@brainervirus/workit-core 8.13.0 → 8.13.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "8.13.0",
+  "version": "8.13.1",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/scripts/rewrite-workspace-deps.ts

@@ -29,9 +29,9 @@ for (const pkg of [
 ]) {
   const file = resolve(root, `packages/${pkg}/package.json`);
   const data = JSON.parse(readFileSync(file, "utf8"));
-  // devDependencies too: the Claude Code plugin bundles core and the CLI into
-  // dist/, so they are build-time only, but a published manifest must still
-  // never carry workspace:*.
+  // devDependencies too: every adapter bundles core (and the MCP server) into
+  // dist/, so they are build-time only (N19) and npm never installs them, but
+  // a published manifest must still never carry workspace:*.
   const groups = [data.dependencies, data.devDependencies].filter(Boolean);
   if (groups.length === 0) continue;
   for (const deps of groups)

package/skills/workit-fanout/references/orchestration.md

@@ -72,11 +72,12 @@ Which session id a verdict carries, per host:
 
 - Claude Code: subagents inherit your `WORKIT_SESSION_ID`, so the
   SubagentStart hook names each `verifier` and `reviewer` its own session
-  (`<lead>:<agent id>`), passed exactly as `--session`: the hook records the
-  ids it issues, and only those are accepted. An `implementer` is issued
+  (`<lead>:<agent id>`) and a token only that subagent sees, passed exactly as
+  `--session` and `--token`: the hook records the ids it issues, and only
+  those, with their token, are accepted. An `implementer` is issued
   none: it keeps your id in its env for its workit commands and commits.
 - Codex: the `workit-verifier` and `workit-reviewer` agents get the same
-  issued `--session` from SubagentStart; any other verifier passes
+  issued `--session` and `--token` from SubagentStart; any other verifier passes
   `--as verifier`.
 - OpenCode: a child session's shell already has
   `WORKIT_SESSION_ID=<lead>:<child>`; Pi: a supervised worker's shell has

package/skills/workit-review/SKILL.md

@@ -8,7 +8,7 @@ description: Independent review of a diff, branch or PR - intent fidelity and st
 Review the candidate, never the author's summary of it. A session that wrote a
 commit on the branch cannot record a passing verdict: if that is you, hand the
 review to a fresh agent with its own host-derived session: Claude Code and
-Codex, the `reviewer` or `verifier` agent (`--session` from SubagentStart);
+Codex, the `reviewer` or `verifier` agent (`--session` and `--token` from SubagentStart);
 OpenCode, a child session; Pi, a supervised worker. Never hand-mint one such
 as `<lead>-v1`: it is refused as `forged_session`.
 An author's `--self` verdict reads self-reviewed and never counts as

package/src/core/hygiene.ts

@@ -1,4 +1,5 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { changelogUnreleasedStats } from "./changelog";
 import { assetRoot } from "./package-root";
@@ -75,6 +76,41 @@ export const hygieneFiles = (
   return { state, openSource };
 };
 
+export type ProjectTarget = { ok: true; root: string } | { ok: false; refused: string };
+
+/**
+ * Where project files (gitignore, hygiene) belong: the git toplevel of `dir`.
+ * Outside a repository there is no project to scaffold, and a folder holding
+ * several projects must never receive them, so the answer is a refusal naming
+ * the way out: the child repositories found one level down, or `cd <repo>`.
+ */
+export const projectTarget = (dir: string): ProjectTarget => {
+  const start = path.resolve(dir);
+  const top = spawnSync("git", ["rev-parse", "--show-toplevel"], { cwd: start, encoding: "utf8" });
+  const root = top.status === 0 ? (top.stdout ?? "").trim() : "";
+  if (root) return { ok: true, root: path.resolve(root) };
+  let children: string[] = [];
+  try {
+    children = readdirSync(start, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory() && existsSync(path.join(start, entry.name, ".git")))
+      .map((entry) => path.join(start, entry.name))
+      .toSorted();
+  } catch {
+    children = [];
+  }
+  const where =
+    children.length > 0
+      ? `run it inside one of its repositories: ${children
+          .slice(0, 5)
+          .map((child) => `cd ${child}`)
+          .join(", ")}${children.length > 5 ? ` (+${children.length - 5} more)` : ""}`
+      : "cd <repo> (or git init here) and run workit init again";
+  return {
+    ok: false,
+    refused: `${start} is not a git repository, so no project files were added there; ${where}`,
+  };
+};
+
 // Pure planner: which hygiene files would be created and with what content,
 // without touching the filesystem. Drives the wizard preview (WZ-08) and the
 // apply path; ensureHygieneFiles is just "plan then write".

package/src/core/store-lock.ts

@@ -44,8 +44,16 @@ export const RECLAIM_GUARD_TTL_MS = 30_000;
  * wait blocks the calling thread, so in-process hosts (OpenCode, MCP, Pi) keep
  * the short default; the CLI raises it for its own process.
  */
-let defaultLockTimeoutMs = 250;
+export const IN_PROCESS_LOCK_TIMEOUT_MS = 250;
+let defaultLockTimeoutMs = IN_PROCESS_LOCK_TIMEOUT_MS;
 export const defaultLockTimeout = (): number => defaultLockTimeoutMs;
+/**
+ * The wait for a lock that a CLI process may hold longer (the ledger's
+ * network-filesystem lock): `cliMs` once the process raised the default
+ * (the CLI does), else the in-process cap.
+ */
+export const hostAwareLockTimeout = (cliMs: number): number =>
+  defaultLockTimeoutMs > IN_PROCESS_LOCK_TIMEOUT_MS ? cliMs : IN_PROCESS_LOCK_TIMEOUT_MS;
 export const setDefaultLockTimeout = (ms: number): void => {
   defaultLockTimeoutMs = ms;
 };

package/src/forge/pr-ops.ts

@@ -35,6 +35,7 @@ import { currentBranch, fetchRefs, GIT_TIMEOUTS, remoteRefTip, resolveRef } from
 import {
   appendObserved,
   checkVerdicts,
+  tamperedUnblock,
   readLedger,
   type LedgerActor,
   type VerdictCheck,
@@ -366,6 +367,8 @@ export type MergeOutcome = {
   grant: { source: AutonomySource };
   deletedBranch: boolean | { error: string };
   recorded: { id: string } | { error: string };
+  /** The `pr.merge.verified` row confirming `recorded`, or why it was not written. */
+  confirmed: { id: string } | { error: string };
   /**
    * Release tracks: when the PR landed on a track's production branch, the
    * branches it must flow back into (mergeBackBranches); empty otherwise.
@@ -420,7 +423,9 @@ export type MergeRefusal = {
     | "already_merged"
     | "closed"
     | "protected_branch"
-    | "base_mismatch";
+    | "base_mismatch"
+    | "ledger_tampered"
+    | "intent_unrecorded";
   next?: string;
   blockers?: string[];
   verdict?: Pick<VerdictCheck, "head" | "accepted" | "authors">;
@@ -434,6 +439,8 @@ export type MergeResult =
       error: string;
       unblock?: string;
       refusal?: MergeRefusal;
+      /** merge_unverified: the `pr.merged` row (verified:false) written when the forge accepted it. */
+      recorded?: { id: string } | { error: string };
     };
 
