@brainervirus/workit-pi 2.5.0 → 2.7.0

package/dist/workit.js

@@ -2,9 +2,9 @@
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // packages/workit-core/src/core.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync6 } from "node:child_process";
 import { existsSync as existsSync6, realpathSync as realpathSync8 } from "node:fs";
-import path13 from "node:path";
+import path15 from "node:path";
 
 // packages/workit-core/src/core/task-contract.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -8121,7 +8121,37 @@ var candidateSchema = object({
       path: ["id"]
     });
 });
-var evidenceSchema = object({
+var checkObservationSchema = object({
+  observer: literal("workit_cli"),
+  name: nonEmpty.nullable(),
+  configured: boolean2(),
+  argv: array(text).min(1),
+  shell: boolean2(),
+  cwd: nonEmpty,
+  exitCode: safeInteger,
+  durationMs: safeInteger.min(0),
+  timedOut: boolean2(),
+  head: text.nullable(),
+  tree: text.nullable(),
+  dirty: boolean2().nullable(),
+  signal: text.nullable(),
+  treeAfter: text.nullable(),
+  modifiedWorktree: boolean2(),
+  base: text.nullable(),
+  patchId: text.nullable(),
+  environment: object({
+    platform: nonEmpty,
+    arch: nonEmpty,
+    vars: record(nonEmpty, text.nullable())
+  }).strict(),
+  logDigest: text.nullable(),
+  logRef: text.nullable(),
+  logTail: array(text).max(40),
+  ledgerRowId: text.nullable(),
+  attestation: object({ host: nonEmpty, session: text.nullable(), agentId: text.nullable() }).strict().nullable()
+}).strict();
+var CHECK_OBSERVATION_PATH = "evidence.*.data.observation";
+var evidenceFields = {
   kind: _enum(["check", "review", "investigation", "artifact"]),
   claim: text,
   requirementIds: array(digest),
@@ -8132,7 +8162,9 @@ var evidenceSchema = object({
   refs: array(refSchema),
   exitCode: safeInteger.nullable(),
   reviewContext: refSchema.nullable()
-}).strict();
+};
+var evidenceSchema = object({ ...evidenceFields, observation: checkObservationSchema.optional() }).strict();
+var reportedEvidenceSchema = object(evidenceFields).strict();
 var evidenceEvaluationSchema = object({
   evidenceId: id,
   status: _enum(["passed", "failed", "missing", "skipped", "stale"]),
@@ -8464,7 +8496,7 @@ var evidenceOperations = {
     action: literal("record"),
     ...taskId,
     expectedRevision: revision.optional(),
-    evidence: evidenceSchema
+    evidence: reportedEvidenceSchema
   })
 };
 var findingOperations = {
@@ -10964,10 +10996,10 @@ function assertProductWriteAllowed(input) {
 }
 
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash7 } from "node:crypto";
-import * as fs8 from "node:fs";
-import { spawnSync as spawnSync3 } from "node:child_process";
-import path11 from "node:path";
+import { createHash as createHash8 } from "node:crypto";
+import * as fs10 from "node:fs";
+import { spawnSync as spawnSync5 } from "node:child_process";
+import path13 from "node:path";
 
 // packages/workit-core/src/core/authority.ts
 import { createHash as createHash6 } from "node:crypto";
@@ -13174,16 +13206,407 @@ function reconcileAction(input) {
 var bindingCovers = scopeCovers;
 var verifyDecisionContent = verifyContentRefs;
 
