@brainervirus/workit-opencode 8.23.0 → 8.24.0

package/dist/plugin.js

@@ -4,9 +4,9 @@ function define(plugin) {
 }
 
 // packages/workit-core/src/core.ts
-import { spawnSync as spawnSync16 } from "node:child_process";
-import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
-import path25 from "node:path";
+import { spawnSync as spawnSync17 } from "node:child_process";
+import { existsSync as existsSync10, realpathSync as realpathSync5 } from "node:fs";
+import path27 from "node:path";
 
 // packages/workit-core/src/core/task-contract.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -8430,7 +8430,7 @@ var workspaceConfigSchema = object({
   }).passthrough().optional(),
   autoApprove: union([boolean2(), array(nonBlank)]).optional(),
   defaultEndpoint: unknown().optional(),
-  verification: _enum(["self", "independent"]).optional(),
+  verification: _enum(["proportional", "self", "independent"]).optional(),
   delegation: unknown().optional(),
   trailers: boolean2().optional(),
   liveSessionGuard: boolean2().optional(),
@@ -9015,6 +9015,124 @@ function resolveRef(cwd, ref) {
     return null;
   return line(git(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]));
 }
+var LANE_DIFF = [
+  "-c",
+  "core.quotePath=false",
+  "diff",
+  "--no-color",
+  "--no-ext-diff",
+  "--no-textconv",
+  "--no-renames"
+];
+var laneRange = (fork, head) => {
+  if (!safeArg(fork) || head !== null && !safeArg(head))
+    return null;
+  return head === null ? [fork] : [fork, head];
+};
+function diffNumstat(cwd, fork, head) {
+  const range = laneRange(fork, head);
+  if (!range)
+    return null;
+  const run = git(cwd, [...LANE_DIFF, "--numstat", "-z", ...range, "--"]);
+  if (!run.ok)
+    return null;
+  const out = [];
+  for (const record of run.stdout.split("\x00")) {
+    const match = /^(-|\d+)\t(-|\d+)\t(.+)$/su.exec(record.replace(/^\n/u, ""));
+    if (!match)
+      continue;
+    const binary = match[1] === "-";
+    out.push({
+      path: match[3],
+      added: binary ? 0 : Number(match[1]),
+      deleted: binary ? 0 : Number(match[2]),
+      binary
+    });
+  }
+  return out;
+}
+function diffRaw(cwd, fork, head) {
+  const range = laneRange(fork, head);
+  if (!range)
+    return null;
+  const run = git(cwd, [...LANE_DIFF, "--raw", "-z", "--no-abbrev", ...range, "--"]);
+  if (!run.ok)
+    return null;
+  const fields = run.stdout.split("\x00");
+  const out = [];
+  for (let index = 0;index + 1 < fields.length; index += 2) {
+    const meta = /^:(\d{6}) (\d{6}) ([0-9a-f]+) ([0-9a-f]+) [A-Z]\d*$/u.exec(fields[index].replace(/^\n/u, ""));
+    if (!meta)
+      return null;
+    out.push({
+      path: fields[index + 1],
+      oldMode: meta[1],
+      newMode: meta[2],
+      oldBlob: meta[3],
+      newBlob: meta[4]
+    });
+  }
+  return out;
+}
+function readBlobs(cwd, ids) {
+  const out = new Map;
+  const wanted = [...new Set(ids)].filter((id) => /^[0-9a-f]{40,64}$/u.test(id));
+  if (!wanted.length)
+    return out;
+  const run = spawnSync3("git", ["cat-file", "--batch"], {
+    cwd,
+    input: `${wanted.join(`
+`)}
+`,
+    maxBuffer: MAX_BUFFER,
+    timeout: GIT_TIMEOUTS.local,
+    killSignal: "SIGKILL",
+    windowsHide: true
+  });
+  if (run.status !== 0 || !run.stdout)
+    return null;
+  const bytes = run.stdout;
+  let at = 0;
+  for (const id of wanted) {
+    const end = bytes.indexOf(10, at);
+    if (end < 0)
+      return null;
+    const header = bytes.subarray(at, end).toString("utf8").split(" ");
+    at = end + 1;
+    if (header[1] === "missing")
+      continue;
+    const size = Number(header[2]);
+    if (header[0] !== id || !Number.isSafeInteger(size))
+      return null;
+    out.set(id, bytes.subarray(at, at + size));
+    at += size + 1;
+  }
+  return out;
+}
+function treeFilesNamed(cwd, rev, name) {
+  if (!safeArg(rev))
+    return null;
+  const run = git(cwd, ["ls-tree", "-r", "-z", "--full-tree", rev]);
+  if (!run.ok)
+    return null;
+  const out = new Map;
+  for (const record of run.stdout.split("\x00")) {
+    const match = /^\d{6} blob ([0-9a-f]+)\t(.+)$/su.exec(record);
+    if (match && (match[2] === name || match[2].endsWith(`/${name}`)))
+      out.set(match[2], match[1]);
+  }
+  return out;
+}
+function fileAt(cwd, rev, file) {
+  if (!safeArg(rev))
+    return null;
+  const run = git(cwd, ["cat-file", "blob", `${rev}:${file}`]);
+  return run.ok ? run.stdout : null;
+}
+function untrackedFiles(cwd) {
+  const run = git(cwd, ["ls-files", "-z", "--others", "--exclude-standard"]);
+  return run.ok ? run.stdout.split("\x00").filter(Boolean) : [];
+}
 var config2 = (cwd, key) => line(git(cwd, ["config", "--get", key]));
 function currentBranch(cwd) {
   return line(git(cwd, ["symbolic-ref", "--short", "-q", "HEAD"]));
@@ -12775,9 +12893,9 @@ var holdsLiveState = (state, dirty) => state === "running" || dirty === true;
 
 // packages/workit-core/src/core/task-evaluation.ts
 import { createHash as createHash12 } from "node:crypto";
-import * as fs14 from "node:fs";
-import { spawnSync as spawnSync10 } from "node:child_process";
-import path17 from "node:path";
+import * as fs15 from "node:fs";
+import { spawnSync as spawnSync12 } from "node:child_process";
+import path20 from "node:path";
 
 // packages/workit-core/src/check-config.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
@@ -13007,8 +13125,8 @@ function checkCommand(args, version, onPath = workitAvailable()) {
 }
 
 // packages/workit-core/src/core/policy/derive.ts
-import { existsSync as existsSync4 } from "node:fs";
-import path16 from "node:path";
+import { existsSync as existsSync6 } from "node:fs";
+import path19 from "node:path";
 
 // packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
@@ -13912,7 +14030,8 @@ function checkVerdicts(cwd, branch, ledgerRows) {
     verdict: failing?.verdict ?? null,
     reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
   };
-  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && !untrusted(entry.reasons) && STRONG_RESULTS.has(String(entry.verdict.result)));
+  const latestSelf = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && !untrusted(entry.reasons) && (STRONG_RESULTS.has(String(entry.verdict.result)) || FAILING.has(String(entry.verdict.result))));
+  const selfEntry = latestSelf && STRONG_RESULTS.has(String(latestSelf.verdict.result)) ? latestSelf : undefined;
   return {
     branch,
     head,
@@ -13956,151 +14075,1001 @@ var OBSERVED_ONLY = new Set([
   ...PR_ROW_TYPES
 ]);
 