 const refuse = (error: string, unblock: string, refusal: MergeRefusal): MergeResult => ({
@@ -635,7 +642,7 @@ export async function mergePullRequest(
         { reason: "protected_branch" },
       );
   }
-  const ledger = readLedger(cwd);
+  const ledger = readLedger(cwd, { integrity: true });
   if (!ledger.ok) return ledger;
   const check = checkVerdicts(cwd, branch, ledger.value.rows);
   const summary = { head: check.head, accepted: check.accepted, authors: check.authors };
@@ -680,6 +687,12 @@ export async function mergePullRequest(
       `git fetch && git switch ${branch} && git merge --ff-only @{u}  # then re-verify that head`,
       { reason: "head_mismatch", verdict: summary },
     );
+  else if (!covered && check.accepted.reasons.includes("ledger_tampered"))
+    return refuse(
+      `ledger_tampered: a ledger row was edited, removed or moved, so no verdict for ${label} is accepted until it is repaired`,
+      tamperedUnblock(cwd),
+      { reason: "ledger_tampered", verdict: summary },
+    );
   else if (!covered)
     return refuse(
       `NEEDS_VERDICT: ${label} has no accepted independent verdict for ${head.slice(0, 12)} (${check.accepted.reasons.join(", ")})`,
@@ -689,12 +702,57 @@ export async function mergePullRequest(
 
   const squashMessage = squashMessageFor(cwd, resolved, input, doc);
   if (squashMessage && !squashMessage.ok) return squashMessage;
+  // The intent goes in before the forge write: a merge call that errors after
+  // the forge did merge still leaves a record `pr status` reads. A merge that
+  // cannot be recorded never starts.
+  const intent = appendObserved(cwd, {
+    type: "pr.merge.intent",
+    actor: input.actor,
+    branch,
+    head,
+    pr: doc.number,
+    base: doc.base,
+    method: input.method,
+    verdictId: verdict.verdictId,
+    ...(unverified ? { unverified: unverified.recorded } : {}),
+    grant: grant.source,
+  });
+  if (!intent.ok)
+    return refuse(
+      `intent_unrecorded: the merge intent for ${label} could not be recorded (${intent.error}); nothing was merged`,
+      "fix the ledger (workit ledger check), then merge again",
+      { reason: "intent_unrecorded" },
+    );
+  const intentId = String(intent.value.id);
   const merged = resolved.forge.merge(doc.number, {
     sha: head,
     method: input.method,
     ...(squashMessage ? { squashMessage: squashMessage.data } : {}),
   });
-  if (!merged.ok) return merged;
+  if (!merged.ok)
+    return {
+      ...merged,
+      error: `${merged.error} (merge intent ${intentId} is recorded: if the forge merged anyway, workit pr status reads it)`,
+    };
+  // Recorded as soon as the forge accepts it (N3): a failed read below must
+  // not leave a merge that `pr status`, the stop hook and `verify-delivery
+  // merged` cannot see. The post-verify then confirms it in its own row.
+  const row = appendObserved(cwd, {
+    type: "pr.merged",
+    actor: input.actor,
+    branch,
+    head,
+    pr: doc.number,
+    base: doc.base,
+    mergeSha: merged.data.mergeSha,
+    method: input.method,
+    verdictId: verdict.verdictId,
+    ...(unverified ? { unverified: unverified.recorded } : {}),
+    grant: grant.source,
+    intent: intentId,
+    verified: false,
+  });
+  const recorded = row.ok ? { id: String(row.value.id) } : { error: row.error };
   // Post-verify: the forge must report the PR merged.
   let state = "open";
   for (const delay of [0, ...VERIFY_DELAYS_MS]) {
@@ -707,9 +765,29 @@ export async function mergePullRequest(
     return {
       ok: false,
       code: "failed",
-      error: `merge_unverified: the forge accepted the merge of ${label} but still reports it ${state}`,
+      error: `merge_unverified: the forge accepted the merge of ${label} but still reports it ${state}${"id" in recorded ? `; recorded as pr.merged ${recorded.id} (verified: false)` : `; the pr.merged row could not be written (${recorded.error})`}`,
       unblock: `workit verify-delivery merged --pr ${doc.number}`,
+      recorded,
     };
+  const confirmation =
+    "id" in recorded
+      ? appendObserved(cwd, {
+          type: "pr.merge.verified",
+          actor: input.actor,
+          branch,
+          head,
+          pr: doc.number,
+          base: doc.base,
+          merged: recorded.id,
+          mergeSha: merged.data.mergeSha,
+        })
+      : null;
+  const confirmed: MergeOutcome["confirmed"] =
+    confirmation === null
+      ? { error: "no pr.merged row to confirm" }
+      : confirmation.ok
+        ? { id: String(confirmation.value.id) }
+        : { error: confirmation.error };
 
   let deletedBranch: MergeOutcome["deletedBranch"] = false;
   if (input.deleteBranch) {
@@ -720,19 +798,6 @@ export async function mergePullRequest(
       deleted.ok || (gone && gone.ok && gone.sha === null) ? true : { error: deleted.error };
   }
   const mergeBack = mergeBackFor(cwd, doc.base, branch);
-  const row = appendObserved(cwd, {
-    type: "pr.merged",
-    actor: input.actor,
-    branch,
-    head,
-    pr: doc.number,
-    base: doc.base,
-    mergeSha: merged.data.mergeSha,
-    method: input.method,
-    verdictId: verdict.verdictId,
-    ...(unverified ? { unverified: unverified.recorded } : {}),
-    grant: grant.source,
-  });
   return {
     ok: true,
     data: {
@@ -747,7 +812,8 @@ export async function mergePullRequest(
       unverified,
       grant: { source: grant.source },
       deletedBranch,
-      recorded: row.ok ? { id: String(row.value.id) } : { error: row.error },
+      recorded,
+      confirmed,
       mergeBack: mergeBack.branches,
       mergeBackTrack: mergeBack.track,
     },

package/src/forge/redact.ts

@@ -8,8 +8,12 @@ const R = "[REDACTED]";
 const TOKEN_PATTERNS: readonly RegExp[] = [
   // GitHub tokens (classic, fine-grained, app, OAuth, refresh).
   /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/gu,
-  // GitLab tokens: glpat-, glrt-, gldt-, glcbt-, glptt-, glft-, gloas-, …
-  /\bgl[a-z]{1,8}-[A-Za-z0-9_-]{16,}/gu,
+  // GitLab tokens, by every prefix GitLab documents
+  // (https://docs.gitlab.com/security/tokens/#token-prefixes) and only those:
+  // a bare `gl…-` also matches words such as `global-setup-teardown-hook`.
+  /\b(?:glpat|gloas|gldt|glrtr|glrt|glcbt|glptt|glft|glimt|glagent|glwt|glsoat|glffct)-[A-Za-z0-9_-]{20,}/gu,
+  // GitLab's session cookie.
+  /\b_gitlab_session=[A-Za-z0-9%_-]{16,}/gu,
   /\bnpm_[A-Za-z0-9]{30,}/gu,
   /\bxox[abposr]-[A-Za-z0-9-]{10,}/gu,
   /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/gu,