+// packages/workit-core/src/check-config.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
+import fs8 from "node:fs";
+import path11 from "node:path";
+var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
+var CHECKS_FILE = "workit.checks.json";
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var SHELL_META = /[|&;<>()$`\\*?[\]{}~!#]/u;
+function splitCommand(command) {
+  const argv = [];
+  let current = "";
+  let quote = null;
+  let started = false;
+  for (const char of command) {
+    if (quote) {
+      if (char === quote)
+        quote = null;
+      else
+        current += char;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      started = true;
+      continue;
+    }
+    if (/\s/u.test(char)) {
+      if (started)
+        argv.push(current);
+      current = "";
+      started = false;
+      continue;
+    }
+    if (SHELL_META.test(char))
+      return new Error(`"${command}" uses shell syntax (${char}); configure an argv array instead`);
+    current += char;
+    started = true;
+  }
+  if (quote)
+    return new Error(`"${command}" has an unterminated quote`);
+  if (started)
+    argv.push(current);
+  return argv.length ? argv : new Error("empty command");
+}
+var git = (cwd, args) => {
+  const run = spawnSync3("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: 20000,
+    killSignal: "SIGKILL",
+    windowsHide: true
+  });
+  const value = run.status === 0 ? (run.stdout ?? "").trim() : "";
+  return value || null;
+};
+function checkRoot(cwd) {
+  return path11.resolve(git(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
+}
+var packageManager = (root) => {
+  const has = (file) => fs8.existsSync(path11.join(root, file));
+  if (has("bun.lock") || has("bun.lockb"))
+    return "bun";
+  if (has("pnpm-lock.yaml"))
+    return "pnpm";
+  if (has("yarn.lock"))
+    return "yarn";
+  return "npm";
+};
+var scriptCheck = (pm, name) => {
+  const argv = [pm, "run", name];
+  const accepts = [argv];
+  if (pm === "pnpm" || pm === "yarn" || pm === "npm" && name === "test")
+    accepts.push([pm, name]);
+  return { name, argv, accepts };
+};
+var CHECK_NAME = /^[a-z0-9][a-z0-9:._-]{0,63}$/u;
+function detectedChecks(root) {
+  const read = (file) => {
+    try {
+      return fs8.readFileSync(path11.join(root, file), "utf8");
+    } catch {
+      return null;
+    }
+  };
+  const checks = [];
+  const add = (check) => {
+    if (!checks.some((item) => item.name === check.name))
+      checks.push(check);
+  };
+  const manifestText = read("package.json");
+  if (manifestText !== null) {
+    let manifest = null;
+    try {
+      manifest = JSON.parse(manifestText);
+    } catch {}
+    const scripts = isRecord2(manifest) && isRecord2(manifest.scripts) ? manifest.scripts : {};
+    const pm = packageManager(root);
+    for (const name of SCRIPT_CHECKS) {
+      const script = scripts[name];
+      if (typeof script === "string" && script.trim() !== "")
+        add(scriptCheck(pm, name));
+    }
+  }
+  const plain = (name, argv) => ({ name, argv, accepts: [argv] });
+  if (read("go.mod") !== null)
+    add(plain("test", ["go", "test", "./..."]));
+  if (read("Cargo.toml") !== null)
+    add(plain("test", ["cargo", "test"]));
+  if (read("pytest.ini") !== null || /\bpytest\b/u.test(read("pyproject.toml") ?? ""))
+    add(plain("test", ["pytest"]));
+  const makefile = read("Makefile") ?? read("makefile") ?? read("GNUmakefile");
+  if (makefile !== null && /^test\s*:(?!=)/mu.test(makefile))
+    add(plain("test", ["make", "test"]));
+  return checks;
+}
+var GATES = ["testing", "verification"];
+function loadCheckConfig(cwd) {
+  const root = checkRoot(cwd);
+  const file = path11.join(root, CHECKS_FILE);
+  const none = (error = null) => ({
+    source: error ? CHECKS_FILE : "none",
+    root,
+    checks: [],
+    gates: {},
+    error
+  });
+  let text = null;
+  try {
+    text = fs8.readFileSync(file, "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
+  }
+  if (text === null) {
+    const checks = detectedChecks(root);
+    return checks.length ? { source: "defaults", root, checks, gates: {}, error: null } : none();
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return none(`${CHECKS_FILE} is not valid JSON`);
+  }
+  if (!isRecord2(parsed) || !isRecord2(parsed.checks))
+    return none(`${CHECKS_FILE} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
+  const checks = [];
+  for (const [name, value] of Object.entries(parsed.checks)) {
+    if (!CHECK_NAME.test(name))
+      return none(`${CHECKS_FILE}: check name "${name}" must match ${CHECK_NAME.source}`);
+    const argv = typeof value === "string" ? splitCommand(value) : Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string" && item.length > 0) ? value : new Error("expected a command string or a non-empty argv array");
+    if (argv instanceof Error)
+      return none(`${CHECKS_FILE}: check "${name}": ${argv.message}`);
+    checks.push({ name, argv, accepts: [argv] });
+  }
+  const gates = {};
+  if (parsed.gates !== undefined) {
+    if (!isRecord2(parsed.gates))
+      return none(`${CHECKS_FILE}: gates must be {"testing":"<name>"|["<name>",…]}`);
+    for (const [gate, value] of Object.entries(parsed.gates)) {
+      if (!GATES.includes(gate))
+        return none(`${CHECKS_FILE}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
+      const names = typeof value === "string" ? [value] : value;
+      if (!Array.isArray(names) || names.length === 0 || !names.every((name) => typeof name === "string" && checks.some((c) => c.name === name)))
+        return none(`${CHECKS_FILE}: gates.${gate} must name configured checks`);
+      gates[gate] = names;
+    }
+  }
+  return { source: CHECKS_FILE, root, checks, gates, error: null };
+}
+var sameArgv = (left, right) => left.length === right.length && left.every((item, index) => item === right[index]);
+function matchesNamedCheck(config, name, argv, cwd) {
+  if (config.error || name === null || cwd !== ".")
+    return false;
+  const check = config.checks.find((item) => item.name === name);
+  return Boolean(check?.accepts.some((accepted) => sameArgv(accepted, argv)));
+}
+function gateCheckNames(config, dimension) {
+  const explicit = config.gates[dimension];
+  if (explicit)
+    return explicit;
+  const names = config.checks.map((check) => check.name);
+  if (dimension === "testing")
+    return names.includes("test") ? ["test"] : [];
+  return names;
+}
+var workitOnPath;
+function workitAvailable(env = process.env) {
+  if (workitOnPath !== undefined)
+    return workitOnPath;
+  const windows = process.platform === "win32";
+  const exts = windows ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  const dirs = (env.PATH ?? env.Path ?? "").split(path11.delimiter).filter(Boolean);
+  workitOnPath = dirs.some((dir) => exts.some((ext) => {
+    try {
+      return fs8.statSync(path11.join(dir, `workit${ext}`)).isFile();
+    } catch {
+      return false;
+    }
+  }));
+  return workitOnPath;
+}
+function checkCommand(args, version, onPath = workitAvailable()) {
+  return onPath ? `workit check ${args}` : `npx -y @brainervirus/workit-cli@${version} check ${args}`;
+}
+
+// packages/workit-core/src/git/rev.ts
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { createHash as createHash7 } from "node:crypto";
+import fs9 from "node:fs";
+import os2 from "node:os";
+import path12 from "node:path";
+var MAX_BUFFER = 256 * 1024 * 1024;
+var GIT_TIMEOUTS = { local: 20000, worktree: 120000, network: 15000 };
+var git2 = (cwd, args, options = {}) => {
+  const result = spawnSync4("git", args, {
+    cwd,
+    encoding: "utf8",
+    env: options.env ?? process.env,
+    input: options.input,
+    maxBuffer: MAX_BUFFER,
+    timeout: options.timeoutMs ?? GIT_TIMEOUTS.local,
+    killSignal: "SIGKILL",
+    windowsHide: true
+  });
+  const error = result.error;
+  return {
+    ok: result.status === 0,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? "",
+    timedOut: error?.code === "ETIMEDOUT"
+  };
+};
+var line = (run) => {
+  if (!run.ok)
+    return null;
+  const value = run.stdout.trim();
+  return value ? value : null;
+};
+function networkGitInvocation(cwd, args, timeoutMs) {
+  const seconds = Math.max(1, Math.ceil(timeoutMs / 1000));
+  const env = {
+    ...process.env,
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: "",
+    SSH_ASKPASS: "",
+    SSH_ASKPASS_REQUIRE: "never",
+    GCM_INTERACTIVE: "never"
+  };
+  const base = process.env.GIT_SSH_COMMAND || line(git2(cwd, ["config", "--get", "core.sshCommand"])) || (process.env.GIT_SSH ? null : "ssh");
+  if (base)
+    env.GIT_SSH_COMMAND = `${base} -o BatchMode=yes -o ConnectTimeout=${Math.min(10, seconds)}`;
+  return {
+    args: ["-c", "http.lowSpeedLimit=1", "-c", `http.lowSpeedTime=${seconds}`, ...args],
+    env
+  };
+}
+var WATCHDOG = `
+const cp = require("node:child_process");
+const { ms, args } = JSON.parse(process.env.WORKIT_GIT_WATCHDOG);
+delete process.env.WORKIT_GIT_WATCHDOG;
+const win = process.platform === "win32";
+const child = cp.spawn("git", args, { stdio: "inherit", detached: !win, windowsHide: true });
+const killTree = () => {
+  if (!child.pid) return;
+  if (win) cp.spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+  else try { process.kill(-child.pid, "SIGKILL"); } catch {}
+};
+let timedOut = false;
+const timer = setTimeout(() => { timedOut = true; killTree(); }, ms);
+child.on("error", () => { clearTimeout(timer); process.exit(127); });
+child.on("exit", (code) => {
+  clearTimeout(timer);
+  if (!win) killTree();
+  process.exit(timedOut ? 124 : code ?? 1);
+});
+`;
+var WATCHDOG_TIMEOUT_EXIT = 124;
+var gitNetwork = (cwd, args, timeoutMs) => {
+  const invocation = networkGitInvocation(cwd, args, timeoutMs);
+  const result = spawnSync4(process.execPath, ["-e", WATCHDOG], {
+    cwd,
+    encoding: "utf8",
+    env: {
+      ...invocation.env,
+      WORKIT_GIT_WATCHDOG: JSON.stringify({ ms: timeoutMs, args: invocation.args })
+    },
+    maxBuffer: MAX_BUFFER,
+    timeout: timeoutMs + 1e4,
+    killSignal: "SIGKILL",
+    windowsHide: true
+  });
+  const error = result.error;
+  return {
+    ok: result.status === 0,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? "",
+    timedOut: result.status === WATCHDOG_TIMEOUT_EXIT || error?.code === "ETIMEDOUT"
+  };
+};
+function headSha(cwd) {
+  return line(git2(cwd, ["rev-parse", "--verify", "-q", "HEAD^{commit}"]));
+}
+var emptyTree = (cwd) => line(git2(cwd, ["mktree"], { input: "" }));
+var MAX_UNTRACKED_BYTES = 5 * 1024 * 1024;
+var seedIndex = (from, to) => {
+  fs9.copyFileSync(from, to);
+  const { atimeNs, mtimeNs } = fs9.statSync(from, { bigint: true });
+  const seconds = (ns) => (Number(ns / 1000n) - 1) / 1e6;
+  fs9.utimesSync(to, seconds(atimeNs), seconds(mtimeNs));
+};
+function worktreeTree(cwd, options = {}) {
+  const top = line(git2(cwd, ["rev-parse", "--show-toplevel"]));
+  const indexPath = line(git2(cwd, ["rev-parse", "--path-format=absolute", "--git-path", "index"]));
+  if (!top || !indexPath)
+    return null;
+  const cap = options.maxUntrackedBytes ?? MAX_UNTRACKED_BYTES;
+  const timeoutMs = options.timeoutMs ?? GIT_TIMEOUTS.worktree;
+  const scratch = fs9.mkdtempSync(path12.join(os2.tmpdir(), "workit-tree-"));
+  try {
+    const tempIndex = path12.join(scratch, "index");
+    if (fs9.existsSync(indexPath))
+      seedIndex(indexPath, tempIndex);
+    const env = { ...process.env, GIT_INDEX_FILE: tempIndex };
+    const untracked = git2(top, ["ls-files", "--others", "--exclude-standard", "-z"], {
+      env,
+      timeoutMs
+    });
+    if (!untracked.ok)
+      return null;
+    const skipped = [];
+    for (const file of untracked.stdout.split("\x00").filter(Boolean)) {
+      try {
+        const stat = fs9.statSync(path12.join(top, file));
+        if (stat.isFile() && stat.size > cap)
+          skipped.push({ path: file, size: stat.size, mtimeMs: Math.trunc(stat.mtimeMs) });
+      } catch {}
+    }
+    skipped.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    const added = skipped.length ? git2(top, ["add", "-A", "--pathspec-from-file=-", "--pathspec-file-nul"], {
+      env,
+      timeoutMs,
+      input: [".", ...skipped.map((file) => `:(exclude,literal)${file.path}`)].join("\x00")
+    }) : git2(top, ["add", "-A"], { env, timeoutMs });
+    if (!added.ok)
+      return null;
+    const tree = line(git2(top, ["write-tree"], { env, timeoutMs }));
+    if (!tree)
+      return null;
+    const base = line(git2(top, ["rev-parse", "--verify", "-q", "HEAD^{tree}"])) ?? emptyTree(top);
+    const key = skipped.length ? `sha256:${createHash7("sha256").update(JSON.stringify({ tree, skipped })).digest("hex")}` : tree;
+    return { tree, key, dirty: tree !== base || skipped.length > 0, skipped };
+  } finally {
+    fs9.rmSync(scratch, { recursive: true, force: true });
+  }
+}
+function worktreeSignal(cwd, options = {}) {
+  const top = line(git2(cwd, ["rev-parse", "--show-toplevel"]));
+  if (!top)
+    return null;
+  const status = git2(top, [
+    "status",
+    "--porcelain=v1",
+    "-z",
+    "--untracked-files=all",
+    "--no-renames",
+    "--ignore-submodules=dirty"
+  ], {
+    env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" },
+    timeoutMs: options.timeoutMs ?? GIT_TIMEOUTS.worktree
+  });
+  if (!status.ok)
+    return null;
+  const hash = createHash7("sha256");
+  hash.update(`${headSha(top) ?? "unborn"}\x00`);
+  for (const entry of status.stdout.split("\x00")) {
+    if (entry.length < 4)
+      continue;
+    const file = entry.slice(3);
+    const absolute = path12.join(top, file);
+    let stat = "-";
+    try {
+      const info = fs9.lstatSync(absolute, { bigint: true });
+      stat = `${info.mode.toString(8)}:${info.size}:${info.mtimeNs}`;
+      if (info.isDirectory())
+        stat += `:${headSha(absolute) ?? "-"}`;
+    } catch {}
+    hash.update(`${entry.slice(0, 2)}\x00${file}\x00${stat}\x00`);
+  }
+  return `sig:${hash.digest("hex")}`;
+}
+
 // packages/workit-core/src/core/task-evaluation.ts
-var digestBytes3 = (value) => createHash7("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path11.sep}`);
-var relative = (root, candidate) => path11.relative(root, candidate).split(path11.sep).join("/") || ".";
+var digestBytes3 = (value) => createHash8("sha256").update(value).digest("hex");
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path13.sep}`);
+var relative = (root, candidate) => path13.relative(root, candidate).split(path13.sep).join("/") || ".";
 var canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path11.posix.normalize(value);
+  const normalized = path13.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -13219,7 +13642,7 @@ var compareCodeUnits2 = (left, right) => {
   return left.length - right.length;
 };
 var gitPaths = (root) => {
-  const result = spawnSync3("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const result = spawnSync5("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     encoding: "buffer"
   });
@@ -13231,21 +13654,21 @@ var gitPaths = (root) => {
       git: !/not a git repository/i.test(stderr)
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path11.sep).join("/")) : [];
-  const stagedDeleted = spawnSync3("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path13.sep).join("/")) : [];
+  const stagedDeleted = spawnSync5("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path11.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path13.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 };
 var walk = (root, directory, output) => {
   let names;
   try {
-    names = fs8.readdirSync(directory);
+    names = fs10.readdirSync(directory);
   } catch {
     return true;
   }
@@ -13253,10 +13676,10 @@ var walk = (root, directory, output) => {
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path11.join(directory, name);
+    const target = path13.join(directory, name);
     let stat;
     try {
-      stat = fs8.lstatSync(target);
+      stat = fs10.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -13271,14 +13694,14 @@ var walk = (root, directory, output) => {
 var scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path11.resolve(root, item);
+    const target = path13.resolve(root, item);
     if (!inside(root, target))
       return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
-    while (!fs8.existsSync(ancestor) && ancestor !== root)
-      ancestor = path11.dirname(ancestor);
+    while (!fs10.existsSync(ancestor) && ancestor !== root)
+      ancestor = path13.dirname(ancestor);
     try {
-      if (!inside(root, fs8.realpathSync(ancestor)))
+      if (!inside(root, fs10.realpathSync(ancestor)))
         return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
     } catch {
       return failure2("invalid_input", `candidate scope cannot be inspected: ${item}`);
@@ -13290,7 +13713,7 @@ var scopeRoots = (root, scope) => {
 function captureCandidate(root, scope, environment = []) {
   let checkout;
   try {
-    checkout = fs8.realpathSync(root);
+    checkout = fs10.realpathSync(root);
   } catch {
     return failure2("invalid_input", "candidate root does not exist");
   }
@@ -13308,11 +13731,11 @@ function captureCandidate(root, scope, environment = []) {
     if (item === ".git" || item === ".workit")
       continue;
     names.add(item);
-    if (!fs8.existsSync(target))
+    if (!fs10.existsSync(target))
       continue;
     let stat;
     try {
-      stat = fs8.lstatSync(target);
+      stat = fs10.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -13328,17 +13751,17 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path11.join(checkout, item);
+    const target = path13.join(checkout, item);
     try {
-      const stat = fs8.lstatSync(target);
+      const stat = fs10.lstatSync(target);
       if (stat.isSymbolicLink()) {
-        const link = fs8.readlinkSync(target);
+        const link = fs10.readlinkSync(target);
         files.push({ path: item, kind: "symlink", digest: digestBytes3(link), executable: null });
       } else if (stat.isFile()) {
         files.push({
           path: item,
           kind: "file",
-          digest: digestBytes3(fs8.readFileSync(target)),
+          digest: digestBytes3(fs10.readFileSync(target)),
           executable: (stat.mode & 73) !== 0
         });
       } else if (!stat.isDirectory()) {
@@ -13363,7 +13786,7 @@ function captureCandidate(root, scope, environment = []) {
   const values = supplied.toSorted((left, right) => compareCodeUnits2(left.name, right.name)).map(({ name, value }) => ({ name, value, refs: [] }));
   if (values.some(({ value }) => value === null))
     completeness = "uncertain";
-  const headResult = spawnSync3("git", ["rev-parse", "HEAD"], { cwd: checkout, encoding: "utf8" });
+  const headResult = spawnSync5("git", ["rev-parse", "HEAD"], { cwd: checkout, encoding: "utf8" });
   if (headResult.status !== 0 && !/not a git repository/i.test(headResult.stderr ?? ""))
     completeness = "uncertain";
   const head = headResult.status === 0 ? headResult.stdout.trim() : null;
@@ -13401,7 +13824,24 @@ var sameSession = (left, right) => {
   return left !== null && other !== null && left.host === other.host && left.handle === other.handle;
 };
 var evidenceScopes = (task, ids) => (task.policy?.requirements ?? []).filter((requirement) => ids.includes(requirement.id)).map((requirement) => requirement.scope);
-function evaluateEvidence(task, candidate) {
+var memo2 = (compute) => {
+  let value;
+  return () => {
+    if (value === undefined)
+      value = compute();
+    return value;
+  };
+};
+var treeFreshness = (root) => ({
+  mode: "tree",
+  current: memo2(() => worktreeTree(root)?.key ?? null)
+});
+var signalFreshness = (root) => ({
+  mode: "signal",
+  current: memo2(() => worktreeSignal(root))
+});
+var isObservedCheck = (entry) => entry.data.kind === "check" && entry.data.observation?.observer === "workit_cli" && entry.provenance?.kind === "host_observed" && entry.provenance.host === "workit_cli";
+function evaluateEvidence(task, candidate, freshness) {
   const current = candidate ?? task.candidates.at(-1) ?? null;
   return task.evidence.map((entry) => {
     const evidence = entry.data;
@@ -13411,6 +13851,25 @@ function evaluateEvidence(task, candidate) {
         status: "failed",
         reason: "failed evidence remains historical"
       };
+    const observation = isObservedCheck(entry) ? evidence.observation : undefined;
+    if (observation && observation.tree !== null) {
+      if (task.status === "closed")
+        return { evidenceId: entry.id, status: evidence.result, reason: "recorded before close" };
+      if (observation.modifiedWorktree)
+        return {
+          evidenceId: entry.id,
+          status: "stale",
+          reason: "the check changed the worktree while it ran; ignore or clean its outputs"
+        };
+      const recorded = freshness?.mode === "signal" ? observation.signal : observation.tree;
+      if (recorded !== null && freshness && recorded === freshness.current())
+        return { evidenceId: entry.id, status: evidence.result, reason: "worktree is unchanged" };
+      return {
+        evidenceId: entry.id,
+        status: "stale",
+        reason: freshness?.mode === "signal" ? "the worktree may have changed since the check ran (quick signal; inspect re-checks exactly)" : "the worktree changed since the check ran"
+      };
+    }
     if (evidence.kind === "check" || evidence.kind === "review") {
       if (!evidence.beforeCandidateId || !evidence.candidateId)
         return {
@@ -13494,8 +13953,45 @@ var expectedKinds = (dimension, ruleId) => {
     return "decision";
   return "worker report";
 };
-function evaluateRequirements(task, workspace, capabilities, candidate, checkoutRoot, _caller) {
-  const evidence = evaluateEvidence(task, candidate);
+var observedGate = (requirement) => (requirement.dimension === "testing" || requirement.dimension === "verification") && requirement.before === "close";
+function evaluateObservedGate(task, requirement, statuses, config) {
+  const names = gateCheckNames(config, requirement.dimension);
+  const observed = task.evidence.filter(isObservedCheck);
+  const fresh = observed.filter((entry) => statuses.get(entry.id) === "passed" && entry.data.observation?.exitCode === 0);
+  const named = (entry) => {
+    const observation = entry.data.observation;
+    return observation.configured && !observation.shell && names.includes(observation.name ?? "") && matchesNamedCheck(config, observation.name, observation.argv, observation.cwd);
+  };
+  const considered = observed.map((entry) => entry.id);
+  const run = checkCommand(names[0] ?? "<name>", runtimeVersion());
+  if (config.error)
+    return {
+      satisfied: [],
+      considered,
+      reason: `check config is invalid (${config.error}); fix it, then run ${run}`
+    };
+  if (!names.length)
+    return {
+      satisfied: [],
+      considered,
+      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE} (committed, so it shows in the diff), e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
+    };
+  const satisfied = fresh.filter(named);
+  if (satisfied.length)
+    return {
+      satisfied: satisfied.map((entry) => entry.id),
+      considered,
+      reason: `a fresh passing configured check (${names.join("|")}) was observed by workit check`
+    };
+  const reported = task.evidence.some((entry) => entry.data.kind === "check" && !isObservedCheck(entry) && entry.data.requirementIds.includes(requirement.id));
+  const reason = fresh.length ? `ad-hoc checks do not satisfy a configured gate; run ${run}` : observed.some((entry) => statuses.get(entry.id) === "stale") ? `observed checks are stale (the worktree changed); run ${run}` : observed.some((entry) => statuses.get(entry.id) === "failed") ? `the observed check failed; fix it and run ${run}` : reported ? `agent-reported checks are notes, not evidence; run ${run}` : `no CLI-observed check (needs kind:check observed by workit check); run ${run}`;
+  return { satisfied: [], considered, reason };
+}
+function evaluateRequirements(task, workspace, capabilities, candidate, checkoutRoot, _caller, freshness = treeFreshness(checkoutRoot)) {
+  const evidence = evaluateEvidence(task, candidate, freshness);
+  const statuses = new Map(evidence.map((item) => [item.evidenceId, item.status]));
+  let checkConfig;
+  const configFor = () => checkConfig ??= loadCheckConfig(checkoutRoot);
   if (task.policy && task.policy.policyVersion !== POLICY_VERSION)
     return task.policy.requirements.map((requirement) => ({
       requirementId: requirement.id,
@@ -13505,8 +14001,19 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
       reason: "stored policy version is unsupported; reassessment is required"
     }));
   return (task.policy?.requirements ?? []).map((requirement) => {
+    const gate = observedGate(requirement) ? evaluateObservedGate(task, requirement, statuses, configFor()) : null;
+    if (gate?.satisfied.length)
+      return {
+        requirementId: requirement.id,
+        status: "satisfied",
+        evidenceIds: gate.satisfied,
+        decisionIds: [],
+        reason: gate.reason
+      };
     const related = task.evidence.map((entry, index) => ({ entry, evaluation: evidence[index] })).filter(({ entry }) => entry.data.requirementIds.includes(requirement.id));
     const passed = related.filter(({ entry, evaluation }) => {
+      if (gate)
+        return false;
       if (!evidenceMatchesRequirement(evaluation.status, entry.data.kind, requirement.dimension, requirement.ruleId))
         return false;
       if ((entry.data.kind === "check" || entry.data.kind === "review") && (!entry.data.beforeCandidateId || !entry.data.candidateId || entry.data.beforeCandidateId !== entry.data.candidateId))
@@ -13569,6 +14076,14 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
         reason: "an applicable approved limitation permits the missing evidence"
       };
     const unavailable = capabilities.some((capability) => capability.assurance === "unavailable" && (capability.name === requirement.dimension || capability.surface === requirement.dimension));
+    if (gate)
+      return {
+        requirementId: requirement.id,
+        status: unavailable ? "unavailable" : "unsatisfied",
+        evidenceIds: [...new Set([...gate.considered, ...related.map(({ entry }) => entry.id)])],
+        decisionIds: [],
+        reason: unavailable ? "required capability is unavailable" : gate.reason
+      };
     if (!unavailable && related.length > 0 && !passed.length)
       return {
         requirementId: requirement.id,
@@ -13745,8 +14260,11 @@ policy, and reapplies the call, returning busy under persistent contention. A
 revision_conflict means a revision you passed is stale: re-read the record
 before deciding whether to retry.
 A solo edit does not need writer acquisition; use it when concurrent checkout
-writers need coordination. Record only observed facts and checks. Evidence can
-become stale when its bound candidate changes; reconcile findings against the
+writers need coordination. Record only observed facts and checks. Close-time
+testing and verification gates accept only a configured check the CLI ran:
+\`workit check <name>\` (\`npx -y @brainervirus/workit-cli check <name>\` when
+\`workit\` is not on PATH); a recorded check result is a note and an ad-hoc
+\`workit check -- <cmd>\` never satisfies a gate. Evidence can become stale when its bound candidate or tree changes; reconcile findings against the
 current candidate before recording completion.
 
