@brainervirus/workit-cursor 8.12.3 → 8.13.1

package/dist/workit-hook.js

@@ -8561,242 +8561,666 @@ function pushRemoteName(cwd, branch) {
 }
 
 // packages/workit-core/src/ledger.ts
-import { spawnSync as spawnSync7 } from "node:child_process";
-import { createHash as createHash7, randomBytes } from "node:crypto";
-import fs5 from "node:fs";
+import { spawnSync as spawnSync8 } from "node:child_process";
+import { createHash as createHash7, randomBytes as randomBytes2 } from "node:crypto";
+import fs6 from "node:fs";
 import path8 from "node:path";
 
-// packages/workit-core/src/core/vcs-config.ts
-import fs2 from "node:fs";
-import path4 from "node:path";
-import { spawnSync as spawnSync5 } from "node:child_process";
+// packages/workit-core/src/core/store-lock.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
+import fs3 from "node:fs";
+import { hostname } from "node:os";
 
-// packages/workit-core/src/core/config.ts
-import {
-  copyFileSync,
-  cpSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  readdirSync,
-  writeFileSync
-} from "node:fs";
-import os2 from "node:os";
+// packages/workit-core/src/store/paths.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { createHash as createHash3 } from "node:crypto";
+import fs2 from "node:fs";
 import path2 from "node:path";
-
-// packages/workit-core/src/core/boundary.ts
-var EVENT = {
-  initialization: "initialization",
-  provenance: "provenance",
-  assets: "assets",
-  configurationSource: "configuration_source",
-  hooks: "hooks",
-  mcpConnection: "mcp_connection",
-  migration: "migration",
-  installSteps: "install_steps",
-  uncaughtFailure: "uncaught_failure",
-  toolsFailed: "tools_failed",
-  doctor: "doctor"
-};
-var errorDetail = (err) => {
-  if (err instanceof Error) {
-    return { error_name: err.name, error: err.message };
-  }
-  return { error_name: "unknown", error: String(err) };
-};
-
-// packages/workit-core/src/core/config.ts
-var diagnosticLogger;
-var PRESETS = {
-  gitflow: {
-    allowed: ["feature/*", "bugfix/*", "hotfix/*", "release/*"],
-    protected: ["main", "develop", "master", "prod", "production"]
-  },
-  "github-flow": { allowed: ["*"], protected: ["main"] },
-  "trunk-based": { allowed: ["*"], protected: ["main"] },
-  custom: { allowed: [], protected: [] }
-};
-var mergePreset = (preset, input = {}, current = {
-  branchPolicy: { preset, allowed: [], protected: [] }
-}) => {
-  const defs = PRESETS[preset];
+var NOT_A_REPO = /not a git repository \(or any (of the parent directories|parent up to)/u;
+var gitRun = (cwd, args) => {
+  const run = spawnSync2("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: 20000,
+    killSignal: "SIGKILL",
+    windowsHide: true,
+    env: {
+      ...process.env,
+      GIT_TERMINAL_PROMPT: "0",
+      GIT_OPTIONAL_LOCKS: "0",
+      LC_ALL: "C",
+      LANGUAGE: "C"
+    }
+  });
+  const error = run.error;
   return {
-    preset,
-    allowed: preset === "custom" ? input.allowed ?? current.branchPolicy.allowed : [...defs.allowed],
-    protected: preset === "custom" ? input.protectedNames ?? current.branchPolicy.protected : [...defs.protected]
+    ok: run.status === 0,
+    stdout: run.stdout ?? "",
+    stderr: error ? String(error.message) : run.stderr ?? "",
+    missing: error?.code === "ENOENT"
   };
 };
-var resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path2.join(process.env.XDG_CONFIG_HOME || path2.join(os2.homedir(), ".config"), "workit");
-var migratedDir = null;
-var migrationFailed = false;
-var ensureConfigDir = (dir = resolveConfigDir()) => {
-  if (migratedDir === dir)
-    return dir;
-  if (process.env.WORKFLOW_TOOLKIT_CONFIG || process.env.WORKFLOW_TOOLKIT_CONFIG_DIR) {
-    migratedDir = dir;
-    return dir;
-  }
-  const legacy = path2.join(process.env.XDG_CONFIG_HOME || path2.join(os2.homedir(), ".config"), "workflow-toolkit");
-  if (!existsSync(legacy)) {
-    migratedDir = dir;
-    return dir;
-  }
-  if (!migrationFailed && existsSync(dir)) {
-    migratedDir = dir;
-    return dir;
-  }
-  migrationFailed = false;
-  mkdirSync(dir, { recursive: true });
-  diagnosticLogger?.info(EVENT.migration, { from: legacy, to: dir });
-  for (const entry of readdirSync(legacy, { withFileTypes: true })) {
-    const src = path2.join(legacy, entry.name);
-    const dest = path2.join(dir, entry.name);
-    if (existsSync(dest))
-      continue;
-    try {
-      if (entry.isDirectory())
-        cpSync(src, dest, { recursive: true });
-      else if (entry.isFile())
-        copyFileSync(src, dest);
-    } catch (err) {
-      migrationFailed = true;
-      diagnosticLogger?.warn(EVENT.migration, { from: src, ok: false, ...errorDetail(err) });
-      console.warn(`[workit] config migration: a file could not be copied to ${dir}; it will be retried on the next run`);
-    }
-  }
-  if (!migrationFailed)
-    migratedDir = dir;
-  return dir;
-};
-var configDir = () => ensureConfigDir();
-var LOCALE_RE = /^[a-z]{2,3}(-(?:[A-Z]{2}|[0-9]{3}))?$/;
-var DEFAULTS = {
-  locale: "en",
-  localeOptions: ["en", "es-CL", "es-MX", "es-AR", "pt-BR"],
-  branchPolicy: {
-    preset: "gitflow",
-    allowed: [...PRESETS.gitflow.allowed],
-    protected: [...PRESETS.gitflow.protected]
-  },
-  commitPolicy: { preset: "conventional" }
-};
-var unchosenBranchPolicy = new WeakSet([DEFAULTS]);
-var readSafe = (p) => {
+var shortHash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 12);
+var real = (file) => {
   try {
-    return readFileSync(p, "utf8");
+    return fs2.realpathSync.native(file);
   } catch {
-    return null;
+    return file;
   }
 };
-var isConfigObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-var parseConfigResult = (raw, file) => {
-  if (raw === null)
-    return { status: "missing", path: file };
-  let parsed;
+var DISCOVERY_ENV = [
+  "GIT_DIR",
+  "GIT_COMMON_DIR",
+  "GIT_WORK_TREE",
+  "GIT_CEILING_DIRECTORIES",
+  "GIT_DISCOVERY_ACROSS_FILESYSTEM"
+];
+var isGitDir = (dir) => {
   try {
-    parsed = JSON.parse(raw);
+    return fs2.statSync(path2.join(dir, "HEAD")).isFile() && fs2.statSync(path2.join(dir, "objects")).isDirectory() && fs2.statSync(path2.join(dir, "refs")).isDirectory();
   } catch {
-    return { status: "malformed", path: file, error: `${file} is not valid JSON` };
-  }
-  if (!isConfigObject(parsed)) {
-    return { status: "malformed", path: file, error: `${file} is not a JSON object` };
+    return false;
   }
-  const input = parsed;
-  const locale = LOCALE_RE.test(String(input.locale ?? "")) ? input.locale : DEFAULTS.locale;
-  const preset = Object.hasOwn(PRESETS, input.branchPolicy?.preset) ? input.branchPolicy?.preset : "gitflow";
-  const commitPreset = COMMIT_PRESETS.includes(String(input.commitPolicy?.preset ?? "")) ? input.commitPolicy?.preset : "conventional";
-  const config = {
-    locale,
-    localeOptions: Array.isArray(input.localeOptions) ? input.localeOptions : DEFAULTS.localeOptions,
-    branchPolicy: mergePreset(preset, {
-      allowed: Array.isArray(input.branchPolicy?.allowed) ? input.branchPolicy.allowed : undefined,
-      protectedNames: Array.isArray(input.branchPolicy?.protected) ? input.branchPolicy.protected : undefined
-    }, DEFAULTS),
-    commitPolicy: {
-      preset: commitPreset,
-      ...typeof input.commitPolicy?.pattern === "string" ? { pattern: input.commitPolicy.pattern } : {}
-    }
-  };
-  if (!Object.hasOwn(PRESETS, input.branchPolicy?.preset))
-    unchosenBranchPolicy.add(config);
-  return { status: "valid", path: file, config };
-};
-var readConfigTyped = (dir) => {
-  const file = path2.join(dir ?? configDir(), "config.json");
-  return parseConfigResult(readSafe(file), file);
-};
-var readConfig = () => {
-  const result = readConfigTyped();
-  if (result.status === "malformed")
-    throw new Error(result.error);
-  return result.config ?? DEFAULTS;
-};
-var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path2.join(configDir(), "vcs.json");
-var branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i");
-var resolveBranchPolicy = (config, workspace, repoPreset) => {
-  const wp = workspace?.branchPolicy ?? {};
-  const workspacePreset = Object.hasOwn(PRESETS, wp.preset);
-  const detected = !workspacePreset && unchosenBranchPolicy.has(config) ? repoPreset?.() ?? null : null;
-  const preset = workspacePreset ? wp.preset : detected ?? config.branchPolicy?.preset ?? "gitflow";
-  const merged = mergePreset(preset, {
-    allowed: wp.allowed,
-    protectedNames: wp.protected
-  }, config);
-  const allowed = merged.allowed.map(branchGlobPattern);
-  return {
-    preset,
-    allowed,
-    protected: new Set([...merged.protected, ...detected ? PRESETS.gitflow.protected : []].map((p) => p.toLowerCase())),
-    integration: wp.integration === "merge" ? "merge" : "pr",
-    defaultTargetBranch: preset === "github-flow" ? "main" : preset === "trunk-based" ? "master" : "develop",
-    detected: detected !== null
-  };
 };
-var COMMIT_PRESETS = [
-  "conventional",
-  "gitmoji",
-  "ticket-prefix",
-  "freeform",
-  "custom",
-  "auto"
-];
-var resolveCommitPolicy = (config, workspace) => {
-  const wp = workspace?.commitPolicy ?? {};
-  if (COMMIT_PRESETS.includes(String(wp.preset ?? ""))) {
-    return {
-      preset: wp.preset,
-      ...typeof wp.pattern === "string" ? { pattern: wp.pattern } : {}
-    };
+var reftableRefs = (common) => {
+  try {
+    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs2.readFileSync(path2.join(common, "config"), "utf8"));
+  } catch {
+    return false;
   }
-  return config.commitPolicy ?? { preset: "conventional" };
-};
-
-// packages/workit-core/src/core/workspaces.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
-import { createHash as createHash3 } from "node:crypto";
-import { readFileSync as readFileSync2, realpathSync } from "node:fs";
-import path3 from "node:path";
-
-// packages/workit-core/src/core/branch-policy.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-var PREFIXES = {
-  feature: "feature/*",
-  bugfix: "bugfix/*",
-  release: "release/*",
-  hotfix: "hotfix/*"
-};
-var branchNames = (workspaceRoot) => {
-  const r = spawnSync2("git", ["for-each-ref", "--format=%(refname)", "refs/heads", "refs/remotes/origin"], { cwd: workspaceRoot, encoding: "utf8" });
-  if (r.status !== 0)
-    return new Set;
-  return new Set((r.stdout ?? "").split(`
-`).filter(Boolean).map((ref) => ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref.slice("refs/remotes/origin/".length)));
 };
-var productionBranchOf = (names) => names.has("main") ? "main" : names.has("master") ? "master" : "main";
-var detectBranchPolicy = (workspaceRoot) => {
-  const names = branchNames(workspaceRoot);
-  const develop = names.has("develop");
-  const main = names.has("main");
+function fastGit(root) {
+  if (DISCOVERY_ENV.some((name) => process.env[name]))
+    return null;
+  let dir = real(root);
+  let device = null;
+  for (;; ) {
+    let stat;
+    try {
+      stat = fs2.statSync(dir);
+    } catch {
+      return null;
+    }
+    if (device !== null && stat.dev !== device)
+      return { kind: "none" };
+    device = stat.dev;
+    const dotGit = path2.join(dir, ".git");
+    let entry = null;
+    try {
+      entry = fs2.statSync(dotGit);
+    } catch {}
+    let gitDir = null;
+    let top = null;
+    if (entry) {
+      top = dir;
+      if (entry.isDirectory())
+        gitDir = dotGit;
+      else if (entry.isFile()) {
+        let text = "";
+        try {
+          text = fs2.readFileSync(dotGit, "utf8");
+        } catch {
+          return null;
+        }
+        const match = /^gitdir: (.+)$/mu.exec(text);
+        if (!match)
+          return null;
+        gitDir = path2.resolve(dir, match[1].trim());
+      } else
+        return null;
+      if (!fs2.existsSync(path2.join(gitDir, "HEAD")))
+        return null;
+    } else if (isGitDir(dir))
+      gitDir = dir;
+    if (gitDir) {
+      let common = gitDir;
+      try {
+        common = path2.resolve(gitDir, fs2.readFileSync(path2.join(gitDir, "commondir"), "utf8").trim());
+      } catch {}
+      if (!fs2.existsSync(path2.join(common, "objects")))
+        return null;
+      return {
+        kind: "repo",
+        common: real(common),
+        gitDir: real(gitDir),
+        top: top === null ? null : real(top),
+        reftable: reftableRefs(common)
+      };
+    }
+    const parent = path2.dirname(dir);
+    if (parent === dir)
+      return { kind: "none" };
+    dir = parent;
+  }
+}
+function resolveStore(root) {
+  root = path2.resolve(root);
+  let directory = false;
+  try {
+    directory = fs2.statSync(root).isDirectory();
+  } catch {}
+  if (!directory)
+    return { dir: path2.join(root, ".workit"), shared: false, top: null };
+  const fast = fastGit(root);
+  if (fast?.kind === "none")
+    return { dir: path2.join(root, ".workit"), shared: false, top: null };
+  if (fast?.kind === "repo")
+    return {
+      dir: path2.join(fast.common, "workit"),
+      shared: true,
+      top: fast.top,
+      git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
+    };
+  const run = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+  const common = run.stdout.trim();
+  if (run.ok && common) {
+    const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
+    return {
+      dir: path2.join(real(path2.resolve(root, common)), "workit"),
+      shared: true,
+      top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
+    };
+  }
+  if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
+    return { dir: path2.join(root, ".workit"), shared: false, top: null };
+  return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
+`)[0] || "no output"}); fix the repository (git status should work here)`);
+}
+var rebasingBranch = (gitDir) => {
+  for (const state of ["rebase-merge", "rebase-apply"]) {
+    try {
+      const ref = fs2.readFileSync(path2.join(gitDir, state, "head-name"), "utf8").trim();
+      const match = /^refs\/heads\/(.+)$/u.exec(ref);
+      if (match)
+        return match[1];
+    } catch {}
+  }
+  return null;
+};
+function resolveTaskKey(root, location) {
+  if (!location.shared)
+    return { key: `dir-${shortHash(root)}`, kind: "dir", branch: null };
+  const branchKey = (name) => ({ key: name, kind: "branch", branch: name });
+  if (location.git && !location.git.reftable) {
+    let head = "";
+    try {
+      head = fs2.readFileSync(path2.join(location.git.gitDir, "HEAD"), "utf8").trim();
+    } catch {}
+    const ref = /^ref: refs\/heads\/(.+)$/u.exec(head);
+    if (ref && ref[1] !== ".invalid")
+      return branchKey(ref[1]);
+    if (/^[0-9a-f]{40,64}$/u.test(head)) {
+      const rebasing = rebasingBranch(location.git.gitDir);
+      if (rebasing)
+        return branchKey(rebasing);
+      return {
+        key: `detached-${shortHash(location.git.top ?? location.git.gitDir)}`,
+        kind: "detached",
+        branch: null
+      };
+    }
+  }
+  const branch = gitRun(root, ["symbolic-ref", "-q", "--short", "HEAD"]);
+  const name = branch.ok ? branch.stdout.trim() : "";
+  if (name && name !== ".invalid")
+    return branchKey(name);
+  const gitDir = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-dir"]);
+  if (gitDir.ok && gitDir.stdout.trim()) {
+    const rebasing = rebasingBranch(gitDir.stdout.trim());
+    if (rebasing)
+      return branchKey(rebasing);
+  }
+  const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
+  const worktree = top.ok && top.stdout.trim() ? top.stdout.trim() : root;
+  return { key: `detached-${shortHash(real(worktree))}`, kind: "detached", branch: null };
+}
+function checkoutRootOf(root, location) {
+  const resolved = path2.resolve(root);
+  let canonical = resolved;
+  try {
+    canonical = fs2.realpathSync(resolved);
+  } catch {
+    return resolved;
+  }
+  const found = location ?? resolveStore(canonical);
+  if (found instanceof Error || !found.shared || !found.top)
+    return canonical;
+  if (real(canonical) === found.top)
+    return canonical;
+  try {
+    return fs2.realpathSync(found.top);
+  } catch {
+    return canonical;
+  }
+}
+function branchRenames(location) {
+  if (!location.shared)
+    return [];
+  const files = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = fs2.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries)
+      if (entry.isDirectory())
+        walk(path2.join(dir, entry.name));
+      else
+        files.push(path2.join(dir, entry.name));
+  };
+  walk(path2.join(path2.dirname(location.dir), "logs", "refs", "heads"));
+  if (location.git)
+    files.push(path2.join(location.git.gitDir, "logs", "HEAD"));
+  const seen = new Set;
+  const renames = [];
+  for (const file of files) {
+    let text = "";
+    try {
+      text = fs2.readFileSync(file, "utf8");
+    } catch {
+      continue;
+    }
+    for (const match of text.matchAll(/ (\d+) [+-]\d{4}\tBranch: renamed refs\/heads\/(\S+) to refs\/heads\/(\S+)/gu)) {
+      const rename = { from: match[2], to: match[3], at: Number(match[1]) };
+      const id = `${rename.at}\x00${rename.from}\x00${rename.to}`;
+      if (seen.has(id))
+        continue;
+      seen.add(id);
+      renames.push(rename);
+    }
+  }
+  return renames.toSorted((left, right) => left.at - right.at);
+}
+function followRenames(key, boundAt, renames) {
+  let current = key;
+  let since = Math.floor(Date.parse(boundAt) / 1000);
+  for (const rename of renames)
+    if (rename.from === current && rename.at >= since) {
+      current = rename.to;
+      since = rename.at;
+    }
+  return current;
+}
+var checkoutSlug = (root) => {
+  let canonical = real(root);
+  if (process.platform === "win32")
+    canonical = canonical.toLowerCase();
+  const base = path2.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
+  return `${base}-${shortHash(canonical)}`;
+};
+
+// packages/workit-core/src/core/store-lock.ts
+var metadataLockSchema = object({
+  pid: number2().int().nonnegative().safe(),
+  processStart: string2().nullable(),
+  host: string2().min(1),
+  nonce: string2().min(1),
+  externalAction: literal(true).optional()
+}).strict();
+var FOREIGN_LOCK_TTL_MS = 10 * 60000;
+var UNREADABLE_LOCK_TTL_MS = 30000;
+var RECLAIM_GUARD_TTL_MS = 30000;
+var IN_PROCESS_LOCK_TIMEOUT_MS = 250;
+var defaultLockTimeoutMs = IN_PROCESS_LOCK_TIMEOUT_MS;
+var defaultLockTimeout = () => defaultLockTimeoutMs;
+var hostAwareLockTimeout = (cliMs) => defaultLockTimeoutMs > IN_PROCESS_LOCK_TIMEOUT_MS ? cliMs : IN_PROCESS_LOCK_TIMEOUT_MS;
+var parseMetadataLock = (raw) => {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw Object.assign(new Error("metadata lock is invalid"), { code: "metadata_lock_invalid" });
+  }
+  const parsed = metadataLockSchema.safeParse(value);
+  if (!parsed.success)
+    throw Object.assign(new Error("metadata lock is invalid"), { code: "metadata_lock_invalid" });
+  return parsed.data;
+};
+var parseMetadataLockOrNull = (raw) => {
+  try {
+    return parseMetadataLock(raw);
+  } catch {
+    return null;
+  }
+};
+var parseProcStatStart = (stat) => {
+  const close = stat.lastIndexOf(")");
+  if (close < 0)
+    return null;
+  return stat.slice(close + 1).trim().split(/\s+/)[19] ?? null;
+};
+var processStartOf = (pid) => {
+  if (process.platform === "linux") {
+    try {
+      return parseProcStatStart(fs3.readFileSync(`/proc/${pid}/stat`, "utf8"));
+    } catch {
+      return null;
+    }
+  }
+  if (process.platform === "darwin" || process.platform === "freebsd") {
+    try {
+      const run = spawnSync3("ps", ["-o", "lstart=", "-p", String(pid)], {
+        encoding: "utf8",
+        timeout: 1000
+      });
+      const value = run.status === 0 ? run.stdout.trim() : "";
+      return value || null;
+    } catch {
+      return null;
+    }
+  }
+  return null;
+};
+var readTrimmed = (file) => {
+  try {
+    return fs3.readFileSync(file, "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+};
+var cachedLockHost = null;
+var localLockHost = () => {
+  if (cachedLockHost !== null)
+    return cachedLockHost;
+  let pidns = null;
+  try {
+    pidns = /\[(\d+)\]/.exec(fs3.readlinkSync("/proc/self/ns/pid"))?.[1] ?? null;
+  } catch {}
+  const boot = readTrimmed("/proc/sys/kernel/random/boot_id");
+  cachedLockHost = pidns || boot ? `${hostname()}#${pidns ?? "?"}:${boot ?? "?"}` : hostname();
+  return cachedLockHost;
+};
+var pidAlive = (pid) => {
+  if (!Number.isSafeInteger(pid) || pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+};
+var TASK_STORE_LOCK = { reclaimUnverifiedAfterTtl: true };
+var classifyLockOwner = (payload, ageMs, localHost = localLockHost(), options = {}) => {
+  const lock = metadataLockSchema.safeParse(payload);
+  if (!lock.success)
+    return ageMs !== null && ageMs > UNREADABLE_LOCK_TTL_MS ? { state: "stale", reason: "unreadable lock left behind" } : { state: "unknown", reason: "lock is being written" };
+  const { pid, processStart, host } = lock.data;
+  const [lockName, lockSpace] = host.split("#");
+  const [localName, localSpace] = localHost.split("#");
+  if (lockSpace && localSpace && lockName === localName) {
+    const [lockNs, lockBoot] = lockSpace.split(":");
+    const [localNs, localBoot] = localSpace.split(":");
+    if (lockNs === localNs && lockNs !== "?" && lockBoot !== "?" && lockBoot !== localBoot)
+      return { state: "stale", reason: "lock was taken before this machine rebooted" };
+  }
+  if (host !== localHost)
+    return ageMs !== null && ageMs > FOREIGN_LOCK_TTL_MS ? { state: "stale", reason: `lock from ${host} is older than its TTL` } : { state: "unknown", reason: `lock is held from ${host}; its pid cannot be checked here` };
+  if (!pidAlive(pid))
+    return { state: "stale", reason: `pid ${pid} is not running` };
+  const currentStart = processStartOf(pid);
+  if (processStart !== null && currentStart !== null && processStart !== currentStart)
+    return { state: "stale", reason: `pid ${pid} now belongs to a different process` };
+  if (options.reclaimUnverifiedAfterTtl === true && (processStart === null || currentStart === null) && ageMs !== null && ageMs > FOREIGN_LOCK_TTL_MS)
+    return {
+      state: "stale",
+      reason: `pid ${pid} is running but the lock is older than its TTL and the pid's start time cannot be checked (reused pid)`
+    };
+  return { state: "live", reason: `held by running pid ${pid}` };
+};
+var ageOf = (file, nowMs) => {
+  try {
+    return nowMs - fs3.lstatSync(file).mtimeMs;
+  } catch {
+    return null;
+  }
+};
+var clearAbandonedReclaimGuard = (lockPath, nowMs = Date.now()) => {
+  const guard = `${lockPath}.reclaim`;
+  const age = ageOf(guard, nowMs);
+  if (age === null || age <= RECLAIM_GUARD_TTL_MS)
+    return false;
+  try {
+    fs3.rmdirSync(guard);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+// packages/workit-core/src/core/vcs-config.ts
+import fs4 from "node:fs";
+import path5 from "node:path";
+import { spawnSync as spawnSync7 } from "node:child_process";
+
+// packages/workit-core/src/core/config.ts
+import {
+  copyFileSync,
+  cpSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  writeFileSync
+} from "node:fs";
+import os2 from "node:os";
+import path3 from "node:path";
+
+// packages/workit-core/src/core/boundary.ts
+var EVENT = {
+  initialization: "initialization",
+  provenance: "provenance",
+  assets: "assets",
+  configurationSource: "configuration_source",
+  hooks: "hooks",
+  mcpConnection: "mcp_connection",
+  migration: "migration",
+  installSteps: "install_steps",
+  uncaughtFailure: "uncaught_failure",
+  toolsFailed: "tools_failed",
+  doctor: "doctor"
+};
+var errorDetail = (err) => {
+  if (err instanceof Error) {
+    return { error_name: err.name, error: err.message };
+  }
+  return { error_name: "unknown", error: String(err) };
+};
+
+// packages/workit-core/src/core/config.ts
+var diagnosticLogger;
+var PRESETS = {
+  gitflow: {
+    allowed: ["feature/*", "bugfix/*", "hotfix/*", "release/*"],
+    protected: ["main", "develop", "master", "prod", "production"]
+  },
+  "github-flow": { allowed: ["*"], protected: ["main"] },
+  "trunk-based": { allowed: ["*"], protected: ["main"] },
+  custom: { allowed: [], protected: [] }
+};
+var mergePreset = (preset, input = {}, current = {
+  branchPolicy: { preset, allowed: [], protected: [] }
+}) => {
+  const defs = PRESETS[preset];
+  return {
+    preset,
+    allowed: preset === "custom" ? input.allowed ?? current.branchPolicy.allowed : [...defs.allowed],
+    protected: preset === "custom" ? input.protectedNames ?? current.branchPolicy.protected : [...defs.protected]
+  };
+};
+var resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path3.join(process.env.XDG_CONFIG_HOME || path3.join(os2.homedir(), ".config"), "workit");
+var migratedDir = null;
+var migrationFailed = false;
+var ensureConfigDir = (dir = resolveConfigDir()) => {
+  if (migratedDir === dir)
+    return dir;
+  if (process.env.WORKFLOW_TOOLKIT_CONFIG || process.env.WORKFLOW_TOOLKIT_CONFIG_DIR) {
+    migratedDir = dir;
+    return dir;
+  }
+  const legacy = path3.join(process.env.XDG_CONFIG_HOME || path3.join(os2.homedir(), ".config"), "workflow-toolkit");
+  if (!existsSync(legacy)) {
+    migratedDir = dir;
+    return dir;
+  }
+  if (!migrationFailed && existsSync(dir)) {
+    migratedDir = dir;
+    return dir;
+  }
+  migrationFailed = false;
+  mkdirSync(dir, { recursive: true });
+  diagnosticLogger?.info(EVENT.migration, { from: legacy, to: dir });
+  for (const entry of readdirSync(legacy, { withFileTypes: true })) {
+    const src = path3.join(legacy, entry.name);
+    const dest = path3.join(dir, entry.name);
+    if (existsSync(dest))
+      continue;
+    try {
+      if (entry.isDirectory())
+        cpSync(src, dest, { recursive: true });
+      else if (entry.isFile())
+        copyFileSync(src, dest);
+    } catch (err) {
+      migrationFailed = true;
+      diagnosticLogger?.warn(EVENT.migration, { from: src, ok: false, ...errorDetail(err) });
+      console.warn(`[workit] config migration: a file could not be copied to ${dir}; it will be retried on the next run`);
+    }
+  }
+  if (!migrationFailed)
+    migratedDir = dir;
+  return dir;
+};
+var configDir = () => ensureConfigDir();
+var LOCALE_RE = /^[a-z]{2,3}(-(?:[A-Z]{2}|[0-9]{3}))?$/;
+var DEFAULTS = {
+  locale: "en",
+  localeOptions: ["en", "es-CL", "es-MX", "es-AR", "pt-BR"],
+  branchPolicy: {
+    preset: "gitflow",
+    allowed: [...PRESETS.gitflow.allowed],
+    protected: [...PRESETS.gitflow.protected]
+  },
+  commitPolicy: { preset: "conventional" }
+};
+var unchosenBranchPolicy = new WeakSet([DEFAULTS]);
+var readSafe = (p) => {
+  try {
+    return readFileSync(p, "utf8");
+  } catch {
+    return null;
+  }
+};
+var isConfigObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var parseConfigResult = (raw, file) => {
+  if (raw === null)
+    return { status: "missing", path: file };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { status: "malformed", path: file, error: `${file} is not valid JSON` };
+  }
+  if (!isConfigObject(parsed)) {
+    return { status: "malformed", path: file, error: `${file} is not a JSON object` };
+  }
+  const input = parsed;
+  const locale = LOCALE_RE.test(String(input.locale ?? "")) ? input.locale : DEFAULTS.locale;
+  const preset = Object.hasOwn(PRESETS, input.branchPolicy?.preset) ? input.branchPolicy?.preset : "gitflow";
+  const commitPreset = COMMIT_PRESETS.includes(String(input.commitPolicy?.preset ?? "")) ? input.commitPolicy?.preset : "conventional";
+  const config = {
+    locale,
+    localeOptions: Array.isArray(input.localeOptions) ? input.localeOptions : DEFAULTS.localeOptions,
+    branchPolicy: mergePreset(preset, {
+      allowed: Array.isArray(input.branchPolicy?.allowed) ? input.branchPolicy.allowed : undefined,
+      protectedNames: Array.isArray(input.branchPolicy?.protected) ? input.branchPolicy.protected : undefined
+    }, DEFAULTS),
+    commitPolicy: {
+      preset: commitPreset,
+      ...typeof input.commitPolicy?.pattern === "string" ? { pattern: input.commitPolicy.pattern } : {}
+    }
+  };
+  if (!Object.hasOwn(PRESETS, input.branchPolicy?.preset))
+    unchosenBranchPolicy.add(config);
+  return { status: "valid", path: file, config };
+};
+var readConfigTyped = (dir) => {
+  const file = path3.join(dir ?? configDir(), "config.json");
+  return parseConfigResult(readSafe(file), file);
+};
+var readConfig = () => {
+  const result = readConfigTyped();
+  if (result.status === "malformed")
+    throw new Error(result.error);
+  return result.config ?? DEFAULTS;
+};
+var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path3.join(configDir(), "vcs.json");
+var branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i");
+var resolveBranchPolicy = (config, workspace, repoPreset) => {
+  const wp = workspace?.branchPolicy ?? {};
+  const workspacePreset = Object.hasOwn(PRESETS, wp.preset);
+  const detected = !workspacePreset && unchosenBranchPolicy.has(config) ? repoPreset?.() ?? null : null;
+  const preset = workspacePreset ? wp.preset : detected ?? config.branchPolicy?.preset ?? "gitflow";
+  const merged = mergePreset(preset, {
+    allowed: wp.allowed,
+    protectedNames: wp.protected
+  }, config);
+  const allowed = merged.allowed.map(branchGlobPattern);
+  return {
+    preset,
+    allowed,
+    protected: new Set([...merged.protected, ...detected ? PRESETS.gitflow.protected : []].map((p) => p.toLowerCase())),
+    integration: wp.integration === "merge" ? "merge" : "pr",
+    defaultTargetBranch: preset === "github-flow" ? "main" : preset === "trunk-based" ? "master" : "develop",
+    detected: detected !== null
+  };
+};
+var COMMIT_PRESETS = [
+  "conventional",
+  "gitmoji",
+  "ticket-prefix",
+  "freeform",
+  "custom",
+  "auto"
+];
+var resolveCommitPolicy = (config, workspace) => {
+  const wp = workspace?.commitPolicy ?? {};
+  if (COMMIT_PRESETS.includes(String(wp.preset ?? ""))) {
+    return {
+      preset: wp.preset,
+      ...typeof wp.pattern === "string" ? { pattern: wp.pattern } : {}
+    };
+  }
+  return config.commitPolicy ?? { preset: "conventional" };
+};
+
+// packages/workit-core/src/core/workspaces.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { createHash as createHash4 } from "node:crypto";
+import { readFileSync as readFileSync2, realpathSync } from "node:fs";
+import path4 from "node:path";
+
+// packages/workit-core/src/core/branch-policy.ts
+import { spawnSync as spawnSync4 } from "node:child_process";
+var PREFIXES = {
+  feature: "feature/*",
+  bugfix: "bugfix/*",
+  release: "release/*",
+  hotfix: "hotfix/*"
+};
+var branchNames = (workspaceRoot) => {
+  const r = spawnSync4("git", ["for-each-ref", "--format=%(refname)", "refs/heads", "refs/remotes/origin"], { cwd: workspaceRoot, encoding: "utf8" });
+  if (r.status !== 0)
+    return new Set;
+  return new Set((r.stdout ?? "").split(`
+`).filter(Boolean).map((ref) => ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref.slice("refs/remotes/origin/".length)));
+};
+var productionBranchOf = (names) => names.has("main") ? "main" : names.has("master") ? "master" : "main";
+var detectBranchPolicy = (workspaceRoot) => {
+  const names = branchNames(workspaceRoot);
+  const develop = names.has("develop");
+  const main = names.has("main");
   const master = names.has("master");
   const root = main ? "main" : master ? "master" : null;
   if (develop) {
@@ -8842,6 +9266,15 @@ var repoBranchPreset = (workspaceRoot) => {
   const detected = detectBranchPolicy(workspaceRoot);
   return detected.developBranch || detected.allowed.length ? detected.preset : null;
 };
+var releaseTagPrefixOf = (workspaceRoot, policyPrefix) => {
+  if (typeof policyPrefix === "string")
+    return policyPrefix.trim();
+  const r = spawnSync4("git", ["config", "--get", "gitflow.prefix.versiontag"], {
+    cwd: workspaceRoot,
+    encoding: "utf8"
+  });
+  return r.status === 0 ? (r.stdout ?? "").trim() : "v";
+};
 
