@brainervirus/workit-cursor 8.17.1 → 8.18.0

package/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "workit",
   "displayName": "Workit",
   "description": "Adaptive Workit workflow with shared MCP tools and native Cursor hooks",
-  "version": "8.17.1",
+  "version": "8.18.0",
   "author": {
     "name": "Cristhofer Pincetti"
   },

package/dist/cursor-session-start.js

@@ -11526,7 +11526,7 @@ var RULES, derived2 = (spec) => ({
     };
   const since = Date.parse(task.createdAt);
   const branch = ledger.branch();
-  const row = ledger.rows().findLast((item) => item.type === "decision" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
+  const row = ledger.rows().findLast((item) => item.type === "decision" && item.by !== "decider" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
   return row ? { met: true, reason: `ledger decision ${row.id} records the choice`, decisionIds: [] } : {
     met: false,
     reason: 'open product choice: ask the user, then `workit ledger decision "<choice>" --why "<reason>"` (or, if it is not open, `workit policy assess --judge product-choice=no --why "<reason>"`)',
@@ -15033,6 +15033,11 @@ var init_workers = __esm(() => {
 import { spawnSync as spawnSync9 } from "node:child_process";
 import fs12 from "node:fs";
 import path16 from "node:path";
+function checksConfigFile(root) {
+  const current = path16.join(root, CHECKS_FILE);
+  const legacy = path16.join(root, LEGACY_CHECKS_FILE);
+  return !fs12.existsSync(current) && fs12.existsSync(legacy) ? legacy : current;
+}
 function repoHeavyCommands(root) {
   try {
     const value = JSON.parse(fs12.readFileSync(checksConfigFile(root), "utf8"));
@@ -15124,19 +15129,25 @@ function detectedChecks(root) {
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
   const file = checksConfigFile(root);
+  const legacy = path16.basename(file) === LEGACY_CHECKS_FILE;
+  const label = legacy ? LEGACY_CHECKS_FILE : CHECKS_FILE;
+  const note = legacy ? {
+    note: `${LEGACY_CHECKS_FILE} is deprecated; move it to ${CHECKS_FILE} (workit doctor --fix)`
+  } : {};
   const none = (error = null) => ({
-    source: error ? CHECKS_FILE : "none",
+    source: error ? label : "none",
     root,
     checks: [],
     gates: {},
-    error
+    error,
+    ...note
   });
   let text = null;
   try {
     text = fs12.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
-      return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
+      return none(`cannot read ${label}: ${error.message}`);
   }
   if (text === null) {
     const checks = detectedChecks(root);
@@ -15146,33 +15157,33 @@ function loadCheckConfig(cwd) {
   try {
     parsed = JSON.parse(text);
   } catch {
-    return none(`${CHECKS_FILE} is not valid JSON`);
+    return none(`${label} is not valid JSON`);
   }
   if (!isRecord3(parsed) || !isRecord3(parsed.checks))
-    return none(`${CHECKS_FILE} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
+    return none(`${label} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
   const checks = [];
   for (const [name, value] of Object.entries(parsed.checks)) {
     if (!CHECK_NAME.test(name))
-      return none(`${CHECKS_FILE}: check name "${name}" must match ${CHECK_NAME.source}`);
+      return none(`${label}: check name "${name}" must match ${CHECK_NAME.source}`);
     const argv = typeof value === "string" ? splitCommand(value) : Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string" && item.length > 0) ? value : new Error("expected a command string or a non-empty argv array");
     if (argv instanceof Error)
-      return none(`${CHECKS_FILE}: check "${name}": ${argv.message}`);
+      return none(`${label}: check "${name}": ${argv.message}`);
     checks.push({ name, argv, accepts: [argv] });
   }
   const gates = {};
   if (parsed.gates !== undefined) {
     if (!isRecord3(parsed.gates))
-      return none(`${CHECKS_FILE}: gates must be {"testing":"<name>"|["<name>",…]}`);
+      return none(`${label}: gates must be {"testing":"<name>"|["<name>",…]}`);
     for (const [gate, value] of Object.entries(parsed.gates)) {
       if (!GATES.includes(gate))
-        return none(`${CHECKS_FILE}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
+        return none(`${label}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
       const names = typeof value === "string" ? [value] : value;
       if (!Array.isArray(names) || names.length === 0 || !names.every((name) => typeof name === "string" && checks.some((c) => c.name === name)))
-        return none(`${CHECKS_FILE}: gates.${gate} must name configured checks`);
+        return none(`${label}: gates.${gate} must name configured checks`);
       gates[gate] = names;
     }
   }
-  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
+  return { source: label, root, checks, gates, error: null, ...note, resources: parsed.resources };
 }
 function matchesNamedCheck(config, name, argv, cwd) {
   if (config.error || name === null || cwd !== ".")
@@ -15207,7 +15218,7 @@ function workitAvailable(env = process.env) {
 function checkCommand(args, version, onPath = workitAvailable()) {
   return onPath ? `workit check ${args}` : `npx -y @brainervirus/workit-cli@${version} check ${args}`;
 }
-var SCRIPT_CHECKS, CHECKS_FILE = "workit.checks.json", checksConfigFile = (root) => path16.join(root, CHECKS_FILE), isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SHELL_META, git4 = (cwd, args) => {
+var SCRIPT_CHECKS, CHECKS_FILE = ".workit/checks.json", LEGACY_CHECKS_FILE = "workit.checks.json", isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SHELL_META, git4 = (cwd, args) => {
   const run = spawnSync9("git", args, {
     cwd,
     encoding: "utf8",
@@ -15423,7 +15434,7 @@ function evaluateObservedGate(task, requirement, statuses, config) {
     return {
       satisfied: [],
       considered,
-      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE} (committed, so it shows in the diff), e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
+      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE}, e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
     };
   const satisfied = fresh.filter(named);
   if (satisfied.length)