 Workit validates domain policy against the actual action target, configured
@@ -13807,7 +14325,7 @@ function reconcileResume(view, observations = []) {
   const candidate = captureCandidate(view.workspace.root, view.task.intent.data.scope, []);
   if (!candidate.ok)
     return candidate;
-  const staleEvidenceIds = evaluateEvidence(view.task, candidate.data).filter((entry) => entry.status === "stale").map((entry) => entry.evidenceId);
+  const staleEvidenceIds = evaluateEvidence(view.task, candidate.data, treeFreshness(view.workspace.root)).filter((entry) => entry.status === "stale").map((entry) => entry.evidenceId);
   const blockers = [...view.task.progress.blockers];
   if (view.task.workers.some((entry) => isUncertainWorker(entry.data.state)))
     blockers.push({
@@ -13932,7 +14450,7 @@ var shellBranchPolicyViolation = (root, command) => {
 // packages/workit-core/src/core/external-action.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { realpathSync as realpathSync6 } from "node:fs";
-import path12 from "node:path";
+import path14 from "node:path";
 var chainStepSchema = union([
   string2().min(1),
   object({ branch: string2().min(1) }).strict(),
@@ -14126,7 +14644,7 @@ var planCommitDescriptor = (content) => {
     if (!steps || typeof branch !== "string" || !branch)
       return null;
     const cwd = value.payload.cwd;
-    if (cwd !== undefined && (typeof cwd !== "string" || !path12.isAbsolute(cwd)))
+    if (cwd !== undefined && (typeof cwd !== "string" || !path14.isAbsolute(cwd)))
       return null;
     const head = value.payload.resolved?.head;
     return {
@@ -14269,7 +14787,7 @@ var descriptorTargetRoot = (store, operation) => {
     const cwd = descriptor.payload?.cwd;
     if (cwd === undefined)
       return store.root;
-    return typeof cwd === "string" && path12.isAbsolute(cwd) ? realpathSync6(cwd) : null;
+    return typeof cwd === "string" && path14.isAbsolute(cwd) ? realpathSync6(cwd) : null;
   } catch {
     return null;
   }
@@ -14380,7 +14898,7 @@ var branchSetupIntent = (descriptor) => {
     const { target_branch, resolved } = value.payload;
     if (typeof target_branch !== "string" || !target_branch || !resolved)
       return null;
-    if (value.payload.cwd !== undefined && (typeof value.payload.cwd !== "string" || !path12.isAbsolute(value.payload.cwd)))
+    if (value.payload.cwd !== undefined && (typeof value.payload.cwd !== "string" || !path14.isAbsolute(value.payload.cwd)))
       return null;
     if (typeof resolved.base_branch !== "string" || typeof resolved.target_exists !== "boolean")
       return null;
@@ -14497,7 +15015,7 @@ var externalActionTargetRoot = (operation, coordinationRoot) => {
   const payload = descriptor.payload;
   const cwd = typeof payload.cwd === "string" ? payload.cwd : coordinationRoot;
   try {
-    return realpathSync6(path12.resolve(coordinationRoot, cwd));
+    return realpathSync6(path14.resolve(coordinationRoot, cwd));
   } catch {
     return null;
   }
@@ -15746,10 +16264,7 @@ class WorkitCore {
           if (finding.data.disposition !== "fixed")
             return finding;
           const withEntry = { ...current, candidates, evidence: [...current.evidence, entry] };
-          const statuses = new Map(evaluateEvidence(withEntry, currentCandidate.data).map((item) => [
-            item.evidenceId,
-            item.status
-          ]));
+          const statuses = new Map(evaluateEvidence(withEntry, currentCandidate.data, treeFreshness(this.store.root)).map((item) => [item.evidenceId, item.status]));
           const verified = withEntry.evidence.some((item) => findingVerificationPasses(finding.data.candidateId, {
             kind: item.data.kind,
             candidateId: item.data.candidateId,
@@ -15764,6 +16279,71 @@ class WorkitCore {
       return changed;
     return success(changed.data.revision, null, changed.data.evidence.at(-1));
   }
+  observeCheck(request) {
+    return this.retryOmittedRevisions(request, () => this.observeCheckOnce(request));
+  }
+  observeCheckOnce(request) {
+    const root = this.contextRootError();
+    if (!root.ok)
+      return root;
+    if (this.context.caller.host !== "workit_cli" || (this.context.workerId ?? null) !== null)
+      return failure2("permission_denied", "only the workit CLI records observed checks");
+    const observation = checkObservationSchema.safeParse(request?.observation);
+    if (!observation.success)
+      return failure2("invalid_input", "check observation is invalid", {
+        fields: observation.error.issues.map((issue) => ({
+          path: issue.path.join("."),
+          reason: issue.message
+        }))
+      });
+    const task = this.store.readTask(request.taskId);
+    if (!task.ok)
+      return task;
+    if (task.data.status === "closed")
+      return failure2("invalid_transition", "closed task cannot record evidence");
+    const observed = observation.data;
+    let candidate = null;
+    if (observed.tree === null) {
+      const captured = captureCandidate(this.store.root, task.data.intent.data.scope, environment());
+      if (!captured.ok)
+        return captured;
+      candidate = captured.data;
+    }
+    const label = observed.name ?? observed.argv.join(" ");
+    const data = {
+      kind: "check",
+      claim: `workit check ${label}`.slice(0, 500),
+      requirementIds: [],
+      ...candidate ? { beforeCandidateId: candidate.id, candidateId: candidate.id } : {},
+      result: observed.exitCode === 0 ? "passed" : "failed",
+      summary: `${observed.configured ? "configured" : "ad-hoc"} check exited ${observed.exitCode}${observed.timedOut ? " (timed out)" : ""} in ${observed.durationMs} ms`,
+      refs: [],
+      exitCode: observed.exitCode,
+      reviewContext: null,
+      observation: observed
+    };
+    const changed = this.store.mutateTask(task.data.id, request.expectedRevision ?? task.data.revision, (current, mutation) => {
+      const candidates = candidate === null || current.candidates.some((item) => item.id === candidate.id) ? current.candidates : [...current.candidates, candidate];
+      const critical = [...new Set([...current.critical ?? [], CHECK_OBSERVATION_PATH])];
+      return success(mutation.revision, null, {
+        ...current,
+        critical,
+        candidates,
+        evidence: [
+          ...current.evidence,
+          {
+            id: newId(),
+            recordedAt: mutation.now,
+            provenance: provenance(this.context, "host_observed"),
+            data
+          }
+        ]
+      });
+    }, trustedNow(this.context));
+    if (!changed.ok)
+      return changed;
+    return success(changed.data.revision, null, changed.data.evidence.at(-1));
+  }
   decision(request) {
     return this.recordDecision(request);
   }
@@ -15999,7 +16579,7 @@ class WorkitCore {
       const current = captureCandidate(this.store.root, task.data.intent.data.scope, environment());
       if (!current.ok)
         return current;
-      const evaluations = evaluateEvidence(task.data, current.data);
+      const evaluations = evaluateEvidence(task.data, current.data, treeFreshness(this.store.root));
       const verified = evidence.some((entry) => {
         const evaluation = evaluations.find((item) => item.evidenceId === entry.id);
         return entry.recordedAt >= finding.recordedAt && findingVerificationPasses(finding.data.candidateId, {
@@ -16703,7 +17283,8 @@ class WorkitCore {
     if (!current.ok)
       return current;
     const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
-    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller);
+    const tree = treeFreshness(this.store.root);
+    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller, tree);
     return success(task.revision, workspace.data.revision, {
       id: task.id,
       revision: task.revision,
@@ -16720,7 +17301,7 @@ class WorkitCore {
       writer: evaluationWorkspace.writer
     });
   }
-  compactContext(taskId) {
+  compactContext(taskId, freshness) {
     const root = this.contextRootError();
     if (!root.ok)
       return root;
@@ -16730,12 +17311,12 @@ class WorkitCore {
     const helper = this.helperTaskGuard(task.data, true);
     if (!helper.ok)
       return helper;
-    const view = this.view(task.data, false);
+    const view = this.view(task.data, false, freshness ?? signalFreshness(this.store.root));
     if (!view.ok)
       return view;
     return success(view.revision, view.workspaceRevision, compactTaskContext(view.data));
   }
-  view(task, capture = true) {
+  view(task, capture = true, freshness = treeFreshness(this.store.root)) {
     const workspace = this.store.readWorkspace();
     if (!workspace.ok)
       return workspace;
@@ -16746,13 +17327,14 @@ class WorkitCore {
     if (!current.ok)
       return current;
     const evaluationWorkspace = task.status === "closed" ? { ...workspace.data, writer: null } : workspace.data;
-    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller);
+    const tree = freshness;
+    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller, tree);
     return success(task.revision, workspace.data.revision, {
       task,
       workspace: evaluationWorkspace,
       capabilities: this.context.capabilities,
       requirements,
-      evidence: evaluateEvidence(task, current.data)
+      evidence: evaluateEvidence(task, current.data, tree)
     });
   }
   reconcileResume(view, observations = []) {
@@ -16979,13 +17561,14 @@ class WorkitCore {
       return current;
     const withCandidate = current.data;
     const taskForView = withCandidate.id === task.data.candidates.at(-1)?.id ? task.data : { ...task.data, candidates: [...task.data.candidates, withCandidate] };
-    const requirements = evaluateRequirements(taskForView, workspace.data, this.context.capabilities, withCandidate, this.store.root, this.context.caller);
+    const tree = treeFreshness(this.store.root);
+    const requirements = evaluateRequirements(taskForView, workspace.data, this.context.capabilities, withCandidate, this.store.root, this.context.caller, tree);
     const view = {
       task: taskForView,
       workspace: workspace.data,
       capabilities: this.context.capabilities,
       requirements,
-      evidence: evaluateEvidence(taskForView, withCandidate)
+      evidence: evaluateEvidence(taskForView, withCandidate, tree)
     };
     const closure = evaluateClosure(input.outcome, view);
     if (!closure.ok)
@@ -17049,22 +17632,22 @@ function resolveGitRevision(root, value) {
 }
 function resolveInside(root, candidate) {
   const base = realpathSync8(root);
-  const target = path13.resolve(base, candidate);
-  if (target !== base && !target.startsWith(base + path13.sep)) {
+  const target = path15.resolve(base, candidate);
+  if (target !== base && !target.startsWith(base + path15.sep)) {
     throw new Error("path must stay inside repository root");
   }
   let ancestor = target;
   while (!existsSync6(ancestor))
-    ancestor = path13.dirname(ancestor);
+    ancestor = path15.dirname(ancestor);
   const canonicalAncestor = realpathSync8(ancestor);
-  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path13.sep)) {
+  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path15.sep)) {
     throw new Error("path must stay inside repository root");
   }
   return target;
 }
 function run2(root, executable, args, env = {}) {
   const cwd = realpathSync8(root);
-  const result = spawnSync4(executable, args, {
+  const result = spawnSync6(executable, args, {
     cwd,
     encoding: "utf8",
     env: { ...process.env, ...env }
@@ -17101,7 +17684,7 @@ var capabilitiesFor = (descriptor, observed = {}) => descriptor.capabilities.map
   };
 });
 // packages/workit-core/src/hooks/context.ts
-import path14 from "node:path";
+import path16 from "node:path";
 var boundTo = (entry, session) => entry.sessions.some((item) => item.host === session.host && item.handle === session.handle);
 var newestFirst = (left, right) => right.updatedAt.localeCompare(left.updatedAt);
 var sessionTaskEntry = (entries, session) => entries.filter((entry) => entry.status !== "closed" && boundTo(entry, session)).toSorted(newestFirst)[0] ?? null;
@@ -17126,6 +17709,19 @@ var filesKey = (files) => {
   return signatures.some((item) => item !== "-" && racySignature(item)) ? null : signatures.join("\x00");
 };
 var CACHE_LIMIT = 64;
+var SIGNAL_TTL_MS = 1500;
+var signals = new Map;
+var recentSignal = (root) => {
+  const now = Date.now();
+  const cached = signals.get(root);
+  if (cached && now - cached.at < SIGNAL_TTL_MS)
+    return cached.value;
+  const value = worktreeSignal(root);
+  signals.set(root, { at: now, value });
+  if (signals.size > CACHE_LIMIT)
+    signals.delete(signals.keys().next().value);
+  return value;
+};
 var cache = new Map;
 function sessionCompactContext(store, session, context, selection = "session-bound") {
   const listed = store.listTaskIndex();
@@ -17149,18 +17745,26 @@ function entryCompactContext(store, entry, session, context) {
     capabilities: context.capabilities
   });
   const hit = cache.get(slot);
-  if (hit && hit.key === key && hit.filesKey !== null && hit.filesKey === filesKey(hit.files))
+  if (hit && hit.key === key && hit.filesKey !== null && hit.filesKey === filesKey(hit.files) && (hit.signal === null || hit.signal === recentSignal(store.root)))
     return hit.value;
   const task = store.readTask(entry.id);
   if (!task.ok)
     return null;
-  const files = task.data.decisions.flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path14.resolve(store.root, ref.path)] : []));
-  const observed = filesKey(files);
-  const compact = new WorkitCore(store, context).compactContext(entry.id);
+  const freshness = { mode: "signal", current: () => recentSignal(store.root) };
+  const observed = task.data.evidence.some(isObservedCheck);
+  const files = task.data.decisions.flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path16.resolve(store.root, ref.path)] : []));
+  const observedFiles = filesKey(files);
+  const compact = new WorkitCore(store, context).compactContext(entry.id, freshness);
   if (!compact.ok)
     return null;
   cache.delete(slot);
-  cache.set(slot, { key, files, filesKey: observed, value: compact.data });
+  cache.set(slot, {
+    key,
+    files,
+    filesKey: observedFiles,
+    signal: observed ? freshness.current() : null,
+    value: compact.data
+  });
   if (cache.size > CACHE_LIMIT)
     cache.delete(cache.keys().next().value);
   return compact.data;
@@ -17327,9 +17931,9 @@ var WORKIT_SKILL_ALIASES = {
 if (false) {}
 
