@brainervirus/workit-cursor 1.0.10 → 1.0.12

package/dist/cursor-session-start.js

@@ -7492,7 +7492,87 @@ var SCHEMA_VERSION = 1, POLICY_VERSION = "1.0.0", OPERATION_FAMILIES, uuidPatter
   const covers = (path) => normOuter.paths.some((base) => base === "." || path === base || path.startsWith(`${base}/`)) && !excluded(path, normOuter);
   const innerExcludes = (path) => innerExclusions.some((excludedPath) => excludedPath === path || path.startsWith(`${excludedPath}/`));
   return innerPaths.every(covers) && !normOuter.exclusions.some((excludedPath) => innerPaths.some((base) => (base === "." || excludedPath === base || excludedPath.startsWith(`${base}/`)) && !innerExcludes(excludedPath)));
-}, refSchema, provenanceSchema, entrySchema = (data) => object({ id, recordedAt: utc, provenance: provenanceSchema, data }).strict(), factSchema, signalSchema, signalSet, consequenceSchema, verificationSchema, assessmentSchema, constraintSchema, intentSchema, progressSchema, dimensionSchema, policySchema, requirementSchema, policyChangeSchema, candidateSchema, evidenceSchema, evidenceEvaluationSchema, decisionSchema, findingSchema, assignmentSchema, workerReportSchema, workerSchema, ownerSchema, closureSchema, actionProgressSchema, actionProgressListSchema, runtimeSchema, taskRecordSchema, workspaceRecordSchema, capabilitySchema, requirementEvaluationSchema, taskViewSchema, taskSummarySchema, exportBundleSchema, callerSchema, base, revisions, taskId, operation = (shape) => object({ ...base, ...shape }).strict(), taskOperations, policyOperations, evidenceOperations, findingOperations, decisionOperations, workerOperations, writerOperations, stateOperations, operationSchemas, compiledOperationSchemas, success = (revisionValue, workspaceRevisionValue, data) => ({
+}, refSchema, rewriteUnknown = (value, map) => {
+  if (Array.isArray(value)) {
+    const out = [];
+    for (const item of value) {
+      const rewritten = rewriteUnknown(item, map);
+      if (!rewritten.drop)
+        out.push(rewritten.value);
+    }
+    return { drop: false, value: out };
+  }
+  if (typeof value === "object" && value !== null) {
+    if (refSchema.safeParse(value).success) {
+      const mapped = map(value);
+      return mapped === null ? { drop: true } : { drop: false, value: mapped };
+    }
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+      const rewritten = rewriteUnknown(item, map);
+      out[key] = rewritten.drop ? null : rewritten.value;
+    }
+    return { drop: false, value: out };
+  }
+  return { drop: false, value };
+}, rewriteNode = (value, schema, map) => {
+  if (typeof value === "object" && value !== null && !Array.isArray(value) && refSchema.safeParse(value).success) {
+    const mapped = map(value);
+    return mapped === null ? { drop: true } : { drop: false, value: mapped };
+  }
+  let node = schema;
+  while (node instanceof ZodNullable || node instanceof ZodOptional || node instanceof ZodDefault) {
+    node = node.unwrap();
+  }
+  if (node === refSchema) {
+    if (!refSchema.safeParse(value).success)
+      return { drop: false, value };
+    const mapped = map(value);
+    return mapped === null ? { drop: true } : { drop: false, value: mapped };
+  }
+  if (node instanceof ZodArray) {
+    if (!Array.isArray(value))
+      return { drop: false, value };
+    const out = [];
+    for (const item of value) {
+      const rewritten = rewriteNode(item, node.element, map);
+      if (!rewritten.drop)
+        out.push(rewritten.value);
+    }
+    return { drop: false, value: out };
+  }
+  if (node instanceof ZodObject) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+      return { drop: false, value };
+    const shape = node.shape;
+    const record = value;
+    const out = {};
+    for (const [key, item] of Object.entries(record)) {
+      if (!(key in shape)) {
+        const scrubbed = rewriteUnknown(item, map);
+        out[key] = scrubbed.drop ? null : scrubbed.value;
+        continue;
+      }
+      const child = shape[key];
+      const rewritten = rewriteNode(item, child, map);
+      if (rewritten.drop) {
+        if (child instanceof ZodOptional || child instanceof ZodDefault)
+          continue;
+        if (child instanceof ZodNullable) {
+          out[key] = null;
+          continue;
+        }
+        return { drop: true };
+      }
+      out[key] = rewritten.value;
+    }
+    return { drop: false, value: out };
+  }
+  return { drop: false, value };
+}, rewriteRecordRefs = (value, schema, map) => {
+  const rewritten = rewriteNode(value, schema, map);
+  return rewritten.drop ? null : rewritten.value;
+}, provenanceSchema, entrySchema = (data) => object({ id, recordedAt: utc, provenance: provenanceSchema, data }).strict(), factSchema, signalSchema, signalSet, consequenceSchema, verificationSchema, assessmentSchema, constraintSchema, intentSchema, progressSchema, dimensionSchema, policySchema, requirementSchema, policyChangeSchema, candidateSchema, evidenceSchema, evidenceEvaluationSchema, decisionSchema, findingSchema, assignmentSchema, workerReportSchema, workerSchema, ownerSchema, closureSchema, actionProgressSchema, actionProgressListSchema, runtimeSchema, taskRecordSchema, workspaceRecordSchema, capabilitySchema, requirementEvaluationSchema, taskViewSchema, taskSummarySchema, exportBundleSchema, callerSchema, base, revisions, taskId, operation = (shape) => object({ ...base, ...shape }).strict(), taskOperations, policyOperations, evidenceOperations, findingOperations, decisionOperations, workerOperations, writerOperations, stateOperations, operationSchemas, compiledOperationSchemas, success = (revisionValue, workspaceRevisionValue, data) => ({
   ok: true,
   schemaVersion: 1,
   revision: revisionValue,
@@ -7795,10 +7875,11 @@ var init_task_contract = __esm(() => {
       presented: text,
       approvedContent: text,
       displayed: text.optional(),
-      contentRefs: array(refSchema)
+      contentRefs: array(refSchema),
+      statedChoice: object({ ref: text, text }).strict().optional()
     }).strict(),
     digest,
-    response: _enum(["approved", "rejected"]),
+    response: _enum(["approved", "rejected", "stated"]),
     requirementIds: array(digest),
     revoked: object({ at: utc, reason: text }).strict().nullable(),
     consumption: object({
@@ -9074,11 +9155,11 @@ class TaskStore {
         return workspace;
       if (!workspace.data)
         return failure("not_found", "workspace not found");
-      const expectedTaskRevision = input.expectedTaskRevision ?? input.expectedRevision;
-      if (!expectedTaskRevision)
+      const expected = input.expectedRevision;
+      if (!expected)
         return failure("invalid_input", "task revision is required");
-      if (task.data.revision !== expectedTaskRevision)
-        return this.conflict(expectedTaskRevision, task.data.revision);