-// packages/workit-core/src/core/policy/derive.ts
-var RULES = {
-  test: "check:test",
-  self: "verdict:self",
-  nonAuthor: "verdict:non-author",
-  verified: "verdict:verified",
-  product: "decision:product",
-  plan: "plan"
-};
-var derived2 = (spec) => ({
-  ...spec,
-  id: requirementId({
-    ruleId: spec.ruleId,
-    scope: spec.scope,
-    satisfaction: spec.satisfaction,
-    before: spec.before,
-    dependentAction: spec.dependentAction
-  })
-});
-var sorted = (values) => [...new Set(values)].toSorted();
-var normalizedScope = (scope) => ({
-  description: scope.description,
-  paths: sorted(scope.paths),
-  exclusions: sorted(scope.exclusions)
-});
-function deriveRequirements(judgment, scope, constraints, verification = "self") {
-  const out = [];
-  const base = { scope, dependentAction: null };
-  if (judgment.behaviorChange)
-    out.push(derived2({
-      ...base,
-      ruleId: RULES.test,
-      dimension: "testing",
-      reason: "Behavior changes: the configured test check must pass on the final tree.",
-      satisfaction: "Run `workit check test` on the final tree.",
-      before: "close",
-      acceptanceAllowed: false
-    }));
-  if (judgment.behaviorChange && judgment.riskTier === "normal")
-    out.push(verification === "independent" ? derived2({
-      ...base,
-      ruleId: RULES.nonAuthor,
-      dimension: "review",
-      reason: "This workspace requires independent verification: a session that did not author the change records the verdict.",
-      satisfaction: "An independent session records a passing verdict: `workit ledger verdict verified --how <what it exercised>`.",
-      before: "close",
-      acceptanceAllowed: false
-    }) : derived2({
-      ...base,
-      ruleId: RULES.self,
-      dimension: "review",
-      reason: "A behavior change needs a recorded verdict; the author's own is allowed and is shown as self-reviewed, never verified.",
-      satisfaction: "After an observed passing `workit check test`, record `workit ledger verdict tests-verified --self --how <what you ran>` (or have a verifier record one).",
-      before: "close",
-      acceptanceAllowed: false
-    }));
-  if (judgment.riskTier === "high")
-    out.push(derived2({
-      ...base,
-      ruleId: RULES.verified,
-      dimension: "review",
-      reason: "High risk: an independent verifier must exercise the live surface.",
-      satisfaction: "An independent verifier runs the real surface and records `workit ledger verdict verified --kind live --how <what it exercised>`.",
-      before: "close",
-      acceptanceAllowed: false
-    }));
-  if (judgment.productChoiceOpen)
-    out.push(derived2({
-      ...base,
-      ruleId: RULES.product,
-      dimension: "decisions",
-      reason: "A product or preference choice is open; the user decides it before code is written.",
-      satisfaction: 'Ask the user (with your recommendation), then record the answer: `workit ledger decision "<choice>" --why "<reason>"`.',
-      before: "write",
-      acceptanceAllowed: false
-    }));
-  if (judgment.needsPlan || judgment.riskTier === "high")
-    out.push(derived2({
-      ...base,
-      ruleId: RULES.plan,
-      dimension: "artifacts",
-      reason: judgment.needsPlan ? "The work needs a written plan or spec before implementation." : "High-risk work needs a written plan before implementation.",
-      satisfaction: "Write the plan or spec (e.g. docs/plans/<slug>.md; docs and Markdown writes stay allowed), then record it: `workit policy assess --ref <path>`.",
-      before: "write",
-      acceptanceAllowed: true
-    }));
-  for (const constraint of constraints)
-    for (const obligation of constraint.requires)
-      out.push(derived2({
-        ruleId: `project-constraint:${constraint.id}:${obligation.kind}:${sha256({
-          kind: obligation.kind,
-          scope: normalizedScope(obligation.scope),
-          refs: obligation.refs.map((ref) => JSON.stringify(ref)).toSorted(),
-          method: obligation.method,
-          before: obligation.before,
-          dependentAction: obligation.dependentAction
-        })}`,
-        dimension: obligation.method ?? (obligation.kind === "check" ? "verification" : obligation.kind === "decision" ? "decisions" : "challenge"),
-        scope: obligation.scope,
-        reason: `${constraint.kind} constraint requires ${obligation.kind}: ${constraint.statement}`,
-        satisfaction: `Satisfy the constraint obligation using its referenced ${obligation.kind}.`,
-        before: obligation.before,
-        dependentAction: obligation.dependentAction,
-        acceptanceAllowed: constraint.acceptanceAllowed && obligation.kind !== "decision"
-      }));
-  const seen = new Set;
-  return out.filter((item) => seen.has(item.id) ? false : (seen.add(item.id), true));
+// packages/workit-core/src/core/policy/lane.ts
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "node:fs";
+import path18 from "node:path";
+
+// packages/workit-core/src/git/ops.ts
+import { spawnSync as spawnSync11 } from "node:child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
+import path17 from "node:path";
+
+// packages/workit-core/src/core/pr-create.ts
+import fs14 from "node:fs";
+import path16 from "node:path";
+import { spawnSync as spawnSync10 } from "node:child_process";
+import { pathToFileURL } from "node:url";
+// packages/workit-core/src/forge/pr-body.ts
+function parseGhIssue(value) {
+  const m = /issues\/(\d+)/.exec(value);
+  return m ? m[1] : String(value).trim().replace(/^#/, "");
 }
-var latestJudgment = (task) => task.judgments?.at(-1)?.data ?? null;
-var ledgerView = (root) => {
-  let branch;
-  let rows;
-  return {
-    branch: () => branch === undefined ? branch = currentBranch(root) : branch,
-    rows: () => {
-      if (rows === undefined) {
-        const read = readLedger(root);
-        rows = read.ok ? read.value.rows : [];
-      }
-      return rows;
+
+// packages/workit-core/src/core/pr-create.ts
+function whichOnPath(tool) {
+  const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
+  for (const dir of (process.env.PATH ?? "").split(path16.delimiter)) {
+    if (!dir)
+      continue;
+    for (const name of names) {
+      const candidate = path16.join(dir, name);
+      try {
+        fs14.accessSync(candidate, fs14.constants.X_OK);
+        return candidate;
+      } catch {}
     }
-  };
+  }
+  return null;
+}
+var hostingCliAvailable = (provider) => whichOnPath(provider === "gitlab" ? "glab" : "gh") !== null;
+var pushRemote = (cwd) => {
+  const result = spawnSync10("git", ["remote", "get-url", "--push", "--all", "origin"], {
+    cwd,
+    encoding: "utf8"
+  });
+  if (result.status !== 0)
+    return null;
+  const urls = (result.stdout ?? "").split(/\r?\n/u).map((url) => url.trim()).filter(Boolean);
+  return urls.length === 1 ? urls[0] : null;
 };
-var productDecision = (task, ledger) => {
-  const decisions = task.decisions.filter((entry) => entry.data.revoked === null && (entry.data.response === "approved" || entry.data.response === "stated") && entry.data.purpose !== "limitation");
-  if (decisions.length)
-    return {
-      met: true,
-      reason: "the user's decision is recorded on the task",
-      decisionIds: decisions.map((entry) => entry.id)
-    };
-  const since = Date.parse(task.createdAt);
-  const branch = ledger.branch();
-  const row = ledger.rows().findLast((item) => item.type === "decision" && item.by !== "decider" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
-  return row ? { met: true, reason: `ledger decision ${row.id} records the choice`, decisionIds: [] } : {
-    met: false,
-    reason: 'open product choice: ask the user, then `workit ledger decision "<choice>" --why "<reason>"` (or, if it is not open, `workit policy assess --judge product-choice=no --why "<reason>"`)',
-    decisionIds: []
-  };
+var safePushUrl = (remote) => {
+  const raw = remote.trim();
+  if (path16.isAbsolute(raw))
+    return pathToFileURL(raw).href;
+  if (!raw.includes("://")) {
+    const scp = /^(?:([^@\s]+)@)?([^:]+):(.+)$/u.exec(raw);
+    if (scp)
+      return `${scp[1] || "git"}@${scp[2]}:${scp[3]}`;
+  }
+  try {
+    const url = new URL(raw);
+    if (!["file:", "git:", "http:", "https:", "ssh:"].includes(url.protocol))
+      return null;
+    url.password = "";
+    if (url.protocol !== "ssh:")
+      url.username = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return null;
+  }
 };
-var planRecorded = (task, root) => {
-  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync4(path16.resolve(root, ref.path)));
-  if (cited)
-    return {
-      met: true,
+var pushTargetIsStable = (cwd, remote) => {
+  const target = safePushUrl(remote);
+  if (!target)
+    return false;
+  const result = spawnSync10("git", ["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"], { cwd, encoding: "utf8" });
+  if (result.status !== 0 && result.status !== 1)
+    return false;
+  const prefixes = (result.stdout ?? "").split(/\r?\n/u).map((line) => line.trim().slice(line.trim().indexOf(" ") + 1)).filter(Boolean);
+  return !prefixes.some((prefix) => target.startsWith(prefix));
+};
+
+// packages/workit-core/src/forge/redact.ts
+var KEY = String.raw`[A-Za-z0-9_.-]*?(?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|account[_-]?key|private[_-]?key|client[_-]?secret|credentials?|authorization|cookie|signature)[A-Za-z0-9_.-]*`;
+var ASSIGNMENT = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*["']?)((?:bearer|basic|token|digest)\s+)?([^\s"',;&]+)`, "giu");
+var QUOTED_ASSIGNMENT = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*)(["'])([^"'\n]*[^\s"'][^"'\n]*)\2`, "giu");
+var ANSI = new RegExp(String.raw`\u001b\[[0-9;?]*[ -/]*[@-~]|\u001b\][^\u0007]*\u0007`, "gu");
+
+// packages/workit-core/src/forge/types.ts
+var success2 = (data) => ({ ok: true, data });
+var failure3 = (code, error, unblock) => ({ ok: false, code, error, ...unblock ? { unblock } : {} });
+
+// packages/workit-core/src/git/ops.ts
+var COMMIT_TIMEOUT_MS = 10 * 60000;
+var git5 = (cwd, args, options = {}) => {
+  const result = spawnSync11("git", args, {
+    cwd,
+    encoding: "utf8",
+    env: { ...options.env ?? process.env, GIT_TERMINAL_PROMPT: "0" },
+    maxBuffer: 64 * 1024 * 1024,
+    timeout: options.timeoutMs ?? GIT_TIMEOUTS.local,
+    killSignal: "SIGKILL",
+    windowsHide: true,
+    ...options.input === undefined ? { stdio: ["ignore", "pipe", "pipe"] } : { input: options.input, stdio: ["pipe", "pipe", "pipe"] }
+  });
+  return {
+    ok: result.status === 0,
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? ""
+  };
+};
+function operationInProgress(cwd) {
+  const markers = [
+    ["rebase-merge", "rebase"],
+    ["rebase-apply", "rebase"],
+    ["MERGE_HEAD", "merge"],
+    ["CHERRY_PICK_HEAD", "cherry-pick"],
+    ["REVERT_HEAD", "revert"]
+  ];
+  const run = git5(cwd, ["rev-parse", ...markers.flatMap(([name]) => ["--git-path", name])]);
+  if (!run.ok)
+    return null;
+  const found = run.stdout.split(`
+`).map((line) => path17.resolve(cwd, line.trim()));
+  const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
+  for (const [index, [, operation]] of markers.entries()) {
+    const marker = found[index];
+    if (!marker || !existsSync4(marker))
+      continue;
+    if (index === 1 && existsSync4(path17.join(marker, "applying")))
+      return { operation: "am", commitAllowed: false, branch: null };
+    if (index === 0 && existsSync4(path17.join(marker, "amend")) && !conflicted()) {
+      let headName = "";
+      try {
+        headName = readFileSync4(path17.join(marker, "head-name"), "utf8").trim();
+      } catch {}
+      const branch = headName.startsWith("refs/heads/") ? headName.slice("refs/heads/".length) : null;
+      return { operation, commitAllowed: branch !== null, branch };
+    }
+    if ((operation === "revert" || operation === "merge") && !conflicted())
+      return { operation, commitAllowed: true, branch: null };
+    return { operation, commitAllowed: false, branch: null };
+  }
+  return null;
+}
+function inProgressFailure(operation, verb) {
+  const command = operation === "am" ? "git am" : `git ${operation}`;
+  return failure3("blocked", `${operation.replace("-", "_")}_in_progress: a ${operation === "am" ? "git am" : operation} is in progress; finish or abort it before workit can ${verb}`, `resolve the conflicts, git add <files>, then ${command} --continue  # or ${command} --abort to return to where you started`);
+}
+function pushPreflight(cwd, options = {}) {
+  const progress = operationInProgress(cwd);
+  if (progress)
+    return inProgressFailure(progress.operation, "push");
+  const branch = options.branch ?? currentBranch(cwd);
+  if (!branch)
+    return failure3("invalid_input", "HEAD is detached; push a branch");
+  if (isProtectedTarget(cwd, branch))
+    return failure3("blocked", `protected_branch: ${branch} is protected by the workspace branch policy; workit git push never pushes to it`, releaseBranch(cwd, branch) ? `workit git push --release ${branch}  # finishing a release or hotfix; needs the release grant` : "workit git branch <feature/name>  # push a feature branch and open a PR");
+  const sha = resolveRef(cwd, `refs/heads/${branch}`);
+  if (!sha)
+    return failure3("not_found", `branch ${branch} has no commit to push`);
+  const remote = pushRemoteName(cwd, branch);
+  if (!remote)
+    return failure3("not_found", "no push remote is configured for this branch", "git remote add origin <url>");
+  const raw = pushUrl(cwd, remote);
+  if (!raw)
+    return failure3("blocked", `remote "${remote}" has no single push URL`, `git remote get-url --push --all ${remote}  # keep exactly one push URL`);
+  const parsed = parseRemoteUrl(raw);
+  const local = parsed?.protocol === "file";
+  if (!local && !pushTargetIsStable(cwd, raw))
+    return failure3("blocked", `push_target_rewritten: the push URL of "${remote}" is rewritten by a url.*.insteadOf rule, so the destination is not the one checked`, "git config --get-regexp '^url\\.'  # remove the rewrite for this remote");
+  return success2({
+    branch,
+    sha,
+    remote,
+    url: redactRemote(raw),
+    rawUrl: raw,
+    local
+  });
+}
+
+// packages/workit-core/src/core/policy/attributes.ts
+function patternRegex(dir, pattern) {
+  if (!pattern || pattern.endsWith("/") || pattern.startsWith('"') || pattern.startsWith("!"))
+    return null;
+  const anchored = pattern.includes("/");
+  const body = pattern.replace(/^\//u, "");
+  let source = "";
+  for (let index = 0;index < body.length; index += 1) {
+    const char = body[index];
+    if (char === "*" && body[index + 1] === "*") {
+      const slash = body[index + 2] === "/";
+      source += slash ? "(?:.*/)?" : ".*";
+      index += slash ? 2 : 1;
+    } else if (char === "*")
+      source += "[^/]*";
+    else if (char === "?")
+      source += "[^/]";
+    else if (char === "[") {
+      const end = body.indexOf("]", index + 2);
+      if (end < 0)
+        return null;
+      const set = body.slice(index + 1, end).replace(/^!/u, "^").replace(/\\/gu, "\\\\");
+      source += `[${set}]`;
+      index = end;
+    } else if (char === "\\" && index + 1 < body.length) {
+      source += body[index + 1].replace(/[.*+?^${}()|[\]\\/]/gu, "\\$&");
+      index += 1;
+    } else
+      source += char.replace(/[.*+?^${}()|[\]\\/]/gu, "\\$&");
+  }
+  const prefix = dir ? `${dir.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}/` : "";
+  try {
+    return new RegExp(anchored ? `^${prefix}${source}$` : `^${prefix}(?:.*/)?${source}$`, "u");
+  } catch {
+    return null;
+  }
+}
+function rulesOf(dir, text) {
+  const out = [];
+  for (const raw of text.split(`
+`)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#") || line.startsWith("[attr]"))
+      continue;
+    const [pattern, ...attributes] = line.split(/\s+/u);
+    let generated = null;
+    for (const attribute of attributes) {
+      if (attribute === "linguist-generated" || attribute === "linguist-generated=true")
+        generated = true;
+      else if (attribute === "-linguist-generated" || attribute === "!linguist-generated" || attribute.startsWith("linguist-generated="))
+        generated = false;
+    }
+    if (generated === null)
+      continue;
+    const regex = patternRegex(dir, pattern);
+    if (regex)
+      out.push({ regex, generated });
+  }
+  return out;
+}
+function generatedByAttributes(files, paths) {
+  const rules = [...files].map(([file, text]) => {
+    const dir = file.includes("/") ? file.slice(0, file.lastIndexOf("/")) : "";
+    return {
+      depth: dir ? dir.split("/").length : 0,
+      rules: rulesOf(dir, text)
+    };
+  }).toSorted((left, right) => left.depth - right.depth).flatMap((entry) => entry.rules);
+  const out = new Set;
+  for (const file of paths) {
+    const last = rules.findLast((rule) => rule.regex.test(file));
+    if (last?.generated)
+      out.add(file);
+  }
+  return out;
+}
+
+// packages/workit-core/src/core/policy/substance.ts
+var SLASH_BLOCK = [["/*", "*/"]];
+var C_LIKE = { line: ["//"], block: SLASH_BLOCK, quotes: `"'` };
+var SYNTAXES = Object.fromEntries([
+  ...["ts", "mts", "cts", "js", "mjs", "cjs"].map((ext) => [ext, { ...C_LIKE, js: true }]),
+  ...["java", "kt", "kts", "scala", "swift", "dart", "groovy"].map((ext) => [
+    ext,
+    { ...C_LIKE, triple: true }
+  ]),
+  ["go", { ...C_LIKE, rawBacktick: true }],
+  ...["css", "scss", "less"].map((ext) => [
+    ext,
+    { line: [], block: SLASH_BLOCK, quotes: `"'`, cssUrl: true }
+  ]),
+  ...["py", "pyi"].map((ext) => [
+    ext,
+    { line: ["#"], block: [], quotes: `"'`, triple: true, indented: true, fstring: true }
+  ]),
+  ["toml", { line: ["#"], block: [], quotes: `"`, literal: "'", triple: true }],
+  ...["html", "htm", "xml", "svg", "xhtml"].map((ext) => [
+    ext,
+    { line: [], block: [["<!--", "-->"]], quotes: "", indented: true }
+  ])
+]);
+var DIRECTIVE = /@ts-|eslint|prettier|biome|oxlint|istanbul|\bc8\b|\bv8\b|@jsx|@flow|@vite|webpack|__PURE__|__NO_SIDE_EFFECTS__|source(?:Mapping)?URL|^\/\s*<|go:|\+build|nolint|noqa|type:|pyright|mypy|pylint|pragma|coding[:=]|fmt:|NOSONAR|@license|@preserve|@refresh|environment|language=|cython|ruff|isort|deno-|@vitest|@jest|swiftlint|ktlint|checkstyle|suppress|nullable|#(?:end)?region/iu;
+var extensionOf = (file) => {
+  const name = file.slice(file.lastIndexOf("/") + 1);
+  const dot = name.lastIndexOf(".");
+  return dot > 0 ? name.slice(dot + 1).toLowerCase() : "";
+};
+var CI_PATH = /^\.github\/|(?:^|\/)(?:\.gitlab-ci\.ya?ml|Jenkinsfile|azure-pipelines\.ya?ml|\.pre-commit-config\.ya?ml|\.circleci\/.*)$/u;
+var syntaxOf = (file) => CI_PATH.test(file) ? null : SYNTAXES[extensionOf(file)] ?? null;
+var SPACE = /[ \t\r\f\v]/u;
+var WORD = /[\w$]/u;
+var NO_SPACE_AFTER = "([{,;";
+var NO_SPACE_BEFORE = ")]},;";
+var REGEX_AFTER = "(,=:[!&|?{};+-*%<>~^";
+var REGEX_KEYWORDS = new Set([
+  "return",
+  "typeof",
+  "instanceof",
+  "case",
+  "do",
+  "else",
+  "in",
+  "of",
+  "new",
+  "delete",
+  "void",
+  "throw",
+  "yield",
+  "await"
+]);
+function substanceOf(file, text) {
+  const syntax = syntaxOf(file);
+  if (!syntax)
+    return plainSubstance(text);
+  const markup = syntax.block.some(([open]) => open === "<!--");
+  if (markup && (/<(?:script|style)\b|<!\[CDATA\[|<\?/iu.test(text) || /[^>\s][ \t]*<!--/u.test(text)))
+    return plainSubstance(text);
+  return lex(syntax, text);
+}
+function plainSubstance(text) {
+  return text.split(`
+`).map((line) => line.replace(/[ \t\r\f\v]+$/u, "")).filter(Boolean).join(`
+`);
+}
+function lex(syntax, text) {
+  const collapse = !syntax.indented;
+  let out = "";
+  let lineStart = 0;
+  let kept = 0;
+  let pendingSpace = false;
+  const frames = [{ kind: "code", braces: 0 }];
+  let index = 0;
+  if (text.startsWith("#!")) {
+    const end = text.indexOf(`
+`);
+    out = end < 0 ? text : text.slice(0, end);
+    kept = out.length;
+    index = end < 0 ? text.length : end;
+  }
+  const emitCode = (chunk) => {
+    if (collapse && pendingSpace && out.length > lineStart) {
+      const before = out[out.length - 1];
+      if (!NO_SPACE_AFTER.includes(before) && !NO_SPACE_BEFORE.includes(chunk[0]))
+        out += " ";
+    }
+    pendingSpace = false;
+    out += chunk;
+  };
+  const emitVerbatim = (chunk) => {
+    emitCode(chunk);
+    kept = out.length;
+  };
+  const newline = () => {
+    if (!collapse) {
+      let end = out.length;
+      while (end > Math.max(lineStart, kept) && SPACE.test(out[end - 1]))
+        end -= 1;
+      out = out.slice(0, end);
+    }
+    pendingSpace = false;
+    if (out.length > lineStart) {
+      out += `
+`;
+      lineStart = out.length;
+    }
+  };
+  const regexAllowed = () => {
+    let end = out.length;
+    while (end > 0 && /\s/u.test(out[end - 1]))
+      end -= 1;
+    if (end === 0 || REGEX_AFTER.includes(out[end - 1]))
+      return true;
+    let start = end;
+    while (start > 0 && WORD.test(out[start - 1]))
+      start -= 1;
+    return REGEX_KEYWORDS.has(out.slice(start, end));
+  };
+  const scanString = (quote, escapes, multiline) => {
+    const prefix = text.slice(Math.max(0, index - 2), index).match(/[a-z]*$/iu)?.[0] ?? "";
+    const fstring = syntax.fstring === true && /f/iu.test(prefix);
+    let end = index + quote.length;
+    while (end < text.length) {
+      const char = text[end];
+      if (escapes && char === "\\") {
+        end += 2;
+        continue;
+      }
+      if (text.startsWith(quote, end)) {
+        if (fstring && unbalanced(text.slice(index + quote.length, end)))
+          return false;
+        emitVerbatim(text.slice(index, end + quote.length));
+        index = end + quote.length;
+        return true;
+      }
+      if (char === `
+` && !multiline)
+        return false;
+      end += 1;
+    }
+    return false;
+  };
+  while (index < text.length) {
+    const frame = frames[frames.length - 1];
+    const char = text[index];
+    if (frame.kind === "template") {
+      if (char === "\\") {
+        emitVerbatim(text.slice(index, index + 2));
+        index += 2;
+      } else if (char === "`") {
+        emitVerbatim(char);
+        frames.pop();
+        index += 1;
+      } else if (text.startsWith("${", index)) {
+        emitVerbatim("${");
+        frames.push({ kind: "code", braces: 0 });
+        index += 2;
+      } else {
+        out += char;
+        kept = out.length;
+        index += 1;
+      }
+      continue;
+    }
+    if (char === `
+`) {
+      newline();
+      index += 1;
+      continue;
+    }
+    if (SPACE.test(char)) {
+      if (collapse)
+        pendingSpace = true;
+      else
+        out += char;
+      index += 1;
+      continue;
+    }
+    const lineOpener = syntax.line.find((opener) => text.startsWith(opener, index));
+    if (lineOpener) {
+      const end = text.indexOf(`
+`, index);
+      const comment = text.slice(index, end < 0 ? text.length : end);
+      if (DIRECTIVE.test(comment.slice(lineOpener.length)))
+        emitVerbatim(comment);
+      else
+        pendingSpace = true;
+      index = end < 0 ? text.length : end;
+      continue;
+    }
+    const block = syntax.block.find(([open]) => text.startsWith(open, index));
+    if (block) {
+      const end = text.indexOf(block[1], index + block[0].length);
+      if (end < 0)
+        return null;
+      const comment = text.slice(index, end + block[1].length);
+      if (DIRECTIVE.test(comment.slice(block[0].length, -block[1].length)))
+        emitVerbatim(comment);
+      else
+        pendingSpace = true;
+      if (comment.includes(`
+`))
+        newline();
+      index = end + block[1].length;
+      continue;
+    }
+    if (syntax.triple && (char === '"' || char === "'") && text.startsWith(char.repeat(3), index)) {
+      if (!scanString(char.repeat(3), !syntax.literal?.includes(char), true))
+        return null;
+      continue;
+    }
+    if (syntax.quotes.includes(char)) {
+      if (!scanString(char, true, Boolean(syntax.multiline)))
+        return null;
+      continue;
+    }
+    if (syntax.literal?.includes(char)) {
+      if (!scanString(char, false, false))
+        return null;
+      continue;
+    }
+    if (syntax.rawBacktick && char === "`") {
+      if (!scanString("`", false, true))
+        return null;
+      continue;
+    }
+    if (syntax.js && char === "`") {
+      emitVerbatim(char);
+      frames.push({ kind: "template" });
+      index += 1;
+      continue;
+    }
+    if (syntax.cssUrl && /^url\(\s*[^"')\s]/iu.test(text.slice(index, index + 64)))
+      return null;
+    if (syntax.js && char === "/" && !regexAllowed() && out.trimEnd().endsWith(")")) {
+      const lineEnd = text.indexOf(`
+`, index);
+      if (text.slice(index + 1, lineEnd < 0 ? text.length : lineEnd).includes("/"))
+        return null;
+    }
+    if (syntax.js && char === "/" && regexAllowed()) {
+      let end = index + 1;
+      let inClass = false;
+      while (end < text.length && (inClass || text[end] !== "/")) {
+        if (text[end] === `
+`)
+          return null;
+        if (text[end] === "\\")
+          end += 1;
+        else if (text[end] === "[")
+          inClass = true;
+        else if (text[end] === "]")
+          inClass = false;
+        end += 1;
+      }
+      if (end >= text.length)
+        return null;
+      emitVerbatim(text.slice(index, end + 1));
+      index = end + 1;
+      continue;
+    }
+    if (frames.length > 1 && frame.kind === "code") {
+      if (char === "{")
+        frame.braces += 1;
+      else if (char === "}") {
+        if (frame.braces === 0) {
+          emitVerbatim(char);
+          frames.pop();
+          index += 1;
+          continue;
+        }
+        frame.braces -= 1;
+      }
+    }
+    emitCode(char);
+    index += 1;
+  }
+  if (frames.length !== 1)
+    return null;
+  newline();
+  return out;
+}
+function unbalanced(body) {
+  let depth = 0;
+  for (const part of body.replaceAll("{{", "").replaceAll("}}", "")) {
+    if (part === "{")
+      depth += 1;
+    else if (part === "}")
+      depth = Math.max(0, depth - 1);
+  }
+  return depth > 0;
+}
+function hasOpaqueLineBreak(text) {
+  return /\r(?!\n)|[\u2028\u2029]/u.test(text);
+}
+var decoder = new TextDecoder("utf-8", { fatal: true });
+function textOf(bytes) {
+  if (bytes.includes(0))
+    return null;
+  try {
+    return decoder.decode(bytes);
+  } catch {
+    return null;
+  }
+}
+function cosmeticChange(file, before, after) {
+  const left = textOf(before);
+  const right = textOf(after);
+  if (left === null || right === null)
+    return false;
+  if (hasOpaqueLineBreak(left) || hasOpaqueLineBreak(right))
+    return false;
+  const a = substanceOf(file, left);
+  return a !== null && a === substanceOf(file, right);
+}
+
+// packages/workit-core/src/core/policy/lane.ts
+var LANE_THRESHOLDS = {
+  selfMaxLines: 100,
+  selfMaxFiles: 5,
+  fullMinLines: 500
+};
+var RISK_TOKENS = new Set([
+  "auth",
+  "authn",
+  "authz",
+  "oauth",
+  "security",
+  "permission",
+  "permissions",
+  "secret",
+  "secrets",
+  "crypto",
+  "gate",
+  "gates",
+  "policy",
+  "policies",
+  "hook",
+  "hooks",
+  "husky",
+  "lefthook",
+  "release",
+  "releases",
+  "migration",
+  "migrations",
+  "migrate",
+  "workflows"
+]);
+var RISK_FILES = new Set([
+  ".gitlab-ci.yml",
+  "Jenkinsfile",
+  "azure-pipelines.yml",
+  ".pre-commit-config.yaml",
+  ".workit/risk-paths"
+]);
+var RISK_NAMES = new Set([".gitattributes"]);
+var RISK_PATHS_FILE = ".workit/risk-paths";
+var LOCKFILES = new Set([
+  "bun.lock",
+  "bun.lockb",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "Cargo.lock",
+  "go.sum",
+  "poetry.lock",
+  "uv.lock",
+  "Pipfile.lock",
+  "Gemfile.lock",
+  "composer.lock"
+]);
+var DOC_EXT = /\.(?:md|mdx|markdown|rst|adoc|txt)$/iu;
+var DOC_NAMES = /^(?:license|licence|notice|authors|changelog|changes|contributors)$/iu;
+var INSTRUCTIONS = /(?:^|\/)(?:AGENTS|CLAUDE|GEMINI|SKILL)\.md$|(?:^|\/)(?:skills|agents|commands|rules|prompts)\/[^/]+/iu;
+var TEST_PATH = /(?:^|\/)(?:test|tests|__tests__|spec|specs|fixtures)\/|\.(?:test|spec)\.[^/]+$/iu;
+var basename = (file) => file.slice(file.lastIndexOf("/") + 1);
+var isDoc = (file) => !INSTRUCTIONS.test(file) && (DOC_EXT.test(file) || DOC_NAMES.test(basename(file)));
+function kindOf(file) {
+  if (file.binary)
+    return "behavior";
+  if (file.generated)
+    return "generated";
+  if (LOCKFILES.has(basename(file.path)))
+    return "lockfile";
+  if (isDoc(file.path))
+    return "doc";
+  if (file.cosmetic)
+    return "cosmetic";
+  return TEST_PATH.test(file.path) ? "test" : "behavior";
+}
+var globCache = new Map;
+function globMatch(pattern, file) {
+  let regex = globCache.get(pattern);
+  if (!regex) {
+    let source = "";
+    for (let index = 0;index < pattern.length; index += 1) {
+      const char = pattern[index];
+      if (char === "*" && pattern[index + 1] === "*") {
+        source += pattern[index + 2] === "/" ? "(?:[^/]*/)*" : ".*";
+        index += pattern[index + 2] === "/" ? 2 : 1;
+      } else if (char === "*")
+        source += "[^/]*";
+      else if (char === "?")
+        source += "[^/]";
+      else
+        source += char.replace(/[.+^${}()|[\]\\]/gu, "\\$&");
+    }
+    regex = new RegExp(`^${source}$`, "u");
+    globCache.set(pattern, regex);
+  }
+  return regex.test(file) || file.startsWith(`${pattern.replace(/\/$/u, "")}/`);
+}
+function isRiskPath(file, extra = []) {
+  if (extra.some((pattern) => globMatch(pattern, file)))
+    return true;
+  if (RISK_FILES.has(file) || RISK_NAMES.has(basename(file)))
+    return true;
+  if (TEST_PATH.test(file) || isDoc(file))
+    return false;
+  return file.split("/").map((segment, index, all) => index === all.length - 1 ? segment.replace(/\.[^.]+$/u, "") : segment).some((segment) => segment.toLowerCase().split(/[-_.]/u).some((token) => RISK_TOKENS.has(token)));
+}
+var parseRiskPaths = (text) => text.split(`
+`).map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).map((line) => line.replace(/^\//u, ""));
+function computeLane(input) {
+  const riskFiles = input.files.filter((file) => isRiskPath(file.path, input.riskPaths)).map((file) => file.path);
+  const risky = new Set(riskFiles);
+  const kinds = input.files.map((file) => ({
+    file,
+    kind: risky.has(file.path) ? "behavior" : kindOf(file)
+  }));
+  const behavior = kinds.filter((entry) => entry.kind === "behavior" || entry.kind === "test" || entry.kind === "lockfile");
+  const lines = behavior.filter((entry) => entry.kind !== "lockfile").reduce((sum, entry) => sum + entry.file.added + entry.file.deleted, 0);
+  const opaque = behavior.filter((entry) => entry.kind === "lockfile" || entry.file.binary);
+  const result = (lane, reasons) => ({
+    lane,
+    reasons,
+    lines,
+    files: behavior.length,
+    riskFiles
+  });
+  const { selfMaxLines, selfMaxFiles, fullMinLines } = LANE_THRESHOLDS;
+  if (input.riskTier === "high")
+    return result("full", ["the task judgment records high risk"]);
+  if (riskFiles.length)
+    return result("full", [
+      `touches a risk path: ${riskFiles.slice(0, 3).join(", ")}${riskFiles.length > 3 ? ", …" : ""}`
+    ]);
+  if (!behavior.length)
+    return result("none", [
+      input.files.length ? "only docs, comments, formatting or generated copies changed" : "no changes"
+    ]);
+  if (lines >= fullMinLines)
+    return result("full", [`large diff: ${lines} lines (≥ ${fullMinLines})`]);
+  if (lines > selfMaxLines)
+    return result("focused", [`${lines} lines changed (> ${selfMaxLines})`]);
+  if (behavior.length > selfMaxFiles)
+    return result("focused", [`${behavior.length} behavior files changed (> ${selfMaxFiles})`]);
+  if (opaque.length)
+    return result("focused", [
+      `a lockfile or binary changed: ${opaque.slice(0, 3).map((entry) => entry.file.path).join(", ")}${opaque.length > 3 ? ", …" : ""}`
+    ]);
+  return result("self", [
+    `small change: ${lines} line${lines === 1 ? "" : "s"} in ${behavior.length} file${behavior.length === 1 ? "" : "s"}, no risk path`
+  ]);
+}
+function untrackedStat(cwd, file) {
+  try {
+    const bytes = readFileSync5(path18.join(cwd, file));
+    if (bytes.includes(0))
+      return { path: file, added: 0, deleted: 0, binary: true };
+    const text = bytes.toString("utf8");
+    if (hasOpaqueLineBreak(text))
+      return { path: file, added: 0, deleted: 0, binary: true };
+    const lines = text.split(`
+`).length - (text.endsWith(`
+`) ? 1 : 0);
+    return { path: file, added: lines, deleted: 0 };
+  } catch {
+    return { path: file, added: 0, deleted: 0, binary: true };
+  }
+}
+var REGULAR = new Set(["100644", "100755"]);
+var ABSENT = /^0+$/u;
+function cosmeticFiles(cwd, fork, head) {
+  const raw = diffRaw(cwd, fork, head);
+  if (!raw)
+    return null;
+  const candidates = raw.filter((entry) => REGULAR.has(entry.oldMode) && entry.oldMode === entry.newMode && !ABSENT.test(entry.oldBlob) && (head === null || !ABSENT.test(entry.newBlob)));
+  const blobs = readBlobs(cwd, candidates.flatMap((entry) => [entry.oldBlob, entry.newBlob]));
+  if (!blobs)
+    return null;
+  const out = new Set;
+  const opaque = new Set;
+  for (const entry of candidates) {
+    const before = blobs.get(entry.oldBlob);
+    let after = blobs.get(entry.newBlob);
+    if (!after && head === null && ABSENT.test(entry.newBlob))
+      try {
+        after = readFileSync5(path18.join(cwd, entry.path));
+      } catch {
+        after = undefined;
+      }
+    if (before && after && cosmeticChange(entry.path, before, after))
+      out.add(entry.path);
+    else if ([before, after].some((bytes) => bytes && hasOpaqueLineBreak(bytes.toString("utf8"))))
+      opaque.add(entry.path);
+  }
+  return { cosmetic: out, opaque };
+}
+function generatedAt(cwd, fork, paths) {
+  const files = treeFilesNamed(cwd, fork, ".gitattributes");
+  const blobs = files?.size ? readBlobs(cwd, [...files.values()]) : null;
+  if (!files || !blobs)
+    return new Set;
+  const texts = new Map;
+  for (const [file, id] of files) {
+    const bytes = blobs.get(id);
+    if (bytes)
+      texts.set(file, bytes.toString("utf8"));
+  }
+  return generatedByAttributes(texts, paths);
+}
+var forkOf = (cwd, base, head) => mergeBase(cwd, base, head ?? "HEAD");
+function laneFiles(cwd, fork, head) {
+  const stats = diffNumstat(cwd, fork, head);
+  const cosmetic = stats ? cosmeticFiles(cwd, fork, head) : null;
+  if (!stats || !cosmetic)
+    return null;
+  const files = [
+    ...stats.map((entry) => ({
+      ...entry,
+      ...cosmetic.opaque.has(entry.path) ? { binary: true } : {},
+      cosmetic: !entry.binary && cosmetic.cosmetic.has(entry.path)
+    })),
+    ...head === null ? untrackedFiles(cwd).map((file) => untrackedStat(cwd, file)) : []
+  ];
+  const generated = generatedAt(cwd, fork, files.map((entry) => entry.path));
+  return files.map((entry) => ({
+    ...entry,
+    generated: generated.has(entry.path)
+  }));
+}
+function branchLane(cwd, options) {
+  const candidates = options.base ? [`origin/${options.base}`, options.base] : [];
+  const base = candidates.find((ref) => resolveRef(cwd, ref) !== null) ?? defaultBase(cwd) ?? null;
+  const head = options.workingTree ? null : options.head;
+  const fork = base && (options.workingTree || options.head) ? forkOf(cwd, base, head) : null;
+  const files = fork ? laneFiles(cwd, fork, head) : null;
+  const riskTier = options.judgment?.riskTier ?? null;
+  if (!fork || !files) {
+    const high = riskTier === "high";
+    return {
+      lane: high ? "full" : "focused",
+      reasons: [
+        `the diff of ${options.head?.slice(0, 12) ?? "(no head)"} against ${base ?? "(no base)"} cannot be read`,
+        ...high ? ["the task judgment records high risk"] : []
+      ],
+      lines: 0,
+      files: 0,
+      riskFiles: [],
+      base,
+      head: options.head
+    };
+  }
+  const repoRisk = parseRiskPaths(fileAt(cwd, fork, RISK_PATHS_FILE) ?? "");
+  return {
+    ...computeLane({
+      files,
+      riskTier,
+      riskPaths: [...repoRisk, ...options.riskPaths ?? []]
+    }),
+    base,
+    head: options.head
+  };
+}
+var laneNeed = (lane) => lane === "none" ? "none" : lane === "self" ? "self" : "non-author";
+
+// packages/workit-core/src/core/policy/derive.ts
+var RULES = {
+  test: "check:test",
+  self: "verdict:self",
+  nonAuthor: "verdict:non-author",
+  verified: "verdict:verified",
+  lane: "verdict:lane",
+  product: "decision:product",
+  plan: "plan"
+};
+var derived2 = (spec) => ({
+  ...spec,
+  id: requirementId({
+    ruleId: spec.ruleId,
+    scope: spec.scope,
+    satisfaction: spec.satisfaction,
+    before: spec.before,
+    dependentAction: spec.dependentAction
+  })
+});
+var sorted = (values) => [...new Set(values)].toSorted();
+var normalizedScope = (scope) => ({
+  description: scope.description,
+  paths: sorted(scope.paths),
+  exclusions: sorted(scope.exclusions)
+});
+function deriveRequirements(judgment, scope, constraints, verification = "self") {
+  const out = [];
+  const base = { scope, dependentAction: null };
+  const proportional = verification === "proportional";
+  if (judgment.behaviorChange)
+    out.push(derived2({
+      ...base,
+      ruleId: RULES.test,
+      dimension: "testing",
+      reason: "Behavior changes: the configured test check must pass on the final tree.",
+      satisfaction: "Run `workit check test` on the final tree.",
+      before: "close",
+      acceptanceAllowed: false
+    }));
+  if (proportional && judgment.riskTier === "normal")
+    out.push(derived2({
+      ...base,
+      ruleId: RULES.lane,
+      dimension: "review",
+      reason: "The review lane computed from the diff decides the verdict: none needs none, self the author's own (shown as self-reviewed), focused and full a non-author one.",
+      satisfaction: "Read the lane in `workit policy assess` or `workit pr status`; record what it asks: `workit ledger verdict tests-verified --self --how <what you ran>` for self, or hand focused and full to a verifier.",
+      before: "close",
+      acceptanceAllowed: false
+    }));
+  if (!proportional && judgment.behaviorChange && judgment.riskTier === "normal")
+    out.push(verification === "independent" ? derived2({
+      ...base,
+      ruleId: RULES.nonAuthor,
+      dimension: "review",
+      reason: "This workspace requires independent verification: a session that did not author the change records the verdict.",
+      satisfaction: "An independent session records a passing verdict: `workit ledger verdict verified --how <what it exercised>`.",
+      before: "close",
+      acceptanceAllowed: false
+    }) : derived2({
+      ...base,
+      ruleId: RULES.self,
+      dimension: "review",
+      reason: "A behavior change needs a recorded verdict; the author's own is allowed and is shown as self-reviewed, never verified.",
+      satisfaction: "After an observed passing `workit check test`, record `workit ledger verdict tests-verified --self --how <what you ran>` (or have a verifier record one).",
+      before: "close",
+      acceptanceAllowed: false
+    }));
+  if (judgment.riskTier === "high")
+    out.push(derived2({
+      ...base,
+      ruleId: RULES.verified,
+      dimension: "review",
+      reason: "High risk: an independent verifier must exercise the live surface.",
+      satisfaction: "An independent verifier runs the real surface and records `workit ledger verdict verified --kind live --how <what it exercised>`.",
+      before: "close",
+      acceptanceAllowed: false
+    }));
+  if (judgment.productChoiceOpen)
+    out.push(derived2({
+      ...base,
+      ruleId: RULES.product,
+      dimension: "decisions",
+      reason: "A product or preference choice is open; the user decides it before code is written.",
+      satisfaction: 'Ask the user (with your recommendation), then record the answer: `workit ledger decision "<choice>" --why "<reason>"`.',
+      before: "write",
+      acceptanceAllowed: false
+    }));
+  if (judgment.needsPlan || judgment.riskTier === "high")
+    out.push(derived2({
+      ...base,
+      ruleId: RULES.plan,
+      dimension: "artifacts",
+      reason: judgment.needsPlan ? "The work needs a written plan or spec before implementation." : "High-risk work needs a written plan before implementation.",
+      satisfaction: "Write the plan or spec (e.g. docs/plans/<slug>.md; docs and Markdown writes stay allowed), then record it: `workit policy assess --ref <path>`.",
+      before: "write",
+      acceptanceAllowed: true
+    }));
+  for (const constraint of constraints)
+    for (const obligation of constraint.requires)
+      out.push(derived2({
+        ruleId: `project-constraint:${constraint.id}:${obligation.kind}:${sha256({
+          kind: obligation.kind,
+          scope: normalizedScope(obligation.scope),
+          refs: obligation.refs.map((ref) => JSON.stringify(ref)).toSorted(),
+          method: obligation.method,
+          before: obligation.before,
+          dependentAction: obligation.dependentAction
+        })}`,
+        dimension: obligation.method ?? (obligation.kind === "check" ? "verification" : obligation.kind === "decision" ? "decisions" : "challenge"),
+        scope: obligation.scope,
+        reason: `${constraint.kind} constraint requires ${obligation.kind}: ${constraint.statement}`,
+        satisfaction: `Satisfy the constraint obligation using its referenced ${obligation.kind}.`,
+        before: obligation.before,
+        dependentAction: obligation.dependentAction,
+        acceptanceAllowed: constraint.acceptanceAllowed && obligation.kind !== "decision"
+      }));
+  const seen = new Set;
+  return out.filter((item) => seen.has(item.id) ? false : (seen.add(item.id), true));
+}
+var latestJudgment = (task) => task.judgments?.at(-1)?.data ?? null;
+var ledgerView = (root) => {
+  let branch;
+  let rows;
+  return {
+    branch: () => branch === undefined ? branch = currentBranch(root) : branch,
+    rows: () => {
+      if (rows === undefined) {
+        const read = readLedger(root);
+        rows = read.ok ? read.value.rows : [];
+      }
+      return rows;
+    }
+  };
+};
+var productDecision = (task, ledger) => {
+  const decisions = task.decisions.filter((entry) => entry.data.revoked === null && (entry.data.response === "approved" || entry.data.response === "stated") && entry.data.purpose !== "limitation");
+  if (decisions.length)
+    return {
+      met: true,
+      reason: "the user's decision is recorded on the task",
+      decisionIds: decisions.map((entry) => entry.id)
+    };
+  const since = Date.parse(task.createdAt);
+  const branch = ledger.branch();
+  const row = ledger.rows().findLast((item) => item.type === "decision" && item.by !== "decider" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
+  return row ? { met: true, reason: `ledger decision ${row.id} records the choice`, decisionIds: [] } : {
+    met: false,
+    reason: 'open product choice: ask the user, then `workit ledger decision "<choice>" --why "<reason>"` (or, if it is not open, `workit policy assess --judge product-choice=no --why "<reason>"`)',
+    decisionIds: []
+  };
+};
+var planRecorded = (task, root) => {
+  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync6(path19.resolve(root, ref.path)));
+  if (cited)
+    return {
+      met: true,
       reason: `plan recorded: ${cited.kind === "file" ? cited.path : cited.kind === "external" ? cited.url : ""}`,
       decisionIds: []
     };
@@ -14111,14 +15080,30 @@ var planRecorded = (task, root) => {
     decisionIds: []
   };
 };
-var verdict = (requirement, root, ledger) => {
+var workingLane = (task, root) => branchLane(root, { head: null, workingTree: true, judgment: latestJudgment(task) });
+var laneVerdict = (task, root, ledger) => {
+  if (!ledger.branch() && latestJudgment(task)?.behaviorChange === false)
+    return {
+      met: true,
+      reason: "no branch to read a lane from, and the judgment records no behavior change",
+      decisionIds: []
+    };
+  const lane = workingLane(task, root);
+  const label = `lane ${lane.lane} (${lane.reasons.join("; ")})`;
+  const need = laneNeed(lane.lane);
+  if (need === "none")
+    return { met: true, reason: `${label}: no verdict needed`, decisionIds: [] };
+  const status = verdict(need === "self" ? RULES.self : RULES.nonAuthor, root, ledger);
+  return { ...status, reason: `${label}: ${status.reason}` };
+};
+var verdict = (ruleId, root, ledger) => {
   const branch = ledger.branch();
   if (!branch)
     return { met: false, reason: "no branch is checked out to hold a verdict", decisionIds: [] };
   const check = checkVerdicts(root, branch, ledger.rows());
   const failing = check.accepted.reasons.includes("failing_verdict");
   const strong = (entry) => STRONG_RESULTS.has(String(entry.verdict.result));
-  const met = !failing && (requirement.ruleId === RULES.verified ? check.verdicts.find((entry) => entry.accepted && entry.kind === "live" && String(entry.verdict.result) === "verified") : requirement.ruleId === RULES.nonAuthor ? check.verdicts.find((entry) => entry.accepted && strong(entry)) : check.verdicts.find((entry) => entry.current && strong(entry)));
+  const met = !failing && (ruleId === RULES.verified ? check.verdicts.find((entry) => entry.accepted && entry.kind === "live" && String(entry.verdict.result) === "verified") : ruleId === RULES.nonAuthor ? check.verdicts.find((entry) => entry.accepted && strong(entry)) : check.verdicts.find((entry) => entry.current && strong(entry)));
   if (met)
     return {
       met: true,
@@ -14126,7 +15111,7 @@ var verdict = (requirement, root, ledger) => {
       decisionIds: []
     };
   const why = failing ? "a current independent verdict fails" : check.verdicts.some((entry) => entry.current && entry.verdict.result === "type-check-only") ? "type-check-only does not prove a behavior change" : (check.accepted.reasons.join(", ") || "no_verdict").replace(/_/g, " ");
-  const unblock = requirement.ruleId === RULES.self ? "record your own verdict after an observed `workit check test`: `workit ledger verdict tests-verified --self --how <what you ran>` (shown as self-reviewed), or have a verifier record one" : `an independent session records \`workit ledger verdict verified${requirement.ruleId === RULES.verified ? " --kind live" : ""} --how <what it exercised>\``;
+  const unblock = ruleId === RULES.self ? "record your own verdict after an observed `workit check test`: `workit ledger verdict tests-verified --self --how <what you ran>` (shown as self-reviewed), or have a verifier record one" : `an independent session records \`workit ledger verdict verified${ruleId === RULES.verified ? " --kind live" : ""} --how <what it exercised>\``;
   return { met: false, reason: `${why}: ${unblock}`, decisionIds: [] };
 };
 function derivedRuleStatus(task, requirement, root, ledger) {
@@ -14138,7 +15123,9 @@ function derivedRuleStatus(task, requirement, root, ledger) {
     case RULES.self:
     case RULES.nonAuthor:
     case RULES.verified:
-      return verdict(requirement, root, ledger);
+      return verdict(requirement.ruleId, root, ledger);
+    case RULES.lane:
+      return laneVerdict(task, root, ledger);
     default:
       return null;
   }
@@ -14157,14 +15144,14 @@ function writeBlockers(task, root) {
 
