@christang/keel 5.67.0 → 5.69.0

package/README.md

@@ -344,6 +344,41 @@ wiring, and `keel --init` whenever it tells you the repository is behind its ins
 protocol version lives in your `AGENTS.md`, and updating the package does not move it.
 Everything below is the vocabulary the agent uses on your behalf.
 
+### When the right answer is "nothing changed"
+
+A refactor, a move, a flow upgrade that claims the numbers hold — the correct evidence for these is
+*zero difference*, and red-green has no shape for it. The repository that reported this had a task
+whose `tasks.md` said "this one has no honest red" several times, and re-recorded its contract twice
+trying to fit. The criterion was right; it had nowhere to live.
+
+```
+- Verify:
+  - Strategy: equivalence
+  - Base: origin/main
+  - Fields: wns, tns, cell_count
+  - M1: node compare.js --base --head reports every field equal
+```
+
+`equivalence` owes no red. Its criterion is that base and head agree on the fields you named, which is
+*stronger* than red-green — it also catches the change that incidentally moved a result. What the gate
+checks is every way that shape can look complete and compare nothing: a missing `Base:` or `Fields:`,
+an empty field set, a ref that resolves to nothing, and a `Base:` that resolves to HEAD.
+
+It is not a way out of red-green. A task declaring `equivalence` while covering a scenario its own
+change *adds* is refused unless a sibling task covers that same entry under a red-green strategy —
+behavior that is new is not behavior that is unchanged, and a task cannot prove both.
+
+And Evidence no longer has to retell the output:
+
+```
+- M1: artifact openspec/changes/<change>/evidence/compare.json sha256:9f2c…
+```
+
+The gate checks the file is there and the digest matches, and refuses a path outside the change's own
+directory, because archiving moves that directory and the pointer would break. Keel hashes the bytes
+and reads nothing inside them — the claim stays yours, and what the digest buys is that the file your
+reviewer opens is the file you meant.
+
 ## Verification layering
 
 Keel splits verification into two layers so a slow suite never blocks your push:

package/assets/bootstrap/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- keel:start version=5.67.0 -->
+<!-- keel:start version=5.69.0 -->
 ## Keel Bootstrap
 
 - Start every session with `keel context`; OpenSpec artifacts and Git are the only durable authority — never native memory, goals, or transcripts.

package/package.json

@@ -2,7 +2,7 @@
   "name": "@christang/keel",
   "displayName": "Keel",
   "description": "Keel OpenSpec execution discipline CLI for Claude Code, Codex, and OpenCode.",
-  "version": "5.67.0",
+  "version": "5.69.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/plugins/keel/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.67.0",
+  "version": "5.69.0",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.67.0",
+  "version": "5.69.0",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/skills/keel-tdd-or-test-first/SKILL.md

@@ -20,10 +20,13 @@ Read the selected task's compiled capsule: resolved Acceptance, Verify strategy
 - `regression-first`: an observable defect; reproduce it through the public interface first, then prove the fix with the same check.
 - `characterization` / `snapshot-characterization`: deterministic or generated outputs kept stable by byte or snapshot comparison; not downgraded to build success.
 - `rendered-behavior`: interactive surfaces exercised through the real rendered interface; strict red-green optional by cost.
-- `evidence-first`: docs, configuration, or diagnosis work whose checks state the observable artifact or evidence instead of a red-green loop.
+- `equivalence`: work whose criterion is that a measured result does not change — a refactor, a move, a flow upgrade claiming the numbers hold. It declares `Base:` (a resolvable git ref) and `Fields:` (the compared field set) beside `Strategy:` and owes no red; the A/B command is an ordinary `M<n>` check. `keel gate task-start` refuses a missing `Base:` or `Fields:`, an empty field set, an unresolvable ref, and a `Base:` that is HEAD, because an A/B against itself always agrees. A task covering a scenario its own change *adds* is refused unless a sibling task covers that same entry under a red-green strategy: behavior that is new is not behavior that is unchanged.
+- `evidence-first`: docs, configuration, or diagnosis work whose checks state the observable artifact or evidence instead of a red-green loop. It is scoped by an absence — nothing here can fail first — which is why it is not the home for `equivalence` work, whose criterion is stronger than red-green rather than missing.
 
