@brainervirus/workit-core 2.6.0 → 2.8.0

package/src/core/task-engine.ts

@@ -1,7 +1,9 @@
 import { realpathSync } from "node:fs";
 import {
+  CHECK_OBSERVATION_PATH,
   POLICY_VERSION,
   canonicalJson,
+  checkObservationSchema,
   failure,
   decisionDigest,
   exportBundleSchema,
@@ -18,6 +20,7 @@ import {
   type Candidate,
   type Capability,
   type Caller,
+  type CheckObservation,
   type Constraint,
   type Decision,
   type Entry,
@@ -83,6 +86,9 @@ import {
 import {
   captureCandidate,
   checkPin,
+  signalFreshness,
+  treeFreshness,
+  type Freshness,
   evaluateClosure,
   evaluateEvidence,
   evaluateRequirements,
@@ -111,6 +117,13 @@ export type OperationContext = {
   workerId?: string | null;
 };
 
+export type ObserveCheckRequest = {
+  taskId: string;
+  /** Omit to retry over concurrent writers (S2b); a value is strict compare-and-swap. */
+  expectedRevision?: string;
+  observation: CheckObservation;
+};
+
 const provenance = (
   context: OperationContext,
   kind: "host_observed" | "agent_reported" = context.provenanceKind ?? "host_observed",
@@ -1210,10 +1223,11 @@ export class WorkitCore {
             // dispositions never auto-reopen.
             const withEntry = { ...current, candidates, evidence: [...current.evidence, entry] };
             const statuses = new Map(
-              evaluateEvidence(withEntry, currentCandidate.data).map((item) => [
-                item.evidenceId,
-                item.status,
-              ]),
+              evaluateEvidence(
+                withEntry,
+                currentCandidate.data,
+                treeFreshness(this.store.root),
+              ).map((item) => [item.evidenceId, item.status]),
             );
             const verified = withEntry.evidence.some((item) =>
               findingVerificationPasses(finding.data.candidateId, {
@@ -1239,6 +1253,91 @@ export class WorkitCore {
     return success(changed.data.revision, null, changed.data.evidence.at(-1)!);
   }
 
