@brainervirus/workit-core 6.0.0 → 7.0.0

package/src/core/task-contract.ts

@@ -267,96 +267,27 @@ export const entrySchema = <T extends z.ZodType>(data: T) =>
   z.object({ id, recordedAt: utc, provenance: provenanceSchema, data }).strict();
 export type Entry<T> = { id: Id; recordedAt: Utc; provenance: Provenance; data: T };
 
-export const factSchema = z
-  .object({
-    statement: text,
-    basis: z.enum(["observed", "inferred", "unknown"]),
-    refs: z.array(refSchema),
-  })
-  .strict()
-  .check((ctx) => {
-    if (ctx.value.basis === "observed" && ctx.value.refs.length === 0)
-      ctx.issues.push({
-        code: "custom",
-        input: ctx.value,
-        message: "observed facts require supporting references",
-        path: ["refs"],
-      });
-  });
-export type Fact = z.infer<typeof factSchema>;
-export const signalSchema = z
+/** Risk tiers an agent judges; aliases (low, medium, …) are mapped on input. */
+export const RISK_TIERS = ["trivial", "normal", "high"] as const;
+export type RiskTier = (typeof RISK_TIERS)[number];
+/**
+ * The agent's policy judgment (S17): four flat calls plus an optional note
+ * and supporting refs. Everything else is derived deterministically
+ * (core/policy/derive.ts).
+ */
+export const judgmentSchema = z
   .object({
-    value: z.union([z.boolean(), z.literal("unknown")]),
-    basis: z.enum(["observed", "inferred", "unknown"]),
-    reason: text,
+    riskTier: z.enum(RISK_TIERS),
+    behaviorChange: z.boolean(),
+    productChoiceOpen: z.boolean(),
+    needsPlan: z.boolean(),
+    note: text.nullable(),
     refs: z.array(refSchema),
   })
-  .strict()
-  .check((ctx) => {
-    const signal = ctx.value;
-    const valid =
-      signal.value === "unknown"
-        ? signal.basis === "unknown"
-        : signal.basis === "observed" || signal.basis === "inferred";
-    if (!valid)
-      ctx.issues.push({
-        code: "custom",
-        input: signal,
-        message: "signal value and basis disagree",
-        path: [],
-      });
-    if (signal.basis === "observed" && signal.refs.length === 0)
-      ctx.issues.push({
-        code: "custom",
-        input: signal,
-        message: "observed signals require supporting references",
-        path: ["refs"],
-      });
-  });
-export type Signal = z.infer<typeof signalSchema>;
-const signalSet = z
-  .object({
-    approachUnknown: signalSchema,
-    productChoiceOpen: signalSchema,
-    behaviorChange: signalSchema,
-    mechanicalLowRisk: signalSchema,
-    durableAgreementNeeded: signalSchema,
-    coordinationPlanNeeded: signalSchema,
-    helperUseful: signalSchema,
-    testFirstPractical: signalSchema,
-  })
-  .strict();
-const consequenceSchema = z
-  .object({
-    area: z.enum([
-      "behavior",
-      "public_contract",
-      "data",
-      "security",
-      "operations",
-      "reversibility",
-      "consumers",
-    ]),
-    fact: factSchema,
-  })
-  .strict();
-const verificationSchema = z
-  .object({
-    claim: text,
-    scope: scopeSchema,
-    availableChecks: z.array(refSchema),
-    gaps: z.array(text),
-  })
   .strict();
-export const assessmentSchema = z
-  .object({
-    facts: z.array(factSchema),
-    signals: signalSet,
-    consequences: z.array(consequenceSchema),
-    verification: z.array(verificationSchema),
-  })
-  .strict();
-export type Assessment = z.infer<typeof assessmentSchema>;
+export type Judgment = z.infer<typeof judgmentSchema>;
+/** A ≤6.x assessment as stored (facts/signals/…): kept verbatim, never written. */
+export const legacyAssessmentSchema = z.looseObject({});
 