 // packages/workit-core/src/core/workspaces.ts
 var nonBlank = string2().refine((value) => value.trim().length > 0, "must not be blank");
@@ -8901,7 +9334,7 @@ var releaseTrackSchema = object({
       context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
     }
   }
-  if (track.versionSource?.kind === "package-json" && (path3.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+  if (track.versionSource?.kind === "package-json" && (path4.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
     context.addIssue({
       code: "custom",
       path: ["versionSource", "path"],
@@ -8962,7 +9395,7 @@ var workspacesFileSchema = object({ workspaces: array(workspaceConfigSchema).opt
     names.add(workspace.name);
   }
 });
-var workspacesRevision = (contents) => createHash3("sha256").update(contents ?? "<missing>").digest("hex");
+var workspacesRevision = (contents) => createHash4("sha256").update(contents ?? "<missing>").digest("hex");
 var validateWorkspacesDocument = (parsed, file) => {
   if (!isConfigObject(parsed)) {
     return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
@@ -9000,7 +9433,7 @@ var validateWorkspacesDocument = (parsed, file) => {
   };
 };
 var readWorkspacesResult = (dir = configDir()) => {
-  const file = path3.join(dir, "workspaces.json");
+  const file = path4.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync2(file, "utf8");
@@ -9099,7 +9532,7 @@ var mainCheckoutOf = (cwd) => {
   for (const name of ["GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_INDEX_FILE"])
     delete env[name];
   const git = (args) => {
-    const run = spawnSync3("git", args, {
+    const run = spawnSync5("git", args, {
       cwd,
       env,
       encoding: "utf8",
@@ -9111,9 +9544,9 @@ var mainCheckoutOf = (cwd) => {
   let main = null;
   const dirs = git(["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"]);
   const [gitDir, common] = (dirs ?? "").trim().split(/\r?\n/u);
-  if (gitDir && common && path3.resolve(gitDir) !== path3.resolve(common)) {
+  if (gitDir && common && path4.resolve(gitDir) !== path4.resolve(common)) {
     const listed = /^worktree (.+)$/mu.exec(git(["worktree", "list", "--porcelain"]) ?? "")?.[1];
-    main = listed?.trim() || (path3.basename(common) === ".git" ? path3.dirname(common) : common);
+    main = listed?.trim() || (path4.basename(common) === ".git" ? path4.dirname(common) : common);
   }
   mainCheckouts.set(cwd, main);
   return main;
@@ -9204,7 +9637,7 @@ var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
 var matchRuntimeWorkspace = (cwd, dir = configDir()) => {
-  const file = path3.join(dir, "workspaces.json");
+  const file = path4.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync2(file, "utf8");
@@ -9297,8 +9730,8 @@ function workspaceDefaultTarget(cwd, globalDefault) {
 }
 
