@brainervirus/workit-core 2.5.0 → 2.7.0

package/src/core/host-install.ts

@@ -11,7 +11,7 @@ import {
 import os from "node:os";
 import path from "node:path";
 
-export type HostId = "opencode" | "cursor" | "codex" | "pi";
+export type HostId = "opencode" | "cursor" | "codex" | "pi" | "claude-code";
 
 /** A reviewed argv vector. Arguments are never composed into a shell string. */
 export type HostInstallCommand = {
@@ -89,6 +89,12 @@ export type HostInstallOptions = {
 
 const MARKETPLACE = "https://github.com/BrainerVirus/workit.git";
 const CODEX_MARKETPLACE_NAME = "workflow-toolkit";
+/** Claude Code reads the git-hosted marketplace at the repo root
+ * (`.claude-plugin/marketplace.json`, name `workit`); its entry installs the
+ * published npm package. */
+export const CLAUDE_MARKETPLACE_REPO = "BrainerVirus/workit";
+export const CLAUDE_MARKETPLACE_NAME = "workit";
+export const CLAUDE_PLUGIN_ID = `workit@${CLAUDE_MARKETPLACE_NAME}`;
 const validPackageVersion = (value: string): boolean =>
   value === "latest" || /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value);
 
@@ -224,6 +230,109 @@ export const isCodexWorkitInstalled = (
   return false;
 };
 