+  /**
+   * Record a check the CLI itself ran and observed (`workit check`, design
+   * §2.1 S9). Host-only, like observeDecision: the caller must be the workit
+   * CLI (never a helper), and agents reach evidence only through
+   * `evidence.record`, which stays agent_reported and cannot carry an
+   * observation. The entry is `host_observed` by `workit_cli`, keyed to the
+   * worktree tree in the observation, and the task lists the observation
+   * path as critical so an older reader fails closed instead of dropping it.
+   * Outside git (no tree key) it is bound to the current candidate instead.
+   */
+  observeCheck(request: ObserveCheckRequest): Result<Entry<Evidence>> {
+    return this.retryOmittedRevisions(request, () => this.observeCheckOnce(request));
+  }
+
+  private observeCheckOnce(request: ObserveCheckRequest): Result<Entry<Evidence>> {
+    const root = this.contextRootError();
+    if (!root.ok) return root;
+    if (this.context.caller.host !== "workit_cli" || (this.context.workerId ?? null) !== null)
+      return failure("permission_denied", "only the workit CLI records observed checks");
+    const observation = checkObservationSchema.safeParse(request?.observation);
+    if (!observation.success)
+      return failure("invalid_input", "check observation is invalid", {
+        fields: observation.error.issues.map((issue) => ({
+          path: issue.path.join("."),
+          reason: issue.message,
+        })),
+      });
+    const task = this.store.readTask(request.taskId);
+    if (!task.ok) return task;
+    if (task.data.status === "closed")
+      return failure("invalid_transition", "closed task cannot record evidence");
+    const observed: CheckObservation = observation.data;
+    let candidate: Candidate | null = null;
+    if (observed.tree === null) {
+      const captured = captureCandidate(
+        this.store.root,
+        task.data.intent.data.scope,
+        environment(),
+      );
+      if (!captured.ok) return captured;
+      candidate = captured.data;
+    }
+    const label = observed.name ?? observed.argv.join(" ");
+    const data: Evidence = {
+      kind: "check",
+      claim: `workit check ${label}`.slice(0, 500),
+      requirementIds: [],
+      ...(candidate ? { beforeCandidateId: candidate.id, candidateId: candidate.id } : {}),
+      result: observed.exitCode === 0 ? "passed" : "failed",
+      summary: `${observed.configured ? "configured" : "ad-hoc"} check exited ${observed.exitCode}${observed.timedOut ? " (timed out)" : ""} in ${observed.durationMs} ms`,
+      refs: [],
+      exitCode: observed.exitCode,
+      reviewContext: null,
+      observation: observed,
+    };
+    const changed = this.store.mutateTask(
+      task.data.id,
+      request.expectedRevision ?? task.data.revision,
+      (current, mutation) => {
+        const candidates =
+          candidate === null || current.candidates.some((item) => item.id === candidate.id)
+            ? current.candidates
+            : [...current.candidates, candidate];
+        const critical = [...new Set([...(current.critical ?? []), CHECK_OBSERVATION_PATH])];
+        return success(mutation.revision, null, {
+          ...current,
+          critical,
+          candidates,
+          evidence: [
+            ...current.evidence,
+            {
+              id: newId(),
+              recordedAt: mutation.now,
+              provenance: provenance(this.context, "host_observed"),
+              data,
+            },
+          ],
+        });
+      },
+      trustedNow(this.context),
+    );
+    if (!changed.ok) return changed;
+    return success(changed.data.revision, null, changed.data.evidence.at(-1)!);
+  }
+
   decision(request: unknown): Result<Entry<Decision>> {
     return this.recordDecision(request);
   }
@@ -1554,7 +1653,7 @@ export class WorkitCore {
     if (input.disposition === "fixed") {
       const current = captureCandidate(this.store.root, task.data.intent.data.scope, environment());
       if (!current.ok) return current;
-      const evaluations = evaluateEvidence(task.data, current.data);
+      const evaluations = evaluateEvidence(task.data, current.data, treeFreshness(this.store.root));
       const verified = evidence.some((entry) => {
         const evaluation = evaluations.find((item) => item.evidenceId === entry.id);
         return (
@@ -2456,6 +2555,7 @@ export class WorkitCore {
     if (!current.ok) return current;
     const evaluationWorkspace =
       task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
+    const tree = treeFreshness(this.store.root);
     const requirements = evaluateRequirements(
       task,
       evaluationWorkspace,
@@ -2463,6 +2563,7 @@ export class WorkitCore {
       current.data,
       this.store.root,
       this.context.caller,
+      tree,
     );
     return success(task.revision, workspace.data.revision, {
       id: task.id,
@@ -2487,19 +2588,24 @@ export class WorkitCore {
    * judged against the last recorded candidate, and live staleness is
    * detected by evidence, close, resume, and full inspection, which capture.
    */
-  compactContext(taskId: string): Result<string> {
+  compactContext(taskId: string, freshness?: Freshness): Result<string> {
     const root = this.contextRootError();
     if (!root.ok) return root;
     const task = this.store.readTask(taskId);
     if (!task.ok) return task;
     const helper = this.helperTaskGuard(task.data, true);
     if (!helper.ok) return helper;
-    const view = this.view(task.data, false);
+    // Per-turn path: the cheap worktree signal, never the object-writing tree hash.
+    const view = this.view(task.data, false, freshness ?? signalFreshness(this.store.root));
     if (!view.ok) return view;
     return success(view.revision, view.workspaceRevision, compactTaskContext(view.data));
   }
 
-  private view(task: TaskRecord, capture = true): Result<TaskView> {
+  private view(
+    task: TaskRecord,
+    capture = true,
+    freshness: Freshness = treeFreshness(this.store.root),
+  ): Result<TaskView> {
     const workspace = this.store.readWorkspace();
     if (!workspace.ok) return workspace;
     if (!workspace.data) return failure("not_found", "workspace not found");
@@ -2512,6 +2618,7 @@ export class WorkitCore {
     if (!current.ok) return current;
     const evaluationWorkspace =
       task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
+    const tree = freshness;
     const requirements = evaluateRequirements(
       task,
       evaluationWorkspace,
@@ -2519,13 +2626,14 @@ export class WorkitCore {
       current.data,
       this.store.root,
       this.context.caller,
+      tree,
     );
     return success(task.revision, workspace.data.revision, {
       task,
       workspace: evaluationWorkspace,
       capabilities: this.context.capabilities,
       requirements,
-      evidence: evaluateEvidence(task, current.data),
+      evidence: evaluateEvidence(task, current.data, tree),
     });
   }
 