package/dist/mcp-server.js

@@ -21250,8 +21250,13 @@ import { spawnSync as spawnSync3 } from "node:child_process";
 import fs9 from "node:fs";
 import path9 from "node:path";
 var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
-var CHECKS_FILE = "workit.checks.json";
-var checksConfigFile = (root) => path9.join(root, CHECKS_FILE);
+var CHECKS_FILE = ".workit/checks.json";
+var LEGACY_CHECKS_FILE = "workit.checks.json";
+function checksConfigFile(root) {
+  const current = path9.join(root, CHECKS_FILE);
+  const legacy = path9.join(root, LEGACY_CHECKS_FILE);
+  return !fs9.existsSync(current) && fs9.existsSync(legacy) ? legacy : current;
+}
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var SHELL_META = /[|&;<>()$`\\*?[\]{}~!#]/u;
 function splitCommand(command) {
@@ -21365,19 +21370,25 @@ var GATES = ["testing", "verification"];
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
   const file = checksConfigFile(root);
+  const legacy = path9.basename(file) === LEGACY_CHECKS_FILE;
+  const label = legacy ? LEGACY_CHECKS_FILE : CHECKS_FILE;
+  const note = legacy ? {
+    note: `${LEGACY_CHECKS_FILE} is deprecated; move it to ${CHECKS_FILE} (workit doctor --fix)`
+  } : {};
   const none = (error = null) => ({
-    source: error ? CHECKS_FILE : "none",
+    source: error ? label : "none",
     root,
     checks: [],
     gates: {},
-    error
+    error,
+    ...note
   });
   let text = null;
   try {
     text = fs9.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
-      return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
+      return none(`cannot read ${label}: ${error.message}`);
   }
   if (text === null) {
     const checks = detectedChecks(root);
@@ -21387,33 +21398,33 @@ function loadCheckConfig(cwd) {
   try {
     parsed = JSON.parse(text);
   } catch {
-    return none(`${CHECKS_FILE} is not valid JSON`);
+    return none(`${label} is not valid JSON`);
   }
   if (!isRecord(parsed) || !isRecord(parsed.checks))
-    return none(`${CHECKS_FILE} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
+    return none(`${label} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
   const checks = [];
   for (const [name, value] of Object.entries(parsed.checks)) {
     if (!CHECK_NAME.test(name))
-      return none(`${CHECKS_FILE}: check name "${name}" must match ${CHECK_NAME.source}`);
+      return none(`${label}: check name "${name}" must match ${CHECK_NAME.source}`);
     const argv = typeof value === "string" ? splitCommand(value) : Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string" && item.length > 0) ? value : new Error("expected a command string or a non-empty argv array");
     if (argv instanceof Error)
-      return none(`${CHECKS_FILE}: check "${name}": ${argv.message}`);
+      return none(`${label}: check "${name}": ${argv.message}`);
     checks.push({ name, argv, accepts: [argv] });
   }
   const gates = {};
   if (parsed.gates !== undefined) {
     if (!isRecord(parsed.gates))
-      return none(`${CHECKS_FILE}: gates must be {"testing":"<name>"|["<name>",…]}`);
+      return none(`${label}: gates must be {"testing":"<name>"|["<name>",…]}`);
     for (const [gate, value] of Object.entries(parsed.gates)) {
       if (!GATES.includes(gate))
-        return none(`${CHECKS_FILE}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
+        return none(`${label}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
       const names = typeof value === "string" ? [value] : value;
       if (!Array.isArray(names) || names.length === 0 || !names.every((name) => typeof name === "string" && checks.some((c) => c.name === name)))
-        return none(`${CHECKS_FILE}: gates.${gate} must name configured checks`);
+        return none(`${label}: gates.${gate} must name configured checks`);
       gates[gate] = names;
     }
   }
-  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
+  return { source: label, root, checks, gates, error: null, ...note, resources: parsed.resources };
 }
 var sameArgv = (left, right) => left.length === right.length && left.every((item, index) => item === right[index]);
 function matchesNamedCheck(config, name, argv, cwd) {
@@ -24072,7 +24083,7 @@ var productDecision = (task, ledger) => {
     };
   const since = Date.parse(task.createdAt);
   const branch = ledger.branch();
-  const row = ledger.rows().findLast((item) => item.type === "decision" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
+  const row = ledger.rows().findLast((item) => item.type === "decision" && item.by !== "decider" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
   return row ? { met: true, reason: `ledger decision ${row.id} records the choice`, decisionIds: [] } : {
     met: false,
     reason: 'open product choice: ask the user, then `workit ledger decision "<choice>" --why "<reason>"` (or, if it is not open, `workit policy assess --judge product-choice=no --why "<reason>"`)',
@@ -24556,7 +24567,7 @@ function evaluateObservedGate(task, requirement, statuses, config) {
     return {
       satisfied: [],
       considered,
-      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE} (committed, so it shows in the diff), e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
+      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE}, e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
     };
   const satisfied = fresh.filter(named);
   if (satisfied.length)