+/** Claude Code's config root (`CLAUDE_CONFIG_DIR`, default `~/.claude`). */
+export const claudeConfigDir = (home: string, env: NodeJS.ProcessEnv = process.env): string =>
+  env.CLAUDE_CONFIG_DIR ?? path.join(home, ".claude");
+
+export type ClaudeInstallScope = "user" | "project" | "local";
+
+export type ClaudeWorkitInstall = {
+  id: string;
+  version: string | null;
+  installPath: string;
+  scope: ClaudeInstallScope;
+  /** The project a project/local-scope install belongs to; null for user scope. */
+  projectPath: string | null;
+};
+
+const CLAUDE_SCOPES = new Set<string>(["user", "project", "local"]);
+
+/** A project/local install applies to `cwd` when cwd is inside its project. */
+const appliesTo = (install: ClaudeWorkitInstall, cwd: string | null): boolean => {
+  if (install.scope === "user") return true;
+  if (cwd === null || install.projectPath === null) return false;
+  const relative = path.relative(path.resolve(install.projectPath), path.resolve(cwd));
+  return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+};
+
+const isCanonicalClaudePlugin = (root: string): boolean => {
+  try {
+    const manifest = JSON.parse(
+      readFileSync(path.join(root, ".claude-plugin", "plugin.json"), "utf8"),
+    ) as { name?: string; repository?: string | { url?: string } };
+    const repository =
+      typeof manifest.repository === "string" ? manifest.repository : manifest.repository?.url;
+    return (
+      manifest.name === "workit" &&
+      repository?.replace(/\.git$/, "").toLowerCase() === "https://github.com/brainervirus/workit"
+    );
+  } catch {
+    return false;
+  }
+};
+
+/**
+ * Workit installs recorded in Claude Code's plugin registry
+ * (`<config>/plugins/installed_plugins.json`, v2: `{plugins: {"name@market":
+ * [{installPath, version}]}}`). Only entries whose install directory carries
+ * the canonical Workit manifest count, whatever marketplace they came from.
+ * Only installs that apply here count: user scope always, project/local
+ * scope only when `cwd` is inside the recorded project (`cwd: null` keeps
+ * user scope only). A `--plugin-dir` pin is per-session and never recorded.
+ */
+export const claudeWorkitInstalls = (
+  home: string,
+  env: NodeJS.ProcessEnv = process.env,
+  cwd: string | null = process.cwd(),
+): ClaudeWorkitInstall[] => {
+  const file = path.join(claudeConfigDir(home, env), "plugins", "installed_plugins.json");
+  let registry: unknown;
+  try {
+    registry = JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    return [];
+  }
+  const plugins =
+    registry && typeof registry === "object" && "plugins" in registry ? registry.plugins : null;
+  if (!plugins || typeof plugins !== "object") return [];
+  const found: ClaudeWorkitInstall[] = [];
+  for (const [id, entries] of Object.entries(plugins as Record<string, unknown>)) {
+    if (!id.startsWith("workit@") || !Array.isArray(entries)) continue;
+    for (const entry of entries as Array<{
+      installPath?: unknown;
+      version?: unknown;
+      scope?: unknown;
+      projectPath?: unknown;
+    }>) {
+      if (typeof entry?.installPath !== "string" || !isCanonicalClaudePlugin(entry.installPath))
+        continue;
+      // Older registries omit scope; Claude's default install scope is user.
+      const scope = entry.scope === undefined ? "user" : String(entry.scope);
+      if (!CLAUDE_SCOPES.has(scope)) continue; // e.g. managed: not ours to change
+      const install: ClaudeWorkitInstall = {
+        id,
+        installPath: entry.installPath,
+        version:
+          typeof entry.version === "string" && /^\d+\.\d+\.\d+/.test(entry.version)
+            ? entry.version
+            : null,
+        scope: scope as ClaudeInstallScope,
+        projectPath:
+          scope !== "user" && typeof entry.projectPath === "string" ? entry.projectPath : null,
+      };
+      if (appliesTo(install, cwd)) found.push(install);
+    }
+  }
+  return found;
+};
+
+/** A Workit install Claude Code loads for this user (any project). */
+export const isClaudeWorkitInstalled = (
+  home: string,
+  env: NodeJS.ProcessEnv = process.env,
+  cwd: string | null = process.cwd(),
+): boolean => claudeWorkitInstalls(home, env, cwd).length > 0;
+
 export function installedHostApp(
   host: HostId,
   home: string,
@@ -297,6 +406,39 @@ export function planHostInstall(
       },
     ];
   }
+  if (host === "claude-code") {
+    if (!upgrading && isClaudeWorkitInstalled(home, env, null)) return [];
+    const base = hostCommand("claude", [], { home, cwd, env });
+    return [
+      nodePrerequisite({ home, cwd, env }),
+      {
+        ...base,
+        args: [...base.args, "plugin", "marketplace", "list", "--json"],
+        purpose: "Check whether the Workit Claude Code marketplace is already registered",
+      },
+      upgrading
+        ? {
+            ...base,
+            args: [...base.args, "plugin", "marketplace", "update", CLAUDE_MARKETPLACE_NAME],
+            purpose: "Refresh the Workit Claude Code marketplace",
+          }
+        : {
+            ...base,
+            args: [...base.args, "plugin", "marketplace", "add", CLAUDE_MARKETPLACE_REPO],
+            purpose: "Register the Workit Claude Code marketplace",
+            skipWhenOutputIncludes: `"name": "${CLAUDE_MARKETPLACE_NAME}"`,
+          },
+      {
+        ...base,
+        args: upgrading
+          ? [...base.args, "plugin", "update", CLAUDE_PLUGIN_ID]
+          : [...base.args, "plugin", "install", CLAUDE_PLUGIN_ID, "--scope", "user"],
+        purpose: upgrading
+          ? "Update the Workit Claude Code plugin"
+          : "Install the Workit Claude Code plugin",
+      },
+    ];
+  }
   if (host === "pi") {
     if (!upgrading && isPiWorkitInstalled(home, env)) return [];
     const base = hostCommand("pi", [], { home, cwd, env });
@@ -440,6 +582,7 @@ export function runHostCommand(
       const env: NodeJS.ProcessEnv = { ...process.env, ...context.env, HOME: home };
       env.CODEX_HOME = context.env?.CODEX_HOME ?? path.join(home, ".codex");
       env.PI_CODING_AGENT_DIR = context.env?.PI_CODING_AGENT_DIR ?? path.join(home, ".pi", "agent");
+      env.CLAUDE_CONFIG_DIR = context.env?.CLAUDE_CONFIG_DIR ?? path.join(home, ".claude");
       env.XDG_CONFIG_HOME = context.env?.XDG_CONFIG_HOME ?? path.join(home, ".config");
       return env;
     })(),