 // packages/workit-core/src/core/task-evaluation.ts
 var digestBytes = (value) => createHash12("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path17.sep}`);
-var relative = (root, candidate) => path17.relative(root, candidate).split(path17.sep).join("/") || ".";
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path20.sep}`);
+var relative = (root, candidate) => path20.relative(root, candidate).split(path20.sep).join("/") || ".";
 var canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path17.posix.normalize(value);
+  const normalized = path20.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -14200,7 +15187,7 @@ var compareCodeUnits2 = (left, right) => {
   return left.length - right.length;
 };
 var gitPaths = (root) => {
-  const result = spawnSync10("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const result = spawnSync12("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     encoding: "buffer"
   });
@@ -14212,21 +15199,21 @@ var gitPaths = (root) => {
       git: !/not a git repository/i.test(stderr)
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")) : [];
-  const stagedDeleted = spawnSync10("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path20.sep).join("/")) : [];
+  const stagedDeleted = spawnSync12("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path20.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 };
 var walk = (root, directory, output) => {
   let names;
   try {
-    names = fs14.readdirSync(directory);
+    names = fs15.readdirSync(directory);
   } catch {
     return true;
   }
@@ -14234,10 +15221,10 @@ var walk = (root, directory, output) => {
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path17.join(directory, name);
+    const target = path20.join(directory, name);
     let stat;
     try {
-      stat = fs14.lstatSync(target);
+      stat = fs15.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -14252,14 +15239,14 @@ var walk = (root, directory, output) => {
 var scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path17.resolve(root, item);
+    const target = path20.resolve(root, item);
     if (!inside(root, target))
       return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
-    while (!fs14.existsSync(ancestor) && ancestor !== root)
-      ancestor = path17.dirname(ancestor);
+    while (!fs15.existsSync(ancestor) && ancestor !== root)
+      ancestor = path20.dirname(ancestor);
     try {
-      if (!inside(root, fs14.realpathSync(ancestor)))
+      if (!inside(root, fs15.realpathSync(ancestor)))
         return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
     } catch {
       return failure2("invalid_input", `candidate scope cannot be inspected: ${item}`);
@@ -14271,7 +15258,7 @@ var scopeRoots = (root, scope) => {
 function captureCandidate(root, scope, environment = []) {
   let checkout;
   try {
-    checkout = fs14.realpathSync(root);
+    checkout = fs15.realpathSync(root);
   } catch {
     return failure2("invalid_input", "candidate root does not exist");
   }
@@ -14289,11 +15276,11 @@ function captureCandidate(root, scope, environment = []) {
     if (item === ".git" || item === ".workit")
       continue;
     names.add(item);
-    if (!fs14.existsSync(target))
+    if (!fs15.existsSync(target))
       continue;
     let stat;
     try {
-      stat = fs14.lstatSync(target);
+      stat = fs15.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -14309,17 +15296,17 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path17.join(checkout, item);
+    const target = path20.join(checkout, item);
     try {
-      const stat = fs14.lstatSync(target);
+      const stat = fs15.lstatSync(target);
       if (stat.isSymbolicLink()) {
-        const link = fs14.readlinkSync(target);
+        const link = fs15.readlinkSync(target);
         files.push({ path: item, kind: "symlink", digest: digestBytes(link), executable: null });
       } else if (stat.isFile()) {
         files.push({
           path: item,
           kind: "file",
-          digest: digestBytes(fs14.readFileSync(target)),
+          digest: digestBytes(fs15.readFileSync(target)),
           executable: (stat.mode & 73) !== 0
         });
       } else if (!stat.isDirectory()) {
@@ -14344,7 +15331,7 @@ function captureCandidate(root, scope, environment = []) {
   const values = supplied.toSorted((left, right) => compareCodeUnits2(left.name, right.name)).map(({ name, value }) => ({ name, value, refs: [] }));
   if (values.some(({ value }) => value === null))
     completeness = "uncertain";
-  const headResult = spawnSync10("git", ["rev-parse", "HEAD"], { cwd: checkout, encoding: "utf8" });
+  const headResult = spawnSync12("git", ["rev-parse", "HEAD"], { cwd: checkout, encoding: "utf8" });
   if (headResult.status !== 0 && !/not a git repository/i.test(headResult.stderr ?? ""))
     completeness = "uncertain";
   const head = headResult.status === 0 ? headResult.stdout.trim() : null;
@@ -14484,7 +15471,7 @@ var findingVerificationPasses = (findingCandidateId, evidence) => evidence.statu
 var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
   let root;
   try {
-    root = fs14.realpathSync(checkoutRoot);
+    root = fs15.realpathSync(checkoutRoot);
   } catch {
     return failure2("permission_denied", "checkout root is unavailable");
   }
@@ -14493,23 +15480,23 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
       continue;
     if (!reference.digest)
       return failure2("invalid_input", "document references require a byte digest");
-    const target = path17.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path17.sep}`))
+    const target = path20.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path20.sep}`))
       return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const below = path17.relative(root, target);
+      const below = path20.relative(root, target);
       let current = root;
-      for (const segment of below.split(path17.sep)) {
+      for (const segment of below.split(path20.sep)) {
         if (!segment)
           continue;
-        current = path17.join(current, segment);
-        const stat = fs14.lstatSync(current);
-        const real = fs14.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path17.sep}`))
+        current = path20.join(current, segment);
+        const stat = fs15.lstatSync(current);
+        const real = fs15.realpathSync(current);
+        if (real !== root && !real.startsWith(`${root}${path20.sep}`))
           return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -14525,7 +15512,7 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
         if (current !== target && !stat.isDirectory())
           return failure2("invalid_input", "document reference ancestor is not a directory");
       }
-      if (digestBytes(fs14.readFileSync(target)) !== reference.digest)
+      if (digestBytes(fs15.readFileSync(target)) !== reference.digest)
         return failure2("permission_denied", "decision document bytes have changed");
     } catch {
       return failure2("invalid_input", "decision document is unavailable");
@@ -14942,9 +15929,9 @@ Autonomy contract:
   Prose is a note: only a configured check the CLI ran (\`workit check <name>\`)
   satisfies a gate; an ad-hoc \`workit check -- <cmd>\` never does.
 - Author is not verifier: your own verdict is \`--self\`, shown as
-  self-reviewed, never verified. High risk, \`verification: independent\` and
-  merge need a verifier with its own host-derived session (a subagent's
-  \`<lead>:<child>\`); never hand-mint one (\`<lead>-v1\`).
+  self-reviewed, never verified. High risk, a focused or full lane and
+  merge under \`verification: self|independent\` need a verifier with its
+  own host-derived session (a subagent's \`<lead>:<child>\`); never hand-mint one (\`<lead>-v1\`).
 - A local-commit endpoint does not imply PR readiness, and a local commit alone
   is not evidence of a requested remote push. Before reporting delivery,
   reconcile every requested item and observe it (\`workit verify-delivery\`).
@@ -15106,21 +16093,21 @@ var exportDigest = (bundle) => sha256({
   task: bundle.task
 });
 // packages/workit-core/src/core/route-intent.ts
-import { spawnSync as spawnSync12 } from "node:child_process";
-import { existsSync as existsSync6 } from "node:fs";
-import path20 from "node:path";
+import { spawnSync as spawnSync14 } from "node:child_process";
+import { existsSync as existsSync8 } from "node:fs";
+import path23 from "node:path";
 