+      if (task.data.revision !== expected)
+        return this.conflict(expected, task.data.revision);
       if (workspace.data.revision !== input.expectedWorkspaceRevision)
         return this.conflict(input.expectedWorkspaceRevision, workspace.data.revision);
       const previousWorkspaceBytes = this.snapshotBytes(this.workspacePath);
@@ -9704,7 +9785,7 @@ var same = (left, right) => {
   } catch {
     return false;
   }
-}, UNCERTAIN_WORKER_STATES, isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state), callerSession = (caller) => caller.session ?? { kind: "host", host: caller.host, handle: caller.actor }, validPath = (value) => typeof value === "string" && value.length > 0 && ![...value].some((char) => {
+}, UNCERTAIN_WORKER_STATES, isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state), workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state), callerSession = (caller) => caller.session ?? { kind: "host", host: caller.host, handle: caller.actor }, validPath = (value) => typeof value === "string" && value.length > 0 && ![...value].some((char) => {
   const code = char.charCodeAt(0);
   return code < 32 || code === 127;
 }) && !value.split(/[\\/]/).includes(".."), callerValue = (value) => ({ host: value.host, actor: value.actor }), workerIdOf = (value) => value.workerId ?? null;
@@ -9999,6 +10080,33 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
   const token = {};
   verifiedAuthorities.set(token, { kind, provenance, ...expected, ...binding, caller });
   return token;
+}, chainStepKey = (step) => step.kind === "commit" ? step.message : step.kind === "branch" ? `branch:${step.target}` : "pr", isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value), normalizeChainSteps = (steps) => {
+  if (!Array.isArray(steps) || steps.length === 0 || steps.length > 32)
+    return null;
+  const normalized = [];
+  for (const step of steps) {
+    if (typeof step === "string") {
+      if (!step.trim())
+        return null;
+      normalized.push({ kind: "commit", message: step });
+      continue;
+    }
+    if (!isRecord(step))
+      return null;
+    if (typeof step.branch === "string" && step.branch.trim() && Object.keys(step).length === 1) {
+      normalized.push({ kind: "branch", target: step.branch });
+      continue;
+    }
+    if (step.pr === true && Object.keys(step).length === 1) {
+      normalized.push({ kind: "pr" });
+      continue;
+    }
+    return null;
+  }
+  const keys = normalized.map(chainStepKey);
+  if (new Set(keys).size !== keys.length)
+    return null;
+  return normalized;
 }, scopeEqual = (left, right) => canonicalJson(left) === canonicalJson(right), parseSteps = (content) => {
   let value;
   try {
@@ -10009,7 +10117,10 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
   if (typeof value !== "object" || value === null || !("steps" in value))
     return [];
   const steps = value.steps;
-  return Array.isArray(steps) && steps.every((step) => typeof step === "string") ? steps : null;
+  if (!Array.isArray(steps))
+    return null;
+  const normalized = normalizeChainSteps(steps);
+  return normalized;
 }, decisionMatches = (entry, purpose, binding) => {
   const decision = entry.data;
   return binding.taskId === decision.binding.taskId && binding.workspaceId === decision.binding.workspaceId && decision.purpose === purpose && decision.response === "approved" && decision.revoked === null && (purpose !== "action" || decision.consumption === null) && decision.digest === decisionDigest(decision) && scopeEqual(decision.binding.scope, binding.scope) && canonicalJson(decision.binding) === canonicalJson(binding);
@@ -10179,14 +10290,12 @@ var verifiedAuthorities, trustedAuthority = (kind, provenance, expected, binding
     return content;
   const requestedSteps = parseSteps(decision.binding.approvedContent);
   if (requestedSteps === null)
-    return failure("invalid_input", "bounded action steps must be a string array");
-  if (input.steps && canonicalJson(input.steps) !== canonicalJson(requestedSteps))
+    return failure("invalid_input", "bounded action steps must be a unique non-empty array");
+  if (input.steps && canonicalJson(input.steps) !== canonicalJson(requestedSteps.map(chainStepKey)))
     return failure("permission_denied", "bounded action steps do not match approved content");
-  if (requestedSteps.some((step) => !step || typeof step !== "string") || new Set(requestedSteps).size !== requestedSteps.length)
-    return failure("invalid_input", "bounded action steps must be unique and non-empty");
   const stored = task.actionProgress?.find((item) => item.decisionId === input.decisionId);
-  const workflow = stored ? { steps: stored.steps, completed: stored.completedSteps } : { steps: requestedSteps, completed: [] };
-  if (workflow.steps.length && requestedSteps.length && canonicalJson(workflow.steps) !== canonicalJson(requestedSteps))
+  const workflow = stored ? { steps: stored.steps, completed: stored.completedSteps } : { steps: requestedSteps.map(chainStepKey), completed: [] };
+  if (workflow.steps.length && requestedSteps.length && canonicalJson(workflow.steps) !== canonicalJson(requestedSteps.map(chainStepKey)))
     return failure("permission_denied", "bounded action scope changed");
   return success(null, null, { entry, workflow });
 }, bindingCovers, verifyDecisionContent;
@@ -10354,7 +10463,7 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
   return (task.policy?.requirements ?? []).map((requirement) => {
     const related = task.evidence.map((entry, index) => ({ entry, evaluation: evidence[index] })).filter(({ entry }) => entry.data.requirementIds.includes(requirement.id));
     const passed = related.filter(({ entry, evaluation }) => {
-      if (!evidenceMatchesRequirement(evaluation.status, entry.data.kind, requirement.dimension))
+      if (!evidenceMatchesRequirement(evaluation.status, entry.data.kind, requirement.dimension, requirement.ruleId))
         return false;
       if ((entry.data.kind === "check" || entry.data.kind === "review") && (!entry.data.beforeCandidateId || !entry.data.candidateId || entry.data.beforeCandidateId !== entry.data.candidateId))
         return false;
@@ -10362,11 +10471,12 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
         return true;
       const reviewSession = sessionFromRef(entry.data.reviewContext);
       const sameImplementation = sameSession(reviewSession, task.intent.provenance.session);
-      const sameEvidenceSession = task.evidence.some((other) => other.id !== entry.id && other.data.kind === "review" && sameSession(reviewSession, other.provenance.session));
+      const sameEvidenceSession = related.some(({ entry: other }) => other.id !== entry.id && other.data.kind === "review" && other.data.candidateId !== null && other.data.candidateId === entry.data.candidateId && sameSession(reviewSession, other.provenance.session));