 // packages/workit-core/src/core/release-tracks.ts
-import { createHash as createHash4 } from "node:crypto";
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { createHash as createHash5 } from "node:crypto";
+import { spawnSync as spawnSync6 } from "node:child_process";
 class ReleaseTrackError extends Error {
 }
 var KNOWN_FIELDS = new Set([
@@ -9564,603 +9997,323 @@ function resolveReleaseTrack(input) {
     return fallback(`no track branch could be compared with ${branch} (fetch the track branches)`);
   const ancestry = new Map;
   const descends = (older, newer) => {
-    if (older === newer)
-      return false;
-    const key = `${older}>${newer}`;
-    if (!ancestry.has(key))
-      ancestry.set(key, input.probe.isAncestor(older, newer));
-    return ancestry.get(key);
-  };
-  const winners = forks.filter((fork) => forks.every((other) => other.track === fork.track || descends(other.sha, fork.sha)));
-  const winningTracks = [...new Set(winners.map((fork) => fork.track))];
-  if (winningTracks.length === 1 && forks.some((fork) => fork.track !== winningTracks[0])) {
-    const win = winners[0];
-    return done(win.track, "ancestry", `${branch} forked from ${win.ref} at ${win.sha.slice(0, 12)}, after every other line's fork point`);
-  }
-  if (winningTracks.length === 1)
-    return fallback(`only ${label(winningTracks[0])} could be compared with ${branch}`);
-  const newest = forks.filter((fork) => !forks.some((other) => descends(fork.sha, other.sha)));
-  return fallback(`${branch} has the same or unrelated fork points with ${[...new Set(newest.map((fork) => `${fork.ref} (${fork.track.name === IMPLICIT ? "workspace default" : fork.track.name})`))].join(" and ")}`);
-}
-var git2 = (cwd, args) => {
-  const run = spawnSync4("git", args, {
-    cwd,
-    encoding: "utf8",
-    timeout: 20000,
-    windowsHide: true,
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  return run.status === 0 ? (run.stdout ?? "").trim() : null;
-};
-var recordedBaseKey = (branch) => `branch.${branch}.workitBase`;
-var escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
-var reflog = (cwd, ref) => (git2(cwd, ["log", "-g", "--date=unix", "--format=%H%x09%gd%x09%gs", ref, "--"]) ?? "").split(`
-`).map((line) => {
-  const [sha = "", selector = "", ...subject] = line.split("\t");
-  return {
-    sha,
-    time: Number(/@\{(\d+)\}$/u.exec(selector)?.[1] ?? Number.NaN),
-    subject: subject.join("\t")
-  };
-}).filter((entry) => entry.sha && Number.isFinite(entry.time));
-function gitTrackProbe(cwd) {
-  let remote;
-  let remotes;
-  const tip = (branch) => {
-    remote ??= pushRemoteName(cwd) ?? "origin";
-    return resolveRef(cwd, `refs/remotes/${remote}/${branch}`) ?? resolveRef(cwd, `refs/heads/${branch}`);
-  };
-  return {
-    remotes: () => remotes ??= remoteNames(cwd),
-    recordedBase: (branch) => git2(cwd, ["config", "--get", recordedBaseKey(branch)]) || null,
-    createdFrom: (branch) => {
-      const log = git2(cwd, ["reflog", "show", "--format=%gs", `refs/heads/${branch}`, "--"]);
-      const oldest = log?.split(`
-`).findLast(Boolean) ?? "";
-      const match = /^branch: Created from (\S+)$/u.exec(oldest);
-      return match && match[1] !== "HEAD" ? match[1] : null;
-    },
-    checkedOutFrom: (branch) => {
-      const own = reflog(cwd, `refs/heads/${branch}`);
-      const created = own.at(-1);
-      if (!created || created.subject !== "branch: Created from HEAD")
-        return null;
-      const pattern = new RegExp(`^checkout: moving from (\\S+) to ${escapeRegExp(branch)}$`, "u");
-      const entry = reflog(cwd, "HEAD").findLast((item) => item.time >= created.time && item.sha === created.sha && pattern.test(item.subject));
-      return entry ? pattern.exec(entry.subject)?.[1] ?? null : null;
-    },
-    mergeBase: (branch, trackBranch) => {
-      const base = tip(trackBranch);
-      return base && resolveRef(cwd, `refs/heads/${branch}`) ? mergeBase(cwd, base, `refs/heads/${branch}`) : null;
-    },
-    isAncestor: (ancestor, descendant) => git2(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]) !== null
-  };
-}
-function workspaceReleaseTracks(cwd) {
-  const raw = resolveRuntimeReleaseTracks(cwd);
-  return { workspace: raw?.workspace ?? null, ...readReleaseTracks(raw?.releaseTracks) };
-}
-var memo2 = new Map;
-var MEMO_LIMIT = 64;
-function resolveTrackFor(cwd, options) {
-  const read = workspaceReleaseTracks(cwd);
-  if (read.error)
-    return { status: "invalid", error: read.error, issues: read.issues };
-  if (read.tracks.length === 0 && !options.track?.trim())
-    return { status: "none", issues: read.issues };
-  const branch = options.branch === undefined ? currentBranch(cwd) : options.branch;
-  const envRequested = process.env.WORKFLOW_RELEASE_TRACK?.trim() || null;
-  const input = {
-    tracks: read.tracks,
-    requested: options.track ?? null,
-    envRequested,
-    branch,
-    defaultBranch: options.defaultBranch,
-    issues: read.issues
-  };
-  let key = null;
-  if (!options.probe) {
-    const refs = git2(cwd, [
-      "for-each-ref",
-      "--format=%(refname) %(objectname)",
-      "refs/heads",
-      "refs/remotes"
-    ]) ?? "";
-    const head = git2(cwd, ["reflog", "show", "-n", "1", "--format=%H %gs", "HEAD", "--"]) ?? "";
-    const own = branch ? [
-      git2(cwd, [
-        "log",
-        "-g",
-        "-n",
-        "1",
-        "--date=unix",
-        "--format=%H %gd %gs",
-        `refs/heads/${branch}`,
-        "--"
-      ]) ?? "",
-      git2(cwd, ["config", "--get", recordedBaseKey(branch)]) ?? ""
-    ] : [];
-    key = createHash4("sha256").update(JSON.stringify({ cwd, input, refs, head, own })).digest("hex");
-    const hit = memo2.get(key);
-    if (hit)
-      return hit;
-  }
-  const resolution = resolveReleaseTrack({ ...input, probe: options.probe ?? gitTrackProbe(cwd) });
-  if (key) {
-    if (memo2.size >= MEMO_LIMIT)
-      memo2.delete(memo2.keys().next().value);
-    memo2.set(key, resolution);
-  }
-  return resolution;
-}
-
-// packages/workit-core/src/core/vcs-config.ts
-var workspacesPath = () => path4.join(configDir(), "workspaces.json");
-var vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
-var remoteProvider = (cwd) => {
-  const r = spawnSync5("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
-  if (r.status !== 0)
-    return null;
-  const url = (r.stdout ?? "").trim();
-  if (/github\.com[:/]/.test(url))
-    return "github";
-  if (/gitlab\.com[:/]/.test(url))
-    return "gitlab";
-  return null;
-};
-var readVcsConfig = () => {
-  const file = vcsConfigPath();
-  let raw;
-  try {
-    raw = fs2.readFileSync(file, "utf8");
-  } catch {
-    return { status: "missing", path: file, config: {} };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return { status: "malformed", path: file, config: {}, error: `${file} is not valid JSON` };
-  }
-  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-    return { status: "valid", path: file, config: parsed };
-  }
-  return { status: "malformed", path: file, config: {}, error: `${file} is not a JSON object` };
-};
-var trackSummary = (resolution) => resolution.status === "resolved" ? {
-  name: resolution.track?.name ?? null,
-  source: resolution.source,
-  detail: resolution.detail,
-  warnings: resolution.warnings,
-  track: resolution.track,
-  tracks: resolution.tracks,
-  blocking: resolution.blocking
-} : null;
-function vcsConfig(mode, cwd, options = {}) {
-  const ws = resolveRuntimeWorkspaceVcs(vcsCwd(cwd));
-  const wsVcs = ws?.vcs ?? {};
-  const wsYt = ws?.youtrack ?? {};
-  const wsIssues = ws?.issues ?? {};
-  const { status: cfgStatus, path: cfgPath, config: cfg, error: cfgError } = readVcsConfig();
-  const root = vcsCwd(cwd);
-  const determinateRoot = cwd !== undefined || process.env.WORKFLOW_WORKSPACE_ROOT !== undefined;
-  const rawProvider = wsVcs.provider ?? (determinateRoot ? remoteProvider(root) : null) ?? cfg.provider ?? null;
-  const provider = rawProvider === null || rawProvider === undefined ? null : String(rawProvider).toLowerCase() || null;
-  const workspaceDefault = workspaceDefaultTarget(root, cfg.defaultTargetBranch);
-  const linkIssues = typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
-  const youtrackBaseUrl = typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
-  let issuesProvider = null;
-  let linkOnPr = null;
-  if (provider === "github" && typeof wsIssues.provider === "string" && wsIssues.provider.toLowerCase() === "github") {
-    issuesProvider = "github";
-    linkOnPr = typeof wsIssues.link_on_pr === "boolean" ? wsIssues.link_on_pr : null;
-  }
-  if (mode === "resolve") {
-    if (cfgStatus === "malformed")
-      return { ok: false, error: cfgError, configPath: cfgPath };
-    const trackResolution = resolveTrackFor(root, {
-      track: options.track,
-      ...options.branch !== undefined ? { branch: options.branch } : {},
-      defaultBranch: workspaceDefault
-    });
-    if (trackResolution.status === "invalid")
-      return { ok: false, error: trackResolution.error, configPath: workspacesPath() };
-    const releaseTrack = trackSummary(trackResolution);
-    const defaultTarget = releaseTrack?.track?.pullRequestTarget ?? workspaceDefault;
-    const baseBranch = releaseTrack?.track?.baseBranch ?? defaultTarget;
-    return {
-      ok: true,
-      workspace_name: ws?.name ?? null,
-      provider,
-      defaultTargetBranch: defaultTarget,
-      workspaceDefaultTargetBranch: workspaceDefault,
-      baseBranch,
-      releaseTrack,
-      link_issues: linkIssues,
-      youtrack_base_url: youtrackBaseUrl,
-      issues_provider: issuesProvider,
-      link_on_pr: linkOnPr
-    };
-  }
-  if (cfgStatus === "malformed") {
-    return { ok: false, error: cfgError, configPath: cfgPath };
-  }
-  if (cfgStatus === "missing" && provider === null)
-    return { ok: false, error: `vcs.json is missing: ${cfgPath}`, configPath: cfgPath };
-  if (provider === null) {
-    return {
-      ok: false,
-      error: `no vcs provider configured (set vcs.provider in ${cfgPath}, match a workspace entry, or run inside a checkout with a recognized origin remote)`,
-      configPath: cfgPath
-    };
-  }
-  const prov = cfg[provider] ?? {};
-  const out = {
-    ok: true,
-    configPath: path4.resolve(cfgPath),
-    provider,
-    defaultTargetBranch: workspaceDefault,
-    pr: cfg.pr ?? {},
-    workspace_name: ws?.name ?? null,
-    link_issues: linkIssues,
-    youtrack_base_url: youtrackBaseUrl,
-    issues_provider: issuesProvider,
-    link_on_pr: linkOnPr
+    if (older === newer)
+      return false;
+    const key = `${older}>${newer}`;
+    if (!ancestry.has(key))
+      ancestry.set(key, input.probe.isAncestor(older, newer));
+    return ancestry.get(key);
   };
-  if (provider === "gitlab") {
-    out.gitlab = {
-      host: prov.host ?? "gitlab.com",
-      apiUrl: prov.apiUrl ?? "https://gitlab.com/api/v4"
-    };
-  } else if (provider === "github") {
-    out.github = { host: prov.host ?? "github.com" };
+  const winners = forks.filter((fork) => forks.every((other) => other.track === fork.track || descends(other.sha, fork.sha)));
+  const winningTracks = [...new Set(winners.map((fork) => fork.track))];
+  if (winningTracks.length === 1 && forks.some((fork) => fork.track !== winningTracks[0])) {
+    const win = winners[0];
+    return done(win.track, "ancestry", `${branch} forked from ${win.ref} at ${win.sha.slice(0, 12)}, after every other line's fork point`);
   }
-  return out;
+  if (winningTracks.length === 1)
+    return fallback(`only ${label(winningTracks[0])} could be compared with ${branch}`);
+  const newest = forks.filter((fork) => !forks.some((other) => descends(fork.sha, other.sha)));
+  return fallback(`${branch} has the same or unrelated fork points with ${[...new Set(newest.map((fork) => `${fork.ref} (${fork.track.name === IMPLICIT ? "workspace default" : fork.track.name})`))].join(" and ")}`);
 }
-
-// packages/workit-core/src/host-session.ts
-import { createHash as createHash6 } from "node:crypto";
-import fs4 from "node:fs";
-import path7 from "node:path";
-
-// packages/workit-core/src/core/logger.ts
-import os3 from "node:os";
-import path5 from "node:path";
-var SENSITIVE_WORDS = new Set([
-  "token",
-  "secret",
-  "password",
-  "passwd",
-  "authorization",
-  "credential",
-  "credentials",
-  "cookie",
-  "api",
-  "apikey",
-  "apitoken",
-  "accesstoken",
-  "clientsecret",
-  "refreshtoken",
-  "key",
-  "bearer",
-  "prompt",
-  "message",
-  "messages",
-  "content",
-  "body",
-  "args",
-  "argument",
-  "result",
-  "results",
-  "output",
-  "issue",
-  "description",
-  "summary",
-  "payload",
-  "script",
-  "command",
-  "text",
-  "query"
-]);
-var STACK_WORDS = new Set(["stack", "stacktrace", "trace"]);
-var escapeRegExp2 = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-var resolveStateDir = () => {
-  const override = process.env.WORKFLOW_TOOLKIT_STATE;
-  if (override)
-    return override;
-  const home = os3.homedir();
-  if (process.env.XDG_STATE_HOME)
-    return path5.join(process.env.XDG_STATE_HOME, "workit");
-  switch (os3.platform()) {
-    case "darwin":
-      return path5.join(home, "Library", "Application Support", "workit");
-    case "win32":
-      return path5.join(process.env.LOCALAPPDATA ?? path5.join(home, "AppData", "Local"), "workit");
-    default:
-      return path5.join(process.env.HOME ?? home, ".local", "state", "workit");
-  }
-};
-var homePattern = new RegExp(`${escapeRegExp2(os3.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
-
-// packages/workit-core/src/store/paths.ts
-import { spawnSync as spawnSync6 } from "node:child_process";
-import { createHash as createHash5 } from "node:crypto";
-import fs3 from "node:fs";
-import path6 from "node:path";
-var NOT_A_REPO = /not a git repository \(or any (of the parent directories|parent up to)/u;
-var gitRun = (cwd, args) => {
+var git2 = (cwd, args) => {
   const run = spawnSync6("git", args, {
     cwd,
     encoding: "utf8",
     timeout: 20000,
-    killSignal: "SIGKILL",
     windowsHide: true,
-    env: {
-      ...process.env,
-      GIT_TERMINAL_PROMPT: "0",
-      GIT_OPTIONAL_LOCKS: "0",
-      LC_ALL: "C",
-      LANGUAGE: "C"
-    }
+    stdio: ["ignore", "pipe", "ignore"]
   });
-  const error = run.error;
+  return run.status === 0 ? (run.stdout ?? "").trim() : null;
+};
+var recordedBaseKey = (branch) => `branch.${branch}.workitBase`;
+var escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+var reflog = (cwd, ref) => (git2(cwd, ["log", "-g", "--date=unix", "--format=%H%x09%gd%x09%gs", ref, "--"]) ?? "").split(`
+`).map((line) => {
+  const [sha = "", selector = "", ...subject] = line.split("\t");
   return {
-    ok: run.status === 0,
-    stdout: run.stdout ?? "",
-    stderr: error ? String(error.message) : run.stderr ?? "",
-    missing: error?.code === "ENOENT"
+    sha,
+    time: Number(/@\{(\d+)\}$/u.exec(selector)?.[1] ?? Number.NaN),
+    subject: subject.join("\t")
   };
-};
-var shortHash = (value) => createHash5("sha256").update(value).digest("hex").slice(0, 12);
-var real = (file) => {
-  try {
-    return fs3.realpathSync.native(file);
-  } catch {
-    return file;
-  }
-};
-var DISCOVERY_ENV = [
-  "GIT_DIR",
-  "GIT_COMMON_DIR",
-  "GIT_WORK_TREE",
-  "GIT_CEILING_DIRECTORIES",
-  "GIT_DISCOVERY_ACROSS_FILESYSTEM"
-];
-var isGitDir = (dir) => {
-  try {
-    return fs3.statSync(path6.join(dir, "HEAD")).isFile() && fs3.statSync(path6.join(dir, "objects")).isDirectory() && fs3.statSync(path6.join(dir, "refs")).isDirectory();
-  } catch {
-    return false;
-  }
-};
-var reftableRefs = (common) => {
-  try {
-    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs3.readFileSync(path6.join(common, "config"), "utf8"));
-  } catch {
-    return false;
-  }
-};
-function fastGit(root) {
-  if (DISCOVERY_ENV.some((name) => process.env[name]))
-    return null;
-  let dir = real(root);
-  let device = null;
-  for (;; ) {
-    let stat;
-    try {
-      stat = fs3.statSync(dir);
-    } catch {
-      return null;
-    }
-    if (device !== null && stat.dev !== device)
-      return { kind: "none" };
-    device = stat.dev;
-    const dotGit = path6.join(dir, ".git");
-    let entry = null;
-    try {
-      entry = fs3.statSync(dotGit);
-    } catch {}
-    let gitDir = null;
-    let top = null;
-    if (entry) {
-      top = dir;
-      if (entry.isDirectory())