 Red-green strategies (`vertical-tdd`, `regression-first`) must record concrete per-label `.red` and `.green` Evidence entries for the same check; `keel gate task-complete` rejects absent or pending entries.
 
+A check's Evidence may read `artifact <path> sha256:<digest>` instead of retelling the output. `keel gate task-complete` checks the file exists and the digest matches, and refuses a path outside the change's own directory — archiving moves that directory, so a pointer outside it breaks. Keel hashes the bytes and reads nothing inside them: the claim the artifact supports stays yours.
+
 ## Domain lenses
 
 When the change's proposal/design/specs or the task's Touch extensions signal a domain, consult the matching lens's `Execution and review checks` section from `keel/lenses/` — the lens whose `Applies when:` header matches — before finalizing the strategy and the first check, and load only that one. When no lens matches, load nothing.

package/scripts/validate_plugin.py

@@ -38,8 +38,8 @@ REQUIRED_SCRIPTS = [
     "scripts/validate_plugin.py",
 ]
 
-PACKAGE_VERSION = "5.67.0"
-PROTOCOL_VERSION = "5.67.0"
+PACKAGE_VERSION = "5.69.0"
+PROTOCOL_VERSION = "5.69.0"
 LEGACY_MANAGED_START = "<!-- keel:start version=2.1 -->"
 OPENSPEC_SCHEMA_NAME = "keel-spec-driven"
 # Mirrors KEEL_PACKAGE_NAME in scripts/install_to_repo.py, one of the two
@@ -2302,6 +2302,61 @@ def validate_domain_lenses_scenario() -> int:
     return 0
 
 
+# `bump_version.js` writes a stub section for the new release, and the convention
+# is to fill it in. Writing the entry *above* it instead leaves an orphan, and
+# the stub carries the `Version alignment:` line this scenario reads — so the
+# section describing nothing was the section that passed (#151). It happened in
+# 5.67.0 and 5.68.0, with the suite green both times.
+#
+# Takes the text rather than reading the file, so the rule can be exercised on a
+# planted copy: a rule that could only ever see the changelog already known to be
+# correct would pass forever without anyone learning whether it fires.
+def release_description_problem(changelog: str, version: str) -> str | None:
+    """Return the problem the released version's section has, or None.
+
+    Scoped to the version being released. An older section is history a current
+    author cannot act on, and a rule that swept the whole file would fail on the
+    archive — which is how a check gets disabled rather than fixed. The file also
+    legitimately quotes `TODO` when describing the rules that refuse it.
+    """
+    pattern = re.compile(
+        r"^## " + re.escape(version) + r"\b[^\n]*$", re.M
+    )
+    headings = pattern.findall(changelog)
+    if not headings:
+        return (
+            f"the changelog carries no `## {version}` section, so the release "
+            "describes nothing at all."
+        )
+    if len(headings) > 1:
+        return (
+            f"the changelog describes {version} twice — {len(headings)} `## "
+            f"{version}` headings: {', '.join(h.strip() for h in headings)}. A "
+            "release entry written above the stub instead of into it leaves both."
+        )
+    for heading in headings:
+        if "TODO" in heading:
+            return (
+                f"the changelog still carries the stub heading `{heading.strip()}`"
+                f", so the {version} release was never described. Fill that "
+                "section in rather than writing the entry above it."
+            )
+    # The section body, bounded by the next `## ` heading, so a `TODO` belonging
+    # to an older release is not read as this one's.
+    start = changelog.index(headings[0])
+    rest = changelog[start + len(headings[0]):]
+    end = rest.find("\n## ")
+    body = rest if end < 0 else rest[:end]
+    for line in body.splitlines():
+        if re.match(r"^\s*-\s*TODO\b", line):
+            return (
+                f"the {version} section still carries the stub bullet "
+                f"`{line.strip().lstrip('- ')}`, so the release is titled but "
+                "not described."
+            )
+    return None
+
+
 def validate_version_alignment_scenario() -> int:
     package = json.loads((ROOT / "package.json").read_text(encoding="utf-8"))
     if package.get("version") != PACKAGE_VERSION:
@@ -2366,6 +2421,103 @@ def validate_version_alignment_scenario() -> int:
         )
         return 1
 