@@ -2797,6 +2905,7 @@ export class WorkitCore {
       withCandidate.id === task.data.candidates.at(-1)?.id
         ? task.data
         : { ...task.data, candidates: [...task.data.candidates, withCandidate] };
+    const tree = treeFreshness(this.store.root);
     const requirements = evaluateRequirements(
       taskForView,
       workspace.data,
@@ -2804,13 +2913,14 @@ export class WorkitCore {
       withCandidate,
       this.store.root,
       this.context.caller,
+      tree,
     );
     const view = {
       task: taskForView,
       workspace: workspace.data,
       capabilities: this.context.capabilities,
       requirements,
-      evidence: evaluateEvidence(taskForView, withCandidate),
+      evidence: evaluateEvidence(taskForView, withCandidate, tree),
     } satisfies TaskView;
     const closure = evaluateClosure(input.outcome, view);
     if (!closure.ok) return closure;

package/src/core/task-evaluation.ts

@@ -14,6 +14,8 @@ import {
   type Capability,
   type Caller,
   type Decision,
+  type Entry,
+  type Evidence,
   type EvidenceEvaluation,
   type Outcome,
   type Requirement,
@@ -24,6 +26,16 @@ import {
   type WorkspaceRecord,
 } from "./task-contract";
 import { verifyDecisionContentAtRoot } from "./authority";
+import {
+  CHECKS_FILE,
+  checkCommand,
+  gateCheckNames,
+  loadCheckConfig,
+  matchesNamedCheck,
+  type CheckConfig,
+} from "../check-config";
+import { worktreeSignal, worktreeTree } from "../git/rev";
+import { runtimeVersion } from "./task-store";
 
 export type CandidateEnvironment =
   | readonly (string | { name: string; value?: string | null })[]
@@ -318,9 +330,49 @@ const evidenceScopes = (task: TaskRecord, ids: string[]): Scope[] =>
     .filter((requirement) => ids.includes(requirement.id))
     .map((requirement) => requirement.scope);
 
+/**
+ * How observed checks are judged fresh (§2.2). `tree`: the exact worktree tree
+ * key (worktreeTree hashes changed files into the object store, so it is only
+ * for paths that decide: close, inspect, evidence). `signal`: the cheap
+ * stat-cached worktreeSignal for per-turn context, which writes nothing.
+ * `current` is computed at most once and is null outside git.
+ */
+export type Freshness = { mode: "tree" | "signal"; current: () => string | null };
+
+const memo = (compute: () => string | null): (() => string | null) => {
+  let value: string | null | undefined;
+  return () => {
+    if (value === undefined) value = compute();
+    return value;
+  };
+};
+export const treeFreshness = (root: string): Freshness => ({
+  mode: "tree",
+  current: memo(() => worktreeTree(root)?.key ?? null),
+});
+export const signalFreshness = (root: string): Freshness => ({
+  mode: "signal",
+  current: memo(() => worktreeSignal(root)),
+});
+
+/** Evidence the workit CLI itself observed (`workit check`), as opposed to an agent's report. */
+export const isObservedCheck = (entry: Entry<Evidence>): boolean =>
+  entry.data.kind === "check" &&
+  entry.data.observation?.observer === "workit_cli" &&
+  entry.provenance?.kind === "host_observed" &&
+  entry.provenance.host === "workit_cli";
+
+/**
+ * Evidence status against the current state. Observed checks keyed to a tree
+ * are fresh while the worktree is unchanged (§2.2), judged by `freshness`
+ * (exact tree key, or the cheap signal on per-turn paths); a check that
+ * changed the worktree itself is stale (fail safe), and a closed task keeps
+ * the recorded status. Without `freshness` they read stale.
+ */
 export function evaluateEvidence(
   task: TaskRecord,
   candidate: Candidate | null,
+  freshness?: Freshness,
 ): EvidenceEvaluation[] {
   const current = candidate ?? task.candidates.at(-1) ?? null;
   return task.evidence.map((entry) => {
@@ -331,6 +383,28 @@ export function evaluateEvidence(
         status: "failed" as const,
         reason: "failed evidence remains historical",
       };
+    const observation = isObservedCheck(entry) ? evidence.observation : undefined;
+    if (observation && observation.tree !== null) {
+      if (task.status === "closed")
+        return { evidenceId: entry.id, status: evidence.result, reason: "recorded before close" };
+      if (observation.modifiedWorktree)
+        return {
+          evidenceId: entry.id,
+          status: "stale" as const,
+          reason: "the check changed the worktree while it ran; ignore or clean its outputs",
+        };
+      const recorded = freshness?.mode === "signal" ? observation.signal : observation.tree;
+      if (recorded !== null && freshness && recorded === freshness.current())
+        return { evidenceId: entry.id, status: evidence.result, reason: "worktree is unchanged" };
+      return {
+        evidenceId: entry.id,
+        status: "stale" as const,
+        reason:
+          freshness?.mode === "signal"
+            ? "the worktree may have changed since the check ran (quick signal; inspect re-checks exactly)"
+            : "the worktree changed since the check ran",
+      };
+    }
     if (evidence.kind === "check" || evidence.kind === "review") {
       if (!evidence.beforeCandidateId || !evidence.candidateId)
         return {
@@ -499,6 +573,82 @@ const expectedKinds = (dimension: Requirement["dimension"], ruleId?: string): st
   return "worker report";
 };
 