 export const constraintSchema = z
   .object({
@@ -714,7 +645,10 @@ export const taskRecordSchema = z
     progress: progressSchema,
     pauseReason: text.nullable().optional(),
     runtime: runtimeSchema.optional(),
-    assessments: z.array(entrySchema(assessmentSchema)),
+    /** ≤6.x assessments, read-only history; judgments replace them. */
+    assessments: z.array(entrySchema(legacyAssessmentSchema)),
+    /** Listed in `critical` once written, so an older reader fails closed. */
+    judgments: z.array(entrySchema(judgmentSchema)).optional(),
     policy: policySchema.nullable(),
     policyChanges: z.array(policyChangeSchema),
     candidates: z.array(candidateSchema),
@@ -969,14 +903,16 @@ const taskOperations = {
     decisionIds: z.array(id).optional(),
   }),
 };
+/** Judgment values as sent; core/policy/judgment.ts maps aliases and validates. */
+const rawJudgment = z.record(z.string(), z.unknown());
 const policyOperations = {
   assess: operation({
     action: z.literal("assess"),
     ...taskId,
     expectedRevision: revision.optional(),
-    assessment: assessmentSchema,
+    judgment: rawJudgment,
   }),
-  preview: operation({ action: z.literal("preview"), ...taskId, assessment: assessmentSchema }),
+  preview: operation({ action: z.literal("preview"), ...taskId, judgment: rawJudgment }),
   explain: operation({ action: z.literal("explain"), ...taskId }),
 };
 const evidenceOperations = {
@@ -1015,7 +951,11 @@ const decisionOperations = {
     ...taskId,
     expectedRevision: revision.optional(),
     purpose: decisionSchema.shape.purpose,
-    binding: decisionSchema.shape.binding,
+    // The engine binds the decision to the task and workspace it records on.
+    binding: decisionSchema.shape.binding.extend({
+      taskId: id.optional(),
+      workspaceId: id.optional(),
+    }),
     response: decisionSchema.shape.response,
     requirementIds: z.array(digest),
   }),
@@ -1071,6 +1011,16 @@ export const operationSchemas = {
   state: z.discriminatedUnion("action", Object.values(stateOperations) as any),
 } as const;
 export type OperationRequest = z.infer<(typeof operationSchemas)[OperationFamily]>;
+/** Every action of each family, in contract order: the one action table. */
+export const OPERATION_ACTIONS: Record<OperationFamily, readonly string[]> = {
+  task: Object.keys(taskOperations),
+  policy: Object.keys(policyOperations),
+  evidence: Object.keys(evidenceOperations),
+  finding: Object.keys(findingOperations),
+  decision: Object.keys(decisionOperations),
+  worker: Object.keys(workerOperations),
+  state: Object.keys(stateOperations),
+};
 
 /**
  * Schemas advertised to hosts. Every `taskId` is optional there: an operation
@@ -1186,145 +1136,6 @@ export function parseOperation(family: OperationFamily, input: unknown): Result<
   return failure("invalid_input", "operation input is invalid", { fields });
 }
 