+    # The released version's section has to say what the release did. Asserted on
+    # planted copies first, so the rule is known to fire, and then on the
+    # repository's own changelog.
+    stub = (
+        f"# Keel Changelog\n\n## {PACKAGE_VERSION} - TODO: summarize this "
+        f"release\n\n- TODO: describe the change.\n- Version alignment: "
+        f"shares Keel {PACKAGE_VERSION}.\n\n## 5.0.0 - older\n\n- Done.\n"
+    )
+    planted = release_description_problem(stub, PACKAGE_VERSION)
+    if not planted:
+        report(
+            "version-alignment scenario: an unfilled stub was accepted — a "
+            f"changelog whose {PACKAGE_VERSION} section is the stub "
+            "`bump_version.js` writes produced no problem, so a release can "
+            "ship describing nothing while this scenario passes."
+        )
+        return 1
+    if "TODO: summarize this release" not in planted:
+        report(
+            "version-alignment scenario: the refusal does not name the offending "
+            f"line, so an author is sent to read the whole changelog; got "
+            f"{planted!r}."
+        )
+        return 1
+
+    # Still M1 — the stub survives renaming its heading. The bullet is the other
+    # half of what `bump_version.js` writes, and a section titled correctly while
+    # its only content is `- TODO: describe the change.` describes nothing.
+    renamed = (
+        f"# Keel Changelog\n\n## {PACKAGE_VERSION} - a real sounding title\n\n"
+        f"- TODO: describe the change.\n- Version alignment: shares Keel "
+        f"{PACKAGE_VERSION}.\n"
+    )
+    bullet = release_description_problem(renamed, PACKAGE_VERSION)
+    if not bullet:
+        report(
+            "version-alignment scenario: an unfilled stub was accepted — a "
+            "section with a real heading whose content is still `- TODO: describe "
+            "the change.` produced no problem, so renaming the stub is enough to "
+            "ship an undescribed release."
+        )
+        return 1
+    if "TODO: describe the change." not in bullet:
+        report(
+            "version-alignment scenario: the bullet refusal does not name the "
+            f"line it found; got {bullet!r}."
+        )
+        return 1
+
+    # M2 — two sections for one version. This is the shape the real defect had,
+    # and neither TODO rule catches it once the stub's heading has been renamed:
+    # the reader then sees two identical version headings, one of which describes
+    # nothing.
+    doubled = (
+        f"# Keel Changelog\n\n## {PACKAGE_VERSION} - the real entry\n\n"
+        f"- Did the thing.\n- Version alignment: shares Keel {PACKAGE_VERSION}."
+        f"\n\n## {PACKAGE_VERSION} - summarized\n\n- Also this.\n"
+    )
+    problem_found = release_description_problem(doubled, PACKAGE_VERSION)
+    if not problem_found:
+        report(
+            "version-alignment scenario: a version described twice was accepted "
+            f"— two `## {PACKAGE_VERSION}` sections produced no problem, which is "
+            "the shape the defect this rule exists for actually had."
+        )
+        return 1
+    if "twice" not in problem_found:
+        report(
+            "version-alignment scenario: the duplicate-section refusal does not "
+            f"say the version is described twice; got {problem_found!r}."
+        )
+        return 1
+
+    # M3 — only the version being released is judged. An older section is history,
+    # and this file legitimately quotes `TODO` when describing the rules that
+    # refuse it, so a rule sweeping the whole file would fire on its own
+    # documentation.
+    older = (
+        f"# Keel Changelog\n\n## {PACKAGE_VERSION} - the real entry\n\n"
+        f"- Did the thing.\n- Version alignment: shares Keel {PACKAGE_VERSION}."
+        "\n\n## 5.0.0 - TODO: summarize this release\n\n- TODO: describe it.\n"
+    )
+    if release_description_problem(older, PACKAGE_VERSION):
+        report(
+            "version-alignment scenario: an older section was refused — a `TODO` "
+            "in a section for another version failed the current release, which "
+            "is a check the archive can only be edited to satisfy."
+        )
+        return 1
+    if release_description_problem(changelog, PACKAGE_VERSION):
+        report(
+            "version-alignment scenario: an older section was refused — the "
+            "repository's own changelog does not satisfy the rule: "
+            f"{release_description_problem(changelog, PACKAGE_VERSION)}"
+        )
+        return 1
+
     with tempfile.TemporaryDirectory(prefix="keel-version-") as raw_tmp:
         repo = Path(raw_tmp) / "repo"
         repo.mkdir()
@@ -29042,6 +29194,509 @@ def validate_guidance_is_referenced_and_carries_no_criterion_scenario() -> int:
     return 0
 