       return entry.data.kind === "review" && reviewSession !== null && sameSession(reviewSession, entry.provenance.session) && (requirement.ruleId === "self-review" || !sameImplementation && !sameEvidenceSession);
     });
     if (passed.length) {
-      const withRed = requirement.dimension === "testing" ? passed.filter(({ entry }) => related.some((other) => other.entry.data.kind === "check" && other.evaluation.status === "failed" && other.entry.data.requirementIds.includes(requirement.id) && other.entry.recordedAt <= entry.recordedAt)) : passed;
+      const currentId = candidate?.id ?? null;
+      const withRed = requirement.dimension === "testing" ? passed.filter(({ entry }) => related.some((other) => other.entry.data.kind === "check" && other.evaluation.status === "failed" && other.entry.data.requirementIds.includes(requirement.id) && other.entry.recordedAt <= entry.recordedAt) || related.some((baseline) => baseline.entry.id !== entry.id && baseline.entry.data.kind === "check" && baseline.entry.data.result === "passed" && baseline.entry.data.candidateId !== null && currentId !== null && baseline.entry.data.candidateId !== currentId)) : passed;
       if (withRed.length)
         return {
           requirementId: requirement.id,
@@ -10403,7 +10513,7 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
         status: "satisfied",
         evidenceIds: [],
         decisionIds: decisions.map((decision) => decision.id),
-        reason: "an applicable approved decision satisfies the requirement"
+        reason: "an applicable approved or stated decision satisfies the requirement"
       };
     const limitations = requirement.acceptanceAllowed ? applicableDecision2(task, workspace, requirement, checkoutRoot) : [];
     if (limitations.length)
@@ -10415,6 +10525,14 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
         reason: "an applicable approved limitation permits the missing evidence"
       };
     const unavailable = capabilities.some((capability) => capability.assurance === "unavailable" && (capability.name === requirement.dimension || capability.surface === requirement.dimension));
+    if (!unavailable && related.length > 0 && !passed.length)
+      return {
+        requirementId: requirement.id,
+        status: "unsatisfied",
+        evidenceIds: related.map(({ entry }) => entry.id),
+        decisionIds: [],
+        reason: `no passing evidence (needs kind:${expectedKinds(requirement.dimension, requirement.ruleId)})`
+      };
     return {
       requirementId: requirement.id,
       status: unavailable ? "unavailable" : "unsatisfied",
@@ -10439,7 +10557,13 @@ function evaluateClosure(requestedOutcome, view) {
       if (entry.data.disposition === "fixed") {
         const verified = entry.data.resolution?.evidenceIds.some((id) => {
           const evidence = view.task.evidence.find((item) => item.id === id);
-          return evidenceById.get(id) === "passed" && (evidence?.data.kind === "check" || evidence?.data.kind === "review");
+          if (!evidence)
+            return false;
+          return findingVerificationPasses(entry.data.candidateId, {
+            kind: evidence.data.kind,
+            candidateId: evidence.data.candidateId,
+            status: evidenceById.get(id) ?? "missing"
+          });
         });
         if (!verified)
           return failure("requirements_unsatisfied", "fixed findings require current verification");
@@ -10455,7 +10579,12 @@ function evaluateClosure(requestedOutcome, view) {
       }
     }
   }
-  const blocking = evaluations.filter((item) => item.status === "unsatisfied" || item.status === "unavailable");
+  const blocking = evaluations.filter((item) => {
+    if (item.status !== "unsatisfied" && item.status !== "unavailable")
+      return false;
+    const requirement = view.task.policy?.requirements.find((candidate) => candidate.id === item.requirementId);
+    return !requirement || requirement.before === "close";
+  });
   if (requestedOutcome !== "stopped" && blocking.length)
     return failure("requirements_unsatisfied", "applicable requirements are unsatisfied", {
       requirementIds: blocking.map((item) => item.requirementId),
@@ -10611,11 +10740,23 @@ var digestBytes3 = (value) => createHash4("sha256").update(value).digest("hex"),
 }, sameSession = (left, right) => {
   const other = sessionFromRef(right);
   return left !== null && other !== null && left.host === other.host && left.handle === other.handle;
-}, evidenceScopes = (task, ids) => (task.policy?.requirements ?? []).filter((requirement) => ids.includes(requirement.id)).map((requirement) => requirement.scope), scopeCovers2, applicableDecision2 = (task, workspace, requirement, checkoutRoot) => task.decisions.filter((entry) => entry.provenance.kind !== "imported").map((entry) => entry.data).filter((decision) => decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.binding.taskId === task.id && decision.binding.workspaceId === workspace.id && decision.requirementIds.includes(requirement.id) && decision.binding.scope && scopeCovers2(decision.binding.scope, requirement.scope) && decision.digest === decisionDigest(decision) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok : decision.binding.contentRefs.every((reference) => reference.kind !== "file"))), applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && data.response === "approved" && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id })), evidenceMatchesRequirement = (kind, evidenceKind, dimension) => {
+}, evidenceScopes = (task, ids) => (task.policy?.requirements ?? []).filter((requirement) => ids.includes(requirement.id)).map((requirement) => requirement.scope), scopeCovers2, checkPin = (assignment, beforeCandidateId, candidateId) => {
+  const pin = assignment.candidateId ?? null;
+  if (pin === null)
+    return true;
+  return (beforeCandidateId ?? null) === pin || (candidateId ?? null) === pin;
+}, resolveBinding = (evidence, pin, currentCandidateId) => {
+  const bound = evidence.kind === "check" || evidence.kind === "review";
+  const fallback = bound ? pin ?? currentCandidateId : null;
+  return {
+    beforeCandidateId: evidence.beforeCandidateId ?? fallback,
+    candidateId: evidence.candidateId ?? fallback
+  };