package/src/core/methods.ts

@@ -118,8 +118,11 @@ policy, and reapplies the call, returning busy under persistent contention. A
 revision_conflict means a revision you passed is stale: re-read the record
 before deciding whether to retry.
 A solo edit does not need writer acquisition; use it when concurrent checkout
-writers need coordination. Record only observed facts and checks. Evidence can
-become stale when its bound candidate changes; reconcile findings against the
+writers need coordination. Record only observed facts and checks. Close-time
+testing and verification gates accept only a configured check the CLI ran:
+\`workit check <name>\` (\`npx -y @brainervirus/workit-cli check <name>\` when
+\`workit\` is not on PATH); a recorded check result is a note and an ad-hoc
+\`workit check -- <cmd>\` never satisfies a gate. Evidence can become stale when its bound candidate or tree changes; reconcile findings against the
 current candidate before recording completion.
 
 Workit validates domain policy against the actual action target, configured

package/src/core/setup.ts

@@ -52,6 +52,8 @@ import { writeFileExclusive } from "./safe-write";
 import {
   isCodexWorkitInstalled,
   isPiWorkitInstalled,
+  isClaudeWorkitInstalled,
+  claudeConfigDir,
   planHostInstall,
   runHostInstall,
   type HostCommandRunner,
@@ -385,25 +387,27 @@ export function buildSetupPreview(
           mutations.push({ type: "install-adapter", platform, path: paths.cursorPluginDir });
           mutations.push({ type: "register-platform", platform, path: paths.cursorSettings });
           mutations.push({ type: "register-platform", platform, path: paths.cursorMcp });
-        } else if (platform === "codex" || platform === "pi") {
+        } else if (platform === "codex" || platform === "pi" || platform === "claude-code") {
           const commands = planHostInstall(platform, { home: paths.home, cwd: paths.cwd, env });
           if (commands.length > 0) {
             mutations.push({
               type: "install-host",
               platform,
               path:
-                platform === "codex"
-                  ? path.join(
-                      env.CODEX_HOME ?? path.join(paths.home, ".codex"),
-                      "plugins",
-                      "cache",
-                      "workflow-toolkit",
-                      "workit",
-                    )
-                  : path.join(
-                      env.PI_CODING_AGENT_DIR ?? path.join(paths.home, ".pi", "agent"),
-                      "settings.json",
-                    ),
+                platform === "claude-code"
+                  ? claudeInstallRecord(paths.home, env)
+                  : platform === "codex"
+                    ? path.join(
+                        env.CODEX_HOME ?? path.join(paths.home, ".codex"),
+                        "plugins",
+                        "cache",
+                        "workflow-toolkit",
+                        "workit",
+                      )
+                    : path.join(
+                        env.PI_CODING_AGENT_DIR ?? path.join(paths.home, ".pi", "agent"),
+                        "settings.json",
+                      ),
               commands,
             });
           }
@@ -446,6 +450,10 @@ export function buildSetupPreview(
 // Apply (Task 14: WZ-09, WZ-10, WZ-13-WZ-15; CA-08, CA-13, CA-14, CA-31).
 // ---------------------------------------------------------------------------
 
+/** The Claude Code plugin registry a Workit install is recorded in. */
+const claudeInstallRecord = (home: string, env: NodeJS.ProcessEnv): string =>
+  path.join(claudeConfigDir(home, env), "plugins", "installed_plugins.json");
+
 export type Platform = "opencode" | "cursor";
 
 export type SetupResultStatus = "Installed" | "Configured" | "Skipped" | "Failed";
@@ -1250,7 +1258,9 @@ export function applySetupPreview(
                   res.env.PI_CODING_AGENT_DIR ?? path.join(res.home, ".pi", "agent"),
                   "settings.json",
                 )
-              : "";
+              : mutation.platform === "claude-code"
+                ? claudeInstallRecord(res.home, res.env)
+                : "";
       if (mutation.path !== expectedPath) {
         entries.push({
           platform: mutation.platform,
@@ -1292,7 +1302,9 @@ export function applySetupPreview(
           ? isCodexWorkitInstalled(res.home, res.env)
           : mutation.platform === "pi"
             ? isPiWorkitInstalled(res.home, res.env)
-            : true;
+            : mutation.platform === "claude-code"
+              ? isClaudeWorkitInstalled(res.home, res.env, null)
+              : true;
       if (!verified) {
         entries.push({
           platform: mutation.platform,