-export function operationJsonSchema(family: OperationFamily): z.core.JSONSchema.BaseSchema {
-  return z.toJSONSchema(advertisedOperationSchemas[family], { target: "draft-2020-12" });
-}
-
-/**
- * Advertised object depth shared by every host projection. Runtime validation
- * stays full-depth in parseOperation; this bound only keeps provider tool
- * schemas (e.g. Pi, MCP) within model nesting limits.
- */
-export const OPERATION_SCHEMA_DEPTH = 1;
-
-/** Provider nesting limit every advertised Workit schema must stay within. */
-export const OPERATION_SCHEMA_MAX_DEPTH = 10;
-
-const schemaShapeDescription = (value: unknown, depth = 0): string => {
-  if (!value || typeof value !== "object") return "value";
-  const schema = value as Record<string, unknown>;
-  if (Array.isArray(schema.oneOf) || Array.isArray(schema.anyOf)) {
-    const options = (Array.isArray(schema.oneOf) ? schema.oneOf : schema.anyOf) as unknown[];
-    return `(${options.map((option) => schemaShapeDescription(option, depth)).join("|")})`;
-  }
-  if (schema.const !== undefined) return `=${JSON.stringify(schema.const)}`;
-  if (Array.isArray(schema.enum)) return `[${schema.enum.map(String).join("|")}]`;
-  const type = Array.isArray(schema.type) ? schema.type.join("/") : schema.type;
-  if (type === "array") return `arr<${schemaShapeDescription(schema.items, depth)}>`;
-  if (type === "object" && schema.properties && typeof schema.properties === "object") {
-    if (depth >= 2) return "obj";
-    const required = new Set(Array.isArray(schema.required) ? schema.required : []);
-    const properties = schema.properties as Record<string, unknown>;
-    const fields = Object.entries(properties).map(
-      ([name, child]) =>
-        `${name}${required.has(name) ? "!" : ""}:${schemaShapeDescription(child, depth + 1)}`,
-    );
-    return `obj{${fields.join(",")}}`;
-  }
-  if (typeof type !== "string") return "?";
-  return type
-    .split("/")
-    .map((part) => ({ string: "str", boolean: "bool", number: "num", null: "null" })[part] ?? part)
-    .join("|");
-};
-
-export const canonicalFieldsDescription = (
-  value: string[] | Record<string, unknown> | z.ZodType,
-): string => {
-  if (Array.isArray(value))
-    return `Canonical object fields: ${value.join(", ")}. Workit validates the complete nested value.`;
-  const isZodType = (schema: Record<string, unknown> | z.ZodType): schema is z.ZodType =>
-    "_zod" in schema && typeof schema._zod === "object";
-  const schema = isZodType(value)
-    ? (z.toJSONSchema(value, { target: "draft-2020-12" }) as Record<string, unknown>)
-    : value;
-  if (!schema.properties || typeof schema.properties !== "object") {
-    const variants = Array.isArray(schema.oneOf)
-      ? schema.oneOf
-      : Array.isArray(schema.anyOf)
-        ? schema.anyOf
-        : null;
-    return variants
-      ? `Canonical shapes: ${variants.map((variant) => schemaShapeDescription(variant)).join(" | ")}. Full nested value is validated.`
-      : "Canonical nested value; Workit validates the complete value.";
-  }
-  const properties = schema.properties as Record<string, unknown>;
-  const required = new Set(Array.isArray(schema.required) ? schema.required : []);
-  const fields = Object.entries(properties).map(
-    ([name, child]) => `${name}${required.has(name) ? "!" : ""}:${schemaShapeDescription(child)}`,
-  );
-  return `Fields (! required): ${fields.join(", ")}. Full nested value is validated.`;
-};
-
-/**
- * Provider-safe projection of an operation JSON schema. Objects deeper than
- * maxDepth collapse to a described generic object that still names the
- * canonical fields, so models know what to send while providers accept the
- * shape. The full contract in operationJsonSchema is unchanged.
- *
- * With stringifiedObjects, every object, array, and primitive-const node also
- * accepts its JSON-encoded string form. Pi's transport stringifies nested
- * params before its own validation runs, so Pi publishes the tolerant shape
- * and decodes after validation; transports that carry real JSON stay strict.
- */
-export function boundedOperationJsonSchema(
-  family: OperationFamily,
-  maxDepth: number = OPERATION_SCHEMA_DEPTH,
-  stringifiedObjects = false,
-): Record<string, unknown> {
-  const tolerate = (projected: Record<string, unknown>): Record<string, unknown> => {
-    if (!stringifiedObjects) return projected;
-    if (projected.properties && typeof projected.properties === "object")
-      return { ...projected, type: ["object", "string"] };
-    if (projected.items) return { ...projected, type: ["array", "string"] };
-    if (
-      "const" in projected &&
-      (typeof projected.const === "number" || typeof projected.const === "boolean")
-    )
-      return { anyOf: [projected, { const: String(projected.const) }] };
-    if (projected.type === "object") return { ...projected, type: ["object", "string"] };
-    if (projected.type === "array") return { ...projected, type: ["array", "string"] };
-    return projected;
-  };
-  const collapse = (node: unknown, currentDepth: number): unknown => {
-    if (Array.isArray(node)) return node.map((item) => collapse(item, currentDepth));
-    if (typeof node !== "object" || node === null) return node;
-    const record = node as Record<string, unknown>;
-    if (record.properties && typeof record.properties === "object") {
-      const properties = record.properties as Record<string, unknown>;
-      const fields = Object.keys(properties);
-      if (currentDepth >= maxDepth || fields.length === 0) {
-        const description = stringifiedObjects
-          ? `${canonicalFieldsDescription(record)} A JSON-encoded string is also accepted.`
-          : canonicalFieldsDescription(record);
-        return tolerate({ type: "object", description });
-      }
-      return tolerate({
-        ...record,
-        properties: Object.fromEntries(
-          Object.entries(record.properties as Record<string, unknown>).map(([key, child]) => [
-            key,
-            collapse(child, currentDepth + 1),
-          ]),
-        ),
-      });
-    }
-    if (record.items) return tolerate({ ...record, items: collapse(record.items, currentDepth) });
-    const composed = (["anyOf", "oneOf", "allOf"] as const).filter((key) =>
-      Array.isArray(record[key]),
-    );
-    if (composed.length > 0) {
-      const projected: Record<string, unknown> = { ...record };
-      for (const key of composed)
-        projected[key] = (record[key] as unknown[]).map((item) => collapse(item, currentDepth));
-      return projected;
-    }
-    if ("const" in record) return tolerate({ ...record });
-    return node;
-  };
-  return collapse(operationJsonSchema(family), 0) as Record<string, unknown>;
-}
-
 type JsonValue = null | boolean | number | string | JsonValue[] | { [key: string]: JsonValue };
 function canonical(value: unknown, seen: Set<object>): JsonValue {
   if (value === null || typeof value === "boolean" || typeof value === "string") {