 // packages/workit-core/src/hooks/raw-git.ts
-import { spawnSync as spawnSync11 } from "node:child_process";
+import { spawnSync as spawnSync13 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
-import fs16 from "node:fs";
+import fs17 from "node:fs";
 import os4 from "node:os";
-import path19 from "node:path";
+import path22 from "node:path";
 
 // packages/workit-core/src/hooks/session-marker.ts
 import { createHash as createHash13 } from "node:crypto";
-import fs15 from "node:fs";
-import path18 from "node:path";
+import fs16 from "node:fs";
+import path21 from "node:path";
 var sessionMarkerFile = (input, session, store) => {
   let dir = store;
   if (dir === undefined) {
@@ -15130,13 +16117,13 @@ var sessionMarkerFile = (input, session, store) => {
     dir = location.dir;
   }
   const name = createHash13("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
-  return path18.join(dir, "hooks", `skills-${name}.json`);
+  return path21.join(dir, "hooks", `skills-${name}.json`);
 };
 var list2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 var EMPTY = { nudged: [], loaded: [], raw: [], stops: [], judges: [] };
 var readRaw = (file) => {
   try {
-    return fs15.readFileSync(file, "utf8");
+    return fs16.readFileSync(file, "utf8");
   } catch {
     return "";
   }
@@ -15157,13 +16144,13 @@ var parseMarker = (text) => {
 };
 var readSessionMarker = (file) => parseMarker(readRaw(file));
 var writeAtomic = (file, marker) => {
-  fs15.mkdirSync(path18.dirname(file), { recursive: true });
+  fs16.mkdirSync(path21.dirname(file), { recursive: true });
   const temp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
   try {
-    fs15.writeFileSync(temp, JSON.stringify(marker));
-    fs15.renameSync(temp, file);
+    fs16.writeFileSync(temp, JSON.stringify(marker));
+    fs16.renameSync(temp, file);
   } catch (error) {
-    fs15.rmSync(temp, { force: true });
+    fs16.rmSync(temp, { force: true });
     throw error;
   }
 };
@@ -15675,17 +16662,17 @@ var GIT_VALUE_OPTIONS = new Set([
 ]);
 var GIT_CONFIG_OPTIONS = new Set(["-c", "--config-env", "--git-dir"]);
 var GIT_CONFIG_ENV = /^GIT_(?:CONFIG\w*|DIR|COMMON_DIR|WORK_TREE)$/;
-var ASSIGNMENT = /^([A-Za-z_]\w*)=([\s\S]*)$/;
+var ASSIGNMENT2 = /^([A-Za-z_]\w*)=([\s\S]*)$/;
 var MAX_DEPTH = 4;
 var MAX_EXPANSIONS = 16;
-var isAbsolute = (value) => path19.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
+var isAbsolute = (value) => path22.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
 var HERE = /^(?:\$PWD|\$\{PWD\}|\$\(\s*pwd\s*\)|`pwd`|\$\(\s*git\s+rev-parse\s+--show-toplevel\s*\))(?=$|[\\/])/;
 var joinDir = (base, raw) => {
   const next = raw.replace(HERE, ".");
   if (base === undefined || /[$`*?]/.test(next) || next === "-")
     return;
-  const expanded = next === "~" || next.startsWith("~/") ? path19.join(os4.homedir(), next.slice(1)) : next;
-  return base === null || isAbsolute(expanded) ? expanded : path19.join(base, expanded);
+  const expanded = next === "~" || next.startsWith("~/") ? path22.join(os4.homedir(), next.slice(1)) : next;
+  return base === null || isAbsolute(expanded) ? expanded : path22.join(base, expanded);
 };
 var rebase = (base, inner) => inner === null ? base : inner === undefined ? undefined : joinDir(base, inner);
 var cdTarget = (words) => {
@@ -15702,7 +16689,7 @@ var stripPrefixes = (input) => {
     const first = words[0];
     if (first === undefined)
       return { words, env };
-    const assignment = ASSIGNMENT.exec(first);
+    const assignment = ASSIGNMENT2.exec(first);
     if (assignment) {
       if (GIT_CONFIG_ENV.test(assignment[1]))
         env[assignment[1]] = assignment[2];
@@ -15761,10 +16748,10 @@ var assignments = (words, vars) => {
     while (rest[0]?.startsWith("-"))
       rest = rest.slice(1);
   }
-  if (rest.length === 0 || !rest.every((word) => ASSIGNMENT.test(word)))
+  if (rest.length === 0 || !rest.every((word) => ASSIGNMENT2.test(word)))
     return null;
   return rest.map((word) => {
-    const [, name, value] = ASSIGNMENT.exec(word);
+    const [, name, value] = ASSIGNMENT2.exec(word);
     return [name, expandWord(value, vars)];
   });
 };
@@ -15952,7 +16939,7 @@ var splitString = (line) => {
       return line.slice(index).join(" ").slice(15);
     if (/^-S./.test(word))
       return [word.slice(2), ...line.slice(index + 1)].join(" ");
-    if (!word.startsWith("-") && !ASSIGNMENT.test(word))
+    if (!word.startsWith("-") && !ASSIGNMENT2.test(word))
       return null;
   }
   return null;
@@ -16515,7 +17502,7 @@ var repoAt = (dir) => {
   return { location, dir, branch: resolveTaskKey(dir, location).branch };
 };
 var isWorkitWorkspace = (repo) => {
-  if (fs16.existsSync(repo.location.dir))
+  if (fs17.existsSync(repo.location.dir))
     return true;
   try {
     return resolveRuntimeWorkspaceVcs(repo.location.top ?? repo.dir) !== null;
@@ -16536,17 +17523,17 @@ var headSha2 = (repo) => {
   if (!git || git.reftable)
     return null;
   try {
-    const head = fs16.readFileSync(path19.join(git.gitDir, "HEAD"), "utf8").trim();
+    const head = fs17.readFileSync(path22.join(git.gitDir, "HEAD"), "utf8").trim();
     if (/^[0-9a-f]{40,64}$/.test(head))
       return head;
     const ref = /^ref: (refs\/.+)$/.exec(head)?.[1];
     if (!ref)
       return null;
-    const common = path19.dirname(repo.location.dir);
+    const common = path22.dirname(repo.location.dir);
     try {
-      return fs16.readFileSync(path19.join(common, ref), "utf8").trim() || null;
+      return fs17.readFileSync(path22.join(common, ref), "utf8").trim() || null;
     } catch {}
-    const packed = fs16.readFileSync(path19.join(common, "packed-refs"), "utf8");
+    const packed = fs17.readFileSync(path22.join(common, "packed-refs"), "utf8");
     return new RegExp(`^([0-9a-f]{40,64}) ${ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "m").exec(packed)?.[1] ?? null;
   } catch {
     return null;
@@ -16558,7 +17545,7 @@ var gitConfig = (dir, invocation, cache) => {
   if (cached)
     return cached;
   const config = new Map;
-  const listed = spawnSync11("git", [...invocation.config ?? [], "config", "-z", "--list"], {
+  const listed = spawnSync13("git", [...invocation.config ?? [], "config", "-z", "--list"], {
     cwd: dir,
     encoding: "utf8",
     timeout: 3000,
@@ -16634,8 +17621,8 @@ var expandGitAliases = (root, invocation, cache = new Map, depth = 0) => {
   const sub = invocation.args[0];
   if (invocation.tool !== "git" || invocation.dir === undefined || !sub || sub.startsWith("-") || GIT_COMMANDS.has(sub) || depth >= MAX_DEPTH)
     return [invocation];
-  const dir = path19.resolve(root, invocation.dir ?? ".");
-  if (!fs16.existsSync(dir))
+  const dir = path22.resolve(root, invocation.dir ?? ".");
+  if (!fs17.existsSync(dir))
     return [invocation];
   const config = gitConfig(dir, invocation, cache);
   const alias = configValue(config, `alias.${sub.toLowerCase()}`);
@@ -16657,11 +17644,11 @@ var expandGitAliases = (root, invocation, cache = new Map, depth = 0) => {
 var normalizedUrl = (url, dir) => {
   const trimmed = url.trim();
   if (/^file:\/\//i.test(trimmed))
-    return path19.resolve(dir, trimmed.slice(7)).replace(/\/+$/, "").replace(/\.git$/, "");
+    return path22.resolve(dir, trimmed.slice(7)).replace(/\/+$/, "").replace(/\.git$/, "");
   const scheme = /^[a-z][a-z0-9+.-]*:\/\//i.exec(trimmed);
   const scp = !scheme && /^(?:[^@/\\]+@)?[^/\\:]{2,}:/.test(trimmed);
   if (!scheme && !scp)
-    return path19.resolve(dir, trimmed).replace(/\/+$/, "").replace(/\.git$/, "");
+    return path22.resolve(dir, trimmed).replace(/\/+$/, "").replace(/\.git$/, "");
   const value = scheme ? trimmed.slice(scheme[0].length).replace(/^[^@/]*@/, "").replace(/^([^/:]+):\d+(?=\/)/, "$1") : trimmed.replace(/^[^@/]*@/, "").replace(":", "/");
   return value.toLowerCase().replace(/\/{2,}/g, "/").replace(/^www\./, "").replace(/\/+$/, "").replace(/\.git$/, "");
 };
@@ -16722,7 +17709,7 @@ var refusal = (action, branch, dir) => {
 };
 var refFacts = (repo, remote) => {
   const facts = { heads: new Set, tags: new Set, remoteHeads: new Set };
-  const listed = spawnSync11("git", ["for-each-ref", "--format=%(refname)", "refs/heads", "refs/tags", `refs/remotes/${remote}`], { cwd: repo.dir, encoding: "utf8", timeout: 5000 });
+  const listed = spawnSync13("git", ["for-each-ref", "--format=%(refname)", "refs/heads", "refs/tags", `refs/remotes/${remote}`], { cwd: repo.dir, encoding: "utf8", timeout: 5000 });
   const remotePrefix = `refs/remotes/${remote}/`;
   for (const ref of (listed.stdout ?? "").split(`
 `)) {
@@ -16739,7 +17726,7 @@ var globBranches = (repo, glob) => {
   const source = glob.source.startsWith("refs/") ? glob.source : `refs/heads/${glob.source}`;
   const [sourcePrefix, sourceSuffix = ""] = source.split("*");
   const [destinationPrefix, destinationSuffix = ""] = glob.destination.split("*");
-  const listed = spawnSync11("git", [
+  const listed = spawnSync13("git", [
     "for-each-ref",
     "--format=%(refname)",
     sourcePrefix.slice(0, sourcePrefix.lastIndexOf("/") + 1)
@@ -16816,7 +17803,7 @@ var tagRefusal = (action, facts, dir) => {
   return `workit: raw ${quote(`git push${action.allTags ? " --tags" : ""}`)} of ${tags.length ? `tag ${tags.join(", ")}` : "tags"} bypasses the release grant. Push a release tag with ${quote(`workit git push --release ${named}`)} (${shape} tags whose commit the production branch already has; a tag never moves), under the ${quote("release")} grant (if refused, ask the user to run ${quote("workit grant set <workspace> release=true")}).`;
 };
 var remoteHeads = (repo, remote) => {
-  const listed = spawnSync11("git", ["ls-remote", "--heads", remote], {
+  const listed = spawnSync13("git", ["ls-remote", "--heads", remote], {
     cwd: repo.dir,
     encoding: "utf8",
     timeout: 3000,
@@ -16885,7 +17872,7 @@ var actionsIn = (cwd, command, dialect, cache = new Map) => {
   const out = [];
   const repos = new Map;
   const repoFor = (relative) => {
-    const dir = path19.resolve(cwd, relative ?? ".");
+    const dir = path22.resolve(cwd, relative ?? ".");
     if (!repos.has(dir)) {
       const repo = repoAt(dir);
       repos.set(dir, repo && isWorkitWorkspace(repo) ? repo : null);
@@ -16970,7 +17957,7 @@ var analysisDenial = (error) => ({
   unblock: SPLIT_IT
 });
 var MARKER_TTL_SECONDS = 3600;
-var markerFile = (repo, session, key) => path19.join(repo.location.dir, "hooks", `commit-${createHash14("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`);
+var markerFile = (repo, session, key) => path22.join(repo.location.dir, "hooks", `commit-${createHash14("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`);
 var callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash14("sha256").update(command).digest("hex")}`;
 function noteRawCommit(input, command, key) {
   try {
@@ -16981,14 +17968,14 @@ function noteRawCommit(input, command, key) {
       if (action.kind !== "commit")
         continue;
       const file = markerFile(repo, input.session.id, key);
-      fs16.mkdirSync(path19.dirname(file), { recursive: true });
-      fs16.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
+      fs17.mkdirSync(path22.dirname(file), { recursive: true });
+      fs17.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
 `);
     }
   } catch {}
 }
 var headCommit = (dir) => {
-  const run = spawnSync11("git", [
+  const run = spawnSync13("git", [
     "log",
     "-1",
     "--format=%H%x1f%ct%x1f%s%x1f%(trailers:key=Workit-Session,valueonly,separator=%x2c)"
@@ -17005,11 +17992,11 @@ var headCommit = (dir) => {
 var settle2 = (input, repo, file) => {
   let marker;
   try {
-    marker = JSON.parse(fs16.readFileSync(file, "utf8"));
+    marker = JSON.parse(fs17.readFileSync(file, "utf8"));
   } catch {
     return;
   }
-  fs16.rmSync(file, { force: true });
+  fs17.rmSync(file, { force: true });
   const session = input.session.id;
   const now = Date.now() / 1000;
   if (typeof marker.at !== "number" || now - marker.at > MARKER_TTL_SECONDS)
@@ -17190,7 +18177,7 @@ var targetsOf = (invocations) => invocations.flatMap((invocation) => invocation.
   branch,
   dir: invocation.dir
 })) : []);
-var localBranchExists = (dir, branch) => spawnSync12("git", ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`], {
+var localBranchExists = (dir, branch) => spawnSync14("git", ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`], {
   cwd: dir,
   stdio: "ignore",
   timeout: 5000
@@ -17200,8 +18187,8 @@ var judgedDir = (root, dir) => {
     return null;
   if (dir === null)
     return root;
-  const resolved = path20.resolve(root, dir);
-  return existsSync6(resolved) && inWorkitWorkspace(resolved) ? resolved : null;
+  const resolved = path23.resolve(root, dir);
+  return existsSync8(resolved) && inWorkitWorkspace(resolved) ? resolved : null;
 };
 var shellBranchPolicyViolation = (root, command, dialect = "posix") => {
   let judged = false;
@@ -17436,7 +18423,7 @@ var judgeInputSummary = (raw) => {
 