 // packages/workit-core/src/core/pr-create.ts
-import fs9 from "node:fs";
-import path15 from "node:path";
-import { spawnSync as spawnSync5 } from "node:child_process";
+import fs11 from "node:fs";
+import path17 from "node:path";
+import { spawnSync as spawnSync7 } from "node:child_process";
 import { pathToFileURL } from "node:url";
 // packages/workit-core/src/forge/pr-body.ts
 function parseGhIssue(value) {
@@ -17419,13 +18023,13 @@ var cliRepository = (remote, provider, cfg) => {
 };
 function whichOnPath(tool) {
   const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
-  for (const dir of (process.env.PATH ?? "").split(path15.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(path17.delimiter)) {
     if (!dir)
       continue;
     for (const name of names) {
-      const candidate = path15.join(dir, name);
+      const candidate = path17.join(dir, name);
       try {
-        fs9.accessSync(candidate, fs9.constants.X_OK);
+        fs11.accessSync(candidate, fs11.constants.X_OK);
         return candidate;
       } catch {}
     }
@@ -17434,11 +18038,11 @@ function whichOnPath(tool) {
 }
 var hostingCliAvailable = (provider) => whichOnPath(provider === "gitlab" ? "glab" : "gh") !== null;
 function repoRoot(cwd) {
-  const result = spawnSync5("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8" });
+  const result = spawnSync7("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8" });
   return result.status === 0 ? (result.stdout ?? "").trim() : cwd;
 }
 var pushRemote = (cwd) => {
-  const result = spawnSync5("git", ["remote", "get-url", "--push", "--all", "origin"], {
+  const result = spawnSync7("git", ["remote", "get-url", "--push", "--all", "origin"], {
     cwd,
     encoding: "utf8"
   });
@@ -17449,7 +18053,7 @@ var pushRemote = (cwd) => {
 };
 var safePushUrl = (remote) => {
   const raw = remote.trim();
-  if (path15.isAbsolute(raw))
+  if (path17.isAbsolute(raw))
     return pathToFileURL(raw).href;
   if (!raw.includes("://")) {
     const scp = /^(?:([^@\s]+)@)?([^:]+):(.+)$/u.exec(raw);
@@ -17474,7 +18078,7 @@ var pushRemoteIdentity = (remote) => {
   const raw = remote.trim();
   if (!raw)
     return null;
-  if (path15.isAbsolute(raw))
+  if (path17.isAbsolute(raw))
     return pathToFileURL(raw).href;
   if (!raw.includes("://")) {
     const scp = /^(?:([^@\s]+)@)?([^:]+):(.+)$/u.exec(raw);
@@ -17498,7 +18102,7 @@ var pushTargetIsStable = (cwd, remote) => {
   const target = safePushUrl(remote);
   if (!target)
     return false;
-  const result = spawnSync5("git", ["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"], { cwd, encoding: "utf8" });
+  const result = spawnSync7("git", ["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"], { cwd, encoding: "utf8" });
   if (result.status !== 0 && result.status !== 1)
     return false;
   const prefixes = (result.stdout ?? "").split(/\r?\n/u).map((line) => line.trim().slice(line.trim().indexOf(" ") + 1)).filter(Boolean);
@@ -17535,7 +18139,7 @@ function prCreate(env, cwd) {
     return {
       error: "origin must have exactly one supported push URL for a reserved hosting action"
     };
-  const localOnlyTarget = path15.isAbsolute(pushUrl) || pushUrl.startsWith("file://");
+  const localOnlyTarget = path17.isAbsolute(pushUrl) || pushUrl.startsWith("file://");
   if ((!localOnlyTarget || env.WORKIT_EXPECTED_API_HOST) && !hostingApiHostMatches(pushUrl, identity.host))
     return { error: "hosting API host does not match the push destination" };
   if (env.WORKIT_EXPECTED_REMOTE && env.WORKIT_EXPECTED_REMOTE !== targetIdentity)
@@ -17546,12 +18150,12 @@ function prCreate(env, cwd) {
   const resolvedDefault = String(cfg.defaultTargetBranch ?? policy.defaultTargetBranch ?? "develop");
   const target = targetOverride || resolvedDefault;
   const title = String(env.WF_PR_TITLE ?? "");
-  const br = spawnSync5("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+  const br = spawnSync7("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
     cwd: root,
     encoding: "utf8"
   });
   const branch = br.status === 0 ? (br.stdout ?? "").trim() : "";
-  const sourceResult = branch ? spawnSync5("git", ["rev-parse", "--verify", `refs/heads/${branch}`], {
+  const sourceResult = branch ? spawnSync7("git", ["rev-parse", "--verify", `refs/heads/${branch}`], {
     cwd: root,
     encoding: "utf8"
   }) : null;
@@ -17560,7 +18164,7 @@ function prCreate(env, cwd) {
     return { error: "approved PR source branch and commit are incomplete" };
   if (env.WORKIT_EXPECTED_SOURCE_BRANCH && env.WORKIT_EXPECTED_SOURCE_BRANCH !== branch || env.WORKIT_EXPECTED_SOURCE_COMMIT && env.WORKIT_EXPECTED_SOURCE_COMMIT !== sourceCommit)
     return { error: "approved PR source branch or commit changed before execution" };
-  const mergeBaseResult = policy.integration === "merge" ? spawnSync5("git", ["rev-parse", "--verify", `refs/heads/${target}`], {
+  const mergeBaseResult = policy.integration === "merge" ? spawnSync7("git", ["rev-parse", "--verify", `refs/heads/${target}`], {
     cwd: root,
     encoding: "utf8"
   }) : null;
@@ -17576,7 +18180,7 @@ function prCreate(env, cwd) {
           targetBranch: target,
           stderr: "source or target branch commit could not be resolved"
         };
-      const merge = spawnSync5("git", ["merge", "--no-ff", sourceCommit, "-m", title], {
+      const merge = spawnSync7("git", ["merge", "--no-ff", sourceCommit, "-m", title], {
         cwd: root,
         encoding: "utf8"
       });
@@ -17587,16 +18191,16 @@ function prCreate(env, cwd) {
           targetBranch: target,
           stderr: (merge.stderr ?? "").slice(0, 800)
         };
-      const mergedCommit = spawnSync5("git", ["rev-parse", "HEAD"], {
+      const mergedCommit = spawnSync7("git", ["rev-parse", "HEAD"], {
         cwd: root,
         encoding: "utf8"
       });
       if (mergedCommit.status !== 0)
         return { error: "merge commit could not be resolved", mode: "merge" };
-      const updateTarget = spawnSync5("git", ["update-ref", `refs/heads/${target}`, mergedCommit.stdout.trim(), mergeBaseCommit], { cwd: root, encoding: "utf8" });
+      const updateTarget = spawnSync7("git", ["update-ref", `refs/heads/${target}`, mergedCommit.stdout.trim(), mergeBaseCommit], { cwd: root, encoding: "utf8" });
       if (updateTarget.status !== 0)
         return { error: "merge target branch changed before update", mode: "merge" };
-      const push = spawnSync5("git", ["push", targetUrl, `${mergedCommit.stdout.trim()}:refs/heads/${target}`], { cwd: root, encoding: "utf8", env: { ...process.env, PATH: process.env.PATH ?? "" } });
+      const push = spawnSync7("git", ["push", targetUrl, `${mergedCommit.stdout.trim()}:refs/heads/${target}`], { cwd: root, encoding: "utf8", env: { ...process.env, PATH: process.env.PATH ?? "" } });
       if (push.status !== 0)
         return {
           error: "push failed",
@@ -17613,7 +18217,7 @@ function prCreate(env, cwd) {
         output: (push.stdout ?? "").trim()
       };
     };
-    const co = spawnSync5("git", ["checkout", "--detach", mergeBaseCommit], {
+    const co = spawnSync7("git", ["checkout", "--detach", mergeBaseCommit], {
       cwd: root,
       encoding: "utf8"
     });
@@ -17625,7 +18229,7 @@ function prCreate(env, cwd) {
         stderr: (co.stderr ?? "").slice(0, 800)
       };
     const result = finish();
-    spawnSync5("git", ["checkout", branch], { cwd: root, encoding: "utf8" });
+    spawnSync7("git", ["checkout", branch], { cwd: root, encoding: "utf8" });
     return result;
   }
   const pr = cfg.pr ?? {};
@@ -17633,9 +18237,9 @@ function prCreate(env, cwd) {
   const draft = String(env.WF_PR_DRAFT ?? "false").toLowerCase() === "true";
   let baseUrl = cfg.youtrack_base_url;
   if (!baseUrl) {
-    const ytCfg = process.env.WORKFLOW_YOUTRACK_CONFIG ?? path15.join(path15.dirname(String(cfg.configPath)), "youtrack.json");
+    const ytCfg = process.env.WORKFLOW_YOUTRACK_CONFIG ?? path17.join(path17.dirname(String(cfg.configPath)), "youtrack.json");
     try {
-      const yt = JSON.parse(fs9.readFileSync(ytCfg, "utf8"));
+      const yt = JSON.parse(fs11.readFileSync(ytCfg, "utf8"));
       if (yt && typeof yt === "object")
         baseUrl = yt.baseUrl;
     } catch {}
@@ -17651,7 +18255,7 @@ function prCreate(env, cwd) {
   const push = pr.pushBranch !== false;
   const skipConfirm = pr.confirmSkip !== false;
   const remoteBranchTip = () => {
-    const read = spawnSync5("git", ["ls-remote", targetUrl, `refs/heads/${branch}`], {
+    const read = spawnSync7("git", ["ls-remote", targetUrl, `refs/heads/${branch}`], {
       cwd: root,
       encoding: "utf8",
       env: { ...process.env, PATH: process.env.PATH ?? "" }
@@ -17667,7 +18271,7 @@ function prCreate(env, cwd) {
       stderr: branch ? "source branch commit could not be resolved" : "empty current branch (detached HEAD or unborn HEAD)"
     };
   if (push) {
-    const pushed = spawnSync5("git", ["push", "-u", targetUrl, `${sourceCommit}:refs/heads/${branch}`], { cwd: root, encoding: "utf8", env: { ...process.env, PATH: process.env.PATH ?? "" } });
+    const pushed = spawnSync7("git", ["push", "-u", targetUrl, `${sourceCommit}:refs/heads/${branch}`], { cwd: root, encoding: "utf8", env: { ...process.env, PATH: process.env.PATH ?? "" } });
     if (pushed.status !== 0)
       return { error: "push failed", provider, stderr: (pushed.stderr ?? "").slice(0, 800) };
   }
@@ -17712,12 +18316,12 @@ function prCreate(env, cwd) {
       cmd.push("--draft");
     cmdEnv = { ...process.env, PATH: process.env.PATH ?? "", GH_HOST: identity.host };
   }
-  const result = spawnSync5(cmd[0], cmd.slice(1), { cwd: root, encoding: "utf8", env: cmdEnv });
+  const result = spawnSync7(cmd[0], cmd.slice(1), { cwd: root, encoding: "utf8", env: cmdEnv });
   if (result.status !== 0) {
     const err = (result.stderr ?? result.stdout ?? "").trim();
     let hint = null;
     if (provider === "gitlab" && (err.includes("409") || err.toLowerCase().includes("already exists"))) {
-      const list = spawnSync5("glab", ["mr", "list", `--source-branch=${branch}`, "--output=json"], {
+      const list = spawnSync7("glab", ["mr", "list", `--source-branch=${branch}`, "--output=json"], {
         cwd: root,
         encoding: "utf8",
         env: cmdEnv
@@ -17776,7 +18380,7 @@ function mergePr(cwd, opts) {
     return { error: "approved hosting account changed before execution" };
   if (!/^[a-f0-9]{40,64}$/i.test(opts.sourceCommit))
     return { error: "approved merge source commit is invalid" };
-  const currentCommit = spawnSync5("git", ["rev-parse", "--verify", `refs/heads/${opts.source}`], {
+  const currentCommit = spawnSync7("git", ["rev-parse", "--verify", `refs/heads/${opts.source}`], {
     cwd: root,
     encoding: "utf8"
   });
@@ -17790,7 +18394,7 @@ function mergePr(cwd, opts) {
     return { error: `workflow CLI missing (required for ${provider})` };
   const owner = repoPath.split("/")[0];
   const endpoint = provider === "github" ? `repos/${repository.replace(/^[^/]+\//u, "")}/pulls?state=open&head=${encodeURIComponent(`${owner}:${opts.source}`)}&base=${encodeURIComponent(opts.target)}&per_page=100` : `projects/${encodeURIComponent(repoPath)}/merge_requests?state=opened&source_branch=${encodeURIComponent(opts.source)}&target_branch=${encodeURIComponent(opts.target)}&per_page=100`;
-  const listOpen = () => spawnSync5(provider === "github" ? "gh" : "glab", ["api", endpoint], {
+  const listOpen = () => spawnSync7(provider === "github" ? "gh" : "glab", ["api", endpoint], {
     cwd: root,
     encoding: "utf8",
     env: {
@@ -17850,7 +18454,7 @@ function mergePr(cwd, opts) {
       cmd.push("--delete-branch");
     cmdEnv = { ...process.env, PATH: process.env.PATH ?? "", GH_HOST: identity.host };
   }
-  const result = spawnSync5(cmd[0], cmd.slice(1), { cwd: root, encoding: "utf8", env: cmdEnv });
+  const result = spawnSync7(cmd[0], cmd.slice(1), { cwd: root, encoding: "utf8", env: cmdEnv });
   if (result.status !== 0)
     return {
       error: "merge failed",
@@ -17867,9 +18471,9 @@ function mergePr(cwd, opts) {
 }
 
