@brainervirus/workit-core 6.0.1 → 7.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "6.0.1",
+  "version": "7.1.0",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/skills/workit-deslop/SKILL.md

@@ -22,7 +22,7 @@ behavior. A change that wants new behavior is its own change.
    validator that changes behavior is not deslop.
 5. **Re-run the checks** and report lines removed, not lines written. Nothing
    to clean is a valid result: say what you checked ("0 removals; ran knip and
-   read the diff"). When a tracked task lists a `pre-pr-cleanup` requirement,
+   read the diff"). When a tracked task lists a `pre-pr-cleanup` requirement (≤6.x tasks),
    record this result as its evidence.
 
 ## Example

package/skills/workit-implement/SKILL.md

@@ -11,6 +11,9 @@ description: Build a requested change in small verified steps - follow local pat
    neighbour that already does something similar. Copy its patterns, names and
    error handling. Repo rules (AGENTS.md, CLAUDE.md, lint config) win.
 2. On the default branch? Branch first: `workit git branch --kind feature --slug <s>`.
+   Tracking it? Judge once: `workit policy assess --judge risk=normal
+   behavior=yes product-choice=no plan=no` (trivial and no for a mechanical
+   fix); Workit derives what close needs.
 3. Small steps that each leave the tree green. Behavior change: write the
    acceptance as Given/When/Then and see a test fail first (workit-bdd).
    Mechanical change: the existing checks are enough.
@@ -24,10 +27,12 @@ description: Build a requested change in small verified steps - follow local pat
    PR (`workit git push`, `workit pr create --fill`, then workit-ship) only when
    that was requested, or the request implies delivery and `workit grant show`
    reports `defaultEndpoint` `pr`; otherwise the endpoint is `commit`.
-7. Hand off verification. Never record a passing verdict on your own work.
-   Start a fresh verifier with its own session (`WORKIT_SESSION_ID=<yours>-v1`;
-   Claude Code: the `verifier` agent, which the hook gives one); it runs
-   verify-<app> and `workit ledger verdict`. Before saying done, reconcile
+7. Verify. Normal risk: after `workit check test` passes, record your own
+   `workit ledger verdict tests-verified --self --how "<what you ran>"`; it
+   reads self-reviewed, never verified. High risk, a workspace with
+   `verification: independent` (`workit grant show`) or a verified merge needs
+   a fresh verifier with its own session (`WORKIT_SESSION_ID=<yours>-v1`;
+   Claude Code: the `verifier` agent). Before saying done, reconcile
    every named deliverable against the target checkout and observe it (for a push:
    `workit verify-delivery push`).
 

package/skills/workit-review/SKILL.md

@@ -8,6 +8,8 @@ description: Independent review of a diff, branch or PR - intent fidelity and st
 Review the candidate, never the author's summary of it. A session that wrote a
 commit on the branch cannot record a passing verdict: if that is you, hand the
 review to a fresh agent (Claude Code: the `reviewer` or `verifier` agent).
+An author's `--self` verdict reads self-reviewed and never counts as
+independent; `type-check-only` never proves a behavior change.
 
 1. Pin the candidate: `git rev-parse HEAD`, the base, `git diff <base>...HEAD`;
    for a PR, `workit pr status --json` (checks, unresolved threads).

package/skills/workit-shape/SKILL.md

@@ -43,7 +43,7 @@ a choice that is hard to reverse, surprising and a real trade-off; a glossary
 entry for a term you had to resolve; `.out-of-scope/<concept>.md` for a rejected
 request that will come back. A one-file mechanical fix gets none. Formats and
 triggers: `references/knowledge.md`. Record each settled choice once:
-`workit ledger decision "<what>" --why "<why>"`.
+`workit ledger decision "<what>" --why "<why>"`; cite a plan: `workit policy assess --ref <path>`.
 