 
+def equivalence_task(
+    *,
+    base: str | None = "HEAD~1",
+    fields: str | None = "wns, tns, cell_count",
+    covers: tuple[str, ...] = ("E1: the measured result does not move",),
+    label: str = "1.1",
+    title: str = "Move the attribute without moving the numbers",
+) -> str:
+    """One `equivalence` task, with either declaration omittable."""
+    lines = [
+        f"- [ ] {label} {title}",
+        "  - Covers:",
+    ]
+    lines.extend(f"    - {entry}" for entry in covers)
+    lines.extend(
+        [
+            "  - Read:",
+            "    - README.md",
+            "  - Touch:",
+            "    - src/example.js",
+            "  - Verify:",
+            "    - Strategy: equivalence",
+        ]
+    )
+    if base is not None:
+        lines.append(f"    - Base: {base}")
+    if fields is not None:
+        lines.append(f"    - Fields: {fields}")
+    lines.extend(
+        [
+            "    - M1: node compare.js --base --head reports every field equal",
+            "  - Autonomy boundary:",
+            "    - Default: hard-stop",
+            "    - Pre-authorized fallback: none",
+            "  - Stop Rules:",
+            "    - Stop on any field that differs.",
+            "  - Evidence:",
+            "    - Contract: pending",
+            "    - M1: pending",
+            "    - Review:",
+            "      - Status: pass",
+            "      - Acceptance check: every declared field agreed.",
+            "      - Scope check: writes stayed inside Touch.",
+            "      - Findings: none",
+            "    - Blocker: none",
+        ]
+    )
+    return "\n".join(lines) + "\n"
+
+
+def validate_an_equivalence_claim_names_its_base_scenario() -> int:
+    """Issue #142: the correct evidence for a refactor is zero difference.
+
+    Red-green has no shape for it. The reporting repository re-recorded one
+    task's contract twice to get past the shape — not because a criterion was
+    wrong, but because the criterion had nowhere to live. An A/B against a base
+    is *stronger* than red-green: it catches the change that also, incidentally,
+    moved a result. What it needs is a place to say what it compares against and
+    on which fields, plus a refusal for every way that shape can be complete and
+    still compare nothing.
+    """
+    label = "an-equivalence-claim-names-its-base"
+
+    def git(repo: Path, *args: str) -> subprocess.CompletedProcess[str]:
+        return subprocess.run(
+            ["git", "-C", str(repo), *args], capture_output=True, text=True
+        )
+
+    with tempfile.TemporaryDirectory(prefix="keel-equivalence-") as raw:
+        root = Path(raw)
+
+        def fixture(name: str, task: str) -> Path:
+            repo = (root / name).resolve()
+            repo.mkdir()
+            git(repo, "init", "-q")
+            git(repo, "config", "user.email", "t@example.com")
+            git(repo, "config", "user.name", "keel-test")
+            write_gate_fixture(repo, tasks=task)
+            write_text(repo / "src/example.js", "// product\n")
+            git(repo, "add", "-A")
+            git(repo, "-c", "commit.gpgsign=false", "commit", "-q", "-m", "first")
+            write_text(repo / "src/example.js", "// product, moved\n")
+            git(repo, "add", "-A")
+            git(repo, "-c", "commit.gpgsign=false", "commit", "-q", "-m", "second")
+            return repo
+
+        def start(name: str, **kwargs) -> dict:
+            repo = fixture(name, equivalence_task(**kwargs))
+            result = run_keel(
+                repo, "gate", "task-start", "--change", "demo", "--task", "1.1",
+                "--no-guard", "--json",
+            )
+            try:
+                return json.loads(result.stdout)
+            except json.JSONDecodeError:
+                return {
+                    "status": "unparsed",
+                    "problems": [{"message": result.stdout[:400]}],
+                }
+
+        # M1 — the strategy is accepted, and it owes no red.
+        payload = start("accepted")
+        if payload.get("status") != "pass":
+            report(
+                f"{label}: unsupported verification strategy — a complete "
+                "equivalence task was refused, so the one task class with the "
+                "strongest criterion still has nowhere to declare it. "
+                f"{problem_text(payload)}"
+            )
+            return 1
+        capsule = (payload.get("contract") or {}).get("capsule") or {}
+        verification = capsule.get("verification") or {}
+        if verification.get("strategy", "").lower() != "equivalence":
+            report(
+                f"{label}: the compiled capsule does not carry the strategy; got "
+                f"{verification.get('strategy')!r}."
+            )
+            return 1