package/src/core/task-engine.ts

@@ -7,16 +7,16 @@ import {
   failure,
   decisionDigest,
   exportBundleSchema,
-  assessmentSchema,
   decisionSchema,
   evidenceSchema,
   findingSchema,
   intentSchema,
+  judgmentSchema,
+  legacyAssessmentSchema,
   newId,
   parseOperation,
   rewriteRecordRefs,
   success,
-  type Assessment,
   type Candidate,
   type Capability,
   type Caller,
@@ -27,6 +27,7 @@ import {
   type Evidence,
   type ExportBundle,
   type Finding,
+  type Judgment,
   type Policy,
   provenanceSchema,
   type Ref,
@@ -45,6 +46,11 @@ import {
   scopeCovers as bindingCovers,
 } from "./task-contract";
 import { diffPolicy, resolvePolicy } from "./policy-resolver";
+import { normalizeOperationInput } from "./operation-input";
+import { latestJudgment } from "./policy/derive";
+import { normalizeJudgment } from "./policy/judgment";
+import { resolveAutonomy, type VerificationMode } from "../autonomy";
+
 import { sameDirectoryIdentity, TaskStore } from "./task-store";
 import { checkoutRootOf } from "../store/paths";
 import { defaultLockTimeout } from "./store-lock";
@@ -76,6 +82,15 @@ import {
   type CandidateEnvironment,
 } from "./task-evaluation";
 
+/** The user-config verification mode for `root`; `self` when it cannot be read. */
+const workspaceVerification = (root: string): VerificationMode => {
+  try {
+    return resolveAutonomy(root).verification;
+  } catch {
+    return "self";
+  }
+};
+
 export type OperationContext = {
   root: string;
   caller: Caller;
@@ -429,29 +444,8 @@ const mapRef = (ref: Ref, ids: Map<string, string>): Ref => {
   return { ...ref, id: ids.get(ref.id) ?? ref.id };
 };
 