-        gitDir = dotGit;
-      else if (entry.isFile()) {
-        let text = "";
-        try {
-          text = fs3.readFileSync(dotGit, "utf8");
-        } catch {
-          return null;
-        }
-        const match = /^gitdir: (.+)$/mu.exec(text);
-        if (!match)
-          return null;
-        gitDir = path6.resolve(dir, match[1].trim());
-      } else
-        return null;
-      if (!fs3.existsSync(path6.join(gitDir, "HEAD")))
-        return null;
-    } else if (isGitDir(dir))
-      gitDir = dir;
-    if (gitDir) {
-      let common = gitDir;
-      try {
-        common = path6.resolve(gitDir, fs3.readFileSync(path6.join(gitDir, "commondir"), "utf8").trim());
-      } catch {}
-      if (!fs3.existsSync(path6.join(common, "objects")))
+}).filter((entry) => entry.sha && Number.isFinite(entry.time));
+function gitTrackProbe(cwd) {
+  let remote;
+  let remotes;
+  const tip = (branch) => {
+    remote ??= pushRemoteName(cwd) ?? "origin";
+    return resolveRef(cwd, `refs/remotes/${remote}/${branch}`) ?? resolveRef(cwd, `refs/heads/${branch}`);
+  };
+  return {
+    remotes: () => remotes ??= remoteNames(cwd),
+    recordedBase: (branch) => git2(cwd, ["config", "--get", recordedBaseKey(branch)]) || null,
+    createdFrom: (branch) => {
+      const log = git2(cwd, ["reflog", "show", "--format=%gs", `refs/heads/${branch}`, "--"]);
+      const oldest = log?.split(`
+`).findLast(Boolean) ?? "";
+      const match = /^branch: Created from (\S+)$/u.exec(oldest);
+      return match && match[1] !== "HEAD" ? match[1] : null;
+    },
+    checkedOutFrom: (branch) => {
+      const own = reflog(cwd, `refs/heads/${branch}`);
+      const created = own.at(-1);
+      if (!created || created.subject !== "branch: Created from HEAD")
         return null;
-      return {
-        kind: "repo",
-        common: real(common),
-        gitDir: real(gitDir),
-        top: top === null ? null : real(top),
-        reftable: reftableRefs(common)
-      };
-    }
-    const parent = path6.dirname(dir);
-    if (parent === dir)
-      return { kind: "none" };
-    dir = parent;
+      const pattern = new RegExp(`^checkout: moving from (\\S+) to ${escapeRegExp(branch)}$`, "u");
+      const entry = reflog(cwd, "HEAD").findLast((item) => item.time >= created.time && item.sha === created.sha && pattern.test(item.subject));
+      return entry ? pattern.exec(entry.subject)?.[1] ?? null : null;
+    },
+    mergeBase: (branch, trackBranch) => {
+      const base = tip(trackBranch);
+      return base && resolveRef(cwd, `refs/heads/${branch}`) ? mergeBase(cwd, base, `refs/heads/${branch}`) : null;
+    },
+    isAncestor: (ancestor, descendant) => git2(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]) !== null
+  };
+}
+function workspaceReleaseTracks(cwd) {
+  const raw = resolveRuntimeReleaseTracks(cwd);
+  return { workspace: raw?.workspace ?? null, ...readReleaseTracks(raw?.releaseTracks) };
+}
+var memo2 = new Map;
+var MEMO_LIMIT = 64;
+function resolveTrackFor(cwd, options) {
+  const read = workspaceReleaseTracks(cwd);
+  if (read.error)
+    return { status: "invalid", error: read.error, issues: read.issues };
+  if (read.tracks.length === 0 && !options.track?.trim())
+    return { status: "none", issues: read.issues };
+  const branch = options.branch === undefined ? currentBranch(cwd) : options.branch;
+  const envRequested = process.env.WORKFLOW_RELEASE_TRACK?.trim() || null;
+  const input = {
+    tracks: read.tracks,
+    requested: options.track ?? null,
+    envRequested,
+    branch,
+    defaultBranch: options.defaultBranch,
+    issues: read.issues
+  };
+  let key = null;
+  if (!options.probe) {
+    const refs = git2(cwd, [
+      "for-each-ref",
+      "--format=%(refname) %(objectname)",
+      "refs/heads",
+      "refs/remotes"
+    ]) ?? "";
+    const head = git2(cwd, ["reflog", "show", "-n", "1", "--format=%H %gs", "HEAD", "--"]) ?? "";
+    const own = branch ? [
+      git2(cwd, [
+        "log",
+        "-g",
+        "-n",
+        "1",
+        "--date=unix",
+        "--format=%H %gd %gs",
+        `refs/heads/${branch}`,
+        "--"
+      ]) ?? "",
+      git2(cwd, ["config", "--get", recordedBaseKey(branch)]) ?? ""
+    ] : [];
+    key = createHash5("sha256").update(JSON.stringify({ cwd, input, refs, head, own })).digest("hex");
+    const hit = memo2.get(key);
+    if (hit)
+      return hit;
   }
-}
-function resolveStore(root) {
-  root = path6.resolve(root);
-  let directory = false;
-  try {
-    directory = fs3.statSync(root).isDirectory();
-  } catch {}
-  if (!directory)
-    return { dir: path6.join(root, ".workit"), shared: false, top: null };
-  const fast = fastGit(root);
-  if (fast?.kind === "none")
-    return { dir: path6.join(root, ".workit"), shared: false, top: null };
-  if (fast?.kind === "repo")
-    return {
-      dir: path6.join(fast.common, "workit"),
-      shared: true,
-      top: fast.top,
-      git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
-    };
-  const run = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
-  const common = run.stdout.trim();
-  if (run.ok && common) {
-    const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
-    return {
-      dir: path6.join(real(path6.resolve(root, common)), "workit"),
-      shared: true,
-      top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
-    };
+  const resolution = resolveReleaseTrack({ ...input, probe: options.probe ?? gitTrackProbe(cwd) });
+  if (key) {
+    if (memo2.size >= MEMO_LIMIT)
+      memo2.delete(memo2.keys().next().value);
+    memo2.set(key, resolution);
   }
-  if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
-    return { dir: path6.join(root, ".workit"), shared: false, top: null };
-  return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
-`)[0] || "no output"}); fix the repository (git status should work here)`);
+  return resolution;
 }
-var rebasingBranch = (gitDir) => {
-  for (const state of ["rebase-merge", "rebase-apply"]) {
-    try {
-      const ref = fs3.readFileSync(path6.join(gitDir, state, "head-name"), "utf8").trim();
-      const match = /^refs\/heads\/(.+)$/u.exec(ref);
-      if (match)
-        return match[1];
-    } catch {}
-  }
+
+// packages/workit-core/src/core/vcs-config.ts
+var workspacesPath = () => path5.join(configDir(), "workspaces.json");
+var vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
+var remoteProvider = (cwd) => {
+  const r = spawnSync7("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
+  if (r.status !== 0)
+    return null;
+  const url = (r.stdout ?? "").trim();
+  if (/github\.com[:/]/.test(url))
+    return "github";
+  if (/gitlab\.com[:/]/.test(url))
+    return "gitlab";
   return null;
 };
-function resolveTaskKey(root, location) {
-  if (!location.shared)
-    return { key: `dir-${shortHash(root)}`, kind: "dir", branch: null };
-  const branchKey = (name) => ({ key: name, kind: "branch", branch: name });
-  if (location.git && !location.git.reftable) {
-    let head = "";
-    try {
-      head = fs3.readFileSync(path6.join(location.git.gitDir, "HEAD"), "utf8").trim();
-    } catch {}
-    const ref = /^ref: refs\/heads\/(.+)$/u.exec(head);
-    if (ref && ref[1] !== ".invalid")
-      return branchKey(ref[1]);
-    if (/^[0-9a-f]{40,64}$/u.test(head)) {
-      const rebasing = rebasingBranch(location.git.gitDir);
-      if (rebasing)
-        return branchKey(rebasing);
-      return {
-        key: `detached-${shortHash(location.git.top ?? location.git.gitDir)}`,
-        kind: "detached",
-        branch: null
-      };
-    }
-  }
-  const branch = gitRun(root, ["symbolic-ref", "-q", "--short", "HEAD"]);
-  const name = branch.ok ? branch.stdout.trim() : "";
-  if (name && name !== ".invalid")
-    return branchKey(name);
-  const gitDir = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-dir"]);
-  if (gitDir.ok && gitDir.stdout.trim()) {
-    const rebasing = rebasingBranch(gitDir.stdout.trim());
-    if (rebasing)
-      return branchKey(rebasing);
-  }
-  const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
-  const worktree = top.ok && top.stdout.trim() ? top.stdout.trim() : root;
-  return { key: `detached-${shortHash(real(worktree))}`, kind: "detached", branch: null };
-}
-function checkoutRootOf(root, location) {
-  const resolved = path6.resolve(root);
-  let canonical = resolved;
+var readVcsConfig = () => {
+  const file = vcsConfigPath();
+  let raw;
   try {
-    canonical = fs3.realpathSync(resolved);
+    raw = fs4.readFileSync(file, "utf8");
   } catch {
-    return resolved;
+    return { status: "missing", path: file, config: {} };
   }
-  const found = location ?? resolveStore(canonical);
-  if (found instanceof Error || !found.shared || !found.top)
-    return canonical;
-  if (real(canonical) === found.top)
-    return canonical;
+  let parsed;
   try {
-    return fs3.realpathSync(found.top);
+    parsed = JSON.parse(raw);
   } catch {
-    return canonical;
+    return { status: "malformed", path: file, config: {}, error: `${file} is not valid JSON` };
   }
-}
-function branchRenames(location) {
-  if (!location.shared)
-    return [];
-  const files = [];
-  const walk = (dir) => {
-    let entries;
-    try {
-      entries = fs3.readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries)
-      if (entry.isDirectory())
-        walk(path6.join(dir, entry.name));
-      else
-        files.push(path6.join(dir, entry.name));
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+    return { status: "valid", path: file, config: parsed };
+  }
+  return { status: "malformed", path: file, config: {}, error: `${file} is not a JSON object` };
+};
+var trackSummary = (resolution) => resolution.status === "resolved" ? {
+  name: resolution.track?.name ?? null,
+  source: resolution.source,
+  detail: resolution.detail,
+  warnings: resolution.warnings,
+  track: resolution.track,
+  tracks: resolution.tracks,
+  blocking: resolution.blocking
+} : null;
+function vcsConfig(mode, cwd, options = {}) {
+  const ws = resolveRuntimeWorkspaceVcs(vcsCwd(cwd));
+  const wsVcs = ws?.vcs ?? {};
+  const wsYt = ws?.youtrack ?? {};
+  const wsIssues = ws?.issues ?? {};
+  const { status: cfgStatus, path: cfgPath, config: cfg, error: cfgError } = readVcsConfig();
+  const root = vcsCwd(cwd);
+  const determinateRoot = cwd !== undefined || process.env.WORKFLOW_WORKSPACE_ROOT !== undefined;
+  const rawProvider = wsVcs.provider ?? (determinateRoot ? remoteProvider(root) : null) ?? cfg.provider ?? null;
+  const provider = rawProvider === null || rawProvider === undefined ? null : String(rawProvider).toLowerCase() || null;
+  const workspaceDefault = workspaceDefaultTarget(root, cfg.defaultTargetBranch);
+  const linkIssues = typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
+  const youtrackBaseUrl = typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
+  let issuesProvider = null;
+  let linkOnPr = null;
+  if (provider === "github" && typeof wsIssues.provider === "string" && wsIssues.provider.toLowerCase() === "github") {
+    issuesProvider = "github";
+    linkOnPr = typeof wsIssues.link_on_pr === "boolean" ? wsIssues.link_on_pr : null;
+  }
+  if (mode === "resolve") {
+    if (cfgStatus === "malformed")
+      return { ok: false, error: cfgError, configPath: cfgPath };
+    const trackResolution = resolveTrackFor(root, {
+      track: options.track,
+      ...options.branch !== undefined ? { branch: options.branch } : {},
+      defaultBranch: workspaceDefault
+    });
+    if (trackResolution.status === "invalid")
+      return { ok: false, error: trackResolution.error, configPath: workspacesPath() };
+    const releaseTrack = trackSummary(trackResolution);
+    const defaultTarget = releaseTrack?.track?.pullRequestTarget ?? workspaceDefault;
+    const baseBranch = releaseTrack?.track?.baseBranch ?? defaultTarget;
+    return {
+      ok: true,
+      workspace_name: ws?.name ?? null,
+      provider,
+      defaultTargetBranch: defaultTarget,
+      workspaceDefaultTargetBranch: workspaceDefault,
+      baseBranch,
+      releaseTrack,
+      link_issues: linkIssues,
+      youtrack_base_url: youtrackBaseUrl,
+      issues_provider: issuesProvider,
+      link_on_pr: linkOnPr
+    };
+  }
+  if (cfgStatus === "malformed") {
+    return { ok: false, error: cfgError, configPath: cfgPath };
+  }
+  if (cfgStatus === "missing" && provider === null)
+    return { ok: false, error: `vcs.json is missing: ${cfgPath}`, configPath: cfgPath };
+  if (provider === null) {
+    return {
+      ok: false,
+      error: `no vcs provider configured (set vcs.provider in ${cfgPath}, match a workspace entry, or run inside a checkout with a recognized origin remote)`,
+      configPath: cfgPath
+    };
+  }
+  const prov = cfg[provider] ?? {};
+  const out = {
+    ok: true,
+    configPath: path5.resolve(cfgPath),
+    provider,
+    defaultTargetBranch: workspaceDefault,
+    pr: cfg.pr ?? {},
+    workspace_name: ws?.name ?? null,
+    link_issues: linkIssues,
+    youtrack_base_url: youtrackBaseUrl,
+    issues_provider: issuesProvider,
+    link_on_pr: linkOnPr
   };
-  walk(path6.join(path6.dirname(location.dir), "logs", "refs", "heads"));
-  if (location.git)
-    files.push(path6.join(location.git.gitDir, "logs", "HEAD"));
-  const seen = new Set;
-  const renames = [];
-  for (const file of files) {
-    let text = "";
-    try {
-      text = fs3.readFileSync(file, "utf8");
-    } catch {
-      continue;
-    }
-    for (const match of text.matchAll(/ (\d+) [+-]\d{4}\tBranch: renamed refs\/heads\/(\S+) to refs\/heads\/(\S+)/gu)) {
-      const rename = { from: match[2], to: match[3], at: Number(match[1]) };
-      const id = `${rename.at}\x00${rename.from}\x00${rename.to}`;
-      if (seen.has(id))
-        continue;
-      seen.add(id);
-      renames.push(rename);
-    }
+  if (provider === "gitlab") {
+    out.gitlab = {
+      host: prov.host ?? "gitlab.com",
+      apiUrl: prov.apiUrl ?? "https://gitlab.com/api/v4"
+    };
+  } else if (provider === "github") {
+    out.github = { host: prov.host ?? "github.com" };
+  }
+  return out;
+}
+
+// packages/workit-core/src/host-session.ts
+import { createHash as createHash6, randomBytes, timingSafeEqual } from "node:crypto";
+import fs5 from "node:fs";
+import path7 from "node:path";
+
+// packages/workit-core/src/core/logger.ts
+import os3 from "node:os";
+import path6 from "node:path";
+var SENSITIVE_WORDS = new Set([
+  "token",
+  "secret",
+  "password",
+  "passwd",
+  "authorization",
+  "credential",
+  "credentials",
+  "cookie",
+  "api",
+  "apikey",
+  "apitoken",
+  "accesstoken",
+  "clientsecret",
+  "refreshtoken",
+  "key",
+  "bearer",
+  "prompt",
+  "message",
+  "messages",
+  "content",
+  "body",
+  "args",
+  "argument",
+  "result",
+  "results",
+  "output",
+  "issue",
+  "description",
+  "summary",
+  "payload",
+  "script",
+  "command",
+  "text",
+  "query"
+]);
+var STACK_WORDS = new Set(["stack", "stacktrace", "trace"]);
+var escapeRegExp2 = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var resolveStateDir = () => {
+  const override = process.env.WORKFLOW_TOOLKIT_STATE;
+  if (override)
+    return override;
+  const home = os3.homedir();
+  if (process.env.XDG_STATE_HOME)
+    return path6.join(process.env.XDG_STATE_HOME, "workit");
+  switch (os3.platform()) {
+    case "darwin":
+      return path6.join(home, "Library", "Application Support", "workit");
+    case "win32":
+      return path6.join(process.env.LOCALAPPDATA ?? path6.join(home, "AppData", "Local"), "workit");
+    default:
+      return path6.join(process.env.HOME ?? home, ".local", "state", "workit");
   }
-  return renames.toSorted((left, right) => left.at - right.at);
-}
-function followRenames(key, boundAt, renames) {
-  let current = key;
-  let since = Math.floor(Date.parse(boundAt) / 1000);
-  for (const rename of renames)
-    if (rename.from === current && rename.at >= since) {
-      current = rename.to;
-      since = rename.at;
-    }
-  return current;
-}
-var checkoutSlug = (root) => {
-  let canonical = real(root);
-  if (process.platform === "win32")
-    canonical = canonical.toLowerCase();
-  const base = path6.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
-  return `${base}-${shortHash(canonical)}`;
 };
+var homePattern = new RegExp(`${escapeRegExp2(os3.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
 