package/src/forge/resolve.ts

@@ -181,6 +181,21 @@ function resolveCredential(
         `token_host_unverified: push host ${derived.host} only looks like ${kind}; workspace ${workspace?.name ?? "?"} vcs.tokenFile is not sent to it`,
         `if ${apiHost} is your ${kind} server, set ${kind}.host in ~/.config/workit/vcs.json (or vcs.host for the workspace); otherwise fix the push remote`,
       );
+    // Like youtrack.token: a token other users can read is refused (N14).
+    if (process.platform !== "win32") {
+      let mode = 0;
+      try {
+        mode = fs.statSync(tokenFile.trim()).mode;
+      } catch {
+        // unreadable: reported below
+      }
+      if ((mode & 0o077) !== 0)
+        return failure(
+          "blocked",
+          `workspace ${workspace?.name ?? "?"} vcs.tokenFile is readable by group or other (mode ${(mode & 0o777).toString(8).padStart(4, "0")})`,
+          `chmod 600 ${tokenFile.trim()}`,
+        );
+    }
     let token = "";
     try {
       token = fs.readFileSync(tokenFile.trim(), "utf8").trim();

package/src/git/ops.ts

@@ -49,6 +49,7 @@ import {
 } from "../core/workspaces";
 import { redactText } from "../forge/redact";
 import { failure, success, type ForgeResult } from "../forge/types";
+import { issuedBinding, sessionClaimRefusal } from "../host-session";
 import { appendObserved, readLedger, type LedgerActor } from "../ledger";
 import {
   GIT_TIMEOUTS,
@@ -649,6 +650,25 @@ export function gitCommit(
       "invalid_input",
       "WORKIT_SESSION_ID must be 1-128 characters of [A-Za-z0-9_.:@/+-]",
     );
+  // A commit names its author session (commit.recorded, the trailer): the
+  // same claim check as a verdict, and an id issued to a verifier or
+  // reviewer never authors code (audit mv83zyg6 P2b).
+  if (session) {
+    const env = input.env ?? process.env;
+    if (issuedBinding(cwd, session) !== null)
+      return failure(
+        "blocked",
+        `judge_session: ${session} was issued to a verifier or reviewer subagent; it records verdicts and never authors commits`,
+        "commit from the implementer's or the lead's own session (unset WORKIT_SESSION_ID back to the shell's)",
+      );
+    const refusal = sessionClaimRefusal(env, session, cwd);
+    if (refusal)
+      return failure(
+        "blocked",
+        refusal.error,
+        "commit from the session this shell really is: never set WORKIT_SESSION_ID by hand for a commit (unset it, or use the id the host put in this shell)",
+      );
+  }
   // A commit that only rewords (amend) or is empty on purpose needs no change.
   const changeRequired = !input.amend && !input.allowEmpty;
 

package/src/hooks/handle.ts

@@ -108,10 +108,13 @@ const subagentStartText = (
   const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
   if (role !== "judge" || !event.agentId) return readOnly;
   const own = subagentSession(session, event.agentId);
-  // `ledger verdict` accepts `<lead>:<agent id>` only when this hook issued it.
+  // `ledger verdict` accepts `<lead>:<agent id>` only when this hook issued it,
+  // and only with the token it hands to this subagent alone.
   // (An isolated judge's text is rebuilt with cwd "": the hook's own cwd then.)
-  if (session) recordIssuedSession(input.cwd || process.cwd(), session, own);
-  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> --session ${own} ...\` so the ledger tells it apart from the author.`;
+  // Issued once: a replayed SubagentStart for the same id gets no token.
+  const token = session ? recordIssuedSession(input.cwd || process.cwd(), session, own) : null;
+  const flags = token ? `--session ${own} --token ${token}` : `--session ${own}`;
+  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> ${flags} ...\` so the ledger tells it apart from the author.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 };
 
 export function handleHook(input: HookInput, deps: HookDeps): HookDecision {

package/src/hooks/stop.ts

@@ -253,9 +253,11 @@ export function stopObligation(
     if (!session || input.session.agentId || !inWorkitWorkspace(input.cwd)) return null;
     const branch = currentBranch(input.cwd);
     if (!branch || guardedBranch(input.cwd, branch)) return null;
-    const ledger = readLedger(input.cwd);
+    // Read with the hash chain: a hand-appended row neither creates nor
+    // clears an obligation, and verdicts are judged with integrity (N1).
+    const ledger = readLedger(input.cwd, { integrity: true });
     if (!ledger.ok) return null;
-    const all = ledger.value.rows;
+    const all = ledger.value.rows.filter((row) => row.integrity !== "unverified");
     const rows = all.filter((row) => row.branch === branch);
     const mine = rows.filter((row) => sessionOf(row) === session);
     const commits = new Set(

package/src/host-session.ts

@@ -7,7 +7,7 @@
 //   - Pi: PI_SESSION_ID (the bash tool exposes the Pi session id);
 //   - Codex CLI and Desktop: CODEX_THREAD_ID (the thread id hooks get as session_id).
 // Cursor puts no conversation id in its shell; its hook names the id to use.
-import { createHash } from "node:crypto";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { resolveStateDir } from "./core/logger";
@@ -87,11 +87,12 @@ const ISSUED_PER_LEAD = 64;
 
 /**
  * Written into each issued-id file. A hook bundle that contains this string
- * records issued ids per lead in the user's state dir (`/2`; `/1` hooks of
- * 8.10-8.12 wrote them per repository, which breaks cross-repo verdicts); `workit doctor` looks for it in the installed Claude
- * Code and Codex hooks to catch a plugin older than the CLI.
+ * records issued ids per lead in the user's state dir with a token only the
+ * subagent is told (`/3`; `/2` files carry no token, `/1` hooks of 8.10-8.12
+ * wrote them per repository); `workit doctor` looks for it in the installed
+ * Claude Code and Codex hooks to catch a plugin older than the CLI.
  */
-export const ISSUED_SESSIONS_MARKER = "workit-issued-sessions/2";
+export const ISSUED_SESSIONS_MARKER = "workit-issued-sessions/3";
 
 const hash = (value: string): string =>
   createHash("sha256").update(value).digest("hex").slice(0, 32);
@@ -100,6 +101,13 @@ const hash = (value: string): string =>
 // started in one repository delegates review of others, and the verifier
 // records its verdict from whichever repository it reviews (#294).
 const userIssuedRoot = (): string => path.join(resolveStateDir(), "issued");
+/**
+ * Token hashes, one file per issued id under `<state>/issued-tokens/<lead
+ * hash>/`: a tree hooks older than tokens never write, so an old cached
+ * plugin hook that rewrites a record in `issued/` cannot strip its token.
+ * Once a lead has one, every id under it needs a token (sticky binding).
+ */
+const userTokenRoot = (): string => path.join(resolveStateDir(), "issued-tokens");
 
