@brainervirus/workit-core 8.23.0 → 8.24.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "8.23.0",
+  "version": "8.24.0",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/skills/workit-fanout/SKILL.md

@@ -40,7 +40,7 @@ units of ~100+ lines each. Coupled work stays with one owner. Workit never spawn
    chain resumes. A fix round and recheck that both fail: a decider, not a
    third round; product choices go to the user (`references/orchestration.md`).
 7. **Verify by the workspace `verification` setting** (`workit grant show`).
-   A report is a pointer, never evidence. `self`: a verifier that wrote none
+   A report is a pointer, never evidence. `proportional` (default): each slice's lane (`workit pr status`) decides; none needs no verdict, self the author's `--self`, focused (cheap model: Claude Code `model: sonnet`) and full a verifier after the last push. `self`: a verifier that wrote none
    of the slices, or you if you wrote none. `independent` or high risk: a
    separate verifier session, never yours (doctrine: the ledger only refuses
    authors). One verifier may take a batch of slices, one verdict per branch

package/skills/workit-implement/SKILL.md

@@ -36,11 +36,11 @@ description: Build a requested change in small verified steps - follow local pat
    when that was requested, or the request implies delivery and the effective
    endpoint in `workit grant show` is `pr`, `green` or `merged`; `green` and
    `merged` keep babysitting. Otherwise it is `commit`.
-7. Verify, as far as the policy asks. Normal risk: after `workit check test`
-   passes, record your own `workit ledger verdict tests-verified --self --how
-   "<what you ran>"`; it reads self-reviewed, never verified, and is enough.
-   Ask a non-author only for high risk, a workspace with `verification:
-   independent` (`workit grant show`) or a verified merge: a fresh verifier with its own host-derived session (Claude Code and Codex:
+7. Verify as far as the review lane asks (`workit policy assess`, `workit pr
+   status`). Lane none: no verdict. Lane self: after `workit check test` passes,
+   record `workit ledger verdict tests-verified --self --how "<what you ran>"`;
+   it reads self-reviewed, never verified, and is enough. Focused, full, high
+   risk or `verification: self|independent` merges: one fresh verifier per PR after the last push, its own host-derived session (Claude Code: the `verifier` agent, `model: sonnet` when focused; Codex:
    the `verifier` agent; OpenCode: a child session; Pi: a supervised worker),
    never a hand-minted id. Before saying done, reconcile
    every named deliverable against the target checkout and observe it (for a push:

package/skills/workit-review/SKILL.md

@@ -13,6 +13,9 @@ OpenCode, a child session; Pi, a supervised worker. Never hand-mint one such
 as `<lead>-v1`: it is refused as `forged_session`.
 An author's `--self` verdict reads self-reviewed and never counts as
 independent; `type-check-only` never proves a behavior change.
+Depth follows the review lane in `workit pr status`: focused reads the diff and
+runs its tests; full also drives the real surface (verify-<app>). Review once
+per PR after its last push; a second pass on an unchanged head is waste.
 
 1. Pin the candidate: `git rev-parse HEAD`, the base, `git diff <base>...HEAD`;
    for a PR, `workit pr status --json` (checks, unresolved threads).

package/skills/workit-ship/SKILL.md

@@ -51,8 +51,7 @@ the same check. Fix round and recheck both failed: a decider (workit-fanout).
    allows; no sleep loop. Red: read `logTail`, classify. Flake or infra: one
    `workit ci rerun --failed --reason flake|infra` per head. Real: reproduce
    with `workit check`, fix the root cause, batch every fix in one push.
-6. **Verified.** High risk, `verification: independent` or a verified merge: a
-   non-author verdict (workit-review); else a self verdict stands. Land only when
+6. **Verified.** The lane in `workit pr status` decides: none, no verdict; self, your `--self` verdict; focused or full (or `verification: self|independent`), one non-author verifier per PR after the last push, never per push (workit-review), on Claude Code `model: sonnet` when focused. Land only when
    granted: `workit stack land` or `workit pr merge`; `--unverified --reason` if user-asked.
 7. **Observe it landed:** `workit verify-delivery pr` or `merge`. After a failed
    verdict or a check red 3+ times, at any endpoint: offer `/wk-retro` in one

package/src/autonomy.ts

@@ -185,17 +185,28 @@ function endpointView(entry: unknown, context: EndpointContext): EndpointView {
 }
 