 // packages/workit-core/src/host-session.ts
 var HOST_SESSION_VARS = [
@@ -10191,9 +10344,10 @@ function hostSessionFromEnv(env) {
   return inner ? { host: inner.host, session: inner.session } : { host: declared, session: null };
 }
 var ISSUED_PER_LEAD = 64;
-var ISSUED_SESSIONS_MARKER = "workit-issued-sessions/2";
+var ISSUED_SESSIONS_MARKER = "workit-issued-sessions/3";
 var hash = (value) => createHash6("sha256").update(value).digest("hex").slice(0, 32);
 var userIssuedRoot = () => path7.join(resolveStateDir(), "issued");
+var userTokenRoot = () => path7.join(resolveStateDir(), "issued-tokens");
 function migrateRepoIssued(cwd) {
   if (cwd === undefined)
     return;
@@ -10203,7 +10357,7 @@ function migrateRepoIssued(cwd) {
     if (location instanceof Error)
       return;
     old = path7.join(location.dir, "hooks", "issued");
-    if (!fs4.existsSync(old))
+    if (!fs5.existsSync(old))
       return;
   } catch {
     return;
@@ -10211,13 +10365,18 @@ function migrateRepoIssued(cwd) {
   for (const lead of safeList(old)) {
     try {
       const from = path7.join(old, lead);
-      if (!fs4.statSync(from).isDirectory())
+      if (!fs5.statSync(from).isDirectory())
         continue;
       const to = path7.join(userIssuedRoot(), lead);
-      fs4.mkdirSync(to, { recursive: true, mode: 448 });
-      for (const id of fs4.readdirSync(from)) {
-        fs4.copyFileSync(path7.join(from, id), path7.join(to, id));
-        fs4.rmSync(path7.join(from, id), { force: true });
+      fs5.mkdirSync(to, { recursive: true, mode: 448 });
+      for (const id of fs5.readdirSync(from)) {
+        try {
+          fs5.copyFileSync(path7.join(from, id), path7.join(to, id), fs5.constants.COPYFILE_EXCL);
+        } catch (error) {
+          if (error.code !== "EEXIST")
+            throw error;
+        }
+        fs5.rmSync(path7.join(from, id), { force: true });
       }
       removeIfEmpty(from);
     } catch {}
@@ -10226,31 +10385,81 @@ function migrateRepoIssued(cwd) {
 }
 var safeList = (dir) => {
   try {
-    return fs4.readdirSync(dir);
+    return fs5.readdirSync(dir);
   } catch {
     return [];
   }
 };
 var removeIfEmpty = (dir) => {
   try {
-    fs4.rmdirSync(dir);
+    fs5.rmdirSync(dir);
   } catch {}
 };
+var tokenHash = (token) => createHash6("sha256").update(token).digest("hex");
 function recordIssuedSession(cwd, lead, issued) {
+  const token = randomBytes(18).toString("base64url");
   try {
     migrateRepoIssued(cwd);
-    const dir = path7.join(userIssuedRoot(), hash(lead));
-    fs4.mkdirSync(dir, { recursive: true, mode: 448 });
     const own = hash(issued);
-    fs4.writeFileSync(path7.join(dir, own), ISSUED_SESSIONS_MARKER);
-    const entries = fs4.readdirSync(dir);
+    const tokens = path7.join(userTokenRoot(), hash(lead));
+    fs5.mkdirSync(tokens, { recursive: true, mode: 448 });
+    fs5.writeFileSync(path7.join(tokens, own), `${tokenHash(token)}
+`, { mode: 384, flag: "wx" });
+    const dir = path7.join(userIssuedRoot(), hash(lead));
+    fs5.mkdirSync(dir, { recursive: true, mode: 448 });
+    fs5.writeFileSync(path7.join(dir, own), `${ISSUED_SESSIONS_MARKER}
+`, { mode: 384 });
+    pruneIssued(dir, own, tokens);
+    return token;
+  } catch {
+    return null;
+  }
+}
+function pruneIssued(dir, own, tokens) {
+  try {
+    const entries = fs5.readdirSync(dir);
     if (entries.length <= ISSUED_PER_LEAD)
       return;
-    const byAge = entries.filter((name) => name !== own).map((name) => ({ name, at: fs4.statSync(path7.join(dir, name)).mtimeMs })).toSorted((a, b) => a.at - b.at);
-    for (const { name } of byAge.slice(0, entries.length - ISSUED_PER_LEAD))
-      fs4.rmSync(path7.join(dir, name), { force: true });
+    const byAge = entries.filter((name) => name !== own).map((name) => ({ name, at: fs5.statSync(path7.join(dir, name)).mtimeMs })).toSorted((a, b) => a.at - b.at);
+    for (const { name } of byAge.slice(0, entries.length - ISSUED_PER_LEAD)) {
+      fs5.rmSync(path7.join(dir, name), { force: true });
+      fs5.rmSync(path7.join(tokens, name), { force: true });
+    }
   } catch {}
 }
+var issuedRecord = (cwd, claimed) => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0)
+    return null;
+  migrateRepoIssued(cwd);
+  try {
+    return fs5.readFileSync(path7.join(userIssuedRoot(), hash(claimed.slice(0, cut)), hash(claimed)), "utf8");
+  } catch {
+    return null;
+  }
+};
+var TOKEN_HASH = /^([0-9a-f]{64})$/mu;
+var issuedToken = (claimed) => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0)
+    return { stored: null, leadBound: false };
+  const dir = path7.join(userTokenRoot(), hash(claimed.slice(0, cut)));
+  try {
+    const text = fs5.readFileSync(path7.join(dir, hash(claimed)), "utf8");
+    return { stored: TOKEN_HASH.exec(text)?.[1] ?? null, leadBound: true };
+  } catch {
+    return { stored: null, leadBound: safeList(dir).length > 0 };
+  }
+};
+function issuedBinding(cwd, claimed) {
+  const record = issuedRecord(cwd, claimed);
+  const { stored, leadBound } = issuedToken(claimed);
+  if (stored)
+    return "token";
+  if (record === null)
+    return null;
+  return leadBound ? "token" : "legacy";
+}
 var OWN_CHILD_SHELL = new Set(["opencode", "pi"]);
 