 /**
  * Hooks of 8.10-8.12 wrote issued ids into `<store>/hooks/issued` of the
@@ -126,7 +134,13 @@ function migrateRepoIssued(cwd: string | undefined): void {
       const to = path.join(userIssuedRoot(), lead);
       fs.mkdirSync(to, { recursive: true, mode: 0o700 });
       for (const id of fs.readdirSync(from)) {
-        fs.copyFileSync(path.join(from, id), path.join(to, id));
+        // Never over an existing per-user record: a legacy in-repo copy must
+        // not replace a token-bound one (EEXIST just drops the legacy copy).
+        try {
+          fs.copyFileSync(path.join(from, id), path.join(to, id), fs.constants.COPYFILE_EXCL);
+        } catch (error) {
+          if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+        }
         fs.rmSync(path.join(from, id), { force: true });
       }
       removeIfEmpty(from);
@@ -170,14 +184,40 @@ const PLUGIN_UPDATE: Readonly<Record<string, string>> = {
   codex: "codex plugin remove workit@workit && codex plugin add workit@workit",
 };
 
-/** Remember that a SubagentStart hook issued `issued` to a subagent of `lead`. Fails open. */
-export function recordIssuedSession(cwd: string, lead: string, issued: string): void {
+const tokenHash = (token: string): string => createHash("sha256").update(token).digest("hex");
+
+/**
+ * Remember that a SubagentStart hook issued `issued` to a subagent of `lead`,
+ * and return the token that binds the id to that subagent: the hook hands it
+ * only to the subagent, and only its sha256 is stored, so a lead or sibling
+ * that reads the id in the ledger cannot act as it (audit mv83zyg6 P1).
+ * Each id is issued once: a SubagentStart fired again for an id already
+ * issued (a lead replaying the hook) gets no new token (review mv8daa5d P1).
+ * Null when nothing was issued: already issued, or the write failed (fails open).
+ */
+export function recordIssuedSession(cwd: string, lead: string, issued: string): string | null {
+  const token = randomBytes(18).toString("base64url");
   try {
     migrateRepoIssued(cwd);
+    const own = hash(issued);
+    const tokens = path.join(userTokenRoot(), hash(lead));
+    fs.mkdirSync(tokens, { recursive: true, mode: 0o700 });
+    // `wx`: the first SubagentStart for an id wins; any later one fails here.
+    fs.writeFileSync(path.join(tokens, own), `${tokenHash(token)}\n`, { mode: 0o600, flag: "wx" });
     const dir = path.join(userIssuedRoot(), hash(lead));
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const own = hash(issued);
-    fs.writeFileSync(path.join(dir, own), ISSUED_SESSIONS_MARKER);
+    fs.writeFileSync(path.join(dir, own), `${ISSUED_SESSIONS_MARKER}\n`, { mode: 0o600 });
+    pruneIssued(dir, own, tokens);
+    return token;
+  } catch {
+    // Already issued (EEXIST), or a failed write: no token is handed out.
+    return null;
+  }
+}
+
+/** Keep the newest ISSUED_PER_LEAD ids of one lead (and their token hashes); `own` is never pruned. */
+function pruneIssued(dir: string, own: string, tokens: string): void {
+  try {
     const entries = fs.readdirSync(dir);
     if (entries.length <= ISSUED_PER_LEAD) return;
     // Oldest first; the id just issued is never the one pruned.
@@ -185,22 +225,75 @@ export function recordIssuedSession(cwd: string, lead: string, issued: string):
       .filter((name) => name !== own)
       .map((name) => ({ name, at: fs.statSync(path.join(dir, name)).mtimeMs }))
       .toSorted((a, b) => a.at - b.at);
-    for (const { name } of byAge.slice(0, entries.length - ISSUED_PER_LEAD))
+    for (const { name } of byAge.slice(0, entries.length - ISSUED_PER_LEAD)) {
       fs.rmSync(path.join(dir, name), { force: true });
+      fs.rmSync(path.join(tokens, name), { force: true });
+    }
   } catch {
     // Fail open: an unrecorded id is refused later, never a broken hook.
   }
 }
 
-const wasIssued = (cwd: string | undefined, lead: string, claimed: string): boolean => {
+/** The issued-id file's text, or null when no hook issued `claimed`. */
+const issuedRecord = (cwd: string | undefined, claimed: string): string | null => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0) return null;
   migrateRepoIssued(cwd);
   try {
-    return fs.existsSync(path.join(userIssuedRoot(), hash(lead), hash(claimed)));
+    return fs.readFileSync(
+      path.join(userIssuedRoot(), hash(claimed.slice(0, cut)), hash(claimed)),
+      "utf8",
+    );
   } catch {
-    return false;
+    return null;
   }
 };
 
+const TOKEN_HASH = /^([0-9a-f]{64})$/mu;
+
+/** The stored token hash for `claimed`, and whether its lead has any token at all. */
+const issuedToken = (claimed: string): { stored: string | null; leadBound: boolean } => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0) return { stored: null, leadBound: false };
+  const dir = path.join(userTokenRoot(), hash(claimed.slice(0, cut)));
+  try {
+    const text = fs.readFileSync(path.join(dir, hash(claimed)), "utf8");
+    return { stored: TOKEN_HASH.exec(text)?.[1] ?? null, leadBound: true };
+  } catch {
+    return { stored: null, leadBound: safeList(dir).length > 0 };
+  }
+};
+
+/**
+ * How a SubagentStart hook issued `claimed` (`<lead>:<agent id>`): `token`
+ * (it must be presented, `--token`), `legacy` (a hook older than tokens
+ * recorded it) or null (never issued). Binding is sticky: once its lead has
+ * any token-bound id, a token-less record (an old cached hook rewriting one,
+ * or issuing a new one) reads `token` with no token that can match.
+ */
+export type IssuedBinding = "token" | "legacy";
+export function issuedBinding(cwd: string | undefined, claimed: string): IssuedBinding | null {
+  const record = issuedRecord(cwd, claimed);
+  const { stored, leadBound } = issuedToken(claimed);
+  if (stored) return "token";
+  if (record === null) return null;
+  return leadBound ? "token" : "legacy";
+}
+
+/** Whether `token` is the one the hook gave the subagent it issued `claimed` to. */
+export function issuedTokenMatches(
+  cwd: string | undefined,
+  claimed: string,
+  token: string | null | undefined,
+): boolean {
+  migrateRepoIssued(cwd);
+  const { stored } = issuedToken(claimed);
+  if (!stored || !token) return false;
+  const given = Buffer.from(tokenHash(token.trim()));
+  const want = Buffer.from(stored);
+  return given.length === want.length && timingSafeEqual(given, want);
+}
+
 const leadOf = (session: string): string => session.slice(0, session.lastIndexOf(":"));
 