 /**
- * How a normal-risk behavior change is verified (S17). `self` (default): an
- * observed passing `workit check test` plus the author's own `--self`
- * verdict, labelled self-reviewed. `independent`: a verdict from a session
- * that did not author the branch. User config only, like grants.
+ * How a behavior change is verified (S17, #333). `proportional` (default):
+ * the review lane computed from the diff decides (core/policy/lane.ts): none
+ * needs no verdict, self the author's own `--self` verdict, focused and full
+ * a non-author verdict, at every gate including merge. `self`: an observed
+ * passing `workit check test` plus the author's own `--self` verdict at
+ * normal risk, labelled self-reviewed; merge still needs a non-author
+ * verdict. `independent`: a verdict from a session that did not author the
+ * branch. User config only, like grants.
  */
-export type VerificationMode = "self" | "independent";
-export const DEFAULT_VERIFICATION: VerificationMode = "self";
-export const verificationOf = (entry: unknown): VerificationMode =>
-  (entry as { verification?: unknown } | null)?.verification === "independent"
-    ? "independent"
-    : "self";
+export type VerificationMode = "self" | "independent" | "proportional";
+export const VERIFICATION_MODES: readonly VerificationMode[] = [
+  "proportional",
+  "self",
+  "independent",
+];
+export const DEFAULT_VERIFICATION: VerificationMode = "proportional";
+export const verificationOf = (entry: unknown): VerificationMode => {
+  const value = (entry as { verification?: unknown } | null)?.verification;
+  return VERIFICATION_MODES.includes(value as VerificationMode)
+    ? (value as VerificationMode)
+    : DEFAULT_VERIFICATION;
+};
 
 export type AutonomySource = "autonomy" | "autoApprove" | "default";
 
@@ -415,7 +426,7 @@ export function writeGrants(
   dir: string = grantsDir(),
   /** A new default endpoint; `null` removes it (back to `commit`). */
   endpoint?: DefaultEndpoint | null,
-  /** A new verification mode; `null` removes it (back to `self`). */
+  /** A new verification mode; `null` removes it (back to `proportional`). */
   verification?: VerificationMode | null,
 ): GrantWrite {
   const current = readWorkspacesResult(dir);

package/src/check-config.ts

@@ -42,12 +42,19 @@ export function checksConfigFile(root: string): string {
   return !fs.existsSync(current) && fs.existsSync(legacy) ? legacy : current;
 }
 
-/** Create `<root>/.workit/` with its self-ignoring `.gitignore` (idempotent) and return the dir. */
+const WORKIT_GITIGNORE = "*\n!risk-paths\n";
+
+/**
+ * Create `<root>/.workit/` with its `.gitignore` (idempotent) and return the
+ * dir. It ignores everything but `risk-paths`, which a repo commits; the old
+ * `*` alone is rewritten.
+ */
 export function ensureWorkitDir(root: string): string {
   const dir = path.join(root, ".workit");
   fs.mkdirSync(dir, { recursive: true });
   const ignore = path.join(dir, ".gitignore");
-  if (!fs.existsSync(ignore)) fs.writeFileSync(ignore, "*\n");
+  if (!fs.existsSync(ignore) || fs.readFileSync(ignore, "utf8") === "*\n")
+    fs.writeFileSync(ignore, WORKIT_GITIGNORE);
   return dir;
 }
 

package/src/core/methods.ts

@@ -115,9 +115,9 @@ Autonomy contract:
   Prose is a note: only a configured check the CLI ran (\`workit check <name>\`)
   satisfies a gate; an ad-hoc \`workit check -- <cmd>\` never does.
 - Author is not verifier: your own verdict is \`--self\`, shown as
-  self-reviewed, never verified. High risk, \`verification: independent\` and
-  merge need a verifier with its own host-derived session (a subagent's
-  \`<lead>:<child>\`); never hand-mint one (\`<lead>-v1\`).
+  self-reviewed, never verified. High risk, a focused or full lane and
+  merge under \`verification: self|independent\` need a verifier with its
+  own host-derived session (a subagent's \`<lead>:<child>\`); never hand-mint one (\`<lead>-v1\`).
 - A local-commit endpoint does not imply PR readiness, and a local commit alone
   is not evidence of a requested remote push. Before reporting delivery,
   reconcile every requested item and observe it (\`workit verify-delivery\`).