 // packages/workit-core/src/autonomy.ts
 import os5 from "node:os";
-import path21 from "node:path";
+import path24 from "node:path";
 
 // packages/workit-core/src/core/safe-write.ts
 import {
@@ -17470,10 +18457,10 @@ var accountHome = () => {
   }
 };
 var grantsHome = { resolve: accountHome };
-var grantsDir = () => path21.join(grantsHome.resolve(), ".config", "workit");
+var grantsDir = () => path24.join(grantsHome.resolve(), ".config", "workit");
 var grantsOverride = () => {
-  const configured = path21.resolve(resolveConfigDir());
-  return configured === path21.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path21.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
+  const configured = path24.resolve(resolveConfigDir());
+  return configured === path24.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path24.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
 };
 var GRANT_KINDS = ["push", "pr", "merge", "release", "rerun"];
 var DEFAULT_GRANTS = Object.freeze({
@@ -17526,8 +18513,16 @@ function endpointView(entry, context) {
     ...issue ? { endpointIssue: issue } : {}
   };
 }
-var DEFAULT_VERIFICATION = "self";
-var verificationOf = (entry) => entry?.verification === "independent" ? "independent" : "self";
+var VERIFICATION_MODES = [
+  "proportional",
+  "self",
+  "independent"
+];
+var DEFAULT_VERIFICATION = "proportional";
+var verificationOf = (entry) => {
+  const value = entry?.verification;
+  return VERIFICATION_MODES.includes(value) ? value : DEFAULT_VERIFICATION;
+};
 var isGrantValue = (value) => value === true || value === false || value === "verified";
 var normalized = (kind, value) => value === "verified" && kind !== "merge" ? true : value;
 var fromAutoApprove = (value) => {
@@ -19273,10 +20268,10 @@ class WorkitCore {
     return this.summary(changed.data.task);
   }
 }
-// packages/workit-core/src/core/repo-context.ts
-import { spawnSync as spawnSync13 } from "node:child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync5, readdirSync as readdirSync4 } from "node:fs";
-import path22 from "node:path";
+// packages/workit-core/src/core/repo-context.ts
+import { spawnSync as spawnSync15 } from "node:child_process";
+import { existsSync as existsSync9, readFileSync as readFileSync7, readdirSync as readdirSync4 } from "node:fs";
+import path25 from "node:path";
 var isSafeContextRange = (value) => value.length <= 4096 && (() => {
   try {
     gitRevisionParts(value);
@@ -19303,7 +20298,7 @@ var invalidRange = (cwd) => ({
   cwd
 });
 var runGit = (cwd, args) => {
-  const result = spawnSync13("git", args, { cwd, encoding: "utf8" });
+  const result = spawnSync15("git", args, { cwd, encoding: "utf8" });
   return {
     stdout: (result.stdout ?? "").trimEnd(),
     stderr: (result.stderr ?? "").trimEnd(),
@@ -19410,7 +20405,7 @@ var findPrTemplate = (cwd) => {
   ]) {
     const parts = rel.split("/");
     const base = parts[parts.length - 1];
-    const dir = parts.length > 1 ? path22.join(cwd, ...parts.slice(0, -1)) : cwd;
+    const dir = parts.length > 1 ? path25.join(cwd, ...parts.slice(0, -1)) : cwd;
     const actual = probeCaseInsensitive(dir, base);
     if (actual)
       return [...parts.slice(0, -1), actual].join("/");
@@ -19441,11 +20436,11 @@ var diffStatForRange = (cwd, range) => {
   return runGit(cwd, ["diff", "--stat", "--"]).stdout;
 };
 var packageScripts = (cwd, keys) => {
-  const pkgPath = path22.join(cwd, "package.json");
-  if (!existsSync7(pkgPath))
+  const pkgPath = path25.join(cwd, "package.json");
+  if (!existsSync9(pkgPath))
     return [];
   try {
-    const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
+    const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
     return keys.filter((k) => pkg.scripts && typeof pkg.scripts[k] === "string").map((k) => `${k}: ${pkg.scripts?.[k]}`);
   } catch {
     return [];
@@ -19467,9 +20462,9 @@ var documentationFiles = (cwd) => {
       if (entry.isDirectory()) {
         if (excluded.has(entry.name))
           continue;
-        walk(path22.join(dir, entry.name), depth + 1);
+        walk(path25.join(dir, entry.name), depth + 1);
       } else if (entry.isFile() && (entry.name === "README.md" || entry.name.endsWith(".md"))) {
-        matches.push("./" + path22.relative(cwd, path22.join(dir, entry.name)).replaceAll("\\", "/"));
+        matches.push("./" + path25.relative(cwd, path25.join(dir, entry.name)).replaceAll("\\", "/"));
       }
     }
   };
@@ -19477,15 +20472,15 @@ var documentationFiles = (cwd) => {
   return matches.toSorted().slice(0, 200);
 };
 var readTrimmed2 = (file, maxLines) => {
-  if (!existsSync7(file))
+  if (!existsSync9(file))
     return "";
-  const lines = readFileSync5(file, "utf8").split(`
+  const lines = readFileSync7(file, "utf8").split(`
 `);
   return lines.slice(0, maxLines).join(`
 `);
 };
 function prReadyContext(root, range) {
-  const cwd = path22.resolve(repoRoot(root));
+  const cwd = path25.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   let stdout = "";
@@ -19543,7 +20538,7 @@ ${status.stderr}` : "");
     stdout += `template_path: ${template}
 
 `;
-    stdout += readTrimmed2(path22.join(cwd, template), 220);
+    stdout += readTrimmed2(path25.join(cwd, template), 220);
   } else {
     stdout += `template_path: none
 
@@ -19553,7 +20548,7 @@ ${status.stderr}` : "");
   stdout += `
 `;
   stdout += printSection("Recent Validation Signals");
-  if (existsSync7(path22.join(cwd, "package.json"))) {
+  if (existsSync9(path25.join(cwd, "package.json"))) {
     stdout += `package.json detected. Common scripts:
 `;
     const found = packageScripts(cwd, ["lint", "format:check", "test", "build"]);
@@ -19562,7 +20557,7 @@ ${status.stderr}` : "");
 `) + `
 `;
   }
-  if (existsSync7(path22.join(cwd, "Cargo.toml")) || existsSync7(path22.join(cwd, "src-tauri/Cargo.toml"))) {
+  if (existsSync9(path25.join(cwd, "Cargo.toml")) || existsSync9(path25.join(cwd, "src-tauri/Cargo.toml"))) {
     stdout += `Rust project detected.
 `;
   }
@@ -19595,7 +20590,7 @@ var CHANGELOG_RULES = `- Use an [Unreleased] section.
 - Apply with the host-native editor, preserving the repository changelog conventions.
 - If Unreleased already has duplicate category headings, normalize_only first.`;
 function changelogContext(root, range) {
-  const cwd = path22.resolve(repoRoot(root));
+  const cwd = path25.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -19613,8 +20608,8 @@ function changelogContext(root, range) {
   stdout += CHANGELOG_RULES + `
 `;
   stdout += printSection("Existing CHANGELOG.md");
-  const changelogPath = path22.join(cwd, "CHANGELOG.md");
-  if (existsSync7(changelogPath)) {
+  const changelogPath = path25.join(cwd, "CHANGELOG.md");
+  if (existsSync9(changelogPath)) {
     stdout += readTrimmed2(changelogPath, 260) + `
 `;
   } else {
@@ -19633,7 +20628,7 @@ function changelogContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function docsRefreshContext(root, range) {
-  const cwd = path22.resolve(repoRoot(root));
+  const cwd = path25.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -19655,8 +20650,8 @@ function docsRefreshContext(root, range) {
 `) + `
 `;
   stdout += printSection("README Preview");
-  const readme = path22.join(cwd, "README.md");
-  if (existsSync7(readme)) {
+  const readme = path25.join(cwd, "README.md");
+  if (existsSync9(readme)) {
     stdout += readTrimmed2(readme, 220) + `
 `;
   } else {
@@ -19664,10 +20659,10 @@ function docsRefreshContext(root, range) {
 `;
   }
   stdout += printSection("Package Scripts");
-  const pkgPath = path22.join(cwd, "package.json");
-  if (existsSync7(pkgPath)) {
+  const pkgPath = path25.join(cwd, "package.json");
+  if (existsSync9(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
+      const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
       stdout += JSON.stringify({ name: pkg.name, version: pkg.version, scripts: pkg.scripts }, null, 2) + `
 `;
     } catch {}
@@ -19678,7 +20673,7 @@ function docsRefreshContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function releaseNotesContext(root, rangeOrTag) {
-  const cwd = path22.resolve(repoRoot(root));
+  const cwd = path25.resolve(repoRoot(root));
   if (!rangeOrTag) {
     return { stdout: "", stderr: `ERROR: release tag or range required
 `, exitCode: 1, cwd };
@@ -19716,7 +20711,7 @@ function releaseNotesContext(root, rangeOrTag) {
 `;
   stdout += printSection("Existing Release Files");
   for (const rel of ["CHANGELOG.md", "RELEASE_NOTES.md", ".github/releases.md"]) {
-    if (existsSync7(path22.join(cwd, rel)))
+    if (existsSync9(path25.join(cwd, rel)))
       stdout += rel + `
 `;
   }
@@ -19744,81 +20739,7 @@ function releaseNotesContext(root, rangeOrTag) {
 }
 
 // packages/workit-core/src/core/tracker-issues.ts
-import { spawnSync as spawnSync15 } from "node:child_process";
-
-// packages/workit-core/src/core/pr-create.ts
-import fs17 from "node:fs";
-import path23 from "node:path";
-import { spawnSync as spawnSync14 } from "node:child_process";
-import { pathToFileURL } from "node:url";
-// packages/workit-core/src/forge/pr-body.ts
-function parseGhIssue(value) {
-  const m = /issues\/(\d+)/.exec(value);
-  return m ? m[1] : String(value).trim().replace(/^#/, "");
-}
-
-// packages/workit-core/src/core/pr-create.ts
-function whichOnPath(tool) {
-  const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
-  for (const dir of (process.env.PATH ?? "").split(path23.delimiter)) {
-    if (!dir)
-      continue;
-    for (const name of names) {
-      const candidate = path23.join(dir, name);
-      try {
-        fs17.accessSync(candidate, fs17.constants.X_OK);
-        return candidate;
-      } catch {}
-    }
-  }
-  return null;
-}
-var hostingCliAvailable = (provider) => whichOnPath(provider === "gitlab" ? "glab" : "gh") !== null;
-var pushRemote = (cwd) => {
-  const result = spawnSync14("git", ["remote", "get-url", "--push", "--all", "origin"], {
-    cwd,
-    encoding: "utf8"
-  });
-  if (result.status !== 0)
-    return null;
-  const urls = (result.stdout ?? "").split(/\r?\n/u).map((url) => url.trim()).filter(Boolean);
-  return urls.length === 1 ? urls[0] : null;
-};
-var safePushUrl = (remote) => {
-  const raw = remote.trim();
-  if (path23.isAbsolute(raw))
-    return pathToFileURL(raw).href;
-  if (!raw.includes("://")) {
-    const scp = /^(?:([^@\s]+)@)?([^:]+):(.+)$/u.exec(raw);
-    if (scp)
-      return `${scp[1] || "git"}@${scp[2]}:${scp[3]}`;
-  }
-  try {
-    const url = new URL(raw);
-    if (!["file:", "git:", "http:", "https:", "ssh:"].includes(url.protocol))
-      return null;
-    url.password = "";
-    if (url.protocol !== "ssh:")
-      url.username = "";
-    url.search = "";
-    url.hash = "";
-    return url.toString();
-  } catch {
-    return null;
-  }
-};
-var pushTargetIsStable = (cwd, remote) => {
-  const target = safePushUrl(remote);
-  if (!target)
-    return false;
-  const result = spawnSync14("git", ["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"], { cwd, encoding: "utf8" });
-  if (result.status !== 0 && result.status !== 1)
-    return false;
-  const prefixes = (result.stdout ?? "").split(/\r?\n/u).map((line) => line.trim().slice(line.trim().indexOf(" ") + 1)).filter(Boolean);
-  return !prefixes.some((prefix) => target.startsWith(prefix));
-};
-
-// packages/workit-core/src/core/tracker-issues.ts
+import { spawnSync as spawnSync16 } from "node:child_process";
 var repoPathFromRemote = (remote) => {
   let rest = (remote || "").trim().replace(/\/+$/, "");
   if (!rest)
@@ -19839,7 +20760,7 @@ var defaultCli = (bin, available) => {
   if (!available)
     return null;
   return (args, root) => {
-    const out = spawnSync15(bin, args, {
+    const out = spawnSync16(bin, args, {
       cwd: root,
       encoding: "utf8",
       env: { ...process.env, PATH: process.env.PATH ?? "" }
@@ -19918,7 +20839,7 @@ var fetchGitLabIssueBody = async (ref, root, deps = {}) => {
 
 // packages/workit-core/src/core/youtrack.ts
 import fs18 from "node:fs";
-import path24 from "node:path";
+import path26 from "node:path";
 