+        if not verification.get("base") or not verification.get("fields"):
+            report(
+                f"{label}: the capsule drops the declarations — base "
+                f"{verification.get('base')!r}, fields "
+                f"{verification.get('fields')!r}. A declaration absent from the "
+                "capsule is absent from the fingerprint, so it could be edited "
+                "after the run without moving the contract."
+            )
+            return 1
+        warnings = " ".join(str(w) for w in (payload.get("warnings") or []))
+        if ".red" in warnings or ".green" in warnings:
+            report(
+                f"{label}: equivalence was given a red-green obligation; the "
+                f"criterion is agreement with a base, not a failing first run. "
+                f"{warnings}"
+            )
+            return 1
+
+        # M2 — every way the shape can be complete and still compare nothing,
+        # each named for the declaration it is about. A diagnostic that named
+        # the strategy would send the author to the line that is correct.
+        for name, kwargs, code, expected in (
+            ("no-base", {"base": None}, "missing-equivalence-base", "Base:"),
+            ("no-fields", {"fields": None}, "missing-equivalence-fields", "Fields:"),
+            ("empty-fields", {"fields": " , "}, "missing-equivalence-fields", "Fields:"),
+            (
+                "bad-base",
+                {"base": "no-such-ref"},
+                "unresolvable-equivalence-base",
+                "no-such-ref",
+            ),
+        ):
+            payload = start(name, **kwargs)
+            if payload.get("status") == "pass":
+                report(
+                    f"{label}: accepted an equivalence task that compares "
+                    f"nothing — the {name} fixture passed, so the declaration "
+                    "is optional in practice."
+                )
+                return 1
+            if code not in problem_codes(payload):
+                report(
+                    f"{label}: accepted an equivalence task that compares "
+                    f"nothing — the {name} fixture was refused for another "
+                    f"reason; expected {code}, got {problem_codes(payload)!r}."
+                )
+                return 1
+            message = problem_text(payload)
+            if expected not in message:
+                report(
+                    f"{label}: the {name} refusal does not name {expected!r}, so "
+                    f"the author is sent to find which line is wrong; got "
+                    f"{message!r}."
+                )
+                return 1
+        # Absent and empty are the same state to the comparison and different
+        # states to the author, so the two are asserted to read differently.
+        absent = problem_text(start("no-fields-message", fields=None))
+        empty = problem_text(start("empty-fields-message", fields=" , "))
+        if absent == empty:
+            report(
+                f"{label}: a missing `Fields:` and one that resolves to an empty "
+                "set produce the same sentence, so an author who wrote the line "
+                "is told they did not."
+            )
+            return 1
+
+        # M1 of 1.2 — `equivalence` owes no red, which makes it the first thing
+        # reached for by a task that should have one. A task covering a scenario
+        # the change *adds* is claiming new behavior and unchanged behavior at
+        # once, and one of the two claims has no proof anywhere.
+        added_spec = (
+            "## ADDED Requirements\n\n"
+            "### Requirement: The moved attribute keeps its effect\n\n"
+            "The attribute SHALL keep its effect after the move.\n\n"
+            "#### Scenario: The effect survives the move\n\n"
+            "- **WHEN** the attribute moves into the flow\n"
+            "- **THEN** the effect is unchanged\n\n"
+            # A second real scenario, so the mismatched-sibling control fails
+            # because the guard refused it and not because its Covers entry
+            # resolves to nothing. A first attempt pointed the sibling at an
+            # invented scenario and passed for that unrelated reason.
+            "#### Scenario: The flow reports the attribute\n\n"
+            "- **WHEN** the flow runs\n"
+            "- **THEN** it reports the attribute\n"
+        )
+        covered = (
+            "demo / The moved attribute keeps its effect / The effect survives "
+            "the move"
+        )
+
+        def escape_fixture(name: str, *, sibling: str | None) -> dict:
+            repo = (root / name).resolve()
+            repo.mkdir()
+            git(repo, "init", "-q")
+            git(repo, "config", "user.email", "t@example.com")