 /**
@@ -230,12 +323,17 @@ export type SessionClaimRefusal = { error: string; unblock: string };
  * workspace's record of hook-issued ids):
  *   - no host session (CI, a plain terminal): any id; `--session X` and
  *     WORKIT_SESSION_ID=X are the same declaration;
- *   - the shell's own session (a declared `<lead>:<x>` on Claude Code only
- *     when its SubagentStart hook issued it);
+ *   - the shell's own session; a declared `<lead>:<x>` (any WORKIT_HOST but
+ *     cli) only when a SubagentStart hook issued it;
  *   - on a host that sets the id, `<lead>:<this session>`: a child naming its
  *     own host session;
  *   - `<this session>:<agent id>` only when this lead's SubagentStart hook
  *     issued it (Claude Code, Codex).
+ * An issued id the hook bound to a token is accepted only with that token
+ * (`options.token`): a lead or sibling that read the id cannot reuse it.
+ * `options.flag`: named by `--session`. On a host that is only for an issued
+ * id; a shell's own or derived session comes from its environment, so a
+ * `--session` the gate would not accept is refused here, not later.
  * Anything else is a forged id: a verdict recorded under it would make author
  * is not verifier a naming convention.
  */
@@ -243,6 +341,7 @@ export function sessionClaimRefusal(
   env: NodeJS.ProcessEnv,
   claimed: string,
   cwd?: string,
+  options: { token?: string | null; flag?: boolean } = {},
 ): SessionClaimRefusal | null {
   const real = realHostSession(env);
   const host = family(real.host);
@@ -254,16 +353,27 @@ export function sessionClaimRefusal(
       unblock: `record the verdict from the ${real.host} session's own shell, where ${HOST_SET_VARIABLE[host]} is set`,
     };
   if (real.kind === "none" || !real.session) return null;
-  let issuedClaim = false;
-  if (claimed === real.session) {
-    const declaredChild =
-      real.kind === "declared" && host === "claude_code" && claimed.includes(":");
-    if (!declaredChild || wasIssued(cwd, leadOf(claimed), claimed)) return null;
-    issuedClaim = true;
-  } else if (real.kind === "derived" && claimed.endsWith(`:${real.session}`)) return null;
-  else if (claimed.startsWith(`${real.session}:`)) {
-    if (wasIssued(cwd, real.session, claimed)) return null;
-    issuedClaim = true;
+  const ownShell =
+    (claimed === real.session && !(real.kind === "declared" && claimed.includes(":"))) ||
+    (real.kind === "derived" && claimed.endsWith(`:${real.session}`));
+  if (ownShell)
+    return options.flag
+      ? {
+          error: `session_flag: --session ${claimed} names this shell's own ${real.host} session; on a host only an issued subagent id is passed as --session`,
+          unblock: "drop --session: the shell's own session is already the acting one",
+        }
+      : null;
+  const issuedClaim = claimed === real.session || claimed.startsWith(`${real.session}:`);
+  if (issuedClaim) {
+    const binding = issuedBinding(cwd, claimed);
+    if (binding === "legacy") return null;
+    if (binding === "token")
+      return issuedTokenMatches(cwd, claimed, options.token)
+        ? null
+        : {
+            error: `unbound_session: ${claimed} was issued to a subagent, and this call did not present the token its SubagentStart hook gave it`,
+            unblock: `only that subagent acts as ${claimed}: it passes --token exactly as its SubagentStart context names it (or WORKIT_SESSION_TOKEN); anyone else spawns their own verifier`,
+          };
   }
   const error = `forged_session: ${claimed} is neither this shell's session (${real.session}) nor an id its host issued to a child of it`;
   // A well-formed subagent id, but no hook here ever recorded one: the hook
@@ -278,7 +388,7 @@ export function sessionClaimRefusal(
     error,
     unblock: ownChildShell
       ? `record the verdict from the verifier's own ${host === "pi" ? "Pi worker" : "OpenCode child session"} shell, where WORKIT_SESSION_ID is already set; never set WORKIT_SESSION_ID or --session by hand`
-      : "never name a session yourself: spawn a verifier or reviewer subagent and pass exactly the --session its SubagentStart context names, or pass --as verifier",
+      : "never name a session yourself: spawn a verifier or reviewer subagent and pass exactly the --session and --token its SubagentStart context names, or pass --as verifier",
   };
 }
 

package/src/ledger.ts

@@ -38,8 +38,12 @@
 //   the previous line) and `rowHash` (sha256 over `prevHash` and the row), a
 //   running chain. A row without it after the chain began, or whose hashes do
 //   not match, is reported as unverified (`workit ledger verify-integrity`, a
-//   warning in `ledger check`). Nothing is refused: this catches a hand edit
-//   made by mistake, it is not a defense against a forger.
+//   warning in `ledger check`). Appends are never refused, but verdict gates
+//   (`checkVerdicts`) never accept an unverified or pre-chain verdict, nor a
+//   `--session` verdict whose id no SubagentStart hook issued, and ignore
+//   an unverified row's `supersedes`. The chain is keyless: it stops a row
+//   appended or edited by hand, not a forger who recomputes the hashes.
+//   The file is created 0600 (POSIX).
 // - Branch renames: rows keyed to a branch's earlier names (from its reflog)
 //   count for it, up to the rename.
 //
@@ -49,9 +53,10 @@ import { spawnSync } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { hostAwareLockTimeout } from "./core/store-lock";
 import { vcsConfig } from "./core/vcs-config";
 import { GIT_TIMEOUTS, currentBranch, headSha, patchId, worktreeTree } from "./git/rev";
-import { hostSessionFromEnv } from "./host-session";
+import { hostSessionFromEnv, issuedBinding } from "./host-session";
 import { resolveStore } from "./store/paths";
 
 export const LEDGER_VERSION = 1;
@@ -146,6 +151,8 @@ export type VerdictRow = RowCommon & {
   self: boolean;
   selfReason: SelfReason | null;
   sessionSource: SessionSource;
+  /** The issued session's own subagent presented the token its hook bound the id to. */
+  sessionBound?: boolean;
   evidenceRefs: string[];
 };
 export type HandoffRow = RowCommon & { type: "handoff"; note: string | null; next: string };
@@ -171,8 +178,12 @@ export type LedgerRow =
  * the ledger had a chain).
  */
 export type RowIntegrity = "verified" | "unverified" | "legacy";
-/** unsigned: no chain fields (hand-appended) · hash_mismatch: edited · broken_link: a row before it was edited or removed. */
-export type UnverifiedReason = "unsigned" | "hash_mismatch" | "broken_link";
+/**
+ * unsigned: no chain fields (hand-appended) · hash_mismatch: edited ·
+ * broken_link: a row before it was edited or removed · duplicate_id: a copy
+ * of an earlier row (a replayed line).
+ */
+export type UnverifiedReason = "unsigned" | "hash_mismatch" | "broken_link" | "duplicate_id";
 /** A row as read back: any known or future type, plus its position. */
 export type ReadRow = RowCommon &
   Record<string, unknown> & {
@@ -182,6 +193,8 @@ export type ReadRow = RowCommon &
     supersedeIgnored: boolean;
     /** Set only when read with `{ integrity: true }`. */
     integrity?: RowIntegrity;
+    /** Why an `unverified` row is unverified. */
+    integrityReason?: UnverifiedReason;
   };
 
 export type LedgerError = {
@@ -497,11 +510,15 @@ export const ledgerLock = {
   },
 };
 