 // packages/workit-core/src/core/templates.ts
 var repoRoot2 = assetRoot();
@@ -19931,8 +20852,8 @@ var resolveWorkspaceRoot = (explicit) => explicit || process.cwd();
 // packages/workit-core/src/core/youtrack.ts
 var ISSUE_RE = /^[A-Z]+-\d+$/;
 var TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";
-var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path24.join(configDir(), "youtrack.json");
-var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path24.join(resolveConfigDir(), "youtrack.json");
+var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path26.join(configDir(), "youtrack.json");
+var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path26.join(resolveConfigDir(), "youtrack.json");
 var youTrackTokenModeOk = (p) => {
   if (process.platform === "win32")
     return true;
@@ -20000,7 +20921,7 @@ var youTrackToken = () => {
   if ("error" in loaded)
     return loaded;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path24.isAbsolute(tokenFile) ? path24.resolve(tokenFile) : path24.resolve(process.cwd(), tokenFile) : "";
+  const tokenPath = tokenFile ? path26.isAbsolute(tokenFile) ? path26.resolve(tokenFile) : path26.resolve(process.cwd(), tokenFile) : "";
   if (!tokenPath || !fs18.existsSync(tokenPath))
     return { error: "missing youtrack.token" };
   if (!youTrackTokenModeOk(tokenPath))
@@ -20051,7 +20972,7 @@ function youTrackTokenCreateUrl() {
   const desc = String(defaults.description ?? "OpenCode workit — /wk-issue-update and /wk-meetings");
   const scopes = Array.isArray(defaults.scopes) ? defaults.scopes : ["YouTrack"];
   const base = String(config.baseUrl ?? "").replace(/\/+$/, "");
-  const tokenFile = String(config.tokenFile ?? path24.join(path24.dirname(loaded.path), "youtrack.token"));
+  const tokenFile = String(config.tokenFile ?? path26.join(path26.dirname(loaded.path), "youtrack.token"));
   const tab = String(defaults.profileTab ?? "account-security");
   const createUrl = base ? `${base}/users/me?${new URLSearchParams({ tab })}` : null;
   const docsUrl = "https://www.jetbrains.com/help/youtrack/cloud/manage-permanent-token.html";
@@ -20060,7 +20981,7 @@ function youTrackTokenCreateUrl() {
       tokenName: name,
       tokenDescription: desc,
       scopes,
-      tokenFile: path24.resolve(tokenFile),
+      tokenFile: path26.resolve(tokenFile),
       createUrl,
       docsUrl,
       prefillSupported: false,
@@ -20400,22 +21321,22 @@ function resolveGitRevision(root, value) {
 }
 function resolveInside(root, candidate) {
   const base = realpathSync5(root);
-  const target = path25.resolve(base, candidate);
-  if (target !== base && !target.startsWith(base + path25.sep)) {
+  const target = path27.resolve(base, candidate);
+  if (target !== base && !target.startsWith(base + path27.sep)) {
     throw new Error("path must stay inside repository root");
   }
   let ancestor = target;
-  while (!existsSync8(ancestor))
-    ancestor = path25.dirname(ancestor);
+  while (!existsSync10(ancestor))
+    ancestor = path27.dirname(ancestor);
   const canonicalAncestor = realpathSync5(ancestor);
-  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path25.sep)) {
+  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path27.sep)) {
     throw new Error("path must stay inside repository root");
   }
   return target;
 }
 function run2(root, executable, args, env = {}) {
   const cwd = realpathSync5(root);
-  const result = spawnSync16(executable, args, {
+  const result = spawnSync17(executable, args, {
     cwd,
     encoding: "utf8",
     env: { ...process.env, ...env }
@@ -20452,7 +21373,7 @@ var capabilitiesFor = (descriptor, observed = {}) => descriptor.capabilities.map
   };
 });
 // packages/workit-core/src/hooks/context.ts
-import path26 from "node:path";
+import path28 from "node:path";
 var MIGRATION_PENDING_NOTE = "workit migration pending — run `workit task status`";
 var migrationPending = (result) => !result.ok && result.code === "needs_input" && (result.error ?? "").startsWith(MIGRATION_PENDING);
 var boundTo = (entry, session) => entry.sessions.some((item) => item.host === session.host && item.handle === session.handle);
@@ -20537,7 +21458,7 @@ function entryCompactContext(store, entry, session, context) {
     return null;
   const freshness = { mode: "signal", current: () => recentSignal(store.root) };
   const observed = task?.data.evidence.some(isObservedCheck) ?? false;
-  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path26.resolve(store.root, ref.path)] : []));
+  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path28.resolve(store.root, ref.path)] : []));
   const observedFiles = filesKey(files);
   const compact = new WorkitCore(store, context).compactContext(entry?.id ?? null, freshness, origin && { origin: origin.origin, taskId: origin.entry.id });
   if (!compact.ok || !compact.data)
@@ -20570,7 +21491,7 @@ var shellPolicy = (cwd, command, dialect = "posix") => {
 // packages/workit-core/src/core/heavy-rules.ts
 import fs19 from "node:fs";
 import os6 from "node:os";
-import path27 from "node:path";
+import path29 from "node:path";
 var EMPTY2 = () => ({ deny: [], allow: [] });
 var readText2 = (file) => {
   try {
@@ -20611,19 +21532,19 @@ function parseJsonc(text) {
   return JSON.parse(out.replace(/,(\s*[}\]])/gu, "$1"));
 }
 function gitTop(cwd) {
-  for (let dir = path27.resolve(cwd);; dir = path27.dirname(dir)) {
-    if (fs19.existsSync(path27.join(dir, ".git")))
+  for (let dir = path29.resolve(cwd);; dir = path29.dirname(dir)) {
+    if (fs19.existsSync(path29.join(dir, ".git")))
       return dir;
-    if (path27.dirname(dir) === dir)
+    if (path29.dirname(dir) === dir)
       return null;
   }
 }
 var projectDirs = (cwd) => {
   const top = gitTop(cwd);
   const dirs = [];
-  for (let dir = path27.resolve(cwd);; dir = path27.dirname(dir)) {
+  for (let dir = path29.resolve(cwd);; dir = path29.dirname(dir)) {
     dirs.push(dir);
-    if (!top || dir === top || path27.dirname(dir) === dir)
+    if (!top || dir === top || path29.dirname(dir) === dir)
       return dirs;
   }
 };
@@ -20635,12 +21556,12 @@ var CLAUDE_MANAGED = {
 };
 function claudeSettingsFiles(cwd, env, platform = process.platform) {
   const project = env.CLAUDE_PROJECT_DIR || gitTop(cwd) || cwd;
-  const user = env.CLAUDE_CONFIG_DIR || path27.join(homeOf(env), ".claude");
+  const user = env.CLAUDE_CONFIG_DIR || path29.join(homeOf(env), ".claude");
   return [
     ...CLAUDE_MANAGED[platform] ? [CLAUDE_MANAGED[platform]] : [],
-    path27.join(user, "settings.json"),
-    path27.join(project, ".claude", "settings.json"),
-    path27.join(project, ".claude", "settings.local.json")
+    path29.join(user, "settings.json"),
+    path29.join(project, ".claude", "settings.json"),
+    path29.join(project, ".claude", "settings.local.json")
   ];
 }
 var bashPattern = (entry) => {
@@ -20730,10 +21651,10 @@ var opencodeConfig = (value, rules) => {
 function opencodeRules(cwd, env = process.env) {
   const rules = EMPTY2();
   try {
-    const config = env.XDG_CONFIG_HOME || path27.join(homeOf(env), ".config");
+    const config = env.XDG_CONFIG_HOME || path29.join(homeOf(env), ".config");
     const files = [
-      ...OPENCODE_NAMES.map((name) => path27.join(config, "opencode", name)),
-      ...projectDirs(cwd).flatMap((dir) => OPENCODE_NAMES.flatMap((name) => [path27.join(dir, name), path27.join(dir, ".opencode", name)])),
+      ...OPENCODE_NAMES.map((name) => path29.join(config, "opencode", name)),
+      ...projectDirs(cwd).flatMap((dir) => OPENCODE_NAMES.flatMap((name) => [path29.join(dir, name), path29.join(dir, ".opencode", name)])),
       ...env.OPENCODE_CONFIG ? [env.OPENCODE_CONFIG] : []
     ];
     for (const file of files) {
@@ -20777,9 +21698,9 @@ var codexRule = (body) => {
 function codexRules(cwd, env = process.env) {
   const rules = EMPTY2();
   try {
-    const home = env.CODEX_HOME || path27.join(homeOf(env), ".codex");
+    const home = env.CODEX_HOME || path29.join(homeOf(env), ".codex");
     const top = gitTop(cwd) ?? cwd;
-    for (const dir of [path27.join(home, "rules"), path27.join(top, ".codex", "rules")]) {
+    for (const dir of [path29.join(home, "rules"), path29.join(top, ".codex", "rules")]) {
       let files;
       try {
         files = fs19.readdirSync(dir).filter((name) => name.endsWith(".rules"));
@@ -20789,7 +21710,7 @@ function codexRules(cwd, env = process.env) {
         return "unreadable";
       }
       for (const name of files) {
-        const text = readText2(path27.join(dir, name)) ?? "";
+        const text = readText2(path29.join(dir, name)) ?? "";
         for (const part of text.split(/\bprefix_rule\s*\(/u).slice(1)) {
           const rule = codexRule(part);
           if (!rule)
@@ -20808,8 +21729,8 @@ function cursorRules(cwd, env = process.env) {
   try {
     const top = gitTop(cwd) ?? cwd;
     for (const file of [
-      path27.join(homeOf(env), ".cursor", "cli-config.json"),
-      path27.join(top, ".cursor", "cli.json")
+      path29.join(homeOf(env), ".cursor", "cli-config.json"),
+      path29.join(top, ".cursor", "cli.json")
     ]) {
       const text = readText2(file);
       if (text === null)
@@ -20885,21 +21806,21 @@ function wrapAllowed(read, words, command, options = {}) {
 // packages/workit-core/src/core/heavy.ts
 import fs20 from "node:fs";
 import os7 from "node:os";
-import path28 from "node:path";
+import path30 from "node:path";
 function stateDir(env, platform = process.platform) {
   if (env.WORKFLOW_TOOLKIT_STATE)
     return env.WORKFLOW_TOOLKIT_STATE;
   if (env.XDG_STATE_HOME)
-    return path28.join(env.XDG_STATE_HOME, "workit");
+    return path30.join(env.XDG_STATE_HOME, "workit");
   const home = env.HOME || os7.homedir();
   if (platform === "darwin")
-    return path28.join(home, "Library", "Application Support", "workit");
+    return path30.join(home, "Library", "Application Support", "workit");
   if (platform === "win32")
-    return path28.join(env.LOCALAPPDATA ?? path28.join(home, "AppData", "Local"), "workit");
-  return path28.join(home, ".local", "state", "workit");
+    return path30.join(env.LOCALAPPDATA ?? path30.join(home, "AppData", "Local"), "workit");
+  return path30.join(home, ".local", "state", "workit");
 }
 var HEAVY_COMMANDS_FILE = "heavy-commands.json";
-var heavyCommandsFile = (env) => path28.join(stateDir(env), HEAVY_COMMANDS_FILE);
+var heavyCommandsFile = (env) => path30.join(stateDir(env), HEAVY_COMMANDS_FILE);
 var HEAVY_SCRIPT = /^(?:test|tests|t|tst|unit|integration|e2e|coverage|cov|lint|eslint|typecheck|type-check|types|tsc|check|verify|validate|build|compile|bundle|ci|sonar|cypress|playwright|jest|vitest|mocha|bench|benchmark|all)(?:$|[:_.-])/iu;
 var INFO_FLAGS = new Set(["--version", "-v", "-V", "--help", "-h", "help", "version"]);
 var WATCH_FLAG = /^(?:--watch(?:All)?(?:=.*)?|-w|--serve)$/u;
@@ -21174,7 +22095,7 @@ function machinePatterns(env) {
   return isRecord5(value) ? stringList(value.patterns) : [];
 }
 function repoPatterns(cwd) {
-  return repoHeavyCommands(gitTop(cwd) ?? path28.resolve(cwd));
+  return repoHeavyCommands(gitTop(cwd) ?? path30.resolve(cwd));
 }
 function heavyLines(lines, options) {
   const found = [];
@@ -21252,12 +22173,12 @@ function heavyPlan(command, options) {
 }
 function workitOnPath2(env = process.env) {
   const names = process.platform === "win32" ? ["workit.exe", "workit.cmd", "workit"] : ["workit"];
-  for (const dir of (env.PATH ?? "").split(path28.delimiter))
+  for (const dir of (env.PATH ?? "").split(path30.delimiter))
     for (const name of names) {
       if (!dir)
         continue;
       try {
-        fs20.accessSync(path28.join(dir, name), fs20.constants.X_OK);
+        fs20.accessSync(path30.join(dir, name), fs20.constants.X_OK);
         return true;
       } catch {}
     }
@@ -21276,20 +22197,20 @@ function leaseRewrite(command) {
 // packages/workit-core/src/core/heavy-words.ts
 import fs21 from "node:fs";
 import os8 from "node:os";
-import path29 from "node:path";
+import path31 from "node:path";
 var HEAVY_WORDS = new Set(("npm npx pnpm pnpx yarn bun bunx deno corepack make gmake docker podman nerdctl " + "python python3 py uv poetry pdm pipenv hatch rye bundle rake nx " + "jest vitest mocha ava tap karma jasmine nyc c8 tsc vue-tsc svelte-check eslint stylelint " + "tslint webpack webpack-cli rollup parcel tsup vite next nuxt nuxi astro ng react-scripts " + "playwright cypress wdio testcafe turbo lerna sonar-scanner sonarless sonarless-mcp go " + "golangci-lint gotestsum staticcheck cargo mvn mvnw gradle gradlew ant sbt bazel bazelisk " + "buck2 dotnet msbuild pytest py.test tox nox mypy pyright pylint coverage maturin pip pip3 " + "rspec rails phpunit pest phpstan psalm composer mix swift xcodebuild flutter dart pod cmake " + "ninja meson ctest scons docker-compose buildah earthly").split(" "));
 var wordsOf = (command) => command.split(/[\s;&|()<>`'"]+/u).map((word) => (word.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat)$/u, "")).filter(Boolean);
 var stateDir2 = (env) => {
   if (env.WORKFLOW_TOOLKIT_STATE)
     return env.WORKFLOW_TOOLKIT_STATE;
   if (env.XDG_STATE_HOME)
-    return path29.join(env.XDG_STATE_HOME, "workit");
+    return path31.join(env.XDG_STATE_HOME, "workit");
   const home = env.HOME || os8.homedir();
   if (process.platform === "darwin")
-    return path29.join(home, "Library", "Application Support", "workit");
+    return path31.join(home, "Library", "Application Support", "workit");
   if (process.platform === "win32")
-    return path29.join(env.LOCALAPPDATA ?? path29.join(home, "AppData", "Local"), "workit");
-  return path29.join(home, ".local", "state", "workit");
+    return path31.join(env.LOCALAPPDATA ?? path31.join(home, "AppData", "Local"), "workit");
+  return path31.join(home, ".local", "state", "workit");
 };
 var readJson2 = (file) => {
   try {
@@ -21300,15 +22221,15 @@ var readJson2 = (file) => {
 };
 var patternWords = (cwd, env) => {
   const patterns = [];
-  const machine = readJson2(path29.join(stateDir2(env), "heavy-commands.json"));
+  const machine = readJson2(path31.join(stateDir2(env), "heavy-commands.json"));
   if (Array.isArray(machine?.patterns))
     patterns.push(...machine.patterns);
-  for (let dir = path29.resolve(cwd);; dir = path29.dirname(dir)) {
-    if (fs21.existsSync(path29.join(dir, ".git"))) {
+  for (let dir = path31.resolve(cwd);; dir = path31.dirname(dir)) {
+    if (fs21.existsSync(path31.join(dir, ".git"))) {
       patterns.push(...repoHeavyCommands(dir));
       break;
     }
-    if (path29.dirname(dir) === dir)
+    if (path31.dirname(dir) === dir)
       break;
   }
   const words = new Set;
@@ -21367,21 +22288,21 @@ function heavyGate(cwd, command, options) {
   }
 }
 // packages/workit-core/src/hooks/write-gate.ts
-import { existsSync as existsSync9, realpathSync as realpathSync6 } from "node:fs";
+import { existsSync as existsSync11, realpathSync as realpathSync6 } from "node:fs";
 import os10 from "node:os";
-import path31 from "node:path";
+import path33 from "node:path";
 