package/src/core/policy/attributes.ts

@@ -0,0 +1,97 @@
+// `linguist-generated` from the `.gitattributes` files of one tree (#333,
+// review finding mvkcoxgb). The review lane reads them from the base
+// revision only: never `.git/info/attributes`, a global attributes file or
+// the working tree, so a change cannot mark its own code generated. What this
+// parser does not understand (quoted patterns, macros, directory patterns)
+// marks nothing generated, which only raises a lane.
+
+type Rule = { regex: RegExp; generated: boolean };
+
+/** A gitattributes pattern relative to `dir` ("" for the root) as a regex over repo paths. */
+function patternRegex(dir: string, pattern: string): RegExp | null {
+  if (!pattern || pattern.endsWith("/") || pattern.startsWith('"') || pattern.startsWith("!"))
+    return null;
+  const anchored = pattern.includes("/");
+  const body = pattern.replace(/^\//u, "");
+  let source = "";
+  for (let index = 0; index < body.length; index += 1) {
+    const char = body[index];
+    if (char === "*" && body[index + 1] === "*") {
+      const slash = body[index + 2] === "/";
+      source += slash ? "(?:.*/)?" : ".*";
+      index += slash ? 2 : 1;
+    } else if (char === "*") source += "[^/]*";
+    else if (char === "?") source += "[^/]";
+    else if (char === "[") {
+      const end = body.indexOf("]", index + 2);
+      if (end < 0) return null;
+      const set = body
+        .slice(index + 1, end)
+        .replace(/^!/u, "^")
+        .replace(/\\/gu, "\\\\");
+      source += `[${set}]`;
+      index = end;
+    } else if (char === "\\" && index + 1 < body.length) {
+      source += body[index + 1].replace(/[.*+?^${}()|[\]\\/]/gu, "\\$&");
+      index += 1;
+    } else source += char.replace(/[.*+?^${}()|[\]\\/]/gu, "\\$&");
+  }
+  const prefix = dir ? `${dir.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}/` : "";
+  try {
+    return new RegExp(anchored ? `^${prefix}${source}$` : `^${prefix}(?:.*/)?${source}$`, "u");
+  } catch {
+    return null;
+  }
+}
+
+/** The `linguist-generated` rules of one `.gitattributes` file in `dir`. */
+function rulesOf(dir: string, text: string): Rule[] {
+  const out: Rule[] = [];
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#") || line.startsWith("[attr]")) continue;
+    const [pattern, ...attributes] = line.split(/\s+/u);
+    let generated: boolean | null = null;
+    for (const attribute of attributes) {
+      if (attribute === "linguist-generated" || attribute === "linguist-generated=true")
+        generated = true;
+      else if (
+        attribute === "-linguist-generated" ||
+        attribute === "!linguist-generated" ||
+        attribute.startsWith("linguist-generated=")
+      )
+        generated = false;
+    }
+    if (generated === null) continue;
+    const regex = patternRegex(dir, pattern);
+    if (regex) out.push({ regex, generated });
+  }
+  return out;
+}
+
+/**
+ * Of `paths`, those the `.gitattributes` files of one tree mark
+ * `linguist-generated` (`files`: each file's repo path and text). A deeper
+ * file overrides a shallower one, and a later line an earlier one.
+ */
+export function generatedByAttributes(
+  files: ReadonlyMap<string, string>,
+  paths: readonly string[],
+): Set<string> {
+  const rules = [...files]
+    .map(([file, text]) => {
+      const dir = file.includes("/") ? file.slice(0, file.lastIndexOf("/")) : "";
+      return {
+        depth: dir ? dir.split("/").length : 0,
+        rules: rulesOf(dir, text),
+      };
+    })
+    .toSorted((left, right) => left.depth - right.depth)
+    .flatMap((entry) => entry.rules);
+  const out = new Set<string>();
+  for (const file of paths) {
+    const last = rules.findLast((rule) => rule.regex.test(file));
+    if (last?.generated) out.add(file);
+  }
+  return out;
+}