 ## 5. Slice as tracer bullets
 

package/skills/workit-ship/SKILL.md

@@ -33,7 +33,7 @@ merge: Stop at PR-ready unless the user set merge as the endpoint.
    `workit ci rerun --failed --reason flake` (once per head). Real: reproduce
    with `workit check`, fix the root cause, batch fixes into one push.
 6. **Verified.** After the last push a non-author records a verdict
-   (workit-review). Land only when granted: `workit stack land` (the
+   (workit-review); `pr status` showing self-reviewed is not verified. Land only when granted: `workit stack land` (the
    contiguous verified run from the root) or `workit pr merge`.
 7. **Observe it landed:** `workit verify-delivery pr` or `merge`.
 

package/src/autonomy.ts

@@ -92,6 +92,19 @@ export const DEFAULT_GRANTS: Readonly<Grants> = Object.freeze({
  */
 export type DefaultEndpoint = "commit" | "pr";
 export const DEFAULT_ENDPOINT: DefaultEndpoint = "commit";
+/**
+ * How a normal-risk behavior change is verified (S17). `self` (default): an
+ * observed passing `workit check test` plus the author's own `--self`
+ * verdict, labelled self-reviewed. `independent`: a verdict from a session
+ * that did not author the branch. User config only, like grants.
+ */
+export type VerificationMode = "self" | "independent";
+export const DEFAULT_VERIFICATION: VerificationMode = "self";
+export const verificationOf = (entry: unknown): VerificationMode =>
+  (entry as { verification?: unknown } | null)?.verification === "independent"
+    ? "independent"
+    : "self";
+
 const endpointOf = (entry: unknown): DefaultEndpoint =>
   (entry as { defaultEndpoint?: unknown } | null)?.defaultEndpoint === "pr" ? "pr" : "commit";
 
@@ -106,6 +119,7 @@ export type Autonomy = {
   source: AutonomySource;
   accountConfigured: boolean;
   defaultEndpoint: DefaultEndpoint;
+  verification: VerificationMode;
   /** Set when the grants file was not read (see grantsOverride). */
   note?: string;
 };
@@ -182,6 +196,7 @@ export function resolveAutonomy(cwd: string): Autonomy {
       source: "default",
       accountConfigured: false,
       defaultEndpoint: DEFAULT_ENDPOINT,
+      verification: DEFAULT_VERIFICATION,
       note: override,
     };
   const workspace = resolveWorkspaceFrom(
@@ -197,6 +212,7 @@ export function resolveAutonomy(cwd: string): Autonomy {
     source,
     accountConfigured: Boolean(workspace?.vcs?.account),
     defaultEndpoint: endpointOf(workspace),
+    verification: verificationOf(workspace),
   };
 }
 
@@ -282,6 +298,7 @@ export type GrantWrite =
       grants: Grants;
       configured: GrantKind[];
       defaultEndpoint: DefaultEndpoint;
+      verification: VerificationMode;
     }
   | { ok: false; code: "not_found" | "invalid_input" | "failed"; error: string };
 
@@ -298,6 +315,8 @@ export function writeGrants(
   dir: string = grantsDir(),
   /** A new default endpoint; `null` removes it (back to `commit`). */
   endpoint?: DefaultEndpoint | null,
+  /** A new verification mode; `null` removes it (back to `self`). */
+  verification?: VerificationMode | null,
 ): GrantWrite {
   const current = readWorkspacesResult(dir);
   if (current.status === "missing")
@@ -329,6 +348,8 @@ export function writeGrants(
   delete entry.autoApprove;
   if (endpoint === null || endpoint === DEFAULT_ENDPOINT) delete entry.defaultEndpoint;
   else if (endpoint) entry.defaultEndpoint = endpoint;
+  if (verification === null || verification === DEFAULT_VERIFICATION) delete entry.verification;
+  else if (verification) entry.verification = verification;
   const autonomy = {
     ...unknown,
     ...Object.fromEntries(
@@ -366,6 +387,7 @@ export function writeGrants(
     grants: { ...DEFAULT_GRANTS, ...grants },
     configured: GRANT_KINDS.filter((kind) => grants[kind] !== undefined),
     defaultEndpoint: endpointOf(entry),
+    verification: verificationOf(entry),
   };
 }
 