package/dist/workit-hook.js

@@ -11528,7 +11528,7 @@ var productDecision = (task, ledger) => {
     };
   const since = Date.parse(task.createdAt);
   const branch = ledger.branch();
-  const row = ledger.rows().findLast((item) => item.type === "decision" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
+  const row = ledger.rows().findLast((item) => item.type === "decision" && item.by !== "decider" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
   return row ? { met: true, reason: `ledger decision ${row.id} records the choice`, decisionIds: [] } : {
     met: false,
     reason: 'open product choice: ask the user, then `workit ledger decision "<choice>" --why "<reason>"` (or, if it is not open, `workit policy assess --judge product-choice=no --why "<reason>"`)',
@@ -15071,8 +15071,13 @@ import { spawnSync as spawnSync9 } from "node:child_process";
 import fs12 from "node:fs";
 import path16 from "node:path";
 var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
-var CHECKS_FILE = "workit.checks.json";
-var checksConfigFile = (root) => path16.join(root, CHECKS_FILE);
+var CHECKS_FILE = ".workit/checks.json";
+var LEGACY_CHECKS_FILE = "workit.checks.json";
+function checksConfigFile(root) {
+  const current = path16.join(root, CHECKS_FILE);
+  const legacy = path16.join(root, LEGACY_CHECKS_FILE);
+  return !fs12.existsSync(current) && fs12.existsSync(legacy) ? legacy : current;
+}
 function repoHeavyCommands(root) {
   try {
     const value = JSON.parse(fs12.readFileSync(checksConfigFile(root), "utf8"));
@@ -15196,19 +15201,25 @@ var GATES = ["testing", "verification"];
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
   const file = checksConfigFile(root);
+  const legacy = path16.basename(file) === LEGACY_CHECKS_FILE;
+  const label = legacy ? LEGACY_CHECKS_FILE : CHECKS_FILE;
+  const note = legacy ? {
+    note: `${LEGACY_CHECKS_FILE} is deprecated; move it to ${CHECKS_FILE} (workit doctor --fix)`
+  } : {};
   const none = (error = null) => ({
-    source: error ? CHECKS_FILE : "none",
+    source: error ? label : "none",
     root,
     checks: [],
     gates: {},
-    error
+    error,
+    ...note
   });
   let text = null;
   try {
     text = fs12.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
-      return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
+      return none(`cannot read ${label}: ${error.message}`);
   }
   if (text === null) {
     const checks = detectedChecks(root);
@@ -15218,33 +15229,33 @@ function loadCheckConfig(cwd) {
   try {
     parsed = JSON.parse(text);
   } catch {
-    return none(`${CHECKS_FILE} is not valid JSON`);
+    return none(`${label} is not valid JSON`);
   }
   if (!isRecord3(parsed) || !isRecord3(parsed.checks))
-    return none(`${CHECKS_FILE} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
+    return none(`${label} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
   const checks = [];
   for (const [name, value] of Object.entries(parsed.checks)) {
     if (!CHECK_NAME.test(name))
-      return none(`${CHECKS_FILE}: check name "${name}" must match ${CHECK_NAME.source}`);
+      return none(`${label}: check name "${name}" must match ${CHECK_NAME.source}`);
     const argv = typeof value === "string" ? splitCommand(value) : Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string" && item.length > 0) ? value : new Error("expected a command string or a non-empty argv array");
     if (argv instanceof Error)
-      return none(`${CHECKS_FILE}: check "${name}": ${argv.message}`);
+      return none(`${label}: check "${name}": ${argv.message}`);
     checks.push({ name, argv, accepts: [argv] });
   }
   const gates = {};
   if (parsed.gates !== undefined) {
     if (!isRecord3(parsed.gates))
-      return none(`${CHECKS_FILE}: gates must be {"testing":"<name>"|["<name>",…]}`);
+      return none(`${label}: gates must be {"testing":"<name>"|["<name>",…]}`);
     for (const [gate, value] of Object.entries(parsed.gates)) {
       if (!GATES.includes(gate))
-        return none(`${CHECKS_FILE}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
+        return none(`${label}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
       const names = typeof value === "string" ? [value] : value;
       if (!Array.isArray(names) || names.length === 0 || !names.every((name) => typeof name === "string" && checks.some((c) => c.name === name)))
-        return none(`${CHECKS_FILE}: gates.${gate} must name configured checks`);
+        return none(`${label}: gates.${gate} must name configured checks`);
       gates[gate] = names;
     }
   }
-  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
+  return { source: label, root, checks, gates, error: null, ...note, resources: parsed.resources };
 }
 var sameArgv = (left, right) => left.length === right.length && left.every((item, index) => item === right[index]);
 function matchesNamedCheck(config, name, argv, cwd) {
@@ -15711,7 +15722,7 @@ function evaluateObservedGate(task, requirement, statuses, config) {
     return {
       satisfied: [],
       considered,
-      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE} (committed, so it shows in the diff), e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
+      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE}, e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
     };
   const satisfied = fresh.filter(named);
   if (satisfied.length)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cursor",
-  "version": "8.17.1",
+  "version": "8.18.0",
   "private": false,
   "description": "Workit Cursor plugin — shared MCP transport, native hooks, and sixteen method skills",
   "keywords": [
@@ -46,8 +46,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.17.1",
-    "@brainervirus/workit-mcp": "^8.17.1"
+    "@brainervirus/workit-core": "^8.18.0",
+    "@brainervirus/workit-mcp": "^8.18.0"
   },
   "engines": {
     "node": ">=24"