+/** Close-time testing/verification gates accept only CLI-observed checks (D5, D14). */
+const observedGate = (requirement: Requirement): boolean =>
+  (requirement.dimension === "testing" || requirement.dimension === "verification") &&
+  requirement.before === "close";
+
+type GateResult = { satisfied: string[]; considered: string[]; reason: string };
+
+/**
+ * A close gate over CLI-observed checks. Only a fresh passing run of one of
+ * the gate's named checks whose argv is still its configured command
+ * satisfies it; ad-hoc runs never do, and with no named check for the gate
+ * the reason says how to configure one. Agent-reported checks are notes and
+ * never count. A broken check config fails closed.
+ */
+function evaluateObservedGate(
+  task: TaskRecord,
+  requirement: Requirement,
+  statuses: Map<string, EvidenceEvaluation["status"]>,
+  config: CheckConfig,
+): GateResult {
+  const names = gateCheckNames(config, requirement.dimension);
+  const observed = task.evidence.filter(isObservedCheck);
+  const fresh = observed.filter(
+    (entry) => statuses.get(entry.id) === "passed" && entry.data.observation?.exitCode === 0,
+  );
+  const named = (entry: Entry<Evidence>): boolean => {
+    const observation = entry.data.observation!;
+    return (
+      observation.configured &&
+      !observation.shell &&
+      names.includes(observation.name ?? "") &&
+      matchesNamedCheck(config, observation.name, observation.argv, observation.cwd)
+    );
+  };
+  const considered = observed.map((entry) => entry.id);
+  const run = checkCommand(names[0] ?? "<name>", runtimeVersion());
+  if (config.error)
+    return {
+      satisfied: [],
+      considered,
+      reason: `check config is invalid (${config.error}); fix it, then run ${run}`,
+    };
+  if (!names.length)
+    return {
+      satisfied: [],
+      considered,
+      reason:
+        requirement.dimension === "testing" && config.checks.length
+          ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}`
+          : `no checks are configured or detected; add ${CHECKS_FILE} (committed, so it shows in the diff), e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`,
+    };
+  const satisfied = fresh.filter(named);
+  if (satisfied.length)
+    return {
+      satisfied: satisfied.map((entry) => entry.id),
+      considered,
+      reason: `a fresh passing configured check (${names.join("|")}) was observed by workit check`,
+    };
+  const reported = task.evidence.some(
+    (entry) =>
+      entry.data.kind === "check" &&
+      !isObservedCheck(entry) &&
+      entry.data.requirementIds.includes(requirement.id),
+  );
+  const reason = fresh.length
+    ? `ad-hoc checks do not satisfy a configured gate; run ${run}`
+    : observed.some((entry) => statuses.get(entry.id) === "stale")
+      ? `observed checks are stale (the worktree changed); run ${run}`
+      : observed.some((entry) => statuses.get(entry.id) === "failed")
+        ? `the observed check failed; fix it and run ${run}`
+        : reported
+          ? `agent-reported checks are notes, not evidence; run ${run}`
+          : `no CLI-observed check (needs kind:check observed by workit check); run ${run}`;
+  return { satisfied: [], considered, reason };
+}
+
 export function evaluateRequirements(
   task: TaskRecord,
   workspace: WorkspaceRecord,
@@ -506,8 +656,12 @@ export function evaluateRequirements(
   candidate: Candidate | null,
   checkoutRoot: string,
   _caller?: Caller,
+  freshness: Freshness = treeFreshness(checkoutRoot),
 ) {
-  const evidence = evaluateEvidence(task, candidate);
+  const evidence = evaluateEvidence(task, candidate, freshness);
+  const statuses = new Map(evidence.map((item) => [item.evidenceId, item.status]));
+  let checkConfig: CheckConfig | undefined;
+  const configFor = (): CheckConfig => (checkConfig ??= loadCheckConfig(checkoutRoot));
   if (task.policy && task.policy.policyVersion !== POLICY_VERSION)
     return task.policy.requirements.map((requirement) => ({
       requirementId: requirement.id,
@@ -517,10 +671,23 @@ export function evaluateRequirements(
       reason: "stored policy version is unsupported; reassessment is required",
     }));
   return (task.policy?.requirements ?? []).map((requirement) => {
+    const gate = observedGate(requirement)
+      ? evaluateObservedGate(task, requirement, statuses, configFor())
+      : null;
+    if (gate?.satisfied.length)
+      return {
+        requirementId: requirement.id,
+        status: "satisfied" as const,
+        evidenceIds: gate.satisfied,
+        decisionIds: [],
+        reason: gate.reason,
+      };
     const related = task.evidence
       .map((entry, index) => ({ entry, evaluation: evidence[index] }))
       .filter(({ entry }) => entry.data.requirementIds.includes(requirement.id));
     const passed = related.filter(({ entry, evaluation }) => {
+      // A gated requirement was decided above: reported checks are only notes.
+      if (gate) return false;
       if (
         !evidenceMatchesRequirement(
           evaluation.status,
@@ -659,6 +826,14 @@ export function evaluateRequirements(
         capability.assurance === "unavailable" &&
         (capability.name === requirement.dimension || capability.surface === requirement.dimension),
     );
+    if (gate)
+      return {
+        requirementId: requirement.id,
+        status: unavailable ? ("unavailable" as const) : ("unsatisfied" as const),
+        evidenceIds: [...new Set([...gate.considered, ...related.map(({ entry }) => entry.id)])],
+        decisionIds: [],
+        reason: unavailable ? "required capability is unavailable" : gate.reason,
+      };
     if (!unavailable && related.length > 0 && !passed.length)
       return {
         requirementId: requirement.id,