-/** Run `fn` holding the ledger's advisory lock; null when it stays held for `waitMs`. */
+/**
+ * Run `fn` holding the ledger's advisory lock; null when it stays held for
+ * `waitMs`. The wait blocks the thread, so in-process hosts (OpenCode, Pi,
+ * MCP) wait at most 250 ms by default; the CLI keeps LOCK_WAIT_MS.
+ */
 export function withLedgerLock<T>(
   file: string,
   fn: () => T,
-  waitMs: number = LOCK_WAIT_MS,
+  waitMs: number = hostAwareLockTimeout(LOCK_WAIT_MS),
 ): T | null {
   const lock = `${file}.lock`;
   const deadline = Date.now() + waitMs;
@@ -569,6 +586,15 @@ const lastLine = (fd: number, size: number): string | null => {
   return null;
 };
 
+/** A ledger created before 0600 loses its group/other bits on the next append. */
+const tighten = (fd: number): void => {
+  try {
+    if ((fs.fstatSync(fd).mode & 0o077) !== 0) fs.fchmodSync(fd, 0o600);
+  } catch {
+    // Not the owner (a shared store): the append still goes through.
+  }
+};
+
 /** The line to write, given the file's current last line (null: empty file). */
 type LineBuilder = (previous: string | null) => LedgerResult<string>;
 
@@ -576,8 +602,10 @@ function appendLine(file: string, build: LineBuilder, options: AppendOptions): L
   const write = (): LedgerResult<void> => {
     // a+ = O_APPEND|O_RDWR: every write lands at the end, and we can still
     // peek at the tail to chain onto the last row and fence off a torn one.
-    const fd = fs.openSync(file, "a+");
+    // 0600: rows name sessions, branches and verdict notes (audit N14).
+    const fd = fs.openSync(file, "a+", 0o600);
     try {
+      if (process.platform !== "win32") tighten(fd);
       const size = fs.fstatSync(fd).size;
       let fence = "";
       if (size > 0) {
@@ -774,7 +802,9 @@ export function readLedger(
   const file = ledgerPath(cwd);
   if (!file.ok) return file;
   let text = "";
+  let stat: fs.Stats | null = null;
   try {
+    stat = fs.statSync(file.value);
     text = fs.readFileSync(file.value, "utf8");
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code === "ENOENT")
@@ -798,6 +828,7 @@ export function readLedger(
   // link. An edited row fails its own hash and breaks every link to it.
   const earlier = new Set<string | null>([null]);
   let chainStarted = false;
+  const ids = new Set<string>();
   for (const raw of text.split("\n")) {
     const trimmed = raw.trim();
     if (!trimmed) continue;
@@ -827,6 +858,9 @@ export function readLedger(
       else if (!linked(prevHash)) reason = "broken_link";
     } else if (chainStarted) reason = "unsigned";
     else rowIntegrity = "legacy";
+    // A replayed copy of an earlier line hashes and links like the original.
+    if (options.integrity && !reason && ids.has(parsed.id as string)) reason = "duplicate_id";
+    if (options.integrity) ids.add(parsed.id as string);
     if (reason) rowIntegrity = "unverified";
     const pr = typeof parsed.pr === "number" && Number.isInteger(parsed.pr) ? parsed.pr : undefined;
     const row: ReadRow = {
@@ -850,6 +884,7 @@ export function readLedger(
       superseded: false,
       supersedeIgnored: false,
       ...(rowIntegrity ? { integrity: rowIntegrity } : {}),
+      ...(reason ? { integrityReason: reason } : {}),
     };
     rows.push(row);
     if (!options.integrity) continue;
@@ -866,7 +901,8 @@ export function readLedger(
   }
   // Only a well-formed supersede link counts; anything else is ignored. A
   // link across branch names is checked against the renames (reflog read
-  // only for such links, once per branch).
+  // only for such links, once per branch). An unverified row's link never
+  // counts: a hand-appended row cannot retire another one (N13).
   const scopes = new Map<string, BranchScope>();
   const scopeOf = (branch: string): BranchScope => {
     let scope = scopes.get(branch);
@@ -876,17 +912,71 @@ export function readLedger(
   const byId = new Map<string, ReadRow>();
   for (const row of rows) {
     const target = row.supersedes ? byId.get(row.supersedes) : undefined;
-    if (target && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
+    if (
+      target &&
+      row.integrity !== "unverified" &&
+      supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null
+    )
       target.superseded = true;
     else if (row.supersedes) row.supersedeIgnored = true;
     if (!byId.has(row.id)) byId.set(row.id, row);
   }
+  // A read that saw exactly the stat'ed file remembers its chain breaks.
+  if (options.integrity && stat && Buffer.byteLength(text) === stat.size)
+    tamperCache.set(file.value, {
+      size: stat.size,
+      stamp: fileStamp(stat),
+      breaks: integrity.unverified.filter((row) => TAMPER_REASONS.has(row.reason)),
+    });
   return {
     ok: true,
     value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null },
   };
 }
 
+/** Chain breaks honest appends never produce: a row edited, removed or moved. */
+const TAMPER_REASONS: ReadonlySet<UnverifiedReason> = new Set(["hash_mismatch", "broken_link"]);
+const tamperCache = new Map<string, { size: number; stamp: string; breaks: UnverifiedRow[] }>();
+/** Inode, mtime and ctime: `touch -r` can restore an mtime, never a ctime. */
+const fileStamp = (stat: fs.Stats): string => `${stat.ino}:${stat.mtimeMs}:${stat.ctimeMs}`;
+
+/**
+ * Rows anywhere in the ledger whose chain shows an edit, a removal or a move
+ * (`hash_mismatch`, `broken_link`). Cached per file size and mtime; empty
+ * when the ledger cannot be read.
+ */
+export function ledgerTampering(cwd: string): UnverifiedRow[] {
+  const file = ledgerPath(cwd);
+  if (!file.ok) return [];
+  try {
+    const stat = fs.statSync(file.value);
+    const cached = tamperCache.get(file.value);
+    if (cached && cached.size === stat.size && cached.stamp === fileStamp(stat))
+      return cached.breaks;
+  } catch {
+    return [];
+  }
+  const read = readLedger(cwd, { integrity: true });
+  return read.ok
+    ? (read.value.integrity?.unverified ?? []).filter((row) => TAMPER_REASONS.has(row.reason))
+    : [];
+}
+
+/** How to repair a tampered ledger: see what broke, then start a new one and re-record. */
+export function tamperedUnblock(cwd: string): string {
+  const file = ledgerPath(cwd);
+  const where = file.ok ? file.value : "the ledger file";
+  return `workit ledger verify-integrity  # lists the edited or missing rows; if the edit is understood, move ${where} aside (mv ${where} ${where}.tampered-<date>) and record the verdicts again`;
+}
+
+const tamperedWarning = (cwd: string, breaks: readonly UnverifiedRow[]): string =>
+  `the ledger was edited, or a row was removed or moved (${breaks
+    .slice(0, 3)
+    .map((row) => `${row.reason} at row ${row.seq}`)
+    .join(
+      ", ",
+    )}${breaks.length > 3 ? ", …" : ""}): no verdict is accepted until it is repaired. ${tamperedUnblock(cwd)}`;
+
 export type RowFilter = { branch?: string; pr?: number; type?: string; last?: number };
 