 // packages/workit-core/src/core/live-session.ts
-import { spawnSync as spawnSync17 } from "node:child_process";
+import { spawnSync as spawnSync18 } from "node:child_process";
 import { createHash as createHash15 } from "node:crypto";
 import fs22 from "node:fs";
 import os9 from "node:os";
-import path30 from "node:path";
+import path32 from "node:path";
 var LIVE_SESSION_TTL_MS = 15 * 60000;
 var HEARTBEAT_EVERY_MS = 30000;
 var liveProbe = {
   platform: process.platform,
-  run: (args) => spawnSync17("ps", args, { encoding: "utf8", timeout: 2000 }).stdout ?? "",
+  run: (args) => spawnSync18("ps", args, { encoding: "utf8", timeout: 2000 }).stdout ?? "",
   start: (pid) => processStartOf(pid)
 };
 var leadOf = (session) => session.split(":")[0].replace(/-w-.*$/su, "") || session;
@@ -21450,15 +22371,15 @@ var liveOwner = (input, transport, env = process.env) => {
   };
 };
 var checkoutOf = (target) => {
-  let dir = path30.resolve(target);
-  while (!fs22.existsSync(dir) && path30.dirname(dir) !== dir)
-    dir = path30.dirname(dir);
+  let dir = path32.resolve(target);
+  while (!fs22.existsSync(dir) && path32.dirname(dir) !== dir)
+    dir = path32.dirname(dir);
   if (fs22.existsSync(dir) && !fs22.statSync(dir).isDirectory())
-    dir = path30.dirname(dir);
-  const parts = dir.split(path30.sep);
+    dir = path32.dirname(dir);
+  const parts = dir.split(path32.sep);
   const dotGit = parts.lastIndexOf(".git");
   if (dotGit > 0)
-    dir = parts.slice(0, dotGit).join(path30.sep) || path30.sep;
+    dir = parts.slice(0, dotGit).join(path32.sep) || path32.sep;
   const location = resolveStore(dir);
   if (location instanceof Error || !location.shared || !location.top)
     return null;
@@ -21468,9 +22389,9 @@ var checkoutOf = (target) => {
   } catch {}
   return top;
 };
-var markerFile2 = (top) => path30.join(resolveStateDir(), "live-sessions", `${createHash15("sha256").update(checkoutKey(top)).digest("hex").slice(0, 32)}.json`);
+var markerFile2 = (top) => path32.join(resolveStateDir(), "live-sessions", `${createHash15("sha256").update(checkoutKey(top)).digest("hex").slice(0, 32)}.json`);
 var checkoutKey = (top, platform = process.platform) => {
-  let key = path30.resolve(top);
+  let key = path32.resolve(top);
   try {
     key = fs22.realpathSync.native(key);
   } catch {}
@@ -21565,7 +22486,7 @@ var claimLiveSession = (target, owner, deps = {}) => {
       checkout,
       heartbeatAt: now.toISOString()
     };
-    fs22.mkdirSync(path30.dirname(file), { recursive: true });
+    fs22.mkdirSync(path32.dirname(file), { recursive: true });
     const temp = `${file}.${process.pid}.tmp`;
     fs22.writeFileSync(temp, JSON.stringify(marker));
     fs22.renameSync(temp, file);
@@ -21577,22 +22498,22 @@ var NONE3 = { kind: "none" };
 var CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
 var canonical2 = (file) => {
   let rest = "";
-  for (let dir = path31.resolve(file);; dir = path31.dirname(dir)) {
+  for (let dir = path33.resolve(file);; dir = path33.dirname(dir)) {
     try {
-      return path31.join(realpathSync6.native(dir), rest);
+      return path33.join(realpathSync6.native(dir), rest);
     } catch {
-      if (path31.dirname(dir) === dir)
-        return path31.resolve(file);
-      rest = rest ? path31.join(path31.basename(dir), rest) : path31.basename(dir);
+      if (path33.dirname(dir) === dir)
+        return path33.resolve(file);
+      rest = rest ? path33.join(path33.basename(dir), rest) : path33.basename(dir);
     }
   }
 };
 var exempt = (cwd, root, file, plans) => {
   const fold = (value) => CASE_INSENSITIVE ? value.toLowerCase() : value;
-  const relative = path31.relative(fold(canonical2(root)), fold(canonical2(path31.resolve(cwd, file))));
-  if (relative.startsWith("..") || path31.isAbsolute(relative))
+  const relative = path33.relative(fold(canonical2(root)), fold(canonical2(path33.resolve(cwd, file))));
+  if (relative.startsWith("..") || path33.isAbsolute(relative))
     return true;
-  const posix = relative.split(path31.sep).join("/");
+  const posix = relative.split(path33.sep).join("/");
   const segments = posix.split("/");
   return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
 };
@@ -21769,10 +22690,10 @@ var linkSources = (args, at) => {
   const sources = names.filter((name, index) => into >= 0 ? name !== dest : index < names.length - 1 || names.length === 1);
   const target = dest === undefined ? null : at(dest);
   const symbolic = args.some((arg) => /^-[a-zA-Z]*s|^--symbolic$/.test(arg));
-  const base = target === null ? null : into >= 0 || sources.length > 1 || existsSync9(target) || /[\\/]$/.test(dest ?? "") ? target : path31.dirname(target);
+  const base = target === null ? null : into >= 0 || sources.length > 1 || existsSync11(target) || /[\\/]$/.test(dest ?? "") ? target : path33.dirname(target);
   return sources.flatMap((source) => {
-    if (symbolic && base !== null && !path31.isAbsolute(homeExpanded(source)))
-      return [path31.resolve(base, source)];
+    if (symbolic && base !== null && !path33.isAbsolute(homeExpanded(source)))
+      return [path33.resolve(base, source)];
     const resolved = at(source);
     return resolved ? [resolved] : [];
   });
@@ -21801,7 +22722,7 @@ var shellWrites = (command, depth = 0) => {
   return { writes: true, targets: unknown ? null : targets };
 };
 var cache2 = new Map;
-var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path31.resolve(root, file)) ?? "-").join("\x00");
+var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path33.resolve(root, file)) ?? "-").join("\x00");
 var gateFor = (cwd) => {
   const store = new TaskStore(cwd);
   const listed = store.listTaskIndex();
@@ -21880,13 +22801,13 @@ var gitMutationDirs = (cwd, command, dialect) => {
       return [];
     if (sub === "stash" && ["list", "show"].includes(rest[0] ?? ""))
       return [];
-    return [path31.resolve(cwd, invocation.dir ?? ".")];
+    return [path33.resolve(cwd, invocation.dir ?? ".")];
   });
 };
 var CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
 var PUSHD2 = new Set(["pushd", "push-location"]);
 var POPD2 = new Set(["popd", "pop-location"]);
-var UNKNOWN_DIR = path31.resolve(path31.parse(process.cwd()).root, ".workit-unknown-dir");
+var UNKNOWN_DIR = path33.resolve(path33.parse(process.cwd()).root, ".workit-unknown-dir");
 var cdInto = (dir, words, strict = false) => {
   const lost = strict ? UNKNOWN_DIR : undefined;
   const named = words.slice(1).find((word) => !word.startsWith("-") || word === "-");
@@ -21895,7 +22816,7 @@ var cdInto = (dir, words, strict = false) => {
     return lost;
   if (dir === undefined)
     return lost;
-  return target === undefined ? os10.homedir() : path31.resolve(dir, target);
+  return target === undefined ? os10.homedir() : path33.resolve(dir, target);
 };
 var quoteWord2 = (word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`;
 var homeExpanded = (file) => {
@@ -21909,7 +22830,7 @@ var segmentTargets = (cwd, command, dialect, depth = 0, strict = false) => {
   const groups = [];
   const at = (file) => {
     const home = homeExpanded(file);
-    return path31.isAbsolute(home) ? home : dir === undefined ? null : path31.resolve(dir, home);
+    return path33.isAbsolute(home) ? home : dir === undefined ? null : path33.resolve(dir, home);
   };
   for (const segment of segmentsOf(command, dialect)) {
     if (segment.group === "open") {
@@ -21949,7 +22870,7 @@ var segmentTargets = (cwd, command, dialect, depth = 0, strict = false) => {
       for (const file of opaque ?? []) {
         const resolved = at(file);
         if (resolved)
-          targets.push(file === "." ? path31.join(resolved, DIR_TARGET) : resolved);
+          targets.push(file === "." ? path33.join(resolved, DIR_TARGET) : resolved);
       }
       const ln = words.findIndex((word) => /^ln$/i.test(word.split(/[\\/]/).at(-1) ?? ""));
       if (ln >= 0 && words.slice(0, ln).every((word) => PREFIXES2.has(word)))
@@ -21964,7 +22885,7 @@ var segmentTargets = (cwd, command, dialect, depth = 0, strict = false) => {
     const edits = editsOf(segment.words);
     if (edits === null) {
       if (dir !== undefined)
-        targets.push(path31.join(dir, DIR_TARGET));
+        targets.push(path33.join(dir, DIR_TARGET));
     } else
       for (const file of edits) {
         const resolved = at(file);
@@ -21975,20 +22896,20 @@ var segmentTargets = (cwd, command, dialect, depth = 0, strict = false) => {
       for (const invocation of workitInvocations(segment.words.map(quoteWord2).join(" "), "posix")) {
         const { at: runsIn, args } = workitCwd(dir, invocation);
         if (args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), ""))
-          targets.push(path31.join(runsIn, DIR_TARGET));
+          targets.push(path33.join(runsIn, DIR_TARGET));
       }
   }
   return targets;
 };
 var workitCwd = (dir, args) => {
   const { rest, cwd } = skipWorkitGlobals(args);
-  return { at: cwd === null ? dir : path31.resolve(dir, homeExpanded(cwd)), args: rest };
+  return { at: cwd === null ? dir : path33.resolve(dir, homeExpanded(cwd)), args: rest };
 };
 var shellMutationTargets = (cwd, command, dialect = "posix", strict = false) => {
   try {
     return [
       ...segmentTargets(cwd, command, dialect, 0, strict),
-      ...gitMutationDirs(cwd, command, dialect).map((dir) => path31.join(dir, DIR_TARGET))
+      ...gitMutationDirs(cwd, command, dialect).map((dir) => path33.join(dir, DIR_TARGET))
     ];
   } catch {
     return [];
@@ -22025,7 +22946,7 @@ var liveDeny = ({ marker, checkout, ageMs, file }) => {
 var guarded = (targets) => {
   const seen = new Set;
   return targets.filter((target) => {
-    const dir = path31.dirname(target);
+    const dir = path33.dirname(target);
     if (seen.has(dir))
       return false;
     seen.add(dir);
@@ -22046,7 +22967,7 @@ var claimAll = (owner, targets, deps) => {
   for (const target of guarded(targets))
     claimLiveSession(target, owner, deps);
 };
-var liveTargets = (cwd, paths) => paths?.length ? paths.map((file) => path31.resolve(cwd, file)) : [path31.join(cwd, DIR_TARGET)];
+var liveTargets = (cwd, paths) => paths?.length ? paths.map((file) => path33.resolve(cwd, file)) : [path33.join(cwd, DIR_TARGET)];
 var issuedTarget = (cwd, targets) => {
   const state = resolveStateDir();
   const found = targets.find((target) => underIssued(state, cwd, homeExpanded(target), process.platform, canonical2));
@@ -22054,7 +22975,7 @@ var issuedTarget = (cwd, targets) => {
 };
 var underIssued = (state, cwd, target, platform = process.platform, real = (file) => file) => {
   const win = platform === "win32";
-  const p = win ? path31.win32 : path31.posix;
+  const p = win ? path33.win32 : path33.posix;
   const fold = (value) => win || platform === "darwin" ? value.toLowerCase() : value;
   const named = win ? target.replace(/^\/([a-zA-Z])(?=\/|$)/, "$1:") : target;
   const relative = p.relative(fold(real(p.resolve(state))), fold(real(p.resolve(cwd, named))));
@@ -22144,7 +23065,25 @@ function beforeWriteGate(cwd, paths) {
   }
 }
 // packages/workit-core/src/hooks/stop.ts
-import { spawnSync as spawnSync18 } from "node:child_process";
+import { spawnSync as spawnSync19 } from "node:child_process";
+
+// packages/workit-core/src/core/policy/current-judgment.ts
+function currentJudgment(cwd) {
+  try {
+    const store = new TaskStore(cwd);
+    const listed = store.listTaskIndex();
+    const key = store.currentKey();
+    if (!listed.ok || !key.ok)
+      return null;
+    const entry = listed.data.filter((item) => item.key === key.data.key && item.status !== "closed").toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))[0];
+    const task = entry ? store.readTask(entry.id) : null;
+    return task?.ok === true ? latestJudgment(task.data) : null;
+  } catch {
+    return null;
+  }
+}
+
+// packages/workit-core/src/hooks/stop.ts
 var NONE4 = { kind: "none" };
 var QUESTION = /[?？؟](?=[\s*_`"')\]>]*(?:\s|$))|¿/;
 var OFFER = /\b(?:let me know|want me to|should I|shall I|would you like|do you want|if you(?:'d| would) like|may I|can I go ahead)\b/i;
@@ -22165,7 +23104,7 @@ var asksUser = (message) => {
 };
 var short = (sha) => (sha ?? "?").slice(0, 12);
 var gitList = (cwd, args) => {
-  const run = spawnSync18("git", args, {
+  const run = spawnSync19("git", args, {
     cwd,
     encoding: "utf8",
     timeout: 3000,
@@ -22237,29 +23176,32 @@ var redChecks = (rows, pr, head, endpoint) => {
     reason: `PR #${pr}'s checks were last seen ${state} at ${short(head)}, and this workspace's endpoint is \`${endpoint}\`: run \`workit ci wait --pr ${pr}\`${state === "failing" ? " after fixing the failures `workit pr status` lists (then push)" : ""}.`
   };
 };
-var taskJudgment = (cwd) => {
-  try {
-    const store = new TaskStore(cwd);
-    const listed = store.listTaskIndex();
-    const key = store.currentKey();
-    if (!listed.ok || !key.ok)
-      return null;
-    const entry = listed.data.filter((item) => item.key === key.data.key && item.status !== "closed").toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))[0];
-    const task = entry ? store.readTask(entry.id) : null;
-    return task?.ok === true ? latestJudgment(task.data) : null;
-  } catch {
-    return null;
-  }
+var prBase = (rows) => {
+  const seen = rows.findLast((row) => (row.type === "pr.status" || row.type === "pr.created") && row.observer === "workit_cli" && typeof row.base === "string");
+  return typeof seen?.base === "string" ? seen.base : null;
 };
-var unverified = (cwd, branch, all, descriptor, verification) => {
+var unverified = (cwd, branch, all, descriptor, verification, head) => {
   const check = checkVerdicts(cwd, branch, all);
   if (check.accepted.accepted || check.accepted.reasons.includes("failing_verdict"))
     return null;
-  const judgment = taskJudgment(cwd);
+  const judgment = currentJudgment(cwd);
   const high = judgment?.riskTier === "high";
-  if (judgment && !judgment.behaviorChange && !high)
-    return null;
-  const independent = verification === "independent" || high;
+  let independent;
+  if (verification === "proportional") {
+    const lane = branchLane(cwd, {
+      base: prBase(all.filter((row) => row.branch === branch)),
+      head,
+      judgment
+    });
+    const need = laneNeed(lane.lane);
+    if (need === "none")
+      return null;
+    independent = need === "non-author";
+  } else {
+    if (judgment && !judgment.behaviorChange && !high)
+      return null;
+    independent = verification === "independent" || high;
+  }
   if (!independent && check.review === "self-reviewed")
     return null;
   const has = check.review === "self-reviewed" ? "only a self verdict" : "no current verdict";
@@ -22306,7 +23248,7 @@ function stopObligation(input, descriptor) {
     }
     if (!delivered || endpoint !== "green" && endpoint !== "merged")
       return null;
-    const left = unverified(input.cwd, branch, all, descriptor, autonomy.verification);
+    const left = unverified(input.cwd, branch, all, descriptor, autonomy.verification, head);
     return left ? { ...left, head } : null;
   } catch {
     return null;
@@ -22576,9 +23518,9 @@ var WRITE_TOOLS = new Set([
 ]);
 // packages/workit-core/src/hooks/standing.ts
 import fs23 from "node:fs";
-import path32 from "node:path";
+import path34 from "node:path";
 var readPlans = (store) => {
-  const dir = path32.join(store, "fanouts");
+  const dir = path34.join(store, "fanouts");
   let names;
   try {
     names = fs23.readdirSync(dir).filter((name) => name.endsWith(".json"));
@@ -22588,7 +23530,7 @@ var readPlans = (store) => {
   const plans = [];
   for (const name of names) {
     try {
-      const raw = JSON.parse(fs23.readFileSync(path32.join(dir, name), "utf8"));
+      const raw = JSON.parse(fs23.readFileSync(path34.join(dir, name), "utf8"));
       if (typeof raw.name !== "string" || !Array.isArray(raw.slices))
         continue;
       const texts = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string" && item !== "") : [];
@@ -22796,11 +23738,11 @@ var OPENCODE_DESCRIPTOR = {
   ]
 };
 // packages/workit-opencode/src/shared/init-apply.ts
-import path37 from "node:path";
+import path39 from "node:path";
 
 // packages/workit-core/src/core/gitignore.ts
-import { existsSync as existsSync10, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import path33 from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "node:fs";
+import path35 from "node:path";
 var GITIGNORE_ENTRIES = [
   "# workit: SDD working state (never commit)",
   "docs/*/sdd/",
@@ -22820,8 +23762,8 @@ var GITIGNORE_ENTRIES = [
 var ensureProjectGitignore = (workspaceRoot, confirmed) => {
   if (!confirmed)
     return { ok: false, error: "confirmed: true required" };
-  const file = path33.join(workspaceRoot, ".gitignore");
-  const existing = existsSync10(file) ? readFileSync6(file, "utf8") : "";
+  const file = path35.join(workspaceRoot, ".gitignore");
+  const existing = existsSync12(file) ? readFileSync8(file, "utf8") : "";
   const existingLines = new Set(existing.split(`
 `).map((l) => l.trim()).filter(Boolean));
   const added = [];
@@ -22840,33 +23782,33 @@ var ensureProjectGitignore = (workspaceRoot, confirmed) => {
 ` : "") + append.join(`
 `) + `
 `, "utf8");
-  } else if (!existsSync10(file)) {
+  } else if (!existsSync12(file)) {
     writeFileSync4(file, "", "utf8");
   }
   return { ok: true, path: file, added };
 };
 
 // packages/workit-core/src/core/hygiene.ts
-import { existsSync as existsSync11, readFileSync as readFileSync7, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import path34 from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync9, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import path36 from "node:path";
 var repoRoot3 = assetRoot();
-var templatesDir = () => path34.join(repoRoot3, "templates", "hygiene");
+var templatesDir = () => path36.join(repoRoot3, "templates", "hygiene");
 var packageJson = (root) => {
-  if (!existsSync11(path34.join(root, "package.json")))
+  if (!existsSync13(path36.join(root, "package.json")))
     return null;
   try {
-    return JSON.parse(readFileSync7(path34.join(root, "package.json"), "utf8"));
+    return JSON.parse(readFileSync9(path36.join(root, "package.json"), "utf8"));
   } catch {
     return null;
   }
 };
 var isOpenSource = (root) => {
-  if (existsSync11(path34.join(root, "LICENSE")))
+  if (existsSync13(path36.join(root, "LICENSE")))
     return true;
   const pkg = packageJson(root);
   if (pkg && !pkg.private)
     return true;
-  return path34.basename(root) === "workflow-toolkit";
+  return path36.basename(root) === "workflow-toolkit";
 };
 var licenseHolder = (root) => {
   const pkg = packageJson(root);
@@ -22889,13 +23831,13 @@ var planHygieneFiles = (root, opts = {}) => {
     files.push("LICENSE", "CONTRIBUTING.md");
   const planned = [];
   for (const file of files) {
-    if (existsSync11(path34.join(root, file)))
+    if (existsSync13(path36.join(root, file)))
       continue;
-    const tpl = path34.join(templatesDir(), file);
-    if (!existsSync11(tpl))
+    const tpl = path36.join(templatesDir(), file);
+    if (!existsSync13(tpl))
       continue;
-    const content = readFileSync7(tpl, "utf8").replace(/<PROJECT>/g, path34.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
-    planned.push({ path: path34.join(root, file), content });
+    const content = readFileSync9(tpl, "utf8").replace(/<PROJECT>/g, path36.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
+    planned.push({ path: path36.join(root, file), content });
   }
   return planned;
 };
@@ -22905,30 +23847,30 @@ var ensureHygieneFiles = (root, opts) => {
   const created = [];
   for (const planned of planHygieneFiles(root, opts)) {
     writeFileSync5(planned.path, planned.content, "utf8");
-    created.push(path34.basename(planned.path));
+    created.push(path36.basename(planned.path));
   }
   return { ok: true, created };
 };
 
 // packages/workit-core/src/core/init.ts
 import fs24 from "node:fs";
-import path36 from "node:path";
-import { spawnSync as spawnSync19 } from "node:child_process";
+import path38 from "node:path";
+import { spawnSync as spawnSync20 } from "node:child_process";
 