 // packages/workit-core/src/core/repo-context.ts
-import { spawnSync as spawnSync6 } from "node:child_process";
+import { spawnSync as spawnSync8 } from "node:child_process";
 import { existsSync as existsSync7, readFileSync as readFileSync8, readdirSync as readdirSync4 } from "node:fs";
-import path16 from "node:path";
+import path18 from "node:path";
 var isSafeContextRange = (value) => value.length <= 4096 && (() => {
   try {
     gitRevisionParts(value);
@@ -17896,7 +18500,7 @@ var invalidRange = (cwd) => ({
   cwd
 });
 var runGit = (cwd, args) => {
-  const result = spawnSync6("git", args, { cwd, encoding: "utf8" });
+  const result = spawnSync8("git", args, { cwd, encoding: "utf8" });
   return {
     stdout: (result.stdout ?? "").trimEnd(),
     stderr: (result.stderr ?? "").trimEnd(),
@@ -18003,7 +18607,7 @@ var findPrTemplate = (cwd) => {
   ]) {
     const parts = rel.split("/");
     const base = parts[parts.length - 1];
-    const dir = parts.length > 1 ? path16.join(cwd, ...parts.slice(0, -1)) : cwd;
+    const dir = parts.length > 1 ? path18.join(cwd, ...parts.slice(0, -1)) : cwd;
     const actual = probeCaseInsensitive(dir, base);
     if (actual)
       return [...parts.slice(0, -1), actual].join("/");
@@ -18034,7 +18638,7 @@ var diffStatForRange = (cwd, range) => {
   return runGit(cwd, ["diff", "--stat", "--"]).stdout;
 };
 var packageScripts = (cwd, keys) => {
-  const pkgPath = path16.join(cwd, "package.json");
+  const pkgPath = path18.join(cwd, "package.json");
   if (!existsSync7(pkgPath))
     return [];
   try {
@@ -18060,9 +18664,9 @@ var documentationFiles = (cwd) => {
       if (entry.isDirectory()) {
         if (excluded.has(entry.name))
           continue;
-        walk(path16.join(dir, entry.name), depth + 1);
+        walk(path18.join(dir, entry.name), depth + 1);
       } else if (entry.isFile() && (entry.name === "README.md" || entry.name.endsWith(".md"))) {
-        matches.push("./" + path16.relative(cwd, path16.join(dir, entry.name)).replaceAll("\\", "/"));
+        matches.push("./" + path18.relative(cwd, path18.join(dir, entry.name)).replaceAll("\\", "/"));
       }
     }
   };
@@ -18078,7 +18682,7 @@ var readTrimmed2 = (file, maxLines) => {
 `);
 };
 function prReadyContext(root, range) {
-  const cwd = path16.resolve(repoRoot2(root));
+  const cwd = path18.resolve(repoRoot2(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   let stdout = "";
@@ -18136,7 +18740,7 @@ ${status.stderr}` : "");
     stdout += `template_path: ${template}
 