 export function filterRows(rows: readonly ReadRow[], filter: RowFilter): ReadRow[] {
@@ -1002,7 +1092,21 @@ export type RejectReason =
   | "failing_verdict"
   /** The only passing current verdict is `type-check-only`, which proves no behavior. */
   | "type_check_only"
-  | "no_verdict";
+  | "no_verdict"
+  /** The verdict row is outside the CLI's hash chain: appended by hand, or pre-chain. */
+  | "unsigned"
+  /** The verdict row was edited after the CLI wrote it. */
+  | "hash_mismatch"
+  /** A row before the verdict was edited or removed. */
+  | "broken_link"
+  /** The verdict row repeats an earlier row's id (a replayed line). */
+  | "duplicate_id"
+  /** A `--session` verdict whose id no SubagentStart hook issued, recorded on a host. */
+  | "unissued_session"
+  /** An issued id recorded without the token its hook bound it to (another session reusing it). */
+  | "unbound_session"
+  /** A row somewhere in the ledger was edited, removed or moved: no verdict is accepted until it is repaired. */
+  | "ledger_tampered";
 
 export type VerdictEntry = {
   kind: string;
@@ -1042,8 +1146,8 @@ export type VerdictCheck = {
   warnings: string[];
 };
 
-const isLiveVerdict = (row: ReadRow): boolean =>
-  row.type === "verdict" && typeof row.result === "string" && !row.superseded;
+const isLiveVerdict = (row: ReadRow, retired: ReadonlySet<string>): boolean =>
+  row.type === "verdict" && typeof row.result === "string" && !retired.has(row.id);
 
 /** Sessions recorded in `Workit-Session:` trailers of `base...head` commits. */
 function trailerSessions(cwd: string, base: string | null, head: string | null): string[] {
@@ -1161,6 +1265,83 @@ const authoredBy = (authors: Set<string>, session: string): boolean => {
   return false;
 };
 
+/** Reasons a gate cannot trust a verdict row at all, whoever it names. */
+const TRUST_REASONS: ReadonlySet<RejectReason> = new Set([
+  "unsigned",
+  "hash_mismatch",
+  "broken_link",
+  "duplicate_id",
+  "unissued_session",
+  "unbound_session",
+]);
+
+/**
+ * Hosts whose shell itself names the session (OpenCode, Pi, Codex), and no
+ * host at all (`cli`: CI or a terminal, where any id is a declaration): an
+ * environment session from them was checked against that shell when recorded.
+ */
+const SHELL_VOUCHED_HOSTS: ReadonlySet<string> = new Set([
+  "cli",
+  "opencode",
+  "pi",
+  "codex_cli",
+  "codex_desktop",
+]);
+
+/**
+ * A verdict acting as a session nothing vouches for (`ledger verdict` refuses
+ * these when recording; rows by an older CLI or by hand are caught here):
+ *   - `unissued_session`: a `--session` id on a host, or a `<lead>:<x>`
+ *     environment id on a host that does not name it in its shell (Claude
+ *     Code, Cursor, any declared WORKIT_HOST), that no SubagentStart hook issued;
+ *   - `unbound_session`: such an id the hook bound to a token, recorded
+ *     without it (another session reusing an id it read in the ledger).
+ */
+function sessionTrust(cwd: string, row: ReadRow): RejectReason | null {
+  const session = row.actor.session;
+  if (!session || row.self === true) return null;
+  const source = typeof row.sessionSource === "string" ? row.sessionSource : "env";
+  const host = row.actor.host;
+  const issuedOnly =
+    source === "flag"
+      ? host !== "cli"
+      : source === "env" && session.includes(":") && !SHELL_VOUCHED_HOSTS.has(host);
+  if (!issuedOnly) return null;
+  const binding = issuedBinding(cwd, session);
+  if (binding === null) return "unissued_session";
+  return binding === "token" && row.sessionBound !== true ? "unbound_session" : null;
+}
+
+/**
+ * Why a gate cannot trust `row` (D18, audit N1): outside the hash chain, or
+ * acting as a session nothing vouches for. Rows read without integrity are unsigned.
+ */
+function trustReasons(cwd: string, row: ReadRow): RejectReason[] {
+  if (row.integrity === "unverified") return [row.integrityReason ?? "unsigned"];
+  if (row.integrity !== "verified") return ["unsigned"];
+  const session = sessionTrust(cwd, row);
+  return session ? [session] : [];
+}
+
+/**
+ * `rows` with their place in the hash chain. Rows read without integrity are
+ * re-read with it (and with integrity-aware supersede links): every caller of
+ * `checkVerdicts` is a gate. A row the re-read cannot match stays unsigned.
+ */
+function withIntegrity(cwd: string, rows: readonly ReadRow[]): readonly ReadRow[] {
+  if (rows.every((row) => row.integrity !== undefined)) return rows;
+  const read = readLedger(cwd, { integrity: true });
+  const bySeq = new Map(read.ok ? read.value.rows.map((row) => [row.seq, row]) : []);
+  return rows.map((row) => {
+    if (row.integrity !== undefined) return row;
+    const fresh = bySeq.get(row.seq);
+    return fresh && fresh.id === row.id && fresh.at === row.at ? fresh : row;
+  });
+}
+
+const untrusted = (reasons: readonly RejectReason[]): boolean =>
+  reasons.some((reason) => TRUST_REASONS.has(reason));
+
 const independenceReasons = (row: ReadRow, authors: Set<string>): RejectReason[] => {
   const reasons: RejectReason[] = [];
   if (!row.actor.session) reasons.push("no_session");
@@ -1181,7 +1362,7 @@ const independenceReasons = (row: ReadRow, authors: Set<string>): RejectReason[]
  */
 function effectiveOf(
   rows: readonly ReadRow[],
-  authors: Set<string>,
+  reasonsOf: (row: ReadRow) => RejectReason[],
   sameCode: (failed: ReadRow, row: ReadRow) => boolean,
   isCurrent: (row: ReadRow) => boolean,
 ): ReadRow | null {
@@ -1191,8 +1372,10 @@ function effectiveOf(
       effective = row;
       continue;
     }
-    const rowIndependent = independenceReasons(row, authors).length === 0;
-    const effIndependent = independenceReasons(effective, authors).length === 0;
+    // A row the gate cannot trust never displaces one it can.
+    if (untrusted(reasonsOf(row)) && !untrusted(reasonsOf(effective))) continue;
+    const rowIndependent = reasonsOf(row).length === 0;
+    const effIndependent = reasonsOf(effective).length === 0;
     if (effIndependent && !rowIndependent && isCurrent(effective)) continue;
     if (
       effIndependent &&
@@ -1227,6 +1410,7 @@ function restackCarries(
     if (
       row.type === "stack.restacked" &&
       row.observer === "workit_cli" &&
+      row.integrity === "verified" &&
       row.branch === branch &&
       row.patchEqual === true &&
       typeof row.fromHead === "string" &&
@@ -1248,7 +1432,12 @@ function restackCarries(
 }
 