+            git(repo, "config", "user.name", "keel-test")
+            tasks = equivalence_task(covers=(covered,))
+            if sibling is not None:
+                tasks += (
+                    "- [ ] 1.2 Add the behavior\n"
+                    "  - Covers:\n"
+                    f"    - {sibling}\n"
+                    "  - Read:\n    - README.md\n"
+                    "  - Touch:\n    - src/other.js\n"
+                    "  - Verify:\n"
+                    "    - Strategy: vertical-tdd\n"
+                    "    - M1: node test.js asserts the new behavior\n"
+                    "  - Autonomy boundary:\n"
+                    "    - Default: hard-stop\n"
+                    "    - Pre-authorized fallback: none\n"
+                    "  - Stop Rules:\n    - Stop on failure.\n"
+                    "  - Evidence:\n    - Contract: pending\n    - M1: pending\n"
+                    "    - Review:\n      - Status: pass\n"
+                    "      - Acceptance check: behavior asserted.\n"
+                    "      - Scope check: inside Touch.\n"
+                    "      - Findings: none\n"
+                    "    - Blocker: none\n"
+                )
+            write_gate_fixture(repo, tasks=tasks)
+            write_text(repo / "openspec/changes/demo/specs/demo/spec.md", added_spec)
+            write_text(repo / "src/example.js", "// product\n")
+            git(repo, "add", "-A")
+            git(repo, "-c", "commit.gpgsign=false", "commit", "-q", "-m", "first")
+            write_text(repo / "src/example.js", "// moved\n")
+            git(repo, "add", "-A")
+            git(repo, "-c", "commit.gpgsign=false", "commit", "-q", "-m", "second")
+            result = run_keel(
+                repo, "gate", "task-start", "--change", "demo", "--task", "1.1",
+                "--no-guard", "--json",
+            )
+            try:
+                return json.loads(result.stdout)
+            except json.JSONDecodeError:
+                return {
+                    "status": "unparsed",
+                    "problems": [{"message": result.stdout[:400]}],
+                }
+
+        payload = escape_fixture("escape-alone", sibling=None)
+        if payload.get("status") == "pass":
+            report(
+                f"{label}: accepted new behavior with no red anywhere — an "
+                "equivalence task covering a scenario the change adds passed, so "
+                "the strategy is a way to author a feature with no red in the "
+                "whole change."
+            )
+            return 1
+        if "equivalence-covers-added-behavior" not in problem_codes(payload):
+            report(
+                f"{label}: accepted new behavior with no red anywhere — refused "
+                f"for another reason; got {problem_codes(payload)!r}."
+            )
+            return 1
+        message = problem_text(payload)
+        if "The effect survives the move" not in message:
+            report(
+                f"{label}: the refusal does not name the covered scenario, so "
+                f"the author cannot tell which Covers entry is the problem; got "
+                f"{message!r}."
+            )
+            return 1
+        if "unchanged" not in message:
+            report(
+                f"{label}: the refusal does not say why the two claims conflict; "
+                f"got {message!r}."
+            )
+            return 1
+
+        # M2 of 1.2 — the guard is satisfied by coverage of the entry it
+        # objected to, and not by a red-green task merely existing in the change.
+        payload = escape_fixture("escape-sibling", sibling=covered)
+        if payload.get("status") != "pass":
+            report(
+                f"{label}: a sibling task covering the same scenario under "
+                f"vertical-tdd did not satisfy the guard. {problem_text(payload)}"
+            )
+            return 1
+        payload = escape_fixture(
+            "escape-other-sibling",
+            sibling=(
+                "demo / The moved attribute keeps its effect / The flow reports "
+                "the attribute"
+            ),
+        )
+        if payload.get("status") == "pass":
+            report(
+                f"{label}: any sibling satisfied the guard — a red-green task "
+                "covering a different scenario was accepted as proof of this "
+                "one, which makes the guard a check that a change contains at "
+                "least one red-green task."
+            )
+            return 1
+        if "equivalence-covers-added-behavior" not in problem_codes(payload):
+            report(
+                f"{label}: any sibling satisfied the guard — refused for another "
+                f"reason; got {problem_codes(payload)!r}."
+            )