@@ -378,6 +400,7 @@ export function listGrants(dir: string = grantsDir()): {
     grants: Grants;
     configured: GrantKind[];
     defaultEndpoint: DefaultEndpoint;
+    verification: VerificationMode;
   }[];
   error?: string;
 } {
@@ -394,6 +417,7 @@ export function listGrants(dir: string = grantsDir()): {
         grants: { ...DEFAULT_GRANTS, ...grants },
         configured: GRANT_KINDS.filter((kind) => grants[kind] !== undefined),
         defaultEndpoint: endpointOf(entry),
+        verification: verificationOf(entry),
       };
     }),
   };

package/src/core/branch.ts

@@ -5,6 +5,7 @@ import path from "node:path";
 import { matchCommitFlavor } from "./commit-flavors";
 import { gitContext } from "./git";
 import {
+  branchGlobPattern,
   readConfig,
   resolveBranchPolicy as resolveConfiguredBranchPolicy,
   resolveCommitPolicy as resolveConfiguredCommitPolicy,
@@ -15,6 +16,47 @@ import {
   type WorkspaceCommitPolicy,
 } from "./workspaces";
 import { vcsCliIdentity, vcsConfig } from "./vcs-config";
+import {
+  ReleaseTrackError,
+  namingGlob,
+  trackBranches,
+  workspaceReleaseTracks,
+} from "./release-tracks";
+
+/**
+ * Release tracks extend the branch policy: every track's long-lived branches
+ * are protected (the union across tracks plus the explicit protected list),
+ * and the tracks' naming templates are allowed branch patterns. A track read
+ * that must fail closed (a `critical` field) throws, so callers block.
+ */
+const withReleaseTracks = (
+  workspaceRoot: string,
+  policy: ReturnType<typeof resolveConfiguredBranchPolicy>,
+): ReturnType<typeof resolveConfiguredBranchPolicy> => {
+  const read = workspaceReleaseTracks(workspaceRoot);
+  if (read.error) throw new ReleaseTrackError(read.error);
+  if (read.tracks.length === 0 && read.protectedBranches.length === 0) return policy;
+  const known = new Set(policy.allowed.map((pattern) => pattern.source));
+  const allowed = [...policy.allowed];
+  for (const glob of read.tracks.flatMap((track) => Object.values(track.naming).map(namingGlob))) {
+    const pattern = branchGlobPattern(glob);
+    if (!known.has(pattern.source)) {
+      known.add(pattern.source);
+      allowed.push(pattern);
+    }
+  }
+  return {
+    ...policy,
+    allowed,
+    protected: new Set([
+      ...policy.protected,
+      // Fail-safe: every branch any track entry names, including dropped ones.
+      ...[...trackBranches(read.tracks), ...read.protectedBranches].map((name) =>
+        name.toLowerCase(),
+      ),
+    ]),
+  };
+};
 
 function effectiveWorkspacePolicy(
   workspaceRoot: string,
@@ -53,9 +95,12 @@ function effectiveWorkspacePolicy(
   const config = readConfig();
   return kind === "branch"
     ? {
-        branchPolicy: resolveConfiguredBranchPolicy(
-          config,
-          selected.policy ? { branchPolicy: selected.policy as WorkspaceBranchPolicy } : null,
+        branchPolicy: withReleaseTracks(
+          workspaceRoot,
+          resolveConfiguredBranchPolicy(
+            config,
+            selected.policy ? { branchPolicy: selected.policy as WorkspaceBranchPolicy } : null,
+          ),
         ),
         provenance: { branchPolicy: selected.source },
       }
@@ -262,10 +307,16 @@ export const verifyPushIdentity = (
   return { ok: true };
 };
 // RL-01: malformed vcs.json blocks branch resolution with an exact-path error.
-const baseBranch = (cwd: string): { base: string } | { error: string } => {
+// With release tracks, the base is the resolved track's base branch.
+const baseBranch = (cwd: string): { base: string; trackBranches: string[] } | { error: string } => {
   const resolved = vcsConfig("resolve", cwd);
   if (resolved.ok === false) return { error: String(resolved.error) };
-  return { base: String(resolved.defaultTargetBranch ?? "develop") };
+  // Creating a branch on an undetermined release line would guess the base.
+  if (resolved.releaseTrack?.blocking) return { error: String(resolved.releaseTrack.blocking) };
+  return {
+    base: String(resolved.baseBranch ?? resolved.defaultTargetBranch ?? "develop"),
+    trackBranches: resolved.releaseTrack ? trackBranches(resolved.releaseTrack.tracks) : [],
+  };
 };
 const DECLARE_RE = /^\s*\*+Branch:\*+\s*`?([^`\s|]+)`?\s*$/gim;
 const USE_CURRENT_RE = /^\s*\*+Branch:\*+\s*use-current\s*$/im;
@@ -407,7 +458,13 @@ export const docsBranch = ({
   if ("error" in baseResolved) return { error: baseResolved.error };
   const base = baseResolved.base;
 