package/skills/workit-bdd/SKILL.md

@@ -22,7 +22,7 @@ description: Turn requirements into Given/When/Then scenarios, agree the test se
    then take the next scenario. Any edit makes the observation stale; re-run
    before you claim it. A recorded "tests pass" is a note, and an ad-hoc
    `workit check -- <cmd>` never satisfies the gate: only the configured
-   `test` check does. No `test` detected? Create `workit.checks.json`, copying
+   `test` check does. No `test` detected? Create `.workit/checks.json`, copying
    in every check the repo already runs: once it exists it replaces the
    detected defaults.
 5. **Mock only at system boundaries:** network, clock, randomness, other

package/skills/workit-fanout/SKILL.md

@@ -37,8 +37,8 @@ units of ~100+ lines each. Coupled work stays with one owner. Workit never spawn
 6. **Retry once, then escalate.** A stuck or failed slice gets one retry with
    a fresh brief (`workit fanout brief <slice> --mode resume`, same branch);
    if that fails too, re-slice it, take it over, or report the gap. Never
-   chain resumes. A hard slice may race instead: N attempts, keep the best
-   verdict (`references/orchestration.md`).
+   chain resumes. A fix round and recheck that both fail: a decider, not a
+   third round; product choices go to the user (`references/orchestration.md`).
 7. **Verify by the workspace `verification` setting** (`workit grant show`).
    A report is a pointer, never evidence. `self`: a verifier that wrote none
    of the slices, or you if you wrote none. `independent` or high risk: a

package/skills/workit-fanout/references/orchestration.md

@@ -43,6 +43,27 @@ rulings). If the retry fails too, escalate instead of a third worker:
 re-slice it smaller (`workit fanout plan` again), take it over yourself, or
 report the gap to the user.
 