+}, findingVerificationPasses = (findingCandidateId, evidence) => evidence.status === "passed" && (evidence.kind === "check" || evidence.kind === "review") && ((findingCandidateId ?? null) === null || evidence.candidateId === findingCandidateId), applicableDecision2 = (task, workspace, requirement, checkoutRoot) => task.decisions.filter((entry) => entry.provenance.kind !== "imported").map((entry) => entry.data).filter((decision) => decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.binding.taskId === task.id && decision.binding.workspaceId === workspace.id && decision.requirementIds.includes(requirement.id) && decision.binding.scope && scopeCovers2(decision.binding.scope, requirement.scope) && decision.digest === decisionDigest(decision) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok : decision.binding.contentRefs.every((reference) => reference.kind !== "file"))), applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && (data.response === "approved" || data.response === "stated") && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id })), evidenceMatchesRequirement = (kind, evidenceKind, dimension, ruleId) => {
   if (kind !== "passed")
     return false;
   if (dimension === "testing" || dimension === "verification")
-    return evidenceKind === "check";
+    return evidenceKind === "check" || ruleId === "pre-pr-cleanup" && evidenceKind === "artifact";
   if (dimension === "review")
     return evidenceKind === "review";
   if (dimension === "investigation" || dimension === "challenge")
@@ -10623,6 +10764,20 @@ var digestBytes3 = (value) => createHash4("sha256").update(value).digest("hex"),
   if (dimension === "artifacts" || dimension === "continuity")
     return evidenceKind === "artifact";
   return false;
+}, expectedKinds = (dimension, ruleId) => {
+  if (dimension === "testing")
+    return "check";
+  if (dimension === "verification")
+    return ruleId === "pre-pr-cleanup" ? "check or artifact" : "check";
+  if (dimension === "review")
+    return "review";
+  if (dimension === "investigation" || dimension === "challenge")
+    return "investigation";
+  if (dimension === "artifacts" || dimension === "continuity")
+    return "artifact";
+  if (dimension === "decisions")
+    return "decision";
+  return "worker report";
 };
 var init_task_evaluation = __esm(() => {
   init_task_contract();
@@ -10633,7 +10788,7 @@ var init_task_evaluation = __esm(() => {
 // packages/workit-core/src/core/methods.ts
 function selectMethods(policy, capabilities) {
   return Object.entries(METHODS).flatMap(([id, definition]) => {
-    const requirements = policy.requirements.filter((requirement) => methodMatches(id, definition, requirement));
+    const requirements = policy.requirements.filter((requirement) => methodMatches(definition, requirement));
     if (requirements.length === 0)
       return [];
     const capability = assuranceFor(id, definition, capabilities);
@@ -10646,7 +10801,7 @@ function selectMethods(policy, capabilities) {
     return [{ id, reason: reasons.join("; "), assurance: capability.assurance }];
   });
 }
-var METHODS, methodMatches = (id, definition, requirement) => definition.dimensions?.includes(requirement.dimension) === true && !(id === "workit-review" && requirement.ruleId === "self-review") || definition.ruleIds?.includes(requirement.ruleId) === true, assuranceFor = (id, definition, capabilities) => {
+var METHODS, methodMatches = (definition, requirement) => definition.dimensions?.includes(requirement.dimension) === true || definition.ruleIds?.includes(requirement.ruleId) === true, assuranceFor = (id, definition, capabilities) => {
   const keys = new Set([
     id,
     ...definition.dimensions ?? [],
@@ -10720,12 +10875,12 @@ act from memory of it.
 var init_methods = __esm(() => {
   METHODS = {
     "workit-challenge": { dimensions: ["challenge", "decisions"] },
-    "workit-behavioral-tdd": { dimensions: ["testing"] },
-    "workit-review": { dimensions: ["review"], ruleIds: ["fresh-context-review"] },
+    "workit-behavioral-tdd": { dimensions: ["testing"], ruleIds: ["mechanical-existing-checks"] },
+    "workit-review": { dimensions: ["review"], ruleIds: ["fresh-context-review", "self-review"] },
     "workit-plan": { dimensions: ["artifacts", "continuity"] },
     "workit-implement": { dimensions: ["delegation"] },
-    "workit-debug": { ruleIds: ["root-cause-investigation"] },
-    "workit-handoff": { ruleIds: ["durable-handoff"] },
+    "workit-debug": {},
+    "workit-handoff": {},
     "workit-deslop": { ruleIds: ["pre-pr-cleanup"] }
   };
 });
@@ -10832,12 +10987,70 @@ var init_task_context = __esm(() => {
 });
 
 // packages/workit-core/src/core/route-intent.ts
-var init_route_intent = () => {};
+var init_route_intent = __esm(() => {
+  init_task_store();
+});
+
+// packages/workit-core/src/core/git.ts
+var init_git = () => {};
+
+// packages/workit-core/src/core/boundary.ts
+var init_boundary = () => {};
+
+// packages/workit-core/src/core/config.ts
+var PRESETS, DEFAULTS;
+var init_config = __esm(() => {
+  init_boundary();
+  PRESETS = {
+    gitflow: {
+      allowed: ["feature/*", "bugfix/*", "hotfix/*", "release/*"],
+      protected: ["main", "develop", "master", "prod", "production"]
+    },
+    "github-flow": { allowed: ["*"], protected: ["main"] },
+    "trunk-based": { allowed: ["*"], protected: ["main"] },
+    custom: { allowed: [], protected: [] }
+  };
+  DEFAULTS = {
+    locale: "en",
+    localeOptions: ["en", "es-CL", "es-MX", "es-AR", "pt-BR"],
+    timezone: "America/Santiago",
+    branchPolicy: {
+      preset: "gitflow",
+      allowed: [...PRESETS.gitflow.allowed],
+      protected: [...PRESETS.gitflow.protected]
+    },
+    commitPolicy: { preset: "conventional" }
+  };
+});
+
+// packages/workit-core/src/core/workspaces.ts
+var init_workspaces = __esm(() => {
+  init_config();
+});
+
+// packages/workit-core/src/core/vcs-config.ts
+var init_vcs_config = __esm(() => {
+  init_config();
+  init_workspaces();
+  init_branch();
+});
+
+// packages/workit-core/src/core/branch.ts
+var init_branch = __esm(() => {
+  init_git();
+  init_config();
+  init_workspaces();
+  init_vcs_config();
+});
+
+// packages/workit-core/src/core/runtime-identity.ts
+var init_runtime_identity = () => {};
 
 // packages/workit-core/src/core/external-action.ts
 var externalActionSchema;
 var init_external_action = __esm(() => {
   init_task_contract();
+  init_authority();
   init_zod();
   externalActionSchema = discriminatedUnion("operation", [
     object({
@@ -11311,7 +11524,7 @@ class WorkitCore {
   activeWorkerBlocker(task, workspace) {
     if (workspace.writer)
       return failure("recovery_required", "writer ownership must be released first");
-    if (task.workers.some((entry) => isUncertainWorker(entry.data.state)))
+    if (task.workers.some((entry) => workerBlocksTransition("close", entry.data.state)))
       return failure("recovery_required", "worker state requires reconciliation");
     return null;
   }
@@ -11557,37 +11770,33 @@ class WorkitCore {
     const currentCandidate = captureCandidate(this.store.root, task.data.intent.data.scope, environment());
     if (!currentCandidate.ok)
       return currentCandidate;
-    if (evidence.kind === "check" || evidence.kind === "review") {