-const portableRefs = (refs: Ref[]): Ref[] =>
-  refs.filter((ref) => ref.kind === "file" || ref.kind === "record");
 const portableRef = (ref: Ref | null): Ref | null =>
   ref && (ref.kind === "file" || ref.kind === "record") ? ref : null;
-const portableFact = (fact: Assessment["facts"][number]) => {
-  const refs = portableRefs(fact.refs);
-  return fact.basis === "observed" && refs.length === 0
-    ? { ...fact, basis: "unknown" as const, refs }
-    : { ...fact, refs };
-};
-const portableSignal = (signal: Assessment["signals"][keyof Assessment["signals"]]) => {
-  const refs = portableRefs(signal.refs);
-  return signal.basis === "observed" && refs.length === 0
-    ? {
-        ...signal,
-        value: "unknown" as const,
-        basis: "unknown" as const,
-        reason: "portable supporting reference was removed",
-        refs,
-      }
-    : { ...signal, refs };
-};
-
 const importedProvenance = (context: OperationContext): Provenance => ({
   kind: "imported",
   host: context.caller.host,
@@ -467,21 +461,6 @@ const portableTask = (task: TaskRecord): TaskRecord => {
   if (typeof stripped !== "object" || stripped === null || Array.isArray(stripped))
     throw new TypeError("portable task rewrite produced a non-record");
   const clone = structuredClone(stripped) as TaskRecord;
-  const demote = (
-    facts: Assessment["facts"][number][],
-    signals: Assessment["signals"],
-    consequences: Assessment["consequences"],
-  ): void => {
-    for (const fact of facts) Object.assign(fact, portableFact(fact));
-    for (const name of Object.keys(signals) as (keyof Assessment["signals"])[]) {
-      const signal = signals[name];
-      Object.assign(signal, portableSignal(signal));
-    }
-    for (const consequence of consequences)
-      Object.assign(consequence.fact, portableFact(consequence.fact));
-  };
-  for (const entry of clone.assessments)
-    demote(entry.data.facts, entry.data.signals, entry.data.consequences);
   // Candidate metadata can contain environment-derived paths and digests. The destination
   // must recapture its own candidate instead of receiving source checkout material.
   clone.candidates = [];
@@ -506,6 +485,7 @@ const importedTask = (
   for (const entry of [
     source.intent,
     ...source.assessments,
+    ...(source.judgments ?? []),
     ...source.evidence,
     ...source.decisions,
     ...source.findings,
@@ -529,9 +509,16 @@ const importedTask = (
       id: fresh(entry.id),
       recordedAt: timestamp,
       provenance: imported,
-      data: rewriteRecordRefs(data, assessmentSchema, remap) as typeof data,
+      data: rewriteRecordRefs(data, legacyAssessmentSchema, remap) as typeof data,
     };
   });
+  const judgments = source.judgments?.map((entry) => ({
+    ...entry,
+    id: fresh(entry.id),
+    recordedAt: timestamp,
+    provenance: imported,
+    data: rewriteRecordRefs(entry.data, judgmentSchema, remap) as typeof entry.data,
+  }));
   const evidence = source.evidence.map((entry) => ({
     ...entry,
     id: fresh(entry.id),
@@ -603,6 +590,7 @@ const importedTask = (
     status: "paused",
     closure: null,
     assessments,
+    ...(judgments ? { judgments } : {}),
     evidence,
     decisions: decisions.map((entry) => {
       const data = rewriteRecordRefs(entry.data, decisionSchema, remap) as typeof entry.data;
@@ -700,7 +688,9 @@ export class WorkitCore {
    * this checkout's branch (D3). Recording actions create that task on first
    * use; reads and lifecycle actions only look it up. Helpers never create.
    */
