
+var codexAgentFile = (role) => `${codexAgentName(role)}.toml`;
+var tomlString = (value) => JSON.stringify(value);
 var codexHomeOfInstall = (pluginRoot) => {
   const parts = path25.resolve(pluginRoot).split(path25.sep);
   const cache = parts.length - 4;
   return cache >= 2 && parts[cache] === "cache" && parts[cache - 1] === "plugins" ? parts.slice(0, cache - 1).join(path25.sep) || path25.sep : null;
 };
 var codexHomeFor = (pluginRoot, env) => codexHomeOfInstall(pluginRoot) ?? (env.CODEX_HOME || path25.join(env.HOME || os5.homedir(), ".codex"));
+var withRoleModel = (content, file, models) => {
+  const role = CODEX_AGENT_ROLES.find((candidate) => codexAgentFile(candidate) === file);
+  const chosen = role ? models[role] : undefined;
+  if (!chosen)
+    return content;
+  return content.replace(/^(description = .*)$/m, (line) => `${line}
+model = ${tomlString(chosen.model)}${chosen.effort ? `
+model_reasoning_effort = ${tomlString(chosen.effort)}` : ""}`);
+};
 var MARKER_VERSION = /^# Generated by Workit (\d+\.\d+\.\d+)\b/;
 var agentMarkerVersion = (text) => MARKER_VERSION.exec(text)?.[1] ?? null;
 var stampCodexAgent = (content, version) => version && content.startsWith(CODEX_AGENT_MARKER) && !agentMarkerVersion(content) ? `${CODEX_AGENT_MARKER} ${version}${content.slice(CODEX_AGENT_MARKER.length)}` : content;
@@ -28232,7 +28520,7 @@ var lstatOrNull = (file) => {
     return null;
   }
 };
-var installCodexAgents = (pluginRoot, codexHome) => {
+var installCodexAgents = (pluginRoot, codexHome, models = {}) => {
   const source = path25.join(pluginRoot, "agents");
   if (!existsSync10(source))
     return [];
@@ -28240,7 +28528,7 @@ var installCodexAgents = (pluginRoot, codexHome) => {
   const target = path25.join(codexHome, "agents");
   const results = [];
   for (const file of readdirSync5(source).filter((name) => name.endsWith(".toml")).toSorted()) {
-    const content = stampCodexAgent(readFileSync8(path25.join(source, file), "utf8"), version);
+    const content = withRoleModel(stampCodexAgent(readFileSync8(path25.join(source, file), "utf8"), version), file, models);
     const dest = path25.join(target, file);
     const stat = lstatOrNull(dest);
     if (stat?.isSymbolicLink()) {
@@ -28340,12 +28628,24 @@ var codexContextProvider = (host = detectCodexSurface(process.env), root) => ({
   }
 });
 var pluginRoot = () => path26.resolve(path26.dirname(fileURLToPath3(import.meta.url)), "..");
-var syncCodexAgents = (root) => {
+var codexRoleModels = (cwd) => {
+  const out = {};
+  for (const role of ["verifier", "reviewer"]) {
+    const found = resolveRoleModel(cwd, { role }, "codex");
+    if (found)
+      out[role] = { model: found.model, effort: found.effort };
+  }
+  const implementer = uniformImplementerModel(cwd, "codex");
+  if (implementer)
+    out.implementer = { model: implementer.model, effort: implementer.effort };
+  return out;
+};
+var syncCodexAgents = (root, cwd) => {
   const codexHome = codexHomeOfInstall(root);
   if (!codexHome)
     return;
   try {
-    installCodexAgents(root, codexHome);
+    installCodexAgents(root, codexHome, codexRoleModels(cwd ?? resolveCodexWorkspaceRoot(root, process.env) ?? process.cwd()));
   } catch {}
 };
 if (__require.main == __require.module) {
@@ -28366,6 +28666,7 @@ if (__require.main == __require.module) {
 export {
   codexContextProvider,
   codexQualification,
+  codexRoleModels,
   resolveCodexWorkspaceRoot,
   syncCodexAgents
 };