 // packages/workit-core/src/ledger.ts
@@ -10267,7 +10476,7 @@ var err = (code, error, unblock) => ({
   ...unblock ? { unblock } : {}
 });
 var gitRun2 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync7("git", args, {
+  const run = spawnSync8("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -10379,7 +10588,7 @@ function ledgerPath(cwd) {
   const root = storeRoot(cwd);
   return root.ok ? { ok: true, value: path8.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
-var newId2 = () => `${Date.now().toString(36)}-${randomBytes(6).toString("hex")}`;
+var newId2 = () => `${Date.now().toString(36)}-${randomBytes2(6).toString("hex")}`;
 var NETWORK_FS_TYPES = new Set([
   26985,
   20859,
@@ -10397,7 +10606,7 @@ var onNetworkFs = (dir) => {
   if (process.platform !== "linux")
     return false;
   try {
-    return isNetworkFsType(fs5.statfsSync(dir).type);
+    return isNetworkFsType(fs6.statfsSync(dir).type);
   } catch {
     return false;
   }
@@ -10407,7 +10616,7 @@ var LOCK_STALE_MS = 30000;
 var LOCK_OWNER = "owner";
 var lockToken = (lock) => {
   try {
-    return fs5.readFileSync(path8.join(lock, LOCK_OWNER), "utf8");
+    return fs6.readFileSync(path8.join(lock, LOCK_OWNER), "utf8");
   } catch {
     return null;
   }
@@ -10415,7 +10624,7 @@ var lockToken = (lock) => {
 var lockAgeMs = (lock) => {
   for (const target of [path8.join(lock, LOCK_OWNER), lock]) {
     try {
-      return Date.now() - fs5.statSync(target).mtimeMs;
+      return Date.now() - fs6.statSync(target).mtimeMs;
     } catch {}
   }
   return null;
@@ -10423,55 +10632,55 @@ var lockAgeMs = (lock) => {
 var ledgerLock = {
   acquire(lock) {
     try {
-      fs5.mkdirSync(lock);
+      fs6.mkdirSync(lock);
     } catch (error) {
       if (error.code === "EEXIST")
         return null;
       throw error;
     }
-    const token = `${process.pid}-${randomBytes(8).toString("hex")}`;
-    fs5.writeFileSync(path8.join(lock, LOCK_OWNER), token);
+    const token = `${process.pid}-${randomBytes2(8).toString("hex")}`;
+    fs6.writeFileSync(path8.join(lock, LOCK_OWNER), token);
     return token;
   },
   release(lock, token) {
     if (lockToken(lock) !== token)
       return false;
-    const tomb = `${lock}.release-${randomBytes(6).toString("hex")}`;
+    const tomb = `${lock}.release-${randomBytes2(6).toString("hex")}`;
     try {
-      fs5.renameSync(lock, tomb);
+      fs6.renameSync(lock, tomb);
     } catch {
       return false;
     }
     if (lockToken(tomb) !== token) {
       try {
-        fs5.renameSync(tomb, lock);
+        fs6.renameSync(tomb, lock);
       } catch {}
       return false;
     }
-    fs5.rmSync(tomb, { recursive: true, force: true });
+    fs6.rmSync(tomb, { recursive: true, force: true });
     return true;
   },
   token: lockToken,
   reap(lock, observed) {
-    const tomb = `${lock}.reap-${randomBytes(6).toString("hex")}`;
+    const tomb = `${lock}.reap-${randomBytes2(6).toString("hex")}`;
     try {
-      fs5.renameSync(lock, tomb);
+      fs6.renameSync(lock, tomb);
     } catch {
       return false;
     }
     if (lockToken(tomb) === observed) {
-      fs5.rmSync(tomb, { recursive: true, force: true });
+      fs6.rmSync(tomb, { recursive: true, force: true });
       return true;
     }
     try {
-      fs5.renameSync(tomb, lock);
+      fs6.renameSync(tomb, lock);
     } catch {
-      fs5.rmSync(tomb, { recursive: true, force: true });
+      fs6.rmSync(tomb, { recursive: true, force: true });
     }
     return false;
   }
 };
-function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS) {
+function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
   const lock = `${file}.lock`;
   const deadline = Date.now() + waitMs;
   let token = null;
@@ -10500,7 +10709,7 @@ var TAIL_BYTES = 64 * 1024;
 var lastLine = (fd, size) => {
   for (let span = Math.min(size, TAIL_BYTES);span > 0; span = Math.min(size, span * 2)) {
     const buffer = Buffer.alloc(span);
-    fs5.readSync(fd, buffer, 0, span, size - span);
+    fs6.readSync(fd, buffer, 0, span, size - span);
     const end = buffer.lastIndexOf(10);
     if (end < 0) {
       if (span === size)
@@ -10529,15 +10738,23 @@ var lastLine = (fd, size) => {
   }
   return null;
 };
+var tighten = (fd) => {
+  try {
+    if ((fs6.fstatSync(fd).mode & 63) !== 0)
+      fs6.fchmodSync(fd, 384);
+  } catch {}
+};
 function appendLine(file, build, options) {
   const write = () => {
-    const fd = fs5.openSync(file, "a+");
+    const fd = fs6.openSync(file, "a+", 384);
     try {
-      const size = fs5.fstatSync(fd).size;
+      if (process.platform !== "win32")
+        tighten(fd);
+      const size = fs6.fstatSync(fd).size;
       let fence = "";
       if (size > 0) {
         const last = Buffer.alloc(1);
-        fs5.readSync(fd, last, 0, 1, size - 1);
+        fs6.readSync(fd, last, 0, 1, size - 1);
         if (last[0] !== 10)
           fence = `
 `;
@@ -10546,16 +10763,16 @@ function appendLine(file, build, options) {
       if (!line.ok)
         return line;
       const bytes = Buffer.from(fence + line.value);
-      const written = fs5.writeSync(fd, bytes);
+      const written = fs6.writeSync(fd, bytes);
       if (written !== bytes.length)
         return err("unavailable", `short write to ${file}: ${written} of ${bytes.length} bytes; the row is torn and will be skipped`);
       return { ok: true, value: undefined };
     } finally {
-      fs5.closeSync(fd);
+      fs6.closeSync(fd);
     }
   };
   try {
-    fs5.mkdirSync(path8.dirname(file), { recursive: true });
+    fs6.mkdirSync(path8.dirname(file), { recursive: true });
     if (!options.forceLock && !onNetworkFs(path8.dirname(file)))
       return write();
     const locked = withLedgerLock(file, write);
@@ -10627,8 +10844,10 @@ function readLedger(cwd, options = {}) {
   if (!file.ok)
     return file;
   let text = "";
+  let stat = null;
   try {
-    text = fs5.readFileSync(file.value, "utf8");
+    stat = fs6.statSync(file.value);
+    text = fs6.readFileSync(file.value, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return {
@@ -10647,6 +10866,7 @@ function readLedger(cwd, options = {}) {
   const integrity = { chained: 0, legacy: 0, unverified: [] };
   const earlier = new Set([null]);
   let chainStarted = false;
+  const ids = new Set;
   for (const raw of text.split(`
 `)) {
     const trimmed = raw.trim();
@@ -10680,6 +10900,10 @@ function readLedger(cwd, options = {}) {
       reason = "unsigned";
     else
       rowIntegrity = "legacy";
+    if (options.integrity && !reason && ids.has(parsed.id))
+      reason = "duplicate_id";
+    if (options.integrity)
+      ids.add(parsed.id);
     if (reason)
       rowIntegrity = "unverified";
     const pr = typeof parsed.pr === "number" && Number.isInteger(parsed.pr) ? parsed.pr : undefined;
@@ -10703,7 +10927,8 @@ function readLedger(cwd, options = {}) {
       seq: rows.length + 1,
       superseded: false,
       supersedeIgnored: false,
-      ...rowIntegrity ? { integrity: rowIntegrity } : {}
+      ...rowIntegrity ? { integrity: rowIntegrity } : {},
+      ...reason ? { integrityReason: reason } : {}
     };
     rows.push(row);
     if (!options.integrity)
@@ -10731,18 +10956,48 @@ function readLedger(cwd, options = {}) {
   const byId = new Map;
   for (const row of rows) {
     const target = row.supersedes ? byId.get(row.supersedes) : undefined;
-    if (target && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
+    if (target && row.integrity !== "unverified" && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
       target.superseded = true;
     else if (row.supersedes)
       row.supersedeIgnored = true;
     if (!byId.has(row.id))
       byId.set(row.id, row);
   }
+  if (options.integrity && stat && Buffer.byteLength(text) === stat.size)
+    tamperCache.set(file.value, {
+      size: stat.size,
+      stamp: fileStamp(stat),
+      breaks: integrity.unverified.filter((row) => TAMPER_REASONS.has(row.reason))
+    });
   return {
     ok: true,
     value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null }
   };
 }
+var TAMPER_REASONS = new Set(["hash_mismatch", "broken_link"]);
+var tamperCache = new Map;
+var fileStamp = (stat) => `${stat.ino}:${stat.mtimeMs}:${stat.ctimeMs}`;
+function ledgerTampering(cwd) {
+  const file = ledgerPath(cwd);
+  if (!file.ok)
+    return [];
+  try {
+    const stat = fs6.statSync(file.value);
+    const cached = tamperCache.get(file.value);
+    if (cached && cached.size === stat.size && cached.stamp === fileStamp(stat))
+      return cached.breaks;
+  } catch {
+    return [];
+  }
+  const read = readLedger(cwd, { integrity: true });
+  return read.ok ? (read.value.integrity?.unverified ?? []).filter((row) => TAMPER_REASONS.has(row.reason)) : [];
+}
+function tamperedUnblock(cwd) {
+  const file = ledgerPath(cwd);
+  const where = file.ok ? file.value : "the ledger file";
+  return `workit ledger verify-integrity  # lists the edited or missing rows; if the edit is understood, move ${where} aside (mv ${where} ${where}.tampered-<date>) and record the verdicts again`;
+}
+var tamperedWarning = (cwd, breaks) => `the ledger was edited, or a row was removed or moved (${breaks.slice(0, 3).map((row) => `${row.reason} at row ${row.seq}`).join(", ")}${breaks.length > 3 ? ", …" : ""}): no verdict is accepted until it is repaired. ${tamperedUnblock(cwd)}`;
 function verdictBasis(verdict, current) {
   if (verdict.head && verdict.head === current.head)
     return "fresh";
@@ -10750,7 +11005,7 @@ function verdictBasis(verdict, current) {
     return "carried";
   return "stale";
 }
-var isLiveVerdict = (row) => row.type === "verdict" && typeof row.result === "string" && !row.superseded;
+var isLiveVerdict = (row, retired) => row.type === "verdict" && typeof row.result === "string" && !retired.has(row.id);
 function trailerSessions(cwd, base, head) {
   if (!base || !head || !safeRef(base) || !safeRef(head))
     return [];
@@ -10831,6 +11086,56 @@ var authoredBy = (authors, session) => {
       return true;
   return false;
 };
+var TRUST_REASONS = new Set([
+  "unsigned",
+  "hash_mismatch",
+  "broken_link",
+  "duplicate_id",
+  "unissued_session",
+  "unbound_session"
+]);
+var SHELL_VOUCHED_HOSTS = new Set([
+  "cli",
+  "opencode",
+  "pi",
+  "codex_cli",
+  "codex_desktop"
+]);
+function sessionTrust(cwd, row) {
+  const session = row.actor.session;
+  if (!session || row.self === true)
+    return null;
+  const source = typeof row.sessionSource === "string" ? row.sessionSource : "env";
+  const host = row.actor.host;
+  const issuedOnly = source === "flag" ? host !== "cli" : source === "env" && session.includes(":") && !SHELL_VOUCHED_HOSTS.has(host);
+  if (!issuedOnly)
+    return null;
+  const binding = issuedBinding(cwd, session);
+  if (binding === null)
+    return "unissued_session";
+  return binding === "token" && row.sessionBound !== true ? "unbound_session" : null;
+}
+function trustReasons(cwd, row) {
+  if (row.integrity === "unverified")
+    return [row.integrityReason ?? "unsigned"];
+  if (row.integrity !== "verified")
+    return ["unsigned"];
+  const session = sessionTrust(cwd, row);
+  return session ? [session] : [];
+}
+function withIntegrity(cwd, rows) {
+  if (rows.every((row) => row.integrity !== undefined))
+    return rows;
+  const read = readLedger(cwd, { integrity: true });
+  const bySeq = new Map(read.ok ? read.value.rows.map((row) => [row.seq, row]) : []);
+  return rows.map((row) => {
+    if (row.integrity !== undefined)
+      return row;
+    const fresh = bySeq.get(row.seq);
+    return fresh && fresh.id === row.id && fresh.at === row.at ? fresh : row;
+  });
+}
+var untrusted = (reasons) => reasons.some((reason) => TRUST_REASONS.has(reason));
 var independenceReasons = (row, authors) => {
   const reasons = [];
   if (!row.actor.session)
@@ -10841,15 +11146,17 @@ var independenceReasons = (row, authors) => {
     reasons.push("self");
   return reasons;
 };
-function effectiveOf(rows, authors, sameCode, isCurrent) {
+function effectiveOf(rows, reasonsOf, sameCode, isCurrent) {
   let effective = null;
   for (const row of rows) {
     if (!effective) {
       effective = row;
       continue;
     }
-    const rowIndependent = independenceReasons(row, authors).length === 0;
-    const effIndependent = independenceReasons(effective, authors).length === 0;
+    if (untrusted(reasonsOf(row)) && !untrusted(reasonsOf(effective)))
+      continue;
+    const rowIndependent = reasonsOf(row).length === 0;
+    const effIndependent = reasonsOf(effective).length === 0;
     if (effIndependent && !rowIndependent && isCurrent(effective))
       continue;
     if (effIndependent && FAILING.has(String(effective.result)) && row.actor.session === effective.actor.session && sameCode(effective, row))
@@ -10863,7 +11170,7 @@ function restackCarries(rows, branch, from, to) {
     return false;
   const edges = new Map;
   for (const row of rows)
-    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
+    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.integrity === "verified" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
       edges.set(row.fromHead, [...edges.get(row.fromHead) ?? [], row.head]);
   const seen = new Set([from]);
   const queue = [from];
@@ -10879,7 +11186,8 @@ function restackCarries(rows, branch, from, to) {
   }
   return false;
 }
-function checkVerdicts(cwd, branch, rows) {
+function checkVerdicts(cwd, branch, ledgerRows) {
+  const rows = withIntegrity(cwd, ledgerRows);
   const head = branchHead(cwd, branch);
   const fallbackBase = defaultBase(cwd);
   const scope = branchScope(cwd, branch);
@@ -10909,21 +11217,47 @@ function checkVerdicts(cwd, branch, rows) {
     return verdictBasis(failed, { head: row.head, ...keys }) !== "stale" || restackCarries(rows, branch, failed.head, row.head);
   };
   const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head }, scope);
+  const failureAuthorCache = new Map;
+  const failureAuthors = (row) => {
+    let set = failureAuthorCache.get(row.seq);
+    if (!set) {
+      set = authorSessions(cwd, rows.filter((other) => other.integrity === "verified" && other.seq < row.seq), branch, { base: null, head: null }, scope);
+      failureAuthorCache.set(row.seq, set);
+    }
+    return set;
+  };
+  const reasonCache = new Map;
+  const reasonsOf = (row) => {
+    let reasons = reasonCache.get(row);
+    if (!reasons) {
+      const failing = FAILING.has(String(row.result));
+      reasons = [
+        ...trustReasons(cwd, row),
+        ...independenceReasons(row, failing ? failureAuthors(row) : authors)
+      ];
+      reasonCache.set(row, reasons);
+    }
+    return reasons;
+  };
+  const retired = new Set;
+  for (const row of rows)
+    if (row.type === "verdict" && row.supersedes && !row.supersedeIgnored && trustReasons(cwd, row).length === 0)
+      retired.add(row.supersedes);
   const byKind = new Map;
   for (const row of rows)
-    if (isLiveVerdict(row) && scope(row)) {
+    if (isLiveVerdict(row, retired) && scope(row)) {
       const kind = typeof row.kind === "string" ? row.kind : "review";
       byKind.set(kind, [...byKind.get(kind) ?? [], row]);
     }
   const verdicts = [];
   const warnings = [];
   for (const [kind, list] of byKind) {
-    const row = effectiveOf(list, authors, sameCode, (candidate) => basisOf(candidate) !== "stale");
+    const row = effectiveOf(list, reasonsOf, sameCode, (candidate) => basisOf(candidate) !== "stale");
     if (!row)
       continue;
     const basis = basisOf(row);
     const current = basis !== "stale";
-    const independence = independenceReasons(row, authors);
+    const independence = reasonsOf(row);
     const reasons = [
       ...current ? [] : ["stale"],
       ...PASSING.has(String(row.result)) ? [] : ["not_passing"],
@@ -10940,23 +11274,31 @@ function checkVerdicts(cwd, branch, rows) {
     });
     if (reasons.length === 0) {
       for (const later of list)
-        if (later.seq > row.seq && independenceReasons(later, authors).length > 0 && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
+        if (later.seq > row.seq && reasonsOf(later).length > 0 && !untrusted(reasonsOf(later)) && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
           warnings.push(`the author's own (self) ${String(later.result)} ${kind} verdict ${later.id} by ${later.actor.session ?? "no session"} on the current code is newer than the accepted pass ${row.id}: read it before merging`);
     }
   }
   for (const row of rows)
     if (row.integrity === "unverified" && scope(row))
       warnings.push(`ledger row ${row.id} (${row.type}) on ${row.branch ?? branch} is unverified: the workit CLI did not write it or it changed afterwards (workit ledger verify-integrity)`);
+  const tampered = ledgerTampering(cwd);
+  if (tampered.length) {
+    warnings.push(tamperedWarning(cwd, tampered));
+    for (const entry of verdicts) {
+      entry.accepted = false;
+      entry.reasons = [...entry.reasons, "ledger_tampered"];
+    }
+  }
   verdicts.sort((a, b) => a.verdict.seq - b.verdict.seq);
   const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
   const failing = verdicts.find((entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)));
   const newestAccepted = verdicts.findLast((entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result))) ?? null;
-  const accepted = newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
+  const accepted = tampered.length ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
     accepted: false,
     verdict: failing?.verdict ?? null,
     reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
   };
-  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && STRONG_RESULTS.has(String(entry.verdict.result)));
+  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && !untrusted(entry.reasons) && STRONG_RESULTS.has(String(entry.verdict.result)));
   return {
     branch,
     head,
@@ -11922,12 +12264,12 @@ function sameFileIdentity(left, right, platform = process.platform) {
 }
 