-      evidence.beforeCandidateId ??= currentCandidate.data.id;
-      evidence.candidateId ??= currentCandidate.data.id;
-    } else {
-      evidence.beforeCandidateId ??= null;
-      evidence.candidateId ??= null;
-    }
+    const pin = helper && helper.ok ? helper.data.data.assignment.candidateId : null;
+    const bound = resolveBinding(evidence, pin, currentCandidate.data.id);
     if (helper?.ok) {
       const assignment = helper.data.data.assignment;
-      if (evidence.requirementIds.some((id) => !assignment.requirementIds.includes(id)) || assignment.candidateId !== null && evidence.candidateId !== assignment.candidateId && evidence.beforeCandidateId !== assignment.candidateId || !refsWithinScope(evidence.refs, assignment.scope) || !refsWithinScope(evidence.refs, task.data.intent.data.scope))
+      if (evidence.requirementIds.some((id) => !assignment.requirementIds.includes(id)) || !checkPin(assignment, bound.beforeCandidateId, bound.candidateId) || !refsWithinScope(evidence.refs, assignment.scope) || !refsWithinScope(evidence.refs, task.data.intent.data.scope))
         return failure("permission_denied", "evidence is outside the worker assignment");
     }
     const knownCandidates = new Set(task.data.candidates.map((candidate) => candidate.id));
-    for (const candidateId of [evidence.beforeCandidateId, evidence.candidateId]) {
+    for (const candidateId of [bound.beforeCandidateId, bound.candidateId]) {
       if (candidateId && candidateId !== currentCandidate.data.id && !knownCandidates.has(candidateId))
         return failure("invalid_input", "evidence candidate is not a captured candidate");
     }
+    const boundEvidence = { ...evidence, ...bound };
     const changed = this.store.mutateTask(task.data.id, input.expectedRevision, (current, mutation) => {
       const candidates = current.candidates.some((item) => item.id === currentCandidate.data.id) ? current.candidates : [...current.candidates, currentCandidate.data];
       const entry = {
         id: newId(),
         recordedAt: mutation.now,
         provenance: provenance(this.context, "agent_reported"),
-        data: evidence
+        data: boundEvidence
       };
       return success(mutation.revision, null, {
         ...current,
         candidates,
         evidence: [...current.evidence, entry],
         findings: current.findings.map((finding) => {
-          if (finding.data.disposition === "open" || evidence.result === "skipped")
+          if (finding.data.disposition === "open" || boundEvidence.result === "skipped")
             return finding;
           if (finding.data.disposition !== "fixed")
             return finding;
@@ -11596,8 +11805,12 @@ class WorkitCore {
             item.evidenceId,
             item.status
           ]));
-          const verified = withEntry.evidence.some((item) => statuses.get(item.id) === "passed" && (item.data.kind === "check" || item.data.kind === "review") && (finding.data.candidateId === null || item.data.candidateId === finding.data.candidateId));
-          const contradicted = evidence.result === "failed" && finding.data.refs.some((left) => evidence.refs.some((right) => JSON.stringify(left) === JSON.stringify(right)));
+          const verified = withEntry.evidence.some((item) => findingVerificationPasses(finding.data.candidateId, {
+            kind: item.data.kind,
+            candidateId: item.data.candidateId,
+            status: statuses.get(item.id) ?? "missing"
+          }));
+          const contradicted = boundEvidence.result === "failed" && finding.data.refs.some((left) => boundEvidence.refs.some((right) => sameValue(left, right)));
           return verified && !contradicted ? finding : { ...finding, data: { ...finding.data, disposition: "open", resolution: null } };
         })
       });
@@ -11622,7 +11835,12 @@ class WorkitCore {
     const input = parsed.data;
     if (nativeRequired && input.action !== "record")
       return failure("permission_denied", "native observation is only valid for recording decisions");
-    if (nativeRequired && nativeObservation === undefined)
+    const stated = input.action === "record" && input.response === "stated";
+    if (stated && input.purpose === "action")
+      return failure("permission_denied", "stated choices cannot authorize mutating actions");
+    if (stated && !input.binding?.statedChoice)
+      return failure("invalid_input", "stated choices require binding.statedChoice");
+    if (nativeRequired && nativeObservation === undefined && !stated)
       return failure("permission_denied", "native decision observation is required");
     const task = this.store.readTask(input.taskId);
     if (!task.ok)
@@ -11655,7 +11873,7 @@ class WorkitCore {
         consumption: null
       };
       const data = { ...base, digest: decisionDigest(base) };
-      const native = nativeRequired ? verifyNativeDecision(this.context.nativeAuthority, {
+      const native = nativeRequired && !stated ? verifyNativeDecision(this.context.nativeAuthority, {
         observation: nativeObservation,
         expected: {
           taskId: task.data.id,
@@ -11750,7 +11968,7 @@ class WorkitCore {
     if (input.action === "record") {
       if (helper?.ok) {
         const assignment = helper.data.data.assignment;
-        if (!bindingCovers(assignment.scope, input.scope) || !bindingCovers(task.data.intent.data.scope, input.scope) || assignment.candidateId !== null && input.candidateId !== assignment.candidateId || !refsWithinScope(input.refs, assignment.scope) || !refsWithinScope(input.refs, task.data.intent.data.scope))
+        if (!bindingCovers(assignment.scope, input.scope) || !bindingCovers(task.data.intent.data.scope, input.scope) || !checkPin(assignment, null, input.candidateId ?? null) || !refsWithinScope(input.refs, assignment.scope) || !refsWithinScope(input.refs, task.data.intent.data.scope))
           return failure("permission_denied", "finding is outside the worker assignment");
       }
       if (input.candidateId && !task.data.candidates.some((candidate) => candidate.id === input.candidateId))
@@ -11797,7 +12015,11 @@ class WorkitCore {
       const evaluations = evaluateEvidence(task.data, current.data);
       const verified = evidence.some((entry) => {
         const evaluation = evaluations.find((item) => item.evidenceId === entry.id);
-        return evaluation?.status === "passed" && (entry.data.kind === "check" || entry.data.kind === "review") && (finding.data.candidateId === null || entry.data.candidateId === finding.data.candidateId);
+        return findingVerificationPasses(finding.data.candidateId, {
+          kind: entry.data.kind,
+          candidateId: entry.data.candidateId,
+          status: evaluation?.status ?? "missing"
+        });
       });
       if (!verified)