package/src/core/policy/current-judgment.ts

@@ -0,0 +1,20 @@
+import type { Judgment } from "../task-contract";
+import { TaskStore } from "../task-store";
+import { latestJudgment } from "./derive";
+
+/** The open task's latest judgment (the one policy/derive.ts reads), or null when none is recorded. Never throws. */
+export function currentJudgment(cwd: string): Judgment | null {
+  try {
+    const store = new TaskStore(cwd);
+    const listed = store.listTaskIndex();
+    const key = store.currentKey();
+    if (!listed.ok || !key.ok) return null;
+    const entry = listed.data
+      .filter((item) => item.key === key.data.key && item.status !== "closed")
+      .toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))[0];
+    const task = entry ? store.readTask(entry.id) : null;
+    return task?.ok === true ? latestJudgment(task.data) : null;
+  } catch {
+    return null;
+  }
+}

package/src/core/policy/derive.ts

@@ -6,6 +6,7 @@ import path from "node:path";
 import { currentBranch } from "../../git/rev";
 import { STRONG_RESULTS, checkVerdicts, readLedger, type ReadRow } from "../../ledger";
 import type { VerificationMode } from "../../autonomy";
+import { branchLane, laneNeed, type BranchLane } from "./lane";
 import {
   requirementId,
   sha256,
@@ -21,6 +22,7 @@ export const RULES = {
   self: "verdict:self",
   nonAuthor: "verdict:non-author",
   verified: "verdict:verified",
+  lane: "verdict:lane",
   product: "decision:product",
   plan: "plan",
 } as const;
@@ -46,8 +48,11 @@ const normalizedScope = (scope: Scope): Scope => ({
 /**
  * | judgment                         | requirement                                  |
  * | behaviorChange                   | check:test (configured, fresh tree), close   |
- * | behaviorChange && risk = normal  | verdict:self (default) or verdict:non-author  |
- * |                                  | (workspace verification: independent), close |
+ * | risk = normal,                   | verdict:lane: the review lane from the diff   |
+ * | verification: proportional       | decides (core/policy/lane.ts; met under lane  |
+ * | (whatever behaviorChange says)   | none), close                                  |
+ * | behaviorChange && risk = normal  | verdict:self (verification: self) or          |
+ * |                                  | verdict:non-author (independent), close       |
  * | risk = high                      | verdict:verified (ledger), close             |
  * | productChoiceOpen                | decision:product, before write               |
  * | needsPlan or risk = high         | plan (doc ref, soft), before write           |
@@ -62,6 +67,7 @@ export function deriveRequirements(
 ): Requirement[] {
   const out: Requirement[] = [];
   const base = { scope, dependentAction: null };
+  const proportional = verification === "proportional";
   if (judgment.behaviorChange)
     out.push(
       derived({
@@ -74,7 +80,25 @@ export function deriveRequirements(
         acceptanceAllowed: false,
       }),
     );
-  if (judgment.behaviorChange && judgment.riskTier === "normal")
+  // The diff, not the behavior-change judgment, decides: the requirement is
+  // derived at normal risk whatever behaviorChange says and is met under lane
+  // none (review finding mvkcoxgb). Trivial work keeps needing nothing at
+  // close; the merge gate still reads its lane.
+  if (proportional && judgment.riskTier === "normal")
+    out.push(
+      derived({
+        ...base,
+        ruleId: RULES.lane,
+        dimension: "review",
+        reason:
+          "The review lane computed from the diff decides the verdict: none needs none, self the author's own (shown as self-reviewed), focused and full a non-author one.",
+        satisfaction:
+          "Read the lane in `workit policy assess` or `workit pr status`; record what it asks: `workit ledger verdict tests-verified --self --how <what you ran>` for self, or hand focused and full to a verifier.",