 `;
-    stdout += readTrimmed2(path16.join(cwd, template), 220);
+    stdout += readTrimmed2(path18.join(cwd, template), 220);
   } else {
     stdout += `template_path: none
 
@@ -18146,7 +18750,7 @@ ${status.stderr}` : "");
   stdout += `
 `;
   stdout += printSection("Recent Validation Signals");
-  if (existsSync7(path16.join(cwd, "package.json"))) {
+  if (existsSync7(path18.join(cwd, "package.json"))) {
     stdout += `package.json detected. Common scripts:
 `;
     const found = packageScripts(cwd, ["lint", "format:check", "test", "build"]);
@@ -18155,7 +18759,7 @@ ${status.stderr}` : "");
 `) + `
 `;
   }
-  if (existsSync7(path16.join(cwd, "Cargo.toml")) || existsSync7(path16.join(cwd, "src-tauri/Cargo.toml"))) {
+  if (existsSync7(path18.join(cwd, "Cargo.toml")) || existsSync7(path18.join(cwd, "src-tauri/Cargo.toml"))) {
     stdout += `Rust project detected.
 `;
   }
@@ -18188,7 +18792,7 @@ var CHANGELOG_RULES = `- Use an [Unreleased] section.
 - Apply with the host-native editor, preserving the repository changelog conventions.
 - If Unreleased already has duplicate category headings, normalize_only first.`;
 function changelogContext(root, range) {
-  const cwd = path16.resolve(repoRoot2(root));
+  const cwd = path18.resolve(repoRoot2(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -18206,7 +18810,7 @@ function changelogContext(root, range) {
   stdout += CHANGELOG_RULES + `
 `;
   stdout += printSection("Existing CHANGELOG.md");
-  const changelogPath = path16.join(cwd, "CHANGELOG.md");
+  const changelogPath = path18.join(cwd, "CHANGELOG.md");
   if (existsSync7(changelogPath)) {
     stdout += readTrimmed2(changelogPath, 260) + `
 `;
@@ -18226,7 +18830,7 @@ function changelogContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function docsRefreshContext(root, range) {
-  const cwd = path16.resolve(repoRoot2(root));
+  const cwd = path18.resolve(repoRoot2(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -18248,7 +18852,7 @@ function docsRefreshContext(root, range) {
 `) + `
 `;
   stdout += printSection("README Preview");
-  const readme = path16.join(cwd, "README.md");
+  const readme = path18.join(cwd, "README.md");
   if (existsSync7(readme)) {
     stdout += readTrimmed2(readme, 220) + `
 `;
@@ -18257,7 +18861,7 @@ function docsRefreshContext(root, range) {
 `;
   }
   stdout += printSection("Package Scripts");
-  const pkgPath = path16.join(cwd, "package.json");
+  const pkgPath = path18.join(cwd, "package.json");
   if (existsSync7(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync8(pkgPath, "utf8"));
@@ -18271,7 +18875,7 @@ function docsRefreshContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function releaseNotesContext(root, rangeOrTag) {
-  const cwd = path16.resolve(repoRoot2(root));
+  const cwd = path18.resolve(repoRoot2(root));
   if (!rangeOrTag) {
     return { stdout: "", stderr: `ERROR: release tag or range required
 `, exitCode: 1, cwd };
@@ -18309,7 +18913,7 @@ function releaseNotesContext(root, rangeOrTag) {
 `;
   stdout += printSection("Existing Release Files");
   for (const rel of ["CHANGELOG.md", "RELEASE_NOTES.md", ".github/releases.md"]) {
-    if (existsSync7(path16.join(cwd, rel)))
+    if (existsSync7(path18.join(cwd, rel)))
       stdout += rel + `
 `;
   }
@@ -18337,7 +18941,7 @@ function releaseNotesContext(root, rangeOrTag) {
 }
 
 // packages/workit-core/src/core/tracker-issues.ts
-import { spawnSync as spawnSync7 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 var repoPathFromRemote = (remote) => {
   let rest = (remote || "").trim().replace(/\/+$/, "");
   if (!rest)
@@ -18358,7 +18962,7 @@ var defaultCli = (bin, available) => {
   if (!available)
     return null;
   return (args, root) => {
-    const out = spawnSync7(bin, args, {
+    const out = spawnSync9(bin, args, {
       cwd: root,
       encoding: "utf8",
       env: { ...process.env, PATH: process.env.PATH ?? "" }
@@ -18436,8 +19040,8 @@ var fetchGitLabIssueBody = async (ref, root, deps = {}) => {
 };
 