         return failure("permission_denied", "fixed findings require passing verification evidence");
@@ -11809,7 +12031,7 @@ class WorkitCore {
         if (entry.data.result === "missing" || entry.data.result === "skipped")
           return false;
         const candidateMatches = finding.data.candidateId === null ? entry.data.candidateId === null : entry.data.candidateId === finding.data.candidateId || entry.data.beforeCandidateId === finding.data.candidateId;
-        const referenceMatches = finding.data.refs.some((left) => entry.data.refs.some((right) => JSON.stringify(left) === JSON.stringify(right)));
+        const referenceMatches = finding.data.refs.some((left) => entry.data.refs.some((right) => sameValue(left, right)));
         return candidateMatches && (referenceMatches || entry.data.claim === finding.data.claim);
       });
       if (!relevant)
@@ -11887,7 +12109,7 @@ class WorkitCore {
       const workerId = newId();
       const changed = this.store.mutateTaskAndWorkspace({
         taskId: task.data.id,
-        expectedTaskRevision: input.expectedRevision,
+        expectedRevision: input.expectedRevision,
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         now: trustedNow(this.context),
         workspace: (current, mutation) => success(mutation.revision, mutation.revision, current),
@@ -11925,7 +12147,7 @@ class WorkitCore {
         return failure("permission_denied", "worker report is outside the worker assignment");
       const changed = this.store.mutateTaskAndWorkspace({
         taskId: task.data.id,
-        expectedTaskRevision: input.expectedRevision,
+        expectedRevision: input.expectedRevision,
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         now: trustedNow(this.context),
         workspace: (current, mutation) => success(mutation.revision, mutation.revision, current),
@@ -11949,24 +12171,25 @@ class WorkitCore {
       return failure("invalid_transition", "closed task cannot cancel workers");
     if (entry.data.state === "unknown")
       return failure("recovery_required", "worker state requires recovery");
-    if (entry.data.state === "stopped")
-      return failure("invalid_transition", "stopped worker cannot be cancelled");
-    const settles = entry.data.report !== null || entry.data.state === "cancelling";
+    if (entry.data.state === "stopped") {
+      const stopped = task.data.workers.find((candidate) => candidate.id === input.workerId);
+      return success(task.data.revision, workspace.data.revision, stopped);
+    }
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
-      workspace: (current, mutation) => success(mutation.revision, mutation.revision, current),
+      workspace: (current, mutation) => success(mutation.revision, mutation.revision, {
+        ...current,
+        writer: current.writer?.owner.workerId === input.workerId ? null : current.writer
+      }),
       task: (current, mutation) => success(mutation.revision, null, {
         ...current,
         workers: current.workers.map((candidate) => candidate.id === input.workerId ? {
           ...candidate,
           recordedAt: mutation.now,
-          data: {
-            ...candidate.data,
-            state: settles ? "stopped" : "cancelling"
-          }
+          data: { ...candidate.data, state: "stopped" }
         } : candidate)
       })
     });
@@ -12063,7 +12286,7 @@ class WorkitCore {
       return attested;
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (current, mutation) => success(mutation.revision, mutation.revision, current),
@@ -12229,6 +12452,12 @@ class WorkitCore {
         if (!sameSession2(helper.data.data.session, this.context))
           return failure("permission_denied", "worker session does not match the caller");
       }
+      const gate = this.view(task.data);
+      if (gate.ok) {
+        const writeGates = (task.data.policy?.requirements ?? []).filter((requirement) => requirement.before === "write" && gate.data.requirements.some((evaluation) => evaluation.requirementId === requirement.id && (evaluation.status === "unsatisfied" || evaluation.status === "unavailable")));
+        if (writeGates.length)
+          return failure("requirements_unsatisfied", "writer ownership is gated by unsatisfied requirements; record their evidence or an approved limitation waiver first", { requirementIds: writeGates.map((requirement) => requirement.id) });
+      }
       const owner = {
         taskId: task.data.id,
         workerId: helperId,
@@ -12240,7 +12469,7 @@ class WorkitCore {
       };
       const changed = this.store.mutateTaskAndWorkspace({
         taskId: task.data.id,
-        expectedTaskRevision: input.expectedRevision,
+        expectedRevision: input.expectedRevision,
         expectedWorkspaceRevision: input.expectedWorkspaceRevision,
         now: trustedNow(this.context),
         workspace: (current, mutation) => success(mutation.revision, mutation.revision, {
@@ -12271,7 +12500,7 @@ class WorkitCore {
     }
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (currentWorkspace, mutation) => success(mutation.revision, mutation.revision, { ...currentWorkspace, writer: null }),
@@ -12520,7 +12749,15 @@ class WorkitCore {
       if (seen.has(observation.workerId))
         return failure("invalid_input", "worker observations must be unique");
       seen.add(observation.workerId);
-      if (observation.taskId !== view.task.id || observation.expectedRevision !== view.task.revision || observation.expectedWorkspaceRevision !== view.workspace.revision)
+      const freshTask = this.store.readTask(view.task.id);
+      const freshWorkspace = this.store.readWorkspace();
+      if (!freshTask.ok)
+        return freshTask;
+      if (!freshWorkspace.ok)
+        return freshWorkspace;
+      if (!freshWorkspace.data)
+        return failure("not_found", "workspace not found");
+      if (observation.taskId !== view.task.id || observation.expectedRevision !== freshTask.data.revision || observation.expectedWorkspaceRevision !== freshWorkspace.data.revision)
         return failure("revision_conflict", "worker observation is stale");
       if (!view.task.workers.some((entry) => entry.id === observation.workerId))
         return failure("permission_denied", "worker observation is not assigned");
@@ -12606,19 +12843,26 @@ class WorkitCore {
         return failure("permission_denied", "imported resume requires native destination approval");
       resumeCandidate = current.data.candidate;
     }
-    const blocker = this.activeWorkerBlocker(task.data, workspace.data);
+    const blocker = status === "paused" ? workspace.data.writer ? failure("recovery_required", "writer ownership must be released first") : null : this.activeWorkerBlocker(task.data, workspace.data);
     if (blocker)
       return blocker;