+            return 1
+
+        # M3 of 1.2 — the guard fires on new behavior, not on the strategy. A
+        # task covering only identifiers, or a requirement the change does not
+        # add, is an ordinary equivalence task.
+        plain = start("escape-plain")
+        if plain.get("status") != "pass":
+            report(
+                f"{label}: an equivalence task covering no added scenario was "
+                f"refused. {problem_text(plain)}"
+            )
+            return 1
+
+        # M3 — the shape that is complete, resolvable, and still empty. This is
+        # the refusal worth having: nothing about the task looks wrong, and the
+        # check passes having compared a thing against itself.
+        payload = start("base-is-head", base="HEAD")
+        if payload.get("status") == "pass":
+            report(
+                f"{label}: accepted a base that is head — an A/B against itself "
+                "always agrees, so the check proves nothing and looks complete "
+                "doing it."
+            )
+            return 1
+        if "equivalence-base-is-head" not in problem_codes(payload):
+            report(
+                f"{label}: accepted a base that is head — refused for another "
+                f"reason; got {problem_codes(payload)!r}."
+            )
+            return 1
+        message = problem_text(payload)
+        head = subprocess.run(
+            ["git", "-C", str((root / "base-is-head").resolve()), "rev-parse",
+             "HEAD"],
+            capture_output=True, text=True,
+        ).stdout.strip()
+        if head and head not in message:
+            report(
+                f"{label}: the refusal does not name the resolved commit, so the "
+                "author cannot tell which ref collapsed onto HEAD; got "
+                f"{message!r}."
+            )
+            return 1
+        if "always agrees" not in message:
+            report(
+                f"{label}: the refusal does not say why a base that is HEAD is "
+                f"empty rather than merely redundant; got {message!r}."
+            )
+            return 1
+
+        # 1.3 — Evidence may point at the machine output instead of retelling
+        # it. A 244-line tasks.md that is mostly transcribed test output is a
+        # transcription that can be wrong and that nobody can re-check.
+        def artifact_fixture(
+            name: str,
+            *,
+            artifact_path: str = "openspec/changes/demo/evidence/compare.json",
+            body: str = '{"wns": 0.0, "tns": 0.0}\n',
+            recorded: str | None = None,
+            write_at: str | None = None,
+        ) -> dict:
+            repo = (root / name).resolve()
+            repo.mkdir()
+            git(repo, "init", "-q")
+            git(repo, "config", "user.email", "t@example.com")
+            git(repo, "config", "user.name", "keel-test")
+            digest = hashlib.sha256(body.encode("utf-8")).hexdigest()
+            evidence = recorded or f"artifact {artifact_path} sha256:{digest}"
+            tasks = equivalence_task().replace(
+                "    - M1: pending", f"    - M1: {evidence}"
+            )
+            write_gate_fixture(repo, tasks=tasks)
+            if write_at is not None:
+                write_text(repo / write_at, body)
+            write_text(repo / "src/example.js", "// product\n")
+            git(repo, "add", "-A")
+            git(repo, "-c", "commit.gpgsign=false", "commit", "-q", "-m", "first")
+            write_text(repo / "src/example.js", "// moved\n")
+            git(repo, "add", "-A")
+            git(repo, "-c", "commit.gpgsign=false", "commit", "-q", "-m", "second")
+            run_keel(
+                repo, "gate", "task-start", "--change", "demo", "--task", "1.1",
+                "--record", "--no-guard",
+            )
+            result = run_keel(
+                repo, "gate", "task-complete", "--change", "demo", "--task",
+                "1.1", "--json",
+            )
+            try:
+                return json.loads(result.stdout)
+            except json.JSONDecodeError:
+                return {
+                    "status": "unparsed",
+                    "problems": [{"message": result.stdout[:400]}],
+                }
+
+        inside = "openspec/changes/demo/evidence/compare.json"
+        payload = artifact_fixture("artifact-ok", write_at=inside)
+        if payload.get("status") != "pass":
+            report(
+                f"{label}: an artifact reference was not verified — a reference "
+                "to a file that is there, with a digest that matches, was "
+                f"refused. {problem_text(payload)}"
+            )
+            return 1
+        payload = artifact_fixture("artifact-absent", write_at=None)