 // packages/workit-core/src/core/youtrack.ts
-import fs10 from "node:fs";
-import path17 from "node:path";
+import fs12 from "node:fs";
+import path19 from "node:path";
 
 // packages/workit-core/src/core/templates.ts
 var repoRoot3 = assetRoot();
@@ -18450,22 +19054,22 @@ var resolveWorkspaceRoot = (explicit) => explicit || process.cwd();
 // packages/workit-core/src/core/youtrack.ts
 var ISSUE_RE = /^[A-Z]+-\d+$/;
 var TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";
-var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path17.join(configDir(), "youtrack.json");
-var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path17.join(resolveConfigDir(), "youtrack.json");
+var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path19.join(configDir(), "youtrack.json");
+var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path19.join(resolveConfigDir(), "youtrack.json");
 var youTrackTokenModeOk = (p) => {
   if (process.platform === "win32")
     return true;
-  const mode = fs10.statSync(p).mode & 511;
+  const mode = fs12.statSync(p).mode & 511;
   return mode === 384;
 };
 function readYouTrackConfig(required) {
   const cfgPath = youTrackConfigPath();
-  if (!fs10.existsSync(cfgPath)) {
+  if (!fs12.existsSync(cfgPath)) {
     return required ? { error: "ERROR: missing youtrack.json", path: cfgPath } : { config: {}, path: cfgPath };
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs10.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs12.readFileSync(cfgPath, "utf8"));
   } catch {
     return { error: `${cfgPath} is not valid JSON`, path: cfgPath };
   }
@@ -18476,11 +19080,11 @@ function readYouTrackConfig(required) {
 }
 var readYouTrackContextConfig = () => {
   const cfgPath = youTrackReadOnlyConfigPath();
-  if (!fs10.existsSync(cfgPath))
+  if (!fs12.existsSync(cfgPath))
     return { data: {} };
   let parsed;
   try {
-    parsed = JSON.parse(fs10.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs12.readFileSync(cfgPath, "utf8"));
   } catch {
     return { error: "YouTrack configuration is unavailable" };
   }
@@ -18495,22 +19099,22 @@ function youTrackConfigLoad() {
   }
   const cfgPath = loaded.path;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path17.isAbsolute(tokenFile) ? path17.resolve(tokenFile) : path17.resolve(process.cwd(), tokenFile) : "";
-  if (!tokenPath || !fs10.existsSync(tokenPath)) {
+  const tokenPath = tokenFile ? path19.isAbsolute(tokenFile) ? path19.resolve(tokenFile) : path19.resolve(process.cwd(), tokenFile) : "";
+  if (!tokenPath || !fs12.existsSync(tokenPath)) {
     return { error: "missing youtrack.token" };
   }
   if (!youTrackTokenModeOk(tokenPath)) {
     return { error: "youtrack.token mode must be 0600" };
   }
-  const token = fs10.readFileSync(tokenPath, "utf8").trim();
+  const token = fs12.readFileSync(tokenPath, "utf8").trim();
   if (!token || token === TOKEN_PLACEHOLDER || token.startsWith(TOKEN_PLACEHOLDER)) {
     return { error: "token file still placeholder — edit locally, then /wk-status" };
   }
   const redacted = { ...loaded.config };
   delete redacted.tokenFile;
   redacted.tokenPresent = true;
-  redacted.configPath = path17.resolve(cfgPath);
-  redacted.tokenPath = path17.resolve(tokenPath);
+  redacted.configPath = path19.resolve(cfgPath);
+  redacted.tokenPath = path19.resolve(tokenPath);
   return { data: redacted };
 }
 function tzParts(date, tz) {
@@ -18557,10 +19161,10 @@ function youTrackParseDuration(text) {
 function youTrackWorkDateMs(dateRaw) {
   const cfgPath = youTrackConfigPath();
   let effective = effectiveWorkTimezone(null);
-  if (fs10.existsSync(cfgPath)) {
+  if (fs12.existsSync(cfgPath)) {
     let parsed;
     try {
-      parsed = JSON.parse(fs10.readFileSync(cfgPath, "utf8"));
+      parsed = JSON.parse(fs12.readFileSync(cfgPath, "utf8"));
     } catch {
       return { error: `${cfgPath} is not valid JSON` };
     }
@@ -18601,12 +19205,12 @@ var youTrackToken = () => {
   if ("error" in loaded)
     return loaded;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path17.isAbsolute(tokenFile) ? path17.resolve(tokenFile) : path17.resolve(process.cwd(), tokenFile) : "";
-  if (!tokenPath || !fs10.existsSync(tokenPath))
+  const tokenPath = tokenFile ? path19.isAbsolute(tokenFile) ? path19.resolve(tokenFile) : path19.resolve(process.cwd(), tokenFile) : "";
+  if (!tokenPath || !fs12.existsSync(tokenPath))
     return { error: "missing youtrack.token" };
   if (!youTrackTokenModeOk(tokenPath))
     return { error: "youtrack.token mode must be 0600" };
-  const token = fs10.readFileSync(tokenPath, "utf8").trim();
+  const token = fs12.readFileSync(tokenPath, "utf8").trim();
   if (!token)
     return { error: "empty token file" };
   if (token === TOKEN_PLACEHOLDER || token.startsWith(TOKEN_PLACEHOLDER)) {
@@ -18733,9 +19337,9 @@ function resolveYouTrackFromPaths(spec_path, plan_path, workspace_root) {
     } catch {
       continue;
     }
-    if (!fs10.existsSync(full))
+    if (!fs12.existsSync(full))
       continue;
-    const text = fs10.readFileSync(full, "utf8");
+    const text = fs12.readFileSync(full, "utf8");
     const m = text.match(/^\*\*YouTrack:\*\*\s*`?([A-Z]+-\d+)`?/m);
     if (m)
       return m[1];
@@ -19058,14 +19662,14 @@ async function logTimeUpdate(input, operation = defaultOperations) {
 }
 
 // packages/workit-core/src/core/external-action-effects.ts
-import fs12 from "node:fs";
-import path19 from "node:path";
-import { spawnSync as spawnSync9 } from "node:child_process";
+import fs14 from "node:fs";
+import path21 from "node:path";
+import { spawnSync as spawnSync10 } from "node:child_process";
 
 // packages/workit-core/src/core/changelog.ts
-import fs11 from "node:fs";
-import path18 from "node:path";
-import { createHash as createHash8 } from "node:crypto";
+import fs13 from "node:fs";
+import path20 from "node:path";
+import { createHash as createHash9 } from "node:crypto";
 var CATEGORIES = ["Added", "Changed", "Deprecated", "Removed", "Fixed", "Security"];
 var CAT_RE = /^###\s+(?:Added|Changed|Deprecated|Removed|Fixed|Security)\s*$/i;
 var UNRELEASED_RE = /^##\s+\[Unreleased\]\s*$/i;
@@ -19082,14 +19686,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 `;
-var digestBytes4 = (value) => createHash8("sha256").update(value).digest("hex");
+var digestBytes4 = (value) => createHash9("sha256").update(value).digest("hex");
 var readChangelogSource = (target) => {
-  if (!fs11.existsSync(target)) {
+  if (!fs13.existsSync(target)) {
     const bytes = Buffer.from(SKELETON, "utf8");
     return { exists: false, bytes, text: SKELETON };
   }
   try {
-    const bytes = fs11.readFileSync(target);
+    const bytes = fs13.readFileSync(target);
     const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
     return { exists: true, bytes, text };
   } catch {
@@ -19254,8 +19858,8 @@ function applyChangelog(target, entries, normalizeOnly) {
   const rendered = renderChangelog(source.text, entries, normalizeOnly);
   if ("error" in rendered)
     return { error: rendered.error };
-  fs11.mkdirSync(path18.dirname(target), { recursive: true });
-  fs11.writeFileSync(target, rendered.text, "utf8");
+  fs13.mkdirSync(path20.dirname(target), { recursive: true });
+  fs13.writeFileSync(target, rendered.text, "utf8");
   return { ...rendered.result, path: target };
 }
 function renderChangelog(source, entries, normalizeOnly) {
@@ -19288,17 +19892,17 @@ function renderChangelog(source, entries, normalizeOnly) {
 }
 var changelogTarget = (workspaceRoot, changelogPath) => {
   try {
-    const cwd = fs11.realpathSync(resolveWorkspaceRoot(workspaceRoot));
-    const target = path18.resolve(cwd, changelogPath || "CHANGELOG.md");
-    if (target !== cwd && !target.startsWith(cwd + path18.sep))
+    const cwd = fs13.realpathSync(resolveWorkspaceRoot(workspaceRoot));
+    const target = path20.resolve(cwd, changelogPath || "CHANGELOG.md");
+    if (target !== cwd && !target.startsWith(cwd + path20.sep))
       return { error: "changelog path must be inside workspace_root" };
     let ancestor = target;
-    while (!fs11.existsSync(ancestor))
-      ancestor = path18.dirname(ancestor);
-    const canonicalAncestor = fs11.realpathSync(ancestor);
-    if (canonicalAncestor !== cwd && !canonicalAncestor.startsWith(cwd + path18.sep))
+    while (!fs13.existsSync(ancestor))
+      ancestor = path20.dirname(ancestor);
+    const canonicalAncestor = fs13.realpathSync(ancestor);
+    if (canonicalAncestor !== cwd && !canonicalAncestor.startsWith(cwd + path20.sep))
       return { error: "changelog path must be inside workspace_root" };
-    return { cwd, target: fs11.existsSync(target) ? fs11.realpathSync(target) : target };
+    return { cwd, target: fs13.existsSync(target) ? fs13.realpathSync(target) : target };
   } catch {
     return { error: "changelog path must be inside workspace_root" };
   }
@@ -19453,98 +20057,6 @@ function redactText(value) {
 `);
 }
 