+    let pauseCandidate = null;
+    if (status === "paused") {
+      const captured = captureCandidate(this.store.root, task.data.intent.data.scope, environment());
+      if (!captured.ok)
+        return captured;
+      pauseCandidate = captured.data;
+    }
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (workspace, context) => success(context.revision, context.revision, workspace),
       task: (current, context) => success(context.revision, null, {
         ...current,
         status,
-        candidates: resumeCandidate && !current.candidates.some((candidate) => candidate.id === resumeCandidate.id) ? [...current.candidates, resumeCandidate] : current.candidates,
+        candidates: (resumeCandidate ?? pauseCandidate) && !current.candidates.some((candidate) => candidate.id === (resumeCandidate ?? pauseCandidate).id) ? [...current.candidates, resumeCandidate ?? pauseCandidate] : current.candidates,
         progress: current.progress,
         pauseReason: status === "paused" ? input.reason ?? null : null
       })
@@ -12656,12 +12900,13 @@ class WorkitCore {
       return workspace;
     if (!workspace.data)
       return failure("not_found", "workspace not found");
-    if (workspace.data.writer || task.data.workers.some((entry) => isUncertainWorker(entry.data.state)))
-      return failure("recovery_required", "scope revision requires worker ownership reconciliation");
+    const revisionBlocker = this.activeWorkerBlocker(task.data, workspace.data);
+    if (revisionBlocker)
+      return revisionBlocker;
     this.fillRevisions(input, task.data, workspace.data);
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (workspace, context) => success(context.revision, context.revision, workspace),
@@ -12717,7 +12962,7 @@ class WorkitCore {
       return closure;
     const changed = this.store.mutateTaskAndWorkspace({
       taskId: task.data.id,
-      expectedTaskRevision: input.expectedRevision,
+      expectedRevision: input.expectedRevision,
       expectedWorkspaceRevision: input.expectedWorkspaceRevision,
       now: trustedNow(this.context),
       workspace: (value, context) => success(context.revision, context.revision, value),
@@ -12842,6 +13087,8 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
   if (task.data.status === "paused" && (input.state === "running" || input.state === "cancelling"))
     return failure("invalid_transition", "paused task cannot run a worker");
   const notStarted = input.dispatch === true;
+  if (notStarted && entry.data.state === "stopped" && input.session === null)
+    return success(task.data.revision, workspace.data.revision, entry);
   if (notStarted && (input.state !== "stopped" || input.session !== null))
     return failure("invalid_input", "a never-dispatched worker stops with no session");
   if (notStarted && entry.data.session !== null)
@@ -12873,7 +13120,7 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
     return success(task.data.revision, workspace.data.revision, entry);
   const changed = input.store.mutateTaskAndWorkspace({
     taskId: task.data.id,
-    expectedTaskRevision: input.expectedRevision,
+    expectedRevision: input.expectedRevision,
     expectedWorkspaceRevision: input.expectedWorkspaceRevision,
     now: input.now,
     workspace: (current, mutation) => success(mutation.revision, mutation.revision, {
@@ -12912,90 +13159,22 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
   workerId: null,
   receipts: []
 }), portableTask = (task) => {
-  const clone = structuredClone(task);
-  const portableProvenance = (value) => ({
-    ...value,
-    session: null,
-    receipts: []
-  });
-  const entries = [
-    clone.intent,
-    ...clone.assessments,
-    ...clone.evidence,
-    ...clone.decisions,
-    ...clone.findings,
-    ...clone.workers
-  ];
-  for (const entry of entries)
-    entry.provenance = portableProvenance(entry.provenance);
-  for (const worker of clone.workers)
-    worker.data.session = null;
-  clone.intent = {
-    ...clone.intent,
-    data: { ...clone.intent.data, authorityRefs: portableRefs(clone.intent.data.authorityRefs) }
-  };
-  clone.constraints = clone.constraints.flatMap((constraint) => {
-    const source = portableRef(constraint.source);
-    return source ? [
-      {
-        ...constraint,
-        source,
-        requires: constraint.requires.map((requirement) => ({
-          ...requirement,
-          refs: portableRefs(requirement.refs)
-        }))
-      }
-    ] : [];
-  });
-  clone.assessments = clone.assessments.map((entry) => ({
-    ...entry,
-    data: {
-      ...entry.data,
-      facts: entry.data.facts.map(portableFact),
-      signals: Object.fromEntries(Object.entries(entry.data.signals).map(([name, signal]) => [name, portableSignal(signal)])),
-      consequences: entry.data.consequences.map((consequence) => ({
-        ...consequence,
-        fact: portableFact(consequence.fact)
-      })),
-      verification: entry.data.verification.map((verification) => ({
-        ...verification,
-        availableChecks: portableRefs(verification.availableChecks)
-      }))
-    }
-  }));
-  clone.progress = {
-    ...clone.progress,
-    blockers: clone.progress.blockers.map((blocker) => ({
-      ...blocker,
-      refs: portableRefs(blocker.refs)
-    }))
+  const stripped = rewriteRecordRefs(task, taskRecordSchema, portableRef);
+  if (typeof stripped !== "object" || stripped === null || Array.isArray(stripped))
+    throw new TypeError("portable task rewrite produced a non-record");
+  const clone = structuredClone(stripped);
+  const demote = (facts, signals, consequences) => {
+    for (const fact of facts)
+      Object.assign(fact, portableFact(fact));
+    for (const name of Object.keys(signals)) {
+      const signal = signals[name];
+      Object.assign(signal, portableSignal(signal));
+    }
+    for (const consequence of consequences)
+      Object.assign(consequence.fact, portableFact(consequence.fact));
   };
-  clone.evidence = clone.evidence.map((entry) => ({
-    ...entry,
-    data: {
-      ...entry.data,
-      refs: portableRefs(entry.data.refs),
-      reviewContext: portableRef(entry.data.reviewContext)
-    }
-  }));
-  clone.decisions = clone.decisions.map((entry) => ({
-    ...entry,
-    data: {
-      ...entry.data,
-      consumption: entry.data.consumption ? portableRef(entry.data.consumption.actionRef) ? {
-        ...entry.data.consumption,
-        actionRef: portableRef(entry.data.consumption.actionRef)
-      } : null : null,
-      binding: {
-        ...entry.data.binding,
-        contentRefs: portableRefs(entry.data.binding.contentRefs)
-      }
-    }
-  }));
-  clone.findings = clone.findings.map((entry) => ({
-    ...entry,
-    data: { ...entry.data, refs: portableRefs(entry.data.refs) }
-  }));
+  for (const entry of clone.assessments)