+        before: "close",
+        acceptanceAllowed: false,
+      }),
+    );
+  if (!proportional && judgment.behaviorChange && judgment.riskTier === "normal")
     out.push(
       verification === "independent"
         ? derived({
@@ -264,7 +288,29 @@ const planRecorded = (task: TaskRecord, root: string): RuleStatus => {
  * an accepted independent one; `verdict:verified` an accepted independent
  * `verified` verdict of kind `live`.
  */
-const verdict = (requirement: Requirement, root: string, ledger: LedgerView): RuleStatus => {
+/** The review lane of the checked-out work (the working tree against the default base). */
+export const workingLane = (task: TaskRecord, root: string): BranchLane =>
+  branchLane(root, { head: null, workingTree: true, judgment: latestJudgment(task) });
+
+/** `verdict:lane`: the rule the lane asks for, or met under lane none. */
+const laneVerdict = (task: TaskRecord, root: string, ledger: LedgerView): RuleStatus => {
+  // With no branch (outside git) there is no diff to read and nothing could
+  // hold a verdict: a judgment of no behavior change owes none, as before lanes.
+  if (!ledger.branch() && latestJudgment(task)?.behaviorChange === false)
+    return {
+      met: true,
+      reason: "no branch to read a lane from, and the judgment records no behavior change",
+      decisionIds: [],
+    };
+  const lane = workingLane(task, root);
+  const label = `lane ${lane.lane} (${lane.reasons.join("; ")})`;
+  const need = laneNeed(lane.lane);
+  if (need === "none") return { met: true, reason: `${label}: no verdict needed`, decisionIds: [] };
+  const status = verdict(need === "self" ? RULES.self : RULES.nonAuthor, root, ledger);
+  return { ...status, reason: `${label}: ${status.reason}` };
+};
+
+const verdict = (ruleId: string, root: string, ledger: LedgerView): RuleStatus => {
   const branch = ledger.branch();
   if (!branch)
     return { met: false, reason: "no branch is checked out to hold a verdict", decisionIds: [] };
@@ -274,12 +320,12 @@ const verdict = (requirement: Requirement, root: string, ledger: LedgerView): Ru
     STRONG_RESULTS.has(String(entry.verdict.result));
   const met =
     !failing &&
-    (requirement.ruleId === RULES.verified
+    (ruleId === RULES.verified
       ? check.verdicts.find(
           (entry) =>
             entry.accepted && entry.kind === "live" && String(entry.verdict.result) === "verified",
         )
-      : requirement.ruleId === RULES.nonAuthor
+      : ruleId === RULES.nonAuthor
         ? check.verdicts.find((entry) => entry.accepted && strong(entry))
         : check.verdicts.find((entry) => entry.current && strong(entry)));
   if (met)
@@ -294,9 +340,9 @@ const verdict = (requirement: Requirement, root: string, ledger: LedgerView): Ru
       ? "type-check-only does not prove a behavior change"
       : (check.accepted.reasons.join(", ") || "no_verdict").replace(/_/g, " ");
   const unblock =
-    requirement.ruleId === RULES.self
+    ruleId === RULES.self
       ? "record your own verdict after an observed `workit check test`: `workit ledger verdict tests-verified --self --how <what you ran>` (shown as self-reviewed), or have a verifier record one"
-      : `an independent session records \`workit ledger verdict verified${requirement.ruleId === RULES.verified ? " --kind live" : ""} --how <what it exercised>\``;
+      : `an independent session records \`workit ledger verdict verified${ruleId === RULES.verified ? " --kind live" : ""} --how <what it exercised>\``;
   return { met: false, reason: `${why}: ${unblock}`, decisionIds: [] };
 };
 
@@ -315,7 +361,9 @@ export function derivedRuleStatus(
     case RULES.self:
     case RULES.nonAuthor:
     case RULES.verified:
-      return verdict(requirement, root, ledger);
+      return verdict(requirement.ruleId, root, ledger);
+    case RULES.lane:
+      return laneVerdict(task, root, ledger);
     default:
       return null;
   }