-  if (current === base || current === "main" || current === "master" || current === "develop") {
+  if (
+    current === base ||
+    current === "main" ||
+    current === "master" ||
+    current === "develop" ||
+    baseResolved.trackBranches.includes(current)
+  ) {
     let slug = "";
     if (plan_path) {
       const plan = path.isAbsolute(plan_path) ? plan_path : path.join(cwd, plan_path);

package/src/core/config.ts

@@ -287,6 +287,14 @@ export const describeConfigSource = (
   }
 };
 
+/** The global vcs.json path (WORKFLOW_VCS_CONFIG overrides it). */
+export const vcsConfigPath = (): string =>
+  process.env.WORKFLOW_VCS_CONFIG ?? path.join(configDir(), "vcs.json");
+
+/** An allowed-branch glob (`feature/*`) as a case-insensitive whole-name RegExp. */
+export const branchGlobPattern = (glob: string): RegExp =>
+  new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i");
+
 export const resolveBranchPolicy = (
   config: ToolkitConfig,
   workspace?: { branchPolicy?: Record<string, any> } | null,
@@ -315,9 +323,7 @@ export const resolveBranchPolicy = (
     },
     config,
   );
-  const allowed = merged.allowed.map(
-    (p) => new RegExp(`^${p.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"),
-  );
+  const allowed = merged.allowed.map(branchGlobPattern);
   return {
     preset,
     allowed,

package/src/core/methods.ts

@@ -114,10 +114,10 @@ Autonomy contract:
   inferred, or guess. Prose is a note: only a configured check the CLI ran
   (\`workit check <name>\`) satisfies a gate; an ad-hoc
   \`workit check -- <cmd>\` never does.
-- Author is not verifier: never record a passing verdict on work your session
-  wrote. The lead starts each verifier with its own session
-  (\`WORKIT_SESSION_ID=<lead>-v<n>\`; Claude Code subagents get one from the
-  hook), and the verifier records \`workit ledger verdict\`.
+- Author is not verifier: your own verdict is \`--self\` (after an observed
+  \`workit check test\`), shown as self-reviewed, never verified. High risk,
+  \`verification: independent\` and merge need a verifier with its own
+  session (\`WORKIT_SESSION_ID=<lead>-v<n>\`; Claude Code subagents get one).
 - A local-commit endpoint does not imply PR readiness, and a local commit alone
   is not evidence of a requested remote push. Before reporting delivery,
   reconcile every requested item and observe it (\`workit verify-delivery\`).
@@ -130,7 +130,9 @@ PATH, \`npx -y @brainervirus/workit-cli\`). \`busy\` is retryable
 The task families (task, policy, evidence, finding, decision, worker, state)
 are optional continuity for tracked work; each branch has one implicit task
 that the first recording creates, and a solo edit needs no task. A decision
-records a user choice; it never authorizes an effect.
+records a user choice; it never authorizes an effect. Judge work once with
+\`workit policy assess --judge risk= behavior= product-choice= plan=\`; an
+open choice or missing plan blocks edits until recorded.
 Omit revisions; a revision_conflict means one you passed is stale, so re-read.
 Across repositories, bind each item to its checkout, branch and endpoint,
 resolve competing targets before a mutation, and reconcile an uncertain