+    demote(entry.data.facts, entry.data.signals, entry.data.consequences);
   clone.candidates = [];
   return clone;
 }, importedTask = (source, bundle, destinationWorkspaceId, context, timestamp) => {
@@ -13019,15 +13198,13 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
     allocate(entry.id);
   const fresh = (id) => allocate(id);
   const provenance = importedProvenance(context);
+  const remap = (ref) => mapRef(ref, ids);
   const intent = {
     ...source.intent,
     id: fresh(source.intent.id),
     recordedAt: timestamp,
     provenance,
-    data: {
-      ...source.intent.data,
-      authorityRefs: source.intent.data.authorityRefs.map((ref) => mapRef(ref, ids))
-    }
+    data: rewriteRecordRefs(source.intent.data, intentSchema, remap)
   };
   const assessments = source.assessments.map((entry) => {
     const data = entry.data;
@@ -13036,28 +13213,7 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
       id: fresh(entry.id),
       recordedAt: timestamp,
       provenance,
-      data: {
-        ...data,
-        facts: data.facts.map((fact) => ({
-          ...fact,
-          refs: fact.refs.map((ref) => mapRef(ref, ids))
-        })),
-        signals: Object.fromEntries(Object.entries(data.signals).map(([name, signal]) => [
-          name,
-          { ...signal, refs: signal.refs.map((ref) => mapRef(ref, ids)) }
-        ])),
-        consequences: data.consequences.map((consequence) => ({
-          ...consequence,
-          fact: {
-            ...consequence.fact,
-            refs: consequence.fact.refs.map((ref) => mapRef(ref, ids))
-          }
-        })),
-        verification: data.verification.map((verification) => ({
-          ...verification,
-          availableChecks: verification.availableChecks.map((ref) => mapRef(ref, ids))
-        }))
-      }
+      data: rewriteRecordRefs(data, assessmentSchema, remap)
     };
   });
   const evidence = source.evidence.map((entry) => ({
@@ -13065,11 +13221,7 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
     id: fresh(entry.id),
     recordedAt: timestamp,
     provenance,
-    data: {
-      ...entry.data,
-      refs: entry.data.refs.map((ref) => mapRef(ref, ids)),
-      reviewContext: entry.data.reviewContext ? mapRef(entry.data.reviewContext, ids) : null
-    }
+    data: rewriteRecordRefs(entry.data, evidenceSchema, remap)
   }));
   const decisions = source.decisions.map((entry) => ({
     ...entry,
@@ -13077,21 +13229,23 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
     recordedAt: timestamp,
     provenance
   }));
-  const findings = source.findings.map((entry) => ({
-    ...entry,
-    id: fresh(entry.id),
-    recordedAt: timestamp,
-    provenance,
-    data: {
-      ...entry.data,
-      refs: entry.data.refs.map((ref) => mapRef(ref, ids)),
-      resolution: entry.data.resolution ? {
-        ...entry.data.resolution,
-        evidenceIds: entry.data.resolution.evidenceIds.map((id) => ids.get(id) ?? id),
-        decisionIds: entry.data.resolution.decisionIds.map((id) => ids.get(id) ?? id)
-      } : null
-    }
-  }));
+  const findings = source.findings.map((entry) => {
+    const data = rewriteRecordRefs(entry.data, findingSchema, remap);
+    return {
+      ...entry,
+      id: fresh(entry.id),
+      recordedAt: timestamp,
+      provenance,
+      data: {
+        ...data,
+        resolution: data.resolution ? {
+          ...data.resolution,
+          evidenceIds: data.resolution.evidenceIds.map((id) => ids.get(id) ?? id),
+          decisionIds: data.resolution.decisionIds.map((id) => ids.get(id) ?? id)
+        } : null
+      }
+    };
+  });
   const workers = source.workers.map((entry) => ({
     ...entry,
     id: fresh(entry.id),
@@ -13134,19 +13288,21 @@ var provenance = (context, kind = context.provenanceKind ?? "host_observed") =>
     closure: null,
     assessments,
     evidence,
-    decisions: decisions.map((entry) => ({
-      ...entry,
-      data: {
-        ...entry.data,
-        binding: {
-          ...entry.data.binding,
-          taskId: "",
-          workspaceId: destinationWorkspaceId,
-          contentRefs: entry.data.binding.contentRefs.map((ref) => mapRef(ref, ids))
-        },
-        consumption: null
-      }
-    })),
+    decisions: decisions.map((entry) => {
+      const data = rewriteRecordRefs(entry.data, decisionSchema, remap);
+      return {
+        ...entry,
+        data: {
+          ...data,
+          binding: {
+            ...data.binding,
+            taskId: "",
+            workspaceId: destinationWorkspaceId
+          },
+          consumption: null
+        }
+      };
+    }),
     ...actionProgress ? { actionProgress } : {},
     findings,
     workers,
@@ -13188,6 +13344,9 @@ var init_core3 = __esm(() => {
   init_task_context();
   init_methods();
   init_route_intent();
+  init_branch();
+  init_runtime_identity();
+  init_authority();
   init_authority();
   init_external_action();
   init_external_action();
@@ -13252,8 +13411,8 @@ var hostRef = (handle) => ({ kind: "host", host: "cursor", handle }), cursorCapa
       refs: [hostRef("sessionStart"), hostRef("preCompact")]
     }
   ];
-}, isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value), eventNames, nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "", parseCursorHookInput = (value) => {
-  if (!isRecord(value) || !eventNames.has(value.hook_event_name))
+}, isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), eventNames, nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "", parseCursorHookInput = (value) => {
+  if (!isRecord2(value) || !eventNames.has(value.hook_event_name))
     return { ok: false, error: "hook_event_name is required" };
   const roots = value.workspace_roots;
   if (!Array.isArray(roots) || roots.length !== 1 || !roots.every(nonEmpty2))
@@ -13391,7 +13550,7 @@ var hostRef = (handle) => ({ kind: "host", host: "cursor", handle }), cursorCapa
 }, handleSubagentStop = () => ({}), handleCursorHook = (raw) => {
   const parsed = parseCursorHookInput(raw);
   if (!parsed.ok) {
-    return isRecord(raw) && raw.hook_event_name === "sessionStart" ? {} : deny(parsed.error);
+    return isRecord2(raw) && raw.hook_event_name === "sessionStart" ? {} : deny(parsed.error);
   }
   const input = parsed.data;
   const root = realpathSync5(input.workspace_roots[0]);
@@ -13435,7 +13594,7 @@ ${invariantBootstrap()}${compact}
     const output = handleCursorHook(input);
     process.stdout.write(`${JSON.stringify(output)}
 `);
-    const event = isRecord(input) ? input.hook_event_name : undefined;
+    const event = isRecord2(input) ? input.hook_event_name : undefined;
     if (output.permission === "deny" && ["preToolUse", "beforeShellExecution", "subagentStart"].includes(String(event)))
       process.exitCode = 2;
   } catch {