package/src/git/rev.ts

@@ -296,6 +296,56 @@ export function worktreeTree(
   }
 }
 
+/**
+ * A cheap worktree freshness signal for per-turn paths: sha256 over HEAD and,
+ * for every entry `git status` reports (untracked files listed one by one),
+ * its path, lstat mode, size and mtime. A directory entry (a submodule or an
+ * untracked nested repository) also contributes its own HEAD, so moving a
+ * submodule or committing in a nested repo changes the signal. Git answers
+ * from its stat cache and, with GIT_OPTIONAL_LOCKS=0, never refreshes the
+ * index, and nothing is written to the object store (unlike worktreeTree).
+ * Equal signals mean "probably unchanged": an edit to an already-dirty file
+ * that keeps its mode, size and mtime is not seen, so gates that decide
+ * (close, inspect) use worktreeTree. Null outside a repository.
+ */
+export function worktreeSignal(cwd: string, options: { timeoutMs?: number } = {}): string | null {
+  const top = line(git(cwd, ["rev-parse", "--show-toplevel"]));
+  if (!top) return null;
+  const status = git(
+    top,
+    [
+      "status",
+      "--porcelain=v1",
+      "-z",
+      "--untracked-files=all",
+      "--no-renames",
+      "--ignore-submodules=dirty",
+    ],
+    {
+      env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" },
+      timeoutMs: options.timeoutMs ?? GIT_TIMEOUTS.worktree,
+    },
+  );
+  if (!status.ok) return null;
+  const hash = createHash("sha256");
+  hash.update(`${headSha(top) ?? "unborn"}\0`);
+  for (const entry of status.stdout.split("\0")) {
+    if (entry.length < 4) continue;
+    const file = entry.slice(3);
+    const absolute = path.join(top, file);
+    let stat = "-";
+    try {
+      const info = fs.lstatSync(absolute, { bigint: true });
+      stat = `${info.mode.toString(8)}:${info.size}:${info.mtimeNs}`;
+      if (info.isDirectory()) stat += `:${headSha(absolute) ?? "-"}`;
+    } catch {
+      // Deleted: the status code alone records it.
+    }
+    hash.update(`${entry.slice(0, 2)}\0${file}\0${stat}\0`);
+  }
+  return `sig:${hash.digest("hex")}`;
+}
+
 /** The best common ancestor of two revisions, or null. */
 export function mergeBase(cwd: string, a: string, b: string): string | null {
   if (!safeArg(a) || !safeArg(b)) return null;