package/src/core/support-matrix.ts

@@ -16,5 +16,9 @@ export const SUPPORT_MATRIX = {
   // an installed CLI drifts ahead so a fresh install never silently outruns
   // the qualification pin.
   codex: { cli: "0.153.4", desktopPackage: "26.901.20858", bundledCodexCli: "0.153.0-alpha.5" },
+  // Claude Code is a qualification host too: CI runs `claude plugin validate
+  // --strict` with exactly this CLI, and the hook output schema fixture
+  // (test/fixtures/claude-code-schemas) was transcribed from this binary.
+  claudeCode: { cli: "2.1.288" },
   os: ["ubuntu-latest", "macos-latest", "windows-latest"],
 } as const;

package/src/core/task-context.ts

@@ -13,7 +13,7 @@ import {
   type TaskView,
   type Utc,
 } from "./task-contract";
-import { captureCandidate, evaluateEvidence } from "./task-evaluation";
+import { captureCandidate, evaluateEvidence, treeFreshness } from "./task-evaluation";
 import { selectMethods, type SelectedMethod } from "./methods";
 import type { NativeWorkerObservation } from "./workers";
 
@@ -39,7 +39,11 @@ export function reconcileResume(
     return failure("permission_denied", "worker observations require native host verification");
   const candidate = captureCandidate(view.workspace.root, view.task.intent.data.scope, []);
   if (!candidate.ok) return candidate;
-  const staleEvidenceIds = evaluateEvidence(view.task, candidate.data)
+  const staleEvidenceIds = evaluateEvidence(
+    view.task,
+    candidate.data,
+    treeFreshness(view.workspace.root),
+  )
     .filter((entry) => entry.status === "stale")
     .map((entry) => entry.evidenceId);
   const blockers = [...view.task.progress.blockers];