+## Stuck calls: the decider
+
+A failed review gets one fix round and one recheck (the changed hunks only).
+If the recheck fails, or a worker and a reviewer disagree, spawn a decider
+instead of a third round. A decider is a fresh read-only agent, not the author
+or the reviewer. It returns three things: the options, a pick by
+reversibility (the option cheapest to undo wins a tie), and the exact change
+list. The fixer applies that list once, then one focused recheck follows.
+
+- Hard call (shared contract, security, migration): two deciders on different
+  models (Claude Code: a different `model` on the Agent call; OpenCode: a
+  child session on another configured agent; Codex, Cursor and Pi: one
+  decider, since the host picks no model). If they disagree, you take the
+  more reversible option.
+- Record it: `workit ledger decision "<pick>" --by decider --why "<why it is
+  the more reversible>" --view "<decider A: view>" --view "<decider B: view>"`.
+  The row is listed as a decider call; it is never the user's answer to a
+  product choice and never a verdict.
+- A product choice, or authority nobody here has, is not a decider's call:
+  ask the user with your recommendation.
+
 ## Race a hard slice
 
 When a hard slice has an uncertain approach and a cheap VERIFY, run 2-3

package/skills/workit-retro/SKILL.md

@@ -32,7 +32,7 @@ proposes and stops. Nothing changes until the user approves.
    more cited occurrences**; a one-off is not a learning.
 4. **Name the strongest enforcer that works**, strongest first: architecture
    or types (the mistake cannot be written) > lint rule > configured check
-   (`workit.checks.json`, `workit check <name>`) or CI job > test >
+   (`.workit/checks.json`, `workit check <name>`) or CI job > test >
    `CODING_STANDARDS.md` (judgment the reviewer reads) > AGENTS.md pointer
    (navigation only). A mechanical rule gets a check, not prose: a check can
    fail, a sentence cannot. From types to test, the proof is that the new
@@ -60,7 +60,7 @@ Bad: "Agents seem lost in the build. Added 'read the build docs carefully' to
 AGENTS.md." One vague occurrence, no citation, a no-op line, auto-applied.
 
 Good: "Navigation, 3 occurrences (rulings 12, 19; PR #88 thread): agents sought
-check names in package.json, missing `workit.checks.json`. Enforcer: AGENTS.md
+check names in package.json, missing `.workit/checks.json`. Enforcer: AGENTS.md
 pointer, +74 bytes, minus the stale Commands paragraph (-210). Unstable check,
 2 occurrences (ledger rows 31, 44: `e2e` red then green on one SHA): a debug
 slice to fix the check. Approve?"

package/skills/workit-review/SKILL.md

@@ -36,7 +36,10 @@ independent; `type-check-only` never proves a behavior change.
 7. Record the verdict:
    `workit ledger verdict verified|failed|blocked --kind review --branch <b> --how "<what you ran and read>"`
    under your own session (the one the lead or the hook gave you).
-8. **Harness note** (optional): friction caused by the repo or harness, not
+8. **Bound the loop.** A failed verdict gets one fix round and one recheck of
+   the changed hunks. Still failing, or stuck: no third round; the lead spawns
+   a decider (read the `workit-fanout` skill's SKILL.md and follow it). A product choice goes to the user.
+9. **Harness note** (optional): friction caused by the repo or harness, not
    the change (a flaky fixture, a missing check, a misleading doc or skill
    line), goes on its own `Harness note:` line in the report and any PR
    comment, never as a finding or in the verdict, so a later retro finds it.

package/skills/workit-ship/SKILL.md

@@ -30,7 +30,7 @@ once the verdict is accepted. `merged`: step 7. `null` (closed, not merged):
 stop and report. Stop early only for a new consequential choice, a host
 denial, a review comment that needs a product decision, a required update
 that repeats because the base keeps moving, or after 3 failed fix attempts on
-the same check.
+the same check. Fix round and recheck both failed: a decider (read the `workit-fanout` skill's SKILL.md and follow it).
 
 1. **Open.** `workit git push`, then `workit pr create --title "<title>"
    --body-file <f|->` plus `--issue <#n|ID>` per issue (`--refs`: no close; idempotent;

package/skills/workit-verify-app/SKILL.md

@@ -35,7 +35,7 @@ way a user would.
    never run is a guess; do not hand it off.
 4. **Make the driver a named check** when it is cheap and deterministic. A
    named check is one command without shell syntax (put pipes and setup in a
-   script). Add `"verify": "<driver>"` to `checks` in `workit.checks.json`; if
+   script). Add `"verify": "<driver>"` to `checks` in `.workit/checks.json`; if
    the file does not exist yet, first copy in every check the repo already runs
    (test, lint, typecheck), because the file replaces the detected defaults.
    `workit check verify` then records it, and it joins the verification gate