-  private implicitTask(family: OperationFamily, request: unknown): Result<unknown> {
+  private implicitTask(family: OperationFamily, raw: unknown): Result<unknown> {
+    // Flat tool inputs become the canonical request first (S17).
+    const request = normalizeOperationInput(family, raw, this.context.caller.host);
     if (typeof request !== "object" || request === null || Array.isArray(request))
       return success(null, null, request);
     const value = request as { action?: unknown; taskId?: unknown };
@@ -969,7 +959,10 @@ export class WorkitCore {
     if ((this.context.workerId ?? null) !== null)
       return failure("permission_denied", "helpers cannot change task requirements");
     this.fillRevisions(input, task.data);
-    const resolved = this.resolve(task.data, input.assessment);
+    const judged = normalizeJudgment(input.judgment, latestJudgment(task.data));
+    if (!judged.ok) return judged;
+    const judgment = judged.data.judgment;
+    const resolved = this.resolve(task.data, judgment);
     if (!resolved.ok) return resolved;
     if (input.action === "preview") return success(null, null, resolved.data);
     if (input.action !== "assess")
@@ -986,16 +979,18 @@ export class WorkitCore {
           "policy reassessed",
           mutation.now,
         );
-        const assessment = {
+        const entry = {
           id: newId(),
           recordedAt: mutation.now,
           provenance: provenance(this.context),
-          data: input.assessment as Assessment,
+          data: judgment,
         };
         const next = {
           ...current,
           constraints: this.context.constraints,
-          assessments: [...current.assessments, assessment],
+          judgments: [...(current.judgments ?? []), entry],
+          // Older readers would drop judgments on rewrite: they fail closed instead.
+          critical: [...new Set([...(current.critical ?? []), "judgments"])],
           policy: resolved.data,
           policyChanges: nextChange
             ? [...current.policyChanges, nextChange]
@@ -1270,9 +1265,15 @@ export class WorkitCore {
       const workspace = this.store.readWorkspace();
       if (!workspace.ok) return workspace;
       if (!workspace.data) return failure("not_found", "workspace not found");
-      if (input.binding.taskId !== task.data.id || input.binding.workspaceId !== workspace.data.id)
+      // Flat inputs omit the binding ids: a decision binds to where it is recorded.
+      const binding = {
+        ...input.binding,
+        taskId: input.binding.taskId ?? task.data.id,
+        workspaceId: input.binding.workspaceId ?? workspace.data.id,
+      } as Decision["binding"];
+      if (binding.taskId !== task.data.id || binding.workspaceId !== workspace.data.id)
         return failure("invalid_input", "decision task or workspace binding is invalid");
-      const content = verifyDecisionContentAtRoot(this.store.root, input.binding);
+      const content = verifyDecisionContentAtRoot(this.store.root, binding);
       if (!content.ok) return content;
       const knownRequirements = new Set(
         task.data.policy?.requirements.map((item) => item.id) ?? [],
@@ -1281,7 +1282,7 @@ export class WorkitCore {
         return failure("invalid_input", "decision references an unknown requirement");
       const base = {
         purpose: input.purpose,
-        binding: input.binding,
+        binding,
         response: input.response,
         requirementIds: input.requirementIds,
         revoked: null,
@@ -1765,20 +1766,12 @@ export class WorkitCore {
     });
   }
 