package/src/core/task-contract.ts

@@ -541,20 +541,78 @@ export const candidateSchema = z
       });
   });
 export type Candidate = z.infer<typeof candidateSchema>;
-export const evidenceSchema = z
+/**
+ * What `workit check` observed (design §2.1 S9, §2.2). Only the CLI's
+ * observing path writes it (WorkitCore.observeCheck); the agent-facing
+ * `evidence.record` operation rejects it. A task that holds one lists
+ * `evidence.*.data.observation` in `critical`, so an older reader fails
+ * closed instead of reading the check without it.
+ */
+export const checkObservationSchema = z
   .object({
-    kind: z.enum(["check", "review", "investigation", "artifact"]),
-    claim: text,
-    requirementIds: z.array(digest),
-    beforeCandidateId: nullableDigest.optional(),
-    candidateId: nullableDigest.optional(),
-    result: z.enum(["passed", "failed", "missing", "skipped"]),
-    summary: text,
-    refs: z.array(refSchema),
-    exitCode: safeInteger.nullable(),
-    reviewContext: refSchema.nullable(),
+    observer: z.literal("workit_cli"),
+    /** The check name (`--name` or `workit check <name>`); null for an unnamed ad-hoc run. */
+    name: nonEmpty.nullable(),
+    /** The name is configured and argv is exactly its configured command, run from the repo top. */
+    configured: z.boolean(),
+    argv: z.array(text).min(1),
+    shell: z.boolean(),
+    /** Working directory relative to the repository top (posix), `.` at the top. */
+    cwd: nonEmpty,
+    exitCode: safeInteger,
+    durationMs: safeInteger.min(0),
+    timedOut: z.boolean(),
+    head: text.nullable(),
+    /** Worktree tree key before the run; evidence is fresh while the tree key is unchanged. */
+    tree: text.nullable(),
+    dirty: z.boolean().nullable(),
+    /** Cheap stat-cached worktree signal before the run (per-turn freshness; see worktreeSignal). */
+    signal: text.nullable(),
+    /** Tree key after the run; differs from `tree` when the command changed the worktree. */
+    treeAfter: text.nullable(),
+    /** The command changed the worktree: the evidence is stale (fail safe). */
+    modifiedWorktree: z.boolean(),
+    base: text.nullable(),
+    patchId: text.nullable(),
+    /** A minimal environment fingerprint: platform, arch and allowlisted variables. */
+    environment: z
+      .object({
+        platform: nonEmpty,
+        arch: nonEmpty,
+        vars: z.record(nonEmpty, text.nullable()),
+      })
+      .strict(),
+    logDigest: text.nullable(),
+    logRef: text.nullable(),
+    logTail: z.array(text).max(40),
+    ledgerRowId: text.nullable(),
+    /** Set only when a host hook later attests the run (design §2.1 attestation). */
+    attestation: z
+      .object({ host: nonEmpty, session: text.nullable(), agentId: text.nullable() })
+      .strict()
+      .nullable(),
   })
   .strict();
+export type CheckObservation = z.infer<typeof checkObservationSchema>;
+/** The record path a task lists in `critical` once it stores a check observation. */
+export const CHECK_OBSERVATION_PATH = "evidence.*.data.observation";
+const evidenceFields = {
+  kind: z.enum(["check", "review", "investigation", "artifact"]),
+  claim: text,
+  requirementIds: z.array(digest),
+  beforeCandidateId: nullableDigest.optional(),
+  candidateId: nullableDigest.optional(),
+  result: z.enum(["passed", "failed", "missing", "skipped"]),
+  summary: text,
+  refs: z.array(refSchema),
+  exitCode: safeInteger.nullable(),
+  reviewContext: refSchema.nullable(),
+};
+export const evidenceSchema = z
+  .object({ ...evidenceFields, observation: checkObservationSchema.optional() })
+  .strict();
+/** Evidence as an agent may submit it: no CLI observation. */
+const reportedEvidenceSchema = z.object(evidenceFields).strict();
 export type Evidence = z.infer<typeof evidenceSchema>;
 export const evidenceEvaluationSchema = z
   .object({
@@ -1015,7 +1073,7 @@ const evidenceOperations = {
     action: z.literal("record"),
     ...taskId,
     expectedRevision: revision.optional(),
-    evidence: evidenceSchema,
+    evidence: reportedEvidenceSchema,
   }),
 };
 const findingOperations = {

package/src/core/task-engine.ts

@@ -1,7 +1,9 @@
 import { realpathSync } from "node:fs";
 import {
+  CHECK_OBSERVATION_PATH,
   POLICY_VERSION,
   canonicalJson,
+  checkObservationSchema,
   failure,
   decisionDigest,
   exportBundleSchema,
@@ -18,6 +20,7 @@ import {
   type Candidate,
   type Capability,
   type Caller,
+  type CheckObservation,
   type Constraint,
   type Decision,
   type Entry,
@@ -83,6 +86,9 @@ import {
 import {
   captureCandidate,
   checkPin,
+  signalFreshness,
+  treeFreshness,
+  type Freshness,
   evaluateClosure,
   evaluateEvidence,
   evaluateRequirements,
@@ -111,6 +117,13 @@ export type OperationContext = {
   workerId?: string | null;
 };
 