 /** Current and accepted verdicts for `branch`, after carry-over (D18). */
-export function checkVerdicts(cwd: string, branch: string, rows: readonly ReadRow[]): VerdictCheck {
+export function checkVerdicts(
+  cwd: string,
+  branch: string,
+  ledgerRows: readonly ReadRow[],
+): VerdictCheck {
+  const rows = withIntegrity(cwd, ledgerRows);
   const head = branchHead(cwd, branch);
   const fallbackBase = defaultBase(cwd);
   const scope = branchScope(cwd, branch);
@@ -1284,20 +1473,69 @@ export function checkVerdicts(cwd: string, branch: string, rows: readonly ReadRo
     );
   };
   const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head }, scope);
+  // A failure is an author's only when chained ledger rows written before it
+  // made its session an author. `ledger verdict` refuses an author's
+  // independent verdict, so authorship gained afterwards (a forged row, a
+  // commit or an empty amend under the reviewer's id, a trailer) never
+  // discounts a failure (audit N13, mv83zyg6 P2b).
+  const failureAuthorCache = new Map<number, Set<string>>();
+  const failureAuthors = (row: ReadRow): Set<string> => {
+    let set = failureAuthorCache.get(row.seq);
+    if (!set) {
+      set = authorSessions(
+        cwd,
+        rows.filter((other) => other.integrity === "verified" && other.seq < row.seq),
+        branch,
+        { base: null, head: null },
+        scope,
+      );
+      failureAuthorCache.set(row.seq, set);
+    }
+    return set;
+  };
+  const reasonCache = new Map<ReadRow, RejectReason[]>();
+  const reasonsOf = (row: ReadRow): RejectReason[] => {
+    let reasons = reasonCache.get(row);
+    if (!reasons) {
+      const failing = FAILING.has(String(row.result));
+      reasons = [
+        ...trustReasons(cwd, row),
+        ...independenceReasons(row, failing ? failureAuthors(row) : authors),
+      ];
+      reasonCache.set(row, reasons);
+    }
+    return reasons;
+  };
+  // Only a trusted verdict retires another: an unverified row or one acting
+  // as an unissued or unbound session never supersedes (N13, mv83zyg6 P1).
+  const retired = new Set<string>();
+  for (const row of rows)
+    if (
+      row.type === "verdict" &&
+      row.supersedes &&
+      !row.supersedeIgnored &&
+      trustReasons(cwd, row).length === 0
+    )
+      retired.add(row.supersedes);
   const byKind = new Map<string, ReadRow[]>();
   for (const row of rows)
-    if (isLiveVerdict(row) && scope(row)) {
+    if (isLiveVerdict(row, retired) && scope(row)) {
       const kind = typeof row.kind === "string" ? row.kind : "review";
       byKind.set(kind, [...(byKind.get(kind) ?? []), row]);
     }
   const verdicts: VerdictEntry[] = [];
   const warnings: string[] = [];
   for (const [kind, list] of byKind) {
-    const row = effectiveOf(list, authors, sameCode, (candidate) => basisOf(candidate) !== "stale");
+    const row = effectiveOf(
+      list,
+      reasonsOf,
+      sameCode,
+      (candidate) => basisOf(candidate) !== "stale",
+    );
     if (!row) continue;
     const basis = basisOf(row);
     const current = basis !== "stale";
-    const independence = independenceReasons(row, authors);
+    const independence = reasonsOf(row);
     const reasons: RejectReason[] = [
       ...(current ? [] : (["stale"] as const)),
       ...(PASSING.has(String(row.result)) ? [] : (["not_passing"] as const)),
@@ -1318,7 +1556,8 @@ export function checkVerdicts(cwd: string, branch: string, rows: readonly ReadRo
       for (const later of list)
         if (
           later.seq > row.seq &&
-          independenceReasons(later, authors).length > 0 &&
+          reasonsOf(later).length > 0 &&
+          !untrusted(reasonsOf(later)) &&
           FAILING.has(String(later.result)) &&
           basisOf(later) !== "stale"
         )
@@ -1331,6 +1570,16 @@ export function checkVerdicts(cwd: string, branch: string, rows: readonly ReadRo
       warnings.push(
         `ledger row ${row.id} (${row.type}) on ${row.branch ?? branch} is unverified: the workit CLI did not write it or it changed afterwards (workit ledger verify-integrity)`,
       );
+  // An edited, removed or moved row anywhere breaks the chain; honest appends
+  // never do. Until it is repaired no verdict is accepted (mv83zyg6 P3/P4).
+  const tampered = ledgerTampering(cwd);
+  if (tampered.length) {
+    warnings.push(tamperedWarning(cwd, tampered));
+    for (const entry of verdicts) {
+      entry.accepted = false;
+      entry.reasons = [...entry.reasons, "ledger_tampered"];
+    }
+  }
   verdicts.sort((a, b) => a.verdict.seq - b.verdict.seq);
   const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
   const failing = verdicts.find(
@@ -1340,8 +1589,9 @@ export function checkVerdicts(cwd: string, branch: string, rows: readonly ReadRo
     verdicts.findLast(
       (entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result)),
     ) ?? null;
-  const accepted =
-    newestAccepted && !failing
+  const accepted = tampered.length
+    ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] as RejectReason[] }
+    : newestAccepted && !failing
       ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] }
       : {
           accepted: false,
@@ -1358,7 +1608,10 @@ export function checkVerdicts(cwd: string, branch: string, rows: readonly ReadRo
     ? undefined
     : verdicts.findLast(
         (entry) =>
-          entry.current && !entry.independent && STRONG_RESULTS.has(String(entry.verdict.result)),
+          entry.current &&
+          !entry.independent &&
+          !untrusted(entry.reasons) &&
+          STRONG_RESULTS.has(String(entry.verdict.result)),
       );
   return {
     branch,
@@ -1387,6 +1640,8 @@ export type RecordContext = {
   supersedes?: string;
   /** Where `actor.session` came from (verdicts record it). Default: the environment. */
   sessionSource?: SessionSource;
+  /** The caller presented the token bound to its issued session (verdicts record it). */
+  sessionBound?: boolean;
   now?: Date;
 };
 
@@ -1734,6 +1989,7 @@ export function recordVerdict(
       self,
       selfReason,
       sessionSource: context.sessionSource ?? "env",
+      ...(context.sessionBound === true ? { sessionBound: true } : {}),
       evidenceRefs: input.evidenceRefs ?? [],
     },
     { now: context.now },

package/src/stack.ts

@@ -1180,7 +1180,7 @@ export function qualify(
 export function stackStatus(ctx: Ctx, stack: StackFile): StackResult<StatusOutcome> {
   const mismatch = repoMismatch(ctx, stack);
   if (mismatch) return mismatch;
-  const ledger = readLedger(ctx.cwd);
+  const ledger = readLedger(ctx.cwd, { integrity: true });
   if (!ledger.ok) return stackFail(ledger.code, ledger.error, ledger.unblock);
   const remote = remoteFor(ctx.cwd, ctx.resolved, stack.trunk);
   const trunkSha = trunkTip(ctx.cwd, remote, stack.trunk);
@@ -1823,7 +1823,7 @@ export async function landStack(
     absorb(synced.data);
   }
   const ledgerRows = () => {
-    const ledger = readLedger(ctx.cwd);
+    const ledger = readLedger(ctx.cwd, { integrity: true });
     return ledger.ok ? ledger.value.rows : [];
   };
   const simulated = new Set<string>();