-  private resolve(task: TaskRecord, assessment: Assessment): Result<Policy> {
+  private resolve(task: TaskRecord, judgment: Judgment): Result<Policy> {
     return resolvePolicy({
       intent: task.intent.data,
-      assessment,
+      judgment,
       constraints: this.context.constraints,
-      prior: {
-        decisions: task.decisions
-          .filter((entry) => entry.provenance.kind !== "imported")
-          .map((entry) => entry.data),
-        findings: task.findings
-          .filter((entry) => entry.provenance.kind !== "imported")
-          .map((entry) => entry.data),
-        requirements: task.origin || task.policy === null ? [] : task.policy.requirements,
-      },
+      verification: workspaceVerification(this.context.root),
     });
   }
 

package/src/core/task-evaluation.ts

@@ -34,6 +34,7 @@ import {
 } from "../check-config";
 import { worktreeSignal, worktreeTree } from "../git/rev";
 import { runtimeVersion } from "./task-store";
+import { derivedRuleStatus, ledgerView } from "./policy/derive";
 
 export type CandidateEnvironment =
   | readonly (string | { name: string; value?: string | null })[]
@@ -556,7 +557,7 @@ export const verifyDecisionContentAtRoot = (
   return success(null, null, null);
 };
 
-const applicableDecision = (
+export const applicableDecision = (
   task: TaskRecord,
   workspace: WorkspaceRecord,
   requirement: Requirement,
@@ -729,7 +730,40 @@ export function evaluateRequirements(
       decisionIds: [],
       reason: "stored policy version is unsupported; reassessment is required",
     }));
+  const ledger = ledgerView(checkoutRoot);
   return (task.policy?.requirements ?? []).map((requirement) => {
+    // Verdict, product-decision and plan rules read the ledger or the plan (S17).
+    const derived = derivedRuleStatus(task, requirement, checkoutRoot, ledger);
+    if (derived) {
+      if (derived.met)
+        return {
+          requirementId: requirement.id,
+          status: "satisfied" as const,
+          evidenceIds: [],
+          decisionIds: derived.decisionIds,
+          reason: derived.reason,
+        };
+      const waived = requirement.acceptanceAllowed
+        ? applicableDecision(task, workspace, requirement, checkoutRoot)
+        : [];
+      if (waived.length)
+        return {
+          requirementId: requirement.id,
+          status: "accepted_limitation" as const,
+          evidenceIds: [],
+          decisionIds: waived.map(
+            (decision) => task.decisions.find((entry) => entry.data === decision)!.id,
+          ),
+          reason: "an applicable approved limitation permits the missing evidence",
+        };
+      return {
+        requirementId: requirement.id,
+        status: "unsatisfied" as const,
+        evidenceIds: [],
+        decisionIds: [],
+        reason: derived.reason,
+      };
+    }
     const gate = observedGate(requirement)
       ? evaluateObservedGate(task, requirement, statuses, configFor())
       : null;

package/src/core/workspaces.ts

@@ -121,6 +121,8 @@ const workspaceConfigSchema = z
     autoApprove: z.union([z.boolean(), z.array(nonBlank)]).optional(),
     /** Where an unnamed request stops (skills read it); same rules as grants. */
     defaultEndpoint: z.enum(["commit", "pr"]).optional(),
+    /** How a normal-risk behavior change is verified (S17); same rules as grants. */
+    verification: z.enum(["self", "independent"]).optional(),
     /** Autonomy grants (D15): only ever set here, by the user. */
     autonomy: z
       .object(

package/src/core.ts

@@ -8,11 +8,6 @@ export {
   OPERATION_FAMILIES,
   operationSchemas,
   advertisedOperationSchemas,
-  operationJsonSchema,
-  boundedOperationJsonSchema,
-  OPERATION_SCHEMA_DEPTH,
-  OPERATION_SCHEMA_MAX_DEPTH,
-  canonicalFieldsDescription,
   parseOperation,
   success,
   failure,
@@ -25,6 +20,13 @@ export {
   requirementId,
   rewriteRecordRefs,
 } from "./core/task-contract";
+export {
+  flatOperationJsonSchema,
+  normalizeOperationInput,
+  operationDescription,
+  operationJsonSchema,
+  parseAdvertisedOperation,
+} from "./core/operation-input";
 export type {
   OperationFamily,
   OperationRequest,
@@ -32,7 +34,7 @@ export type {
   Caller,
   Scope,
   Ref,
-  Assessment,
+  Judgment,
   Dimension,
   Requirement,
   Constraint,