+export type ObserveCheckRequest = {
+  taskId: string;
+  /** Omit to retry over concurrent writers (S2b); a value is strict compare-and-swap. */
+  expectedRevision?: string;
+  observation: CheckObservation;
+};
+
 const provenance = (
   context: OperationContext,
   kind: "host_observed" | "agent_reported" = context.provenanceKind ?? "host_observed",
@@ -1210,10 +1223,11 @@ export class WorkitCore {
             // dispositions never auto-reopen.
             const withEntry = { ...current, candidates, evidence: [...current.evidence, entry] };
             const statuses = new Map(
-              evaluateEvidence(withEntry, currentCandidate.data).map((item) => [
-                item.evidenceId,
-                item.status,
-              ]),
+              evaluateEvidence(
+                withEntry,
+                currentCandidate.data,
+                treeFreshness(this.store.root),
+              ).map((item) => [item.evidenceId, item.status]),
             );
             const verified = withEntry.evidence.some((item) =>
               findingVerificationPasses(finding.data.candidateId, {
@@ -1239,6 +1253,91 @@ export class WorkitCore {
     return success(changed.data.revision, null, changed.data.evidence.at(-1)!);
   }
 
+  /**
+   * Record a check the CLI itself ran and observed (`workit check`, design
+   * §2.1 S9). Host-only, like observeDecision: the caller must be the workit
+   * CLI (never a helper), and agents reach evidence only through
+   * `evidence.record`, which stays agent_reported and cannot carry an
+   * observation. The entry is `host_observed` by `workit_cli`, keyed to the
+   * worktree tree in the observation, and the task lists the observation
+   * path as critical so an older reader fails closed instead of dropping it.
+   * Outside git (no tree key) it is bound to the current candidate instead.
+   */
+  observeCheck(request: ObserveCheckRequest): Result<Entry<Evidence>> {
+    return this.retryOmittedRevisions(request, () => this.observeCheckOnce(request));
+  }
+
+  private observeCheckOnce(request: ObserveCheckRequest): Result<Entry<Evidence>> {
+    const root = this.contextRootError();
+    if (!root.ok) return root;
+    if (this.context.caller.host !== "workit_cli" || (this.context.workerId ?? null) !== null)
+      return failure("permission_denied", "only the workit CLI records observed checks");
+    const observation = checkObservationSchema.safeParse(request?.observation);
+    if (!observation.success)
+      return failure("invalid_input", "check observation is invalid", {
+        fields: observation.error.issues.map((issue) => ({
+          path: issue.path.join("."),
+          reason: issue.message,
+        })),
+      });
+    const task = this.store.readTask(request.taskId);
+    if (!task.ok) return task;
+    if (task.data.status === "closed")
+      return failure("invalid_transition", "closed task cannot record evidence");
+    const observed: CheckObservation = observation.data;
+    let candidate: Candidate | null = null;
+    if (observed.tree === null) {
+      const captured = captureCandidate(
+        this.store.root,
+        task.data.intent.data.scope,
+        environment(),
+      );
+      if (!captured.ok) return captured;
+      candidate = captured.data;
+    }
+    const label = observed.name ?? observed.argv.join(" ");
+    const data: Evidence = {
+      kind: "check",
+      claim: `workit check ${label}`.slice(0, 500),
+      requirementIds: [],
+      ...(candidate ? { beforeCandidateId: candidate.id, candidateId: candidate.id } : {}),
+      result: observed.exitCode === 0 ? "passed" : "failed",
+      summary: `${observed.configured ? "configured" : "ad-hoc"} check exited ${observed.exitCode}${observed.timedOut ? " (timed out)" : ""} in ${observed.durationMs} ms`,
+      refs: [],
+      exitCode: observed.exitCode,
+      reviewContext: null,
+      observation: observed,
+    };
+    const changed = this.store.mutateTask(
+      task.data.id,
+      request.expectedRevision ?? task.data.revision,
+      (current, mutation) => {
+        const candidates =
+          candidate === null || current.candidates.some((item) => item.id === candidate.id)
+            ? current.candidates
+            : [...current.candidates, candidate];
+        const critical = [...new Set([...(current.critical ?? []), CHECK_OBSERVATION_PATH])];
+        return success(mutation.revision, null, {
+          ...current,
+          critical,
+          candidates,
+          evidence: [
+            ...current.evidence,
+            {
+              id: newId(),
+              recordedAt: mutation.now,
+              provenance: provenance(this.context, "host_observed"),
+              data,
+            },
+          ],
+        });
+      },
+      trustedNow(this.context),
+    );
+    if (!changed.ok) return changed;
+    return success(changed.data.revision, null, changed.data.evidence.at(-1)!);
+  }
+
   decision(request: unknown): Result<Entry<Decision>> {
     return this.recordDecision(request);
   }
@@ -1554,7 +1653,7 @@ export class WorkitCore {
     if (input.disposition === "fixed") {
       const current = captureCandidate(this.store.root, task.data.intent.data.scope, environment());
       if (!current.ok) return current;
-      const evaluations = evaluateEvidence(task.data, current.data);
+      const evaluations = evaluateEvidence(task.data, current.data, treeFreshness(this.store.root));
       const verified = evidence.some((entry) => {
         const evaluation = evaluations.find((item) => item.evidenceId === entry.id);
         return (
@@ -2456,6 +2555,7 @@ export class WorkitCore {
     if (!current.ok) return current;
     const evaluationWorkspace =
       task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
+    const tree = treeFreshness(this.store.root);
     const requirements = evaluateRequirements(
       task,
       evaluationWorkspace,
@@ -2463,6 +2563,7 @@ export class WorkitCore {
       current.data,
       this.store.root,
       this.context.caller,
+      tree,
     );
     return success(task.revision, workspace.data.revision, {
       id: task.id,
@@ -2487,19 +2588,24 @@ export class WorkitCore {
    * judged against the last recorded candidate, and live staleness is
    * detected by evidence, close, resume, and full inspection, which capture.
    */
-  compactContext(taskId: string): Result<string> {
+  compactContext(taskId: string, freshness?: Freshness): Result<string> {
     const root = this.contextRootError();
     if (!root.ok) return root;
     const task = this.store.readTask(taskId);
     if (!task.ok) return task;
     const helper = this.helperTaskGuard(task.data, true);
     if (!helper.ok) return helper;
-    const view = this.view(task.data, false);
+    // Per-turn path: the cheap worktree signal, never the object-writing tree hash.
+    const view = this.view(task.data, false, freshness ?? signalFreshness(this.store.root));
     if (!view.ok) return view;
     return success(view.revision, view.workspaceRevision, compactTaskContext(view.data));
   }
 