 // node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.js
-import { randomBytes as randomBytes2 } from "node:crypto";
+import { randomBytes as randomBytes3 } from "node:crypto";
 import fsSync from "node:fs";
 import path11 from "node:path";
 
 // node_modules/@openclaw/fs-safe/dist/bounded-read.js
-import fs6 from "node:fs";
+import fs7 from "node:fs";
 
 // node_modules/@openclaw/fs-safe/dist/byte-budget.js
 function normalizeMaxBytes(value, options = {}) {
@@ -11964,7 +12306,7 @@ function readFileDescriptorBoundedSync(fd, maxBytes) {
   let total = 0;
   while (true) {
     const length = nextReadLength(total, maxBytes, scratch.length);
-    const bytesRead = fs6.readSync(fd, scratch, 0, length, null);
+    const bytesRead = fs7.readSync(fd, scratch, 0, length, null);
     if (bytesRead === 0) {
       return Buffer.concat(chunks, total);
     }
@@ -11973,9 +12315,9 @@ function readFileDescriptorBoundedSync(fd, maxBytes) {
 }
 
 // node_modules/@openclaw/fs-safe/dist/read-open-flags.js
-import fs7 from "node:fs";
+import fs8 from "node:fs";
 function resolveReadOpenFlags(options) {
-  const constants = options?.constants ?? fs7.constants;
+  const constants = options?.constants ?? fs8.constants;
   const noFollow = process.platform !== "win32" && options?.followSymlinks !== true && typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
   const nonBlocking = process.platform !== "win32" && typeof constants.O_NONBLOCK === "number" ? constants.O_NONBLOCK : 0;
   return constants.O_RDONLY | noFollow | nonBlocking;
@@ -11992,7 +12334,7 @@ function parseSidecarLockSnapshot(snapshot, parser) {
 }
 function createSidecarLockOwnershipToken() {
   let token = SIDECAR_LOCK_OWNERSHIP_TOKEN_PREFIX;
-  for (const byte of randomBytes2(SIDECAR_LOCK_OWNERSHIP_TOKEN_BYTES)) {
+  for (const byte of randomBytes3(SIDECAR_LOCK_OWNERSHIP_TOKEN_BYTES)) {
     for (let bit = 7;bit >= 0; bit -= 1) {
       token += byte & 1 << bit ? "\t" : " ";
     }
@@ -12166,7 +12508,7 @@ function getFsSafeLockConfig() {
 }
 
 // node_modules/@openclaw/fs-safe/dist/file-lock-sync.js
-import fs8 from "node:fs";
+import fs9 from "node:fs";
 import path12 from "node:path";
 
 // node_modules/@openclaw/fs-safe/dist/timing.js
@@ -12197,7 +12539,7 @@ function releaseAllSyncHeldLocks() {
     }
     try {
       if (held.fd !== undefined)
-        fs8.closeSync(held.fd);
+        fs9.closeSync(held.fd);
     } catch {}
     try {
       removeSidecarLockIfUnchangedSync(held.lockPath, held.snapshot);
@@ -12232,7 +12574,7 @@ function releaseSyncHeldLock(held) {
   if (held.fd !== undefined) {
     const fd = held.fd;
     held.fd = undefined;
-    fs8.closeSync(fd);
+    fs9.closeSync(fd);
   }
   removeSidecarLockIfUnchangedSync(held.lockPath, held.snapshot);
   heldLocks.delete(held.normalizedTargetPath);
@@ -12255,11 +12597,11 @@ function createSyncHeldLockHandle(held) {
   };
 }
 function canonicalLockParentSync(parent) {
-  return process.platform === "win32" ? fs8.realpathSync.native(parent) : fs8.realpathSync(parent);
+  return process.platform === "win32" ? fs9.realpathSync.native(parent) : fs9.realpathSync(parent);
 }
 function normalizeTargetPath(targetPath) {
   const resolved = path12.resolve(targetPath);
-  fs8.mkdirSync(path12.dirname(resolved), { recursive: true });
+  fs9.mkdirSync(path12.dirname(resolved), { recursive: true });
   try {
     return path12.join(canonicalLockParentSync(path12.dirname(resolved)), path12.basename(resolved));
   } catch {
@@ -12287,7 +12629,7 @@ function defaultShouldReclaim(snapshot, staleMs, nowMs) {
 }
 function reclaimGuardExists(reclaimGuardPath) {
   try {
-    fs8.lstatSync(reclaimGuardPath);
+    fs9.lstatSync(reclaimGuardPath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT")
@@ -12351,19 +12693,19 @@ function acquireFileLockSync(targetPath, options) {
     const { raw, ownershipToken } = serializeSidecarLockPayload(payload);
     let lockFileCreateDenied = false;
     try {
-      const noFollow = process.platform !== "win32" && typeof fs8.constants.O_NOFOLLOW === "number" ? fs8.constants.O_NOFOLLOW : 0;
+      const noFollow = process.platform !== "win32" && typeof fs9.constants.O_NOFOLLOW === "number" ? fs9.constants.O_NOFOLLOW : 0;
       try {
-        fd = fs8.openSync(lockPath, fs8.constants.O_WRONLY | fs8.constants.O_CREAT | fs8.constants.O_EXCL | noFollow, 384);
+        fd = fs9.openSync(lockPath, fs9.constants.O_WRONLY | fs9.constants.O_CREAT | fs9.constants.O_EXCL | noFollow, 384);
       } catch (error) {
         lockFileCreateDenied = isTransientLockFileDenial(error, lockPath);
         throw error;
       }
-      fs8.writeFileSync(fd, raw, "utf8");
-      fs8.fsyncSync(fd);
+      fs9.writeFileSync(fd, raw, "utf8");
+      fs9.fsyncSync(fd);
       const snapshot = {
         raw,
         payload,
-        stat: fs8.fstatSync(fd),
+        stat: fs9.fstatSync(fd),
         ownershipToken
       };
       const createdHeld = {
@@ -12398,8 +12740,8 @@ function acquireFileLockSync(targetPath, options) {
       return returnedHandle;
     } catch (error) {
       if (fd !== undefined) {
-        const failed = { payload: null, stat: fs8.fstatSync(fd) };
-        fs8.closeSync(fd);
+        const failed = { payload: null, stat: fs9.fstatSync(fd) };
+        fs9.closeSync(fd);
         fd = undefined;
         removeSidecarLockIfUnchangedSync(lockPath, failed);
       }
@@ -12448,7 +12790,7 @@ function acquireFileLockSync(targetPath, options) {
         })) {
           let ownsReclaimGuard = false;
           try {
-            fs8.mkdirSync(reclaimGuardPath);
+            fs9.mkdirSync(reclaimGuardPath);
             ownsReclaimGuard = true;
             if (removeSidecarLockIfUnchangedSync(lockPath, snapshot))
               continue;
@@ -12461,7 +12803,7 @@ function acquireFileLockSync(targetPath, options) {
           } finally {
             if (ownsReclaimGuard) {
               try {
-                fs8.rmdirSync(reclaimGuardPath);
+                fs9.rmdirSync(reclaimGuardPath);
               } catch {}
             }
           }
@@ -12490,146 +12832,6 @@ var packageRoot = () => {
   }
 };
 