 // packages/workit-core/src/core/workspace-branch-policy.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync8, renameSync as renameSync3, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "node:fs";
-import path35 from "node:path";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync10, renameSync as renameSync3, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "node:fs";
+import path37 from "node:path";
 import { isDeepStrictEqual } from "node:util";
 var readFileSafe = (p) => {
   try {
-    return readFileSync8(p, "utf8");
+    return readFileSync10(p, "utf8");
   } catch {
     return null;
   }
 };
 function applyWorkspaceBranchPolicy(opts) {
   const { workspace_root, env = process.env } = opts;
-  const dir = path35.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
+  const dir = path37.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
   const {
     status,
     path: wsPath,
@@ -22940,7 +23882,7 @@ function applyWorkspaceBranchPolicy(opts) {
   if (status === "malformed" || status === "invalid")
     return { ok: false, error: workspacesError ?? `invalid workspaces.json: ${wsPath}` };
   const detection = detectBranchPolicy(workspace_root);
-  const name = String(env.WORKFLOW_BP_NAME ?? path35.basename(workspace_root));
+  const name = String(env.WORKFLOW_BP_NAME ?? path37.basename(workspace_root));
   const integration = env.WORKFLOW_BP_INTEGRATION ?? detection.integration;
   const policy = {
     preset: detection.preset,
@@ -22989,7 +23931,7 @@ function applyWorkspaceBranchPolicy(opts) {
       ok: false,
       error: `workspaces.json changed while applying the branch policy: ${wsPath}`
     };
-  mkdirSync4(path35.dirname(wsPath), { recursive: true });
+  mkdirSync4(path37.dirname(wsPath), { recursive: true });
   const tmp = `${wsPath}.${process.pid}.tmp`;
   try {
     writeFileSync6(tmp, JSON.stringify({ ...document, workspaces: next }, null, 2) + `
@@ -23036,7 +23978,7 @@ var resolveInitProvider = (cwd) => {
     return env.toLowerCase();
   const root = cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
   try {
-    const out = spawnSync19("git", ["remote", "get-url", "origin"], {
+    const out = spawnSync20("git", ["remote", "get-url", "origin"], {
       cwd: root,
       encoding: "utf8"
     });
@@ -23054,7 +23996,7 @@ var youtrackJsonContent = (dir) => {
   const meetingIssue = process.env.WORKFLOW_YT_MEETING_ISSUE;
   return {
     baseUrl: process.env.WORKFLOW_YT_BASE_URL ?? "https://youtrack.example.com",
-    tokenFile: process.env.WORKFLOW_YT_TOKEN_FILE ?? path36.join(dir, "youtrack.token"),
+    tokenFile: process.env.WORKFLOW_YT_TOKEN_FILE ?? path38.join(dir, "youtrack.token"),
     ...meetingIssue ? {
       meetingIssue,
       meetingIssues: { general: { issue: meetingIssue, label: "General meetings" } }
@@ -23087,16 +24029,16 @@ function initApplyData(action, env = process.env) {
   fs24.mkdirSync(dir, { recursive: true });
   switch (action) {
     case "youtrack_json": {
-      const out = path36.join(dir, "youtrack.json");
+      const out = path38.join(dir, "youtrack.json");
       fs24.writeFileSync(out, JSON.stringify(youtrackJsonContent(dir), null, 2) + `
 `, "utf8");
       return { action, ok: true, path: out };
     }
     case "youtrack_token_placeholder": {
-      const p = path36.join(dir, "youtrack.token");
+      const p = path38.join(dir, "youtrack.token");
       const preserved = writeFileExclusive(p, TOKEN_PLACEHOLDER2 + `
 `, 384) === "preserved";
-      const abs = path36.resolve(p);
+      const abs = path38.resolve(p);
       return {
         action,
         ok: true,
@@ -23108,14 +24050,14 @@ function initApplyData(action, env = process.env) {
       };
     }
     case "youtrack_scaffold": {
-      const jsonOut = path36.join(dir, "youtrack.json");
-      const tokenOut = path36.join(dir, "youtrack.token");
+      const jsonOut = path38.join(dir, "youtrack.json");
+      const tokenOut = path38.join(dir, "youtrack.token");
       fs24.writeFileSync(jsonOut, JSON.stringify(youtrackJsonContent(dir), null, 2) + `
 `, "utf8");
       const preserved = writeFileExclusive(tokenOut, TOKEN_PLACEHOLDER2 + `
 `, 384) === "preserved";
-      const configPath = path36.resolve(jsonOut);
-      const tokenPath = path36.resolve(tokenOut);
+      const configPath = path38.resolve(jsonOut);
+      const tokenPath = path38.resolve(tokenOut);
       const prev = process.env.WORKFLOW_YOUTRACK_CONFIG;
       process.env.WORKFLOW_YOUTRACK_CONFIG = configPath;
       let tokenCreate = {};
@@ -23167,10 +24109,10 @@ function initApplyData(action, env = process.env) {
       }
     }
     case "vcs_scaffold": {
-      const jsonOut = path36.join(dir, "vcs.json");
+      const jsonOut = path38.join(dir, "vcs.json");
       fs24.writeFileSync(jsonOut, JSON.stringify(vcsJsonContent(), null, 2) + `
 `, "utf8");
-      const configPath = path36.resolve(jsonOut);
+      const configPath = path38.resolve(jsonOut);
       const prev = process.env.WORKFLOW_VCS_CONFIG;
       process.env.WORKFLOW_VCS_CONFIG = configPath;
       try {
@@ -23289,7 +24231,7 @@ var executeInitApply = (args, directory, runtime) => {
       protectedNames: args.branch_policy_protected
     }, current);
     writeConfig(next);
-    return output(ok({ action: "config", path: path37.join(configDir(), "config.json"), ...next }));
+    return output(ok({ action: "config", path: path39.join(configDir(), "config.json"), ...next }));
   }
   const env = Object.fromEntries(Object.entries({
     WORKFLOW_YT_BASE_URL: args.base_url,
@@ -23306,14 +24248,14 @@ var executeInitApply = (args, directory, runtime) => {
 
 // packages/workit-opencode/src/shared/session.ts
 import { realpathSync as realpathSync7 } from "node:fs";
-import path38 from "node:path";
+import path40 from "node:path";
 var sameWorkspace = (expected, observed) => {
   if (typeof observed !== "string" || !observed)
     return false;
   try {
     return realpathSync7(expected) === realpathSync7(observed);
   } catch {
-    return path38.resolve(expected) === path38.resolve(observed);
+    return path40.resolve(expected) === path40.resolve(observed);
   }
 };
 
@@ -23385,7 +24327,7 @@ var workitFamilyOf = (toolName) => {
 
 // packages/workit-opencode/src/tools/context.ts
 import { realpathSync as realpathSync8 } from "node:fs";
-import path39 from "node:path";
+import path41 from "node:path";
 var createContextTool = () => ({
   description: "Read Git, pull request, YouTrack, issue, changelog, release, or affected-file context.",
   execute: async (args, context) => {
@@ -23395,7 +24337,7 @@ var createContextTool = () => ({
     let root;
     try {
       const cwd = parsed.data.cwd;
-      root = realpathSync8(cwd ? path39.resolve(context.directory, cwd) : context.directory);
+      root = realpathSync8(cwd ? path41.resolve(context.directory, cwd) : context.directory);
     } catch {
       return JSON.stringify(failure2("invalid_input", "context target directory cannot be resolved"), null, 2);
     }
@@ -23427,118 +24369,13 @@ var workerCoordinatorFor = (task, worker) => {
 // packages/workit-core/src/fanout.ts
 import { createHash as createHash17 } from "node:crypto";
 import fs26 from "node:fs";
-import path42 from "node:path";
+import path43 from "node:path";
 
 // packages/workit-core/src/stack.ts
 import { spawnSync as spawnSync21 } from "node:child_process";
 import { createHash as createHash16, randomBytes as randomBytes4 } from "node:crypto";
 import fs25 from "node:fs";
-import path41 from "node:path";
-
-// packages/workit-core/src/git/ops.ts
-import { spawnSync as spawnSync20 } from "node:child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
-import path40 from "node:path";
-
-// packages/workit-core/src/forge/redact.ts
-var KEY = String.raw`[A-Za-z0-9_.-]*?(?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|account[_-]?key|private[_-]?key|client[_-]?secret|credentials?|authorization|cookie|signature)[A-Za-z0-9_.-]*`;
-var ASSIGNMENT2 = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*["']?)((?:bearer|basic|token|digest)\s+)?([^\s"',;&]+)`, "giu");
-var QUOTED_ASSIGNMENT = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*)(["'])([^"'\n]*[^\s"'][^"'\n]*)\2`, "giu");
-var ANSI = new RegExp(String.raw`\u001b\[[0-9;?]*[ -/]*[@-~]|\u001b\][^\u0007]*\u0007`, "gu");
-
-// packages/workit-core/src/forge/types.ts
-var success2 = (data) => ({ ok: true, data });
-var failure3 = (code, error, unblock) => ({ ok: false, code, error, ...unblock ? { unblock } : {} });
-
-// packages/workit-core/src/git/ops.ts
-var COMMIT_TIMEOUT_MS = 10 * 60000;
-var git5 = (cwd, args, options = {}) => {
-  const result = spawnSync20("git", args, {
-    cwd,
-    encoding: "utf8",
-    env: { ...options.env ?? process.env, GIT_TERMINAL_PROMPT: "0" },
-    maxBuffer: 64 * 1024 * 1024,
-    timeout: options.timeoutMs ?? GIT_TIMEOUTS.local,
-    killSignal: "SIGKILL",
-    windowsHide: true,
-    ...options.input === undefined ? { stdio: ["ignore", "pipe", "pipe"] } : { input: options.input, stdio: ["pipe", "pipe", "pipe"] }
-  });
-  return {
-    ok: result.status === 0,
-    status: result.status,
-    stdout: result.stdout ?? "",
-    stderr: result.stderr ?? ""
-  };
-};
-function operationInProgress(cwd) {
-  const markers = [
-    ["rebase-merge", "rebase"],
-    ["rebase-apply", "rebase"],
-    ["MERGE_HEAD", "merge"],
-    ["CHERRY_PICK_HEAD", "cherry-pick"],
-    ["REVERT_HEAD", "revert"]
-  ];
-  const run = git5(cwd, ["rev-parse", ...markers.flatMap(([name]) => ["--git-path", name])]);
-  if (!run.ok)
-    return null;
-  const found = run.stdout.split(`
-`).map((line) => path40.resolve(cwd, line.trim()));
-  const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
-  for (const [index, [, operation]] of markers.entries()) {
-    const marker = found[index];
-    if (!marker || !existsSync12(marker))
-      continue;
-    if (index === 1 && existsSync12(path40.join(marker, "applying")))
-      return { operation: "am", commitAllowed: false, branch: null };
-    if (index === 0 && existsSync12(path40.join(marker, "amend")) && !conflicted()) {
-      let headName = "";
-      try {
-        headName = readFileSync9(path40.join(marker, "head-name"), "utf8").trim();
-      } catch {}
-      const branch = headName.startsWith("refs/heads/") ? headName.slice("refs/heads/".length) : null;
-      return { operation, commitAllowed: branch !== null, branch };
-    }
-    if ((operation === "revert" || operation === "merge") && !conflicted())
-      return { operation, commitAllowed: true, branch: null };
-    return { operation, commitAllowed: false, branch: null };
-  }
-  return null;
-}
-function inProgressFailure(operation, verb) {
-  const command = operation === "am" ? "git am" : `git ${operation}`;
-  return failure3("blocked", `${operation.replace("-", "_")}_in_progress: a ${operation === "am" ? "git am" : operation} is in progress; finish or abort it before workit can ${verb}`, `resolve the conflicts, git add <files>, then ${command} --continue  # or ${command} --abort to return to where you started`);
-}
-function pushPreflight(cwd, options = {}) {
-  const progress = operationInProgress(cwd);
-  if (progress)
-    return inProgressFailure(progress.operation, "push");
-  const branch = options.branch ?? currentBranch(cwd);
-  if (!branch)
-    return failure3("invalid_input", "HEAD is detached; push a branch");
-  if (isProtectedTarget(cwd, branch))
-    return failure3("blocked", `protected_branch: ${branch} is protected by the workspace branch policy; workit git push never pushes to it`, releaseBranch(cwd, branch) ? `workit git push --release ${branch}  # finishing a release or hotfix; needs the release grant` : "workit git branch <feature/name>  # push a feature branch and open a PR");
-  const sha = resolveRef(cwd, `refs/heads/${branch}`);
-  if (!sha)
-    return failure3("not_found", `branch ${branch} has no commit to push`);
-  const remote = pushRemoteName(cwd, branch);
-  if (!remote)
-    return failure3("not_found", "no push remote is configured for this branch", "git remote add origin <url>");
-  const raw = pushUrl(cwd, remote);
-  if (!raw)
-    return failure3("blocked", `remote "${remote}" has no single push URL`, `git remote get-url --push --all ${remote}  # keep exactly one push URL`);
-  const parsed = parseRemoteUrl(raw);
-  const local = parsed?.protocol === "file";
-  if (!local && !pushTargetIsStable(cwd, raw))
-    return failure3("blocked", `push_target_rewritten: the push URL of "${remote}" is rewritten by a url.*.insteadOf rule, so the destination is not the one checked`, "git config --get-regexp '^url\\.'  # remove the rewrite for this remote");
-  return success2({
-    branch,
-    sha,
-    remote,
-    url: redactRemote(raw),
-    rawUrl: raw,
-    local
-  });
-}
+import path42 from "node:path";
 
 // packages/workit-core/src/forge/report.ts
 var GITLAB_MERGEABLE = new Set(["mergeable"]);
@@ -23620,7 +24457,7 @@ function rebaseInProgress(dir) {
 }
 var scratchDir = (cwd) => {
   const dir = stacksDir(cwd);
-  return dir.ok ? path41.join(dir.data, "worktrees") : null;
+  return dir.ok ? path42.join(dir.data, "worktrees") : null;
 };
 function gitRestack(cwd, input) {
   const owner = worktreeOf(cwd, input.branch);
@@ -23630,7 +24467,7 @@ function gitRestack(cwd, input) {
     if (!scratch)
       return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
     fs25.mkdirSync(scratch, { recursive: true });
-    dir = path41.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
+    dir = path42.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
     const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
     if (!added.ok)
       return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
@@ -23674,7 +24511,7 @@ function stacksDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return stackFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path41.join(root.value.root, "stacks") };
+  return { ok: true, data: path42.join(root.value.root, "stacks") };
 }
 var HEARTBEAT_STALE_MS = 2 * 60000;
 
@@ -23785,7 +24622,7 @@ function fanoutsDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return fanoutFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path42.join(root.value.root, "fanouts") };
+  return { ok: true, data: path43.join(root.value.root, "fanouts") };
 }
 function parseStored(raw) {
   if (!isRecord7(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
@@ -23853,7 +24690,7 @@ function readFanout(cwd, name) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path42.join(dir.data, stackFileName(name));
+  const file = path43.join(dir.data, stackFileName(name));
   let parsed = null;
   try {
     parsed = parseStored(JSON.parse(fs26.readFileSync(file, "utf8")));
@@ -23878,7 +24715,7 @@ function listFanouts(cwd) {
   for (const entry of names) {
     let parsed = null;
     try {
-      parsed = parseStored(JSON.parse(fs26.readFileSync(path42.join(dir.data, entry), "utf8")));
+      parsed = parseStored(JSON.parse(fs26.readFileSync(path43.join(dir.data, entry), "utf8")));
     } catch {
       parsed = null;
     }
@@ -24570,7 +25407,7 @@ var childTaskMissing = (store, input) => {
 var childDenial = (identity) => `OpenCode child session has no validated Workit worker: as ${identity} it may only inspect the task summary (workit_task action "inspect") or record evidence or findings (workit_evidence/workit_finding action "record") on an existing task; for anything else the lead assigns it a worker with workit_worker before launching it`;
 
 // packages/workit-opencode/src/v2/shell.ts
-import path43 from "node:path";
+import path44 from "node:path";
 var commandOf = (input) => {
   if (input === null || typeof input !== "object")
     return null;
@@ -24579,7 +25416,7 @@ var commandOf = (input) => {
 };
 var hookInput = (root, sessionID, id, shell) => ({
   host: "opencode",
-  cwd: shell.workdir ? path43.resolve(root, shell.workdir) : root,
+  cwd: shell.workdir ? path44.resolve(root, shell.workdir) : root,
   session: { id: sessionID, agentId: null, agentType: null, parentId: null },
   permissionMode: null,
   transcriptPath: null,
@@ -24785,38 +25622,38 @@ var createStopControl = (root, port) => {
 };
 
 // packages/workit-opencode/src/v2/registry.ts
-import { existsSync as existsSync14, readFileSync as readFileSync10 } from "node:fs";
-import path45 from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync11 } from "node:fs";
+import path46 from "node:path";
 
 // packages/workit-opencode/src/shared/assets.ts
-import { existsSync as existsSync13, realpathSync as realpathSync9 } from "node:fs";
-import path44 from "node:path";
+import { existsSync as existsSync14, realpathSync as realpathSync9 } from "node:fs";
+import path45 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var moduleDir = () => {
   try {
-    return realpathSync9(path44.dirname(fileURLToPath2(import.meta.url)));
+    return realpathSync9(path45.dirname(fileURLToPath2(import.meta.url)));
   } catch {
-    return path44.dirname(fileURLToPath2(import.meta.url));
+    return path45.dirname(fileURLToPath2(import.meta.url));
   }
 };
 var packageRoot2 = () => {
   const dir = moduleDir();
   for (const candidate of [
-    path44.resolve(dir, ".."),
-    path44.resolve(dir, "..", ".."),
-    path44.resolve(dir, "..", "..", "..")
+    path45.resolve(dir, ".."),
+    path45.resolve(dir, "..", ".."),
+    path45.resolve(dir, "..", "..", "..")
   ]) {
-    if (existsSync13(path44.join(candidate, "package.json")))
+    if (existsSync14(path45.join(candidate, "package.json")))
       return candidate;
   }
-  return path44.resolve(dir, "..");
+  return path45.resolve(dir, "..");
 };
 var skillsRoot = () => {
   const root = packageRoot2();
-  const canonical = path44.resolve(root, "..", "workit-core", "skills");
-  if (existsSync13(path44.join(root, "src")) && existsSync13(canonical))
+  const canonical = path45.resolve(root, "..", "workit-core", "skills");
+  if (existsSync14(path45.join(root, "src")) && existsSync14(canonical))
     return canonical;
-  return path44.join(root, "assets", "skills");
+  return path45.join(root, "assets", "skills");
 };
 
 // packages/workit-opencode/src/v2/registry.ts
@@ -24840,15 +25677,15 @@ var parseFrontmatter = (markdown) => {
 };
 var registerSkills = async (ctx) => {
   const skillsDir = skillsRoot();
-  if (!existsSync14(skillsDir))
+  if (!existsSync15(skillsDir))
     return new Set;
   const listed = await ctx.skill.list().catch(() => ({ data: [] }));
-  const own = (skill) => typeof skill.path === "string" && path45.resolve(skill.path).startsWith(skillsDir + path45.sep);
+  const own = (skill) => typeof skill.path === "string" && path46.resolve(skill.path).startsWith(skillsDir + path46.sep);
   const userSkills = new Set((listed?.data ?? []).filter((skill) => !own(skill)).map((skill) => skill.id));
   const packaged = new Map;
   for (const id of WORKIT_METHOD_SKILLS) {
-    const file = path45.join(skillsDir, id, "SKILL.md");
-    if (!userSkills.has(id) && existsSync14(file))
+    const file = path46.join(skillsDir, id, "SKILL.md");
+    if (!userSkills.has(id) && existsSync15(file))
       packaged.set(id, file);
   }
   await ctx.skill.transform((editor) => {
@@ -24856,7 +25693,7 @@ var registerSkills = async (ctx) => {
     for (const [id, file] of packaged) {
       if (existing.has(id))
         continue;
-      const parsed = parseFrontmatter(readFileSync10(file, "utf8"));
+      const parsed = parseFrontmatter(readFileSync11(file, "utf8"));
       editor.add({
         id,
         name: parsed.name || id,
@@ -24894,25 +25731,25 @@ var registerCommands = async (ctx, registeredSkills) => {
 };
 
 // packages/workit-opencode/src/stale-sources.ts
-import { existsSync as existsSync15, readdirSync as readdirSync6 } from "node:fs";
-import path46 from "node:path";
+import { existsSync as existsSync16, readdirSync as readdirSync6 } from "node:fs";
+import path47 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var typescriptFiles = (directory) => {
-  if (!existsSync15(directory))
+  if (!existsSync16(directory))
     return [];
   return readdirSync6(directory, { withFileTypes: true }).flatMap((entry) => {
-    const file = path46.join(directory, entry.name);
+    const file = path47.join(directory, entry.name);
     return entry.isDirectory() ? typescriptFiles(file) : entry.isFile() && file.endsWith(".ts") ? [file] : [];
   });
 };
 var pluginSourceFiles = [
   ...new Set([
     fileURLToPath3(import.meta.url),
-    ...typescriptFiles(path46.join(packageRoot2(), "src")),
-    path46.join(packageRoot2(), "..", "workit-core", "src", "core.ts"),
-    ...typescriptFiles(path46.join(packageRoot2(), "..", "workit-core", "src", "core"))
+    ...typescriptFiles(path47.join(packageRoot2(), "src")),
+    path47.join(packageRoot2(), "..", "workit-core", "src", "core.ts"),
+    ...typescriptFiles(path47.join(packageRoot2(), "..", "workit-core", "src", "core"))
   ])
-].filter((file) => existsSync15(file)).toSorted();
+].filter((file) => existsSync16(file)).toSorted();
 
 // packages/workit-opencode/src/v2/plugin.ts
 var sessionFacts = async (ctx, sessionID) => {