-  private view(task: TaskRecord, capture = true): Result<TaskView> {
+  private view(
+    task: TaskRecord,
+    capture = true,
+    freshness: Freshness = treeFreshness(this.store.root),
+  ): Result<TaskView> {
     const workspace = this.store.readWorkspace();
     if (!workspace.ok) return workspace;
     if (!workspace.data) return failure("not_found", "workspace not found");
@@ -2512,6 +2618,7 @@ export class WorkitCore {
     if (!current.ok) return current;
     const evaluationWorkspace =
       task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
+    const tree = freshness;
     const requirements = evaluateRequirements(
       task,
       evaluationWorkspace,
@@ -2519,13 +2626,14 @@ export class WorkitCore {
       current.data,
       this.store.root,
       this.context.caller,
+      tree,
     );
     return success(task.revision, workspace.data.revision, {
       task,
       workspace: evaluationWorkspace,
       capabilities: this.context.capabilities,
       requirements,
-      evidence: evaluateEvidence(task, current.data),
+      evidence: evaluateEvidence(task, current.data, tree),
     });
   }
 
@@ -2797,6 +2905,7 @@ export class WorkitCore {
       withCandidate.id === task.data.candidates.at(-1)?.id
         ? task.data
         : { ...task.data, candidates: [...task.data.candidates, withCandidate] };
+    const tree = treeFreshness(this.store.root);
     const requirements = evaluateRequirements(
       taskForView,
       workspace.data,
@@ -2804,13 +2913,14 @@ export class WorkitCore {
       withCandidate,
       this.store.root,
       this.context.caller,
+      tree,
     );
     const view = {
       task: taskForView,
       workspace: workspace.data,
       capabilities: this.context.capabilities,
       requirements,
-      evidence: evaluateEvidence(taskForView, withCandidate),
+      evidence: evaluateEvidence(taskForView, withCandidate, tree),
     } satisfies TaskView;
     const closure = evaluateClosure(input.outcome, view);
     if (!closure.ok) return closure;