-// packages/workit-core/src/git/rev.ts
-import { spawnSync as spawnSync8 } from "node:child_process";
-var MAX_BUFFER = 256 * 1024 * 1024;
-var GIT_TIMEOUTS = { local: 20000, worktree: 120000, network: 15000 };
-var git = (cwd, args, options = {}) => {
-  const result = spawnSync8("git", args, {
-    cwd,
-    encoding: "utf8",
-    env: options.env ?? process.env,
-    input: options.input,
-    maxBuffer: MAX_BUFFER,
-    timeout: options.timeoutMs ?? GIT_TIMEOUTS.local,
-    killSignal: "SIGKILL",
-    windowsHide: true
-  });
-  const error = result.error;
-  return {
-    ok: result.status === 0,
-    stdout: result.stdout ?? "",
-    stderr: result.stderr ?? "",
-    timedOut: error?.code === "ETIMEDOUT"
-  };
-};
-var line = (run) => {
-  if (!run.ok)
-    return null;
-  const value = run.stdout.trim();
-  return value ? value : null;
-};
-function networkGitInvocation(cwd, args, timeoutMs) {
-  const seconds = Math.max(1, Math.ceil(timeoutMs / 1000));
-  const env = {
-    ...process.env,
-    GIT_TERMINAL_PROMPT: "0",
-    GIT_ASKPASS: "",
-    SSH_ASKPASS: "",
-    SSH_ASKPASS_REQUIRE: "never",
-    GCM_INTERACTIVE: "never"
-  };
-  const base = process.env.GIT_SSH_COMMAND || line(git(cwd, ["config", "--get", "core.sshCommand"])) || (process.env.GIT_SSH ? null : "ssh");
-  if (base)
-    env.GIT_SSH_COMMAND = `${base} -o BatchMode=yes -o ConnectTimeout=${Math.min(10, seconds)}`;
-  return {
-    args: ["-c", "http.lowSpeedLimit=1", "-c", `http.lowSpeedTime=${seconds}`, ...args],
-    env
-  };
-}
-var WATCHDOG = `
-const cp = require("node:child_process");
-const { ms, args } = JSON.parse(process.env.WORKIT_GIT_WATCHDOG);
-delete process.env.WORKIT_GIT_WATCHDOG;
-const win = process.platform === "win32";
-const child = cp.spawn("git", args, { stdio: "inherit", detached: !win, windowsHide: true });
-const killTree = () => {
-  if (!child.pid) return;
-  if (win) cp.spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
-  else try { process.kill(-child.pid, "SIGKILL"); } catch {}
-};
-let timedOut = false;
-const timer = setTimeout(() => { timedOut = true; killTree(); }, ms);
-child.on("error", () => { clearTimeout(timer); process.exit(127); });
-child.on("exit", (code) => {
-  clearTimeout(timer);
-  if (!win) killTree();
-  process.exit(timedOut ? 124 : code ?? 1);
-});
-`;
-var WATCHDOG_TIMEOUT_EXIT = 124;
-var gitNetwork = (cwd, args, timeoutMs) => {
-  const invocation = networkGitInvocation(cwd, args, timeoutMs);
-  const result = spawnSync8(process.execPath, ["-e", WATCHDOG], {
-    cwd,
-    encoding: "utf8",
-    env: {
-      ...invocation.env,
-      WORKIT_GIT_WATCHDOG: JSON.stringify({ ms: timeoutMs, args: invocation.args })
-    },
-    maxBuffer: MAX_BUFFER,
-    timeout: timeoutMs + 1e4,
-    killSignal: "SIGKILL",
-    windowsHide: true
-  });
-  const error = result.error;
-  return {
-    ok: result.status === 0,
-    stdout: result.stdout ?? "",
-    stderr: result.stderr ?? "",
-    timedOut: result.status === WATCHDOG_TIMEOUT_EXIT || error?.code === "ETIMEDOUT"
-  };
-};
-var MAX_UNTRACKED_BYTES = 5 * 1024 * 1024;
-
 // packages/workit-core/src/ledger.ts
 var PASSING = new Set(["verified", "tests-verified", "type-check-only"]);
 var FAILING = new Set(["failed", "blocked"]);
@@ -19659,7 +20171,7 @@ var credentialFreeRemote = (value) => pushRemoteIdentity(value);
 var actionRoot = (taskRoot, request) => {
   const chosen = "cwd" in request.payload ? request.payload.cwd : undefined;
   try {
-    const directory = fs12.realpathSync(chosen ? path19.resolve(taskRoot, chosen) : taskRoot);
+    const directory = fs14.realpathSync(chosen ? path21.resolve(taskRoot, chosen) : taskRoot);
     if (request.operation === "context.read")
       return success(null, null, directory);
     const gitAction = request.operation.startsWith("git.") || request.operation.startsWith("hosting.");
@@ -19670,7 +20182,7 @@ var actionRoot = (taskRoot, request) => {
       return failure2("capability_unavailable", "action target is not a Git repository", {
         outcome: "not_started"
       });
-    return success(null, null, fs12.realpathSync(checkout));
+    return success(null, null, fs14.realpathSync(checkout));
   } catch {
     return failure2("invalid_input", "action target directory cannot be resolved", {
       outcome: "not_started"
@@ -20002,7 +20514,7 @@ var hostingProvider = (root, remote) => {
 };
 var remoteBranchTip = (root, provider, host, repo, branch) => {
   const endpoint = provider === "github" ? `repos/${repo}/git/ref/heads/${branch.split("/").map(encodeURIComponent).join("/")}` : `projects/${encodeURIComponent(repo)}/repository/branches/${encodeURIComponent(branch)}`;
-  const response = spawnSync9(provider === "github" ? "gh" : "glab", ["api", endpoint], {
+  const response = spawnSync10(provider === "github" ? "gh" : "glab", ["api", endpoint], {
     cwd: root,
     encoding: "utf8",
     env: hostingCliEnv(provider, host)
@@ -20010,7 +20522,7 @@ var remoteBranchTip = (root, provider, host, repo, branch) => {
   if (response.status !== 0) {
     if (/\b404\b/.test(response.stderr ?? "")) {
       const project = provider === "github" ? `repos/${repo}` : `projects/${encodeURIComponent(repo)}`;
-      const visible = spawnSync9(provider === "github" ? "gh" : "glab", ["api", project], {
+      const visible = spawnSync10(provider === "github" ? "gh" : "glab", ["api", project], {
         cwd: root,
         encoding: "utf8",
         env: hostingCliEnv(provider, host)
@@ -20066,7 +20578,7 @@ var mergedBranch = (root, branch) => {
       outcome: "not_started"
     });
   const endpoint = provider === "github" ? `repos/${repo}/pulls?state=closed&head=${encodeURIComponent(`${repo.split("/")[0]}:${branch}`)}&per_page=100` : `projects/${encodeURIComponent(repo)}/merge_requests?state=merged&source_branch=${encodeURIComponent(branch)}&per_page=100`;
-  const response = spawnSync9(provider === "github" ? "gh" : "glab", ["api", endpoint], {
+  const response = spawnSync10(provider === "github" ? "gh" : "glab", ["api", endpoint], {
     cwd: root,
     encoding: "utf8",
     env: hostingCliEnv(provider, auth.host)
@@ -20128,7 +20640,7 @@ var readHostingAction = async (root, resolved, actionRef) => {
       return unknownHostingEvidence(operation);
     const endpoint = cfg.provider === "github" ? `repos/${repo}/pulls?state=all&head=${encodeURIComponent(`${repo.split("/")[0]}:${branch}`)}&base=${encodeURIComponent(target)}&per_page=100&page=1` : `projects/${encodeURIComponent(repo)}/merge_requests?state=all&source_branch=${encodeURIComponent(branch)}&target_branch=${encodeURIComponent(target)}&per_page=100&page=1`;
     const cli = cfg.provider === "github" ? "gh" : "glab";
-    const response = spawnSync9(cli, ["api", endpoint], {
+    const response = spawnSync10(cli, ["api", endpoint], {
       cwd: root,
       encoding: "utf8",
       env: hostingCliEnv(cfg.provider, auth.host)
@@ -20320,7 +20832,7 @@ var readLocalAction = async (root, resolved, actionRef) => {
     const sdd = resolved.request.payload.sdd_dir;
     if (resolved.request.payload.action === "reapply_stash" && typeof sdd === "string") {
       try {
-        const manifest = JSON.parse(fs12.readFileSync(path19.join(sdd, "manifest.json"), "utf8"));
+        const manifest = JSON.parse(fs14.readFileSync(path21.join(sdd, "manifest.json"), "utf8"));
         const stashes = gitRaw(root, ["stash", "list", "--format=%H"]);
         if (typeof target.stash_commit === "string" && manifest.stash_ref === undefined && stashes !== null && !stashes.split(`
 `).includes(target.stash_commit))
@@ -20328,7 +20840,7 @@ var readLocalAction = async (root, resolved, actionRef) => {
       } catch {}
     } else if (typeof targetBranch === "string" && typeof sdd === "string" && gitValue(root, ["branch", "--show-current"]) === targetBranch && typeof target.target_head === "string" && gitValue(root, ["rev-parse", "HEAD"]) === target.target_head) {
       try {
-        const manifest = JSON.parse(fs12.readFileSync(path19.join(sdd, "manifest.json"), "utf8"));
+        const manifest = JSON.parse(fs14.readFileSync(path21.join(sdd, "manifest.json"), "utf8"));
         if (manifest.branch === targetBranch)
           observed = { branch: targetBranch };
       } catch {}
@@ -20381,7 +20893,7 @@ var readDeletedBranch = async (root, resolved, actionRef) => {
 };
 var youTrackBase = () => {
   try {
-    const config = JSON.parse(fs12.readFileSync(youTrackConfigPath(), "utf8"));
+    const config = JSON.parse(fs14.readFileSync(youTrackConfigPath(), "utf8"));
     const value = typeof config.baseUrl === "string" ? config.baseUrl.trim() : "";
     if (!value || /[\s#?]/.test(value))
       return null;
@@ -20449,7 +20961,7 @@ var resolveExternalActionAtRoot = (root, request, preservedDateMs) => {
         let stashTarget;
         if (action === "reapply_stash") {
           try {
-            const manifest = JSON.parse(fs12.readFileSync(path19.join(sdd_dir, "manifest.json"), "utf8"));
+            const manifest = JSON.parse(fs14.readFileSync(path21.join(sdd_dir, "manifest.json"), "utf8"));
             const stash_ref = typeof manifest.stash_ref === "string" ? manifest.stash_ref : "";
             const stash_commit = stash_ref ? gitValue(root, ["rev-parse", stash_ref]) : null;
             if (stash_ref && stash_commit)
@@ -20724,7 +21236,7 @@ var resolveExternalActionAtRoot = (root, request, preservedDateMs) => {
         if (preview.error)
           return failure2("invalid_input", preview.error);
         const target = String(preview.path);
-        const relative = path19.relative(fs12.realpathSync(root), target).replaceAll(path19.sep, "/") || "CHANGELOG.md";
+        const relative = path21.relative(fs14.realpathSync(root), target).replaceAll(path21.sep, "/") || "CHANGELOG.md";
         const normalized = {
           operation: request.operation,
           payload: {
@@ -21566,9 +22078,9 @@ import { randomUUID as randomUUID3 } from "node:crypto";
 // packages/workit-pi/src/worker-protocol.ts
 var MAX_WORKER_LINE_BYTES = 64 * 1024;
 var MAX_WORKER_STDERR_BYTES = 64 * 1024;
-var isRecord3 = (value) => typeof value === "object" && value !== null;
+var isRecord4 = (value) => typeof value === "object" && value !== null;
 var parseEvent = (value) => {
-  if (!isRecord3(value) || typeof value.type !== "string")
+  if (!isRecord4(value) || typeof value.type !== "string")
     return null;
   if (value.type === "workit_worker_ready") {
     if (typeof value.workerId !== "string" || typeof value.sessionId !== "string")