-// packages/workit-core/src/core/store-lock.ts
-import { spawnSync as spawnSync8 } from "node:child_process";
-import fs9 from "node:fs";
-import { hostname } from "node:os";
-var metadataLockSchema = object({
-  pid: number2().int().nonnegative().safe(),
-  processStart: string2().nullable(),
-  host: string2().min(1),
-  nonce: string2().min(1),
-  externalAction: literal(true).optional()
-}).strict();
-var FOREIGN_LOCK_TTL_MS = 10 * 60000;
-var UNREADABLE_LOCK_TTL_MS = 30000;
-var RECLAIM_GUARD_TTL_MS = 30000;
-var defaultLockTimeoutMs = 250;
-var defaultLockTimeout = () => defaultLockTimeoutMs;
-var parseMetadataLock = (raw) => {
-  let value;
-  try {
-    value = JSON.parse(raw);
-  } catch {
-    throw Object.assign(new Error("metadata lock is invalid"), { code: "metadata_lock_invalid" });
-  }
-  const parsed = metadataLockSchema.safeParse(value);
-  if (!parsed.success)
-    throw Object.assign(new Error("metadata lock is invalid"), { code: "metadata_lock_invalid" });
-  return parsed.data;
-};
-var parseMetadataLockOrNull = (raw) => {
-  try {
-    return parseMetadataLock(raw);
-  } catch {
-    return null;
-  }
-};
-var parseProcStatStart = (stat) => {
-  const close = stat.lastIndexOf(")");
-  if (close < 0)
-    return null;
-  return stat.slice(close + 1).trim().split(/\s+/)[19] ?? null;
-};
-var processStartOf = (pid) => {
-  if (process.platform === "linux") {
-    try {
-      return parseProcStatStart(fs9.readFileSync(`/proc/${pid}/stat`, "utf8"));
-    } catch {
-      return null;
-    }
-  }
-  if (process.platform === "darwin" || process.platform === "freebsd") {
-    try {
-      const run = spawnSync8("ps", ["-o", "lstart=", "-p", String(pid)], {
-        encoding: "utf8",
-        timeout: 1000
-      });
-      const value = run.status === 0 ? run.stdout.trim() : "";
-      return value || null;
-    } catch {
-      return null;
-    }
-  }
-  return null;
-};
-var readTrimmed = (file) => {
-  try {
-    return fs9.readFileSync(file, "utf8").trim() || null;
-  } catch {
-    return null;
-  }
-};
-var cachedLockHost = null;
-var localLockHost = () => {
-  if (cachedLockHost !== null)
-    return cachedLockHost;
-  let pidns = null;
-  try {
-    pidns = /\[(\d+)\]/.exec(fs9.readlinkSync("/proc/self/ns/pid"))?.[1] ?? null;
-  } catch {}
-  const boot = readTrimmed("/proc/sys/kernel/random/boot_id");
-  cachedLockHost = pidns || boot ? `${hostname()}#${pidns ?? "?"}:${boot ?? "?"}` : hostname();
-  return cachedLockHost;
-};
-var pidAlive = (pid) => {
-  if (!Number.isSafeInteger(pid) || pid <= 0)
-    return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === "EPERM";
-  }
-};
-var TASK_STORE_LOCK = { reclaimUnverifiedAfterTtl: true };
-var classifyLockOwner = (payload, ageMs, localHost = localLockHost(), options = {}) => {
-  const lock = metadataLockSchema.safeParse(payload);
-  if (!lock.success)
-    return ageMs !== null && ageMs > UNREADABLE_LOCK_TTL_MS ? { state: "stale", reason: "unreadable lock left behind" } : { state: "unknown", reason: "lock is being written" };
-  const { pid, processStart, host } = lock.data;
-  const [lockName, lockSpace] = host.split("#");
-  const [localName, localSpace] = localHost.split("#");
-  if (lockSpace && localSpace && lockName === localName) {
-    const [lockNs, lockBoot] = lockSpace.split(":");
-    const [localNs, localBoot] = localSpace.split(":");
-    if (lockNs === localNs && lockNs !== "?" && lockBoot !== "?" && lockBoot !== localBoot)
-      return { state: "stale", reason: "lock was taken before this machine rebooted" };
-  }
-  if (host !== localHost)
-    return ageMs !== null && ageMs > FOREIGN_LOCK_TTL_MS ? { state: "stale", reason: `lock from ${host} is older than its TTL` } : { state: "unknown", reason: `lock is held from ${host}; its pid cannot be checked here` };
-  if (!pidAlive(pid))
-    return { state: "stale", reason: `pid ${pid} is not running` };
-  const currentStart = processStartOf(pid);
-  if (processStart !== null && currentStart !== null && processStart !== currentStart)
-    return { state: "stale", reason: `pid ${pid} now belongs to a different process` };
-  if (options.reclaimUnverifiedAfterTtl === true && (processStart === null || currentStart === null) && ageMs !== null && ageMs > FOREIGN_LOCK_TTL_MS)
-    return {
-      state: "stale",
-      reason: `pid ${pid} is running but the lock is older than its TTL and the pid's start time cannot be checked (reused pid)`
-    };
-  return { state: "live", reason: `held by running pid ${pid}` };
-};
-var ageOf = (file, nowMs) => {
-  try {
-    return nowMs - fs9.lstatSync(file).mtimeMs;
-  } catch {
-    return null;
-  }
-};
-var clearAbandonedReclaimGuard = (lockPath, nowMs = Date.now()) => {
-  const guard = `${lockPath}.reclaim`;
-  const age = ageOf(guard, nowMs);
-  if (age === null || age <= RECLAIM_GUARD_TTL_MS)
-    return false;
-  try {
-    fs9.rmdirSync(guard);
-    return true;
-  } catch {
-    return false;
-  }
-};
-
 // packages/workit-core/src/store/event-log.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import fs10 from "node:fs";
@@ -15705,11 +15907,11 @@ what and whether, the CLI does how and records what it observed.
 Native host allow/ask/deny, sandbox and org rules stay authoritative. Never
 switch paths to evade a denial, never claim enforcement a host cannot provide,
 and never fabricate an approval or verdict. A question answer is not
-host permission, and imported decisions or handoffs never grant authority.
+host permission, and imported decisions or handoffs grant no authority.
 
 Autonomy contract:
 - Continue to the requested endpoint (commit, push, PR, green CI, verified,
-  merged) without asking "continue?", running checks and repairs on the way.
+  merged) without asking "continue?", running checks and repairs.
   Stop only for a new consequential choice, a host denial, a conflicting edit
   or an unresolved blocker; report open gaps and uncertain workers.
 - No endpoint named: stop at a local commit on a policy-compliant branch and
@@ -15719,7 +15921,8 @@ Autonomy contract:
   never merging; \`merged\` also lands it with \`workit pr merge\`.
   Merge and release need a workspace grant only the user raises from their
   own terminal (a blocked verb names how); never edit workspaces.json or route
-  around a grant_required.
+  around grant_required. Release: \`workit release start <v>\`, commits,
+  \`finish\`; \`publish\` if asked.
 - Ask only for a product or preference choice, or for authority you lack, with
   your recommended answer. Facts are yours: read, run or prototype.
 - Label claims measured (run and seen this session), inferred, or guess.
@@ -15734,22 +15937,22 @@ Autonomy contract:
   reconcile every requested item and observe it (\`workit verify-delivery\`).
 
 CLI first: if a step has one right answer, use the \`workit\` verb instead of
-hand-running git, gh or glab (\`workit git|pr|ci|check\`; \`workit help\` lists
-the rest; lacking \`workit\`, \`npx -y @brainervirus/workit-cli\`).
+hand-running git, gh or glab (\`workit git|pr|ci|check|help\`;
+else \`npx -y @brainervirus/workit-cli\`).
 Add Co-Authored-By via \`workit git commit --trailer "K: v" -- <paths>\`, never
 an amend.
 The task families (task, policy, evidence, finding, decision, worker, state)
 are optional continuity for tracked work; each branch has one implicit task,
-and a solo edit needs no task. A decision
-records a user choice; it never authorizes an effect. Judge work once with
+and a solo edit needs no task. A decision records a user choice; it never
+authorizes an effect. Judge work once with
 \`workit policy assess --judge risk= behavior= product-choice= plan=\`.
-Across repositories, bind each item to its checkout, branch and endpoint,
-resolve competing targets before a mutation, and reconcile an uncertain
-external effect before retrying it.
+Across repositories, bind items to checkout, branch and endpoint, resolve
+competing targets before a mutation, and reconcile an uncertain
+external effect before a retry.
 
 Mid-task: never silently drop or resume an objective (workit-continue).
 
-Skills: load the skill, never act from memory of it (slash aliases /wk-<name>).
+Skills: load the skill, never act from memory (aliases /wk-<name>).
 - brainstorm, plan, spec, grill, should we: workit-shape
 - implement, build, add a feature: workit-implement
 - review, blast radius: workit-review
@@ -19485,7 +19688,7 @@ var refusal = (action, branch, dir) => {
     return `workit: raw ${quote(action.via === "api" ? `${action.forge} api` : action.forge === "gh" ? "gh pr merge" : "glab mr merge")}${action.via === "api" ? " merge" : ""} bypasses the merge grant and the verdict gate. Run ${quote("workit pr merge")} instead (it checks both; ${quote("workit help pr")}).`;
   const plainPush = action.kind === "push" && !action.blindForce && !action.deletes;
   if (dir && branch && plainPush && releaseBranch(dir, branch))
-    return `workit: raw ${quote("git push")} onto ${branch}, a protected release branch, bypasses workit's protected-branch check. To finish a release or hotfix, push it with ${quote(`workit git push --release ${branch} [--release v<version>]`)}: it pushes ${branch} (fast-forward only) and the release tag, verifies the remote and records it, under the ${quote("release")} grant (if refused, ask the user to run ${quote("workit grant set <workspace> release=true")}). Feature work goes through ${quote("workit git push")} and ${quote("workit pr merge")}.`;
+    return `workit: raw ${quote("git push")} onto ${branch}, a protected release branch, bypasses workit's protected-branch check. To finish a release or hotfix, push it with ${quote(`workit git push --release ${branch} [--release ${releaseTagPrefixOf(dir)}<version>]`)}: it pushes ${branch} (fast-forward only) and the release tag, verifies the remote and records it, under the ${quote("release")} grant (if refused, ask the user to run ${quote("workit grant set <workspace> release=true")}). Feature work goes through ${quote("workit git push")} and ${quote("workit pr merge")}.`;
   return `workit: raw ${quote("git push")}${action.kind === "push" && action.blindForce ? " --force" : ""} onto ${branch}, a protected branch or the default target, bypasses workit's protected-branch check. Push your feature branch with ${quote("workit git push")} (${quote("workit git push --force-with-lease")} to rewrite it) and land it with ${quote("workit pr merge")}.`;
 };
 var refFacts = (repo, remote) => {
@@ -19572,15 +19775,16 @@ var guardedTarget = (dir, target) => {
   return null;
 };
 var isTag = (facts, name) => facts.tags.has(name) && !facts.heads.has(name);
-var tagRefusal = (action, facts) => {
+var tagRefusal = (action, facts, dir) => {
   const tags = [
     ...action.tags ?? [],
     ...action.targets.filter((name) => name !== null && isTag(facts, name))
   ];
   if (!tags.length && !action.allTags)
     return null;
-  const named = tags.length ? tags.join(" --release ") : "v<version>";
-  return `workit: raw ${quote(`git push${action.allTags ? " --tags" : ""}`)} of ${tags.length ? `tag ${tags.join(", ")}` : "tags"} bypasses the release grant. Push a release tag with ${quote(`workit git push --release ${named}`)} (v<version> tags whose commit the production branch already has; a tag never moves), under the ${quote("release")} grant (if refused, ask the user to run ${quote("workit grant set <workspace> release=true")}).`;
+  const shape = `${releaseTagPrefixOf(dir)}<version>`;
+  const named = tags.length ? tags.join(" --release ") : shape;
+  return `workit: raw ${quote(`git push${action.allTags ? " --tags" : ""}`)} of ${tags.length ? `tag ${tags.join(", ")}` : "tags"} bypasses the release grant. Push a release tag with ${quote(`workit git push --release ${named}`)} (${shape} tags whose commit the production branch already has; a tag never moves), under the ${quote("release")} grant (if refused, ask the user to run ${quote("workit grant set <workspace> release=true")}).`;
 };
 var remoteHeads = (repo, remote) => {
   const listed = spawnSync11("git", ["ls-remote", "--heads", remote], {
@@ -19646,7 +19850,7 @@ var pushRefusal = (action, repo, config) => {
     if (guarded)
       return refusal(action, guarded, repo.dir);
   }
-  return tagRefusal(pushed, facts) ?? (action.deletes ? null : offPolicyPush(pushed, repo, facts, remote));
+  return tagRefusal(pushed, facts, repo.dir) ?? (action.deletes ? null : offPolicyPush(pushed, repo, facts, remote));
 };
 var actionsIn = (cwd, command, dialect, cache = new Map) => {
   const out = [];
@@ -20302,10 +20506,10 @@ function stopObligation(input, descriptor) {
     const branch = currentBranch(input.cwd);
     if (!branch || guardedBranch(input.cwd, branch))
       return null;
-    const ledger = readLedger(input.cwd);
+    const ledger = readLedger(input.cwd, { integrity: true });
     if (!ledger.ok)
       return null;
-    const all = ledger.value.rows;
+    const all = ledger.value.rows.filter((row) => row.integrity !== "unverified");
     const rows = all.filter((row) => row.branch === branch);
     const mine = rows.filter((row) => sessionOf(row) === session);
     const commits = new Set(mine.filter((row) => row.type === "commit.recorded").map((row) => typeof row.sha === "string" ? row.sha : row.head).filter((sha) => typeof sha === "string"));
@@ -20681,9 +20885,9 @@ ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
   const own = subagentSession(session, event.agentId);
-  if (session)
-    recordIssuedSession(input.cwd || process.cwd(), session, own);
-  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> --session ${own} ...\` so the ledger tells it apart from the author.`;
+  const token = session ? recordIssuedSession(input.cwd || process.cwd(), session, own) : null;
+  const flags = token ? `--session ${own} --token ${token}` : `--session ${own}`;
+  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> ${flags} ...\` so the ledger tells it apart from the author.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 };
 function handleHook(input, deps) {
   const { descriptor } = deps;