package/src/hooks/context.ts

@@ -3,6 +3,8 @@
 import path from "node:path";
 import { invariantBootstrap } from "../core/methods";
 import { canonicalJson } from "../core/task-contract";
+import { isObservedCheck, type Freshness } from "../core/task-evaluation";
+import { worktreeSignal } from "../git/rev";
 import { WorkitCore, type OperationContext } from "../core/task-engine";
 import { fileSignature, racySignature, TaskStore, type TaskIndexEntry } from "../core/task-store";
 import { capabilitiesFor, type HostDescriptor } from "./descriptor";
@@ -80,8 +82,30 @@ const filesKey = (files: string[]): string | null => {
     : signatures.join("\0");
 };
 
-type CachedContext = { key: string; files: string[]; filesKey: string | null; value: string };
+type CachedContext = {
+  key: string;
+  files: string[];
+  filesKey: string | null;
+  /** The worktree signal the value was judged against; null when no observed check depends on it. */
+  signal: string | null;
+  value: string;
+};
 const CACHE_LIMIT = 64;
+
+/** How long a computed worktree signal is reused, so cache hits do not run `git status` each turn. */
+export const SIGNAL_TTL_MS = 1_500;
+const signals = new Map<string, { at: number; value: string | null }>();
+
+/** worktreeSignal for `root`, reused for SIGNAL_TTL_MS. */
+const recentSignal = (root: string): string | null => {
+  const now = Date.now();
+  const cached = signals.get(root);
+  if (cached && now - cached.at < SIGNAL_TTL_MS) return cached.value;
+  const value = worktreeSignal(root);
+  signals.set(root, { at: now, value });
+  if (signals.size > CACHE_LIMIT) signals.delete(signals.keys().next().value!);
+  return value;
+};
 const cache = new Map<string, CachedContext>();
 
 /**
@@ -123,20 +147,35 @@ function entryCompactContext(
     capabilities: context.capabilities,
   });
   const hit = cache.get(slot);
-  if (hit && hit.key === key && hit.filesKey !== null && hit.filesKey === filesKey(hit.files))
+  if (
+    hit &&
+    hit.key === key &&
+    hit.filesKey !== null &&
+    hit.filesKey === filesKey(hit.files) &&
+    // Observed-check freshness changes with the worktree, not the revision.
+    (hit.signal === null || hit.signal === recentSignal(store.root))
+  )
     return hit.value;
   const task = store.readTask(entry.id);
   if (!task.ok) return null;
+  const freshness: Freshness = { mode: "signal", current: () => recentSignal(store.root) };
+  const observed = task.data.evidence.some(isObservedCheck);
   const files = task.data.decisions.flatMap((decision) =>
     decision.data.binding.contentRefs.flatMap((ref) =>
       ref.kind === "file" ? [path.resolve(store.root, ref.path)] : [],
     ),
   );
-  const observed = filesKey(files);
-  const compact = new WorkitCore(store, context).compactContext(entry.id);
+  const observedFiles = filesKey(files);
+  const compact = new WorkitCore(store, context).compactContext(entry.id, freshness);
   if (!compact.ok) return null;
   cache.delete(slot);
-  cache.set(slot, { key, files, filesKey: observed, value: compact.data });
+  cache.set(slot, {
+    key,
+    files,
+    filesKey: observedFiles,
+    signal: observed ? freshness.current() : null,
+    value: compact.data,
+  });
   if (cache.size > CACHE_LIMIT) cache.delete(cache.keys().next().value!);
   return compact.data;
 }