+        if payload.get("status") == "pass":
+            report(
+                f"{label}: an artifact reference was not verified — a reference "
+                "to a file that does not exist was accepted, so the form is "
+                "tolerated as prose rather than checked. Any sentence would "
+                "have passed the same way."
+            )
+            return 1
+        if "artifact-missing" not in problem_codes(payload):
+            report(
+                f"{label}: an artifact reference was not verified — refused for "
+                f"another reason; got {problem_codes(payload)!r}."
+            )
+            return 1
+
+        # M2 of 1.3 — the digest is what makes the pointer worth more than a
+        # path. A file that moved after the digest was recorded is the case a
+        # bare path cannot see, and it is the common one: the command gets
+        # re-run.
+        stale = hashlib.sha256(b"different\n").hexdigest()
+        payload = artifact_fixture(
+            "artifact-stale",
+            recorded=f"artifact {inside} sha256:{stale}",
+            write_at=inside,
+        )
+        if payload.get("status") == "pass":
+            report(
+                f"{label}: accepted a stale digest — the artifact's content does "
+                "not hash to the recorded digest and the reference was accepted, "
+                "so Review reads whatever the file says now."
+            )
+            return 1
+        if "artifact-digest-mismatch" not in problem_codes(payload):
+            report(
+                f"{label}: accepted a stale digest — refused for another reason; "
+                f"got {problem_codes(payload)!r}."
+            )
+            return 1
+        message = problem_text(payload)
+        for expected in (inside, stale[:12]):
+            if expected not in message:
+                report(
+                    f"{label}: the refusal does not name {expected!r}, so a "
+                    "reader cannot tell a stale record from a wrong path; got "
+                    f"{message!r}."
+                )
+                return 1
+
+        # M3 of 1.3 — the inverse of the `Durable owner:` rule, for the opposite
+        # reason: a follow-up pointer must outlive the change, and an evidence
+        # artifact must travel with it. `openspec archive` moves the change
+        # directory, so a path outside it is one the archive leaves behind.
+        outside = "evidence/compare.json"
+        payload = artifact_fixture("artifact-outside", artifact_path=outside, write_at=outside)
+        if payload.get("status") == "pass":
+            report(
+                f"{label}: accepted a path archiving would leave behind — an "
+                f"artifact at {outside!r} was accepted although the archive "
+                "moves only the change directory."
+            )
+            return 1
+        if "artifact-outside-change" not in problem_codes(payload):
+            report(
+                f"{label}: accepted a path archiving would leave behind — "
+                f"refused for another reason; got {problem_codes(payload)!r}."
+            )
+            return 1
+        if "archiv" not in problem_text(payload):
+            report(
+                f"{label}: the refusal does not say that archiving is what "
+                f"breaks the pointer; got {problem_text(payload)!r}."
+            )
+            return 1
+
+    if label not in {name for name, _ in SCENARIOS}:
+        report(f"{label}: the scenario registry does not include it.")
+        return 1
+    report(f"{label} scenario passed.")
+    return 0
+
+
 SCENARIOS: tuple = (
     ("stateless-continuity", validate_stateless_continuity_scenario),
     ("core-gates", validate_core_gates_scenario),
@@ -29404,6 +30059,10 @@ SCENARIOS: tuple = (
         "a-negation-is-not-a-marker",
         validate_a_negation_is_not_a_marker_scenario,
     ),
+    (
+        "an-equivalence-claim-names-its-base",
+        validate_an_equivalence_claim_names_its_base_scenario,
+    ),
     (
         "guidance-is-referenced-and-carries-no-criterion",
         validate_guidance_is_referenced_and_carries_no_criterion_scenario,

package/src/core/gates.js

@@ -2,6 +2,7 @@
 
 // Keel 4.1.0 deterministic gate contract.
 
+const crypto = require("crypto");
 const fs = require("fs");
 const path = require("path");
 const { spawnSync } = require("child_process");
@@ -293,6 +294,112 @@ function taskShapeWarnings(repo, selection, task, compiled) {
   ];
 }
 
+// The requirement names a change declares as new, read from the `## ADDED
+// Requirements` sections of its delta specs. A `## MODIFIED` requirement is
+// deliberately not here: behavior that changed is still behavior an equivalence
+// task can legitimately claim is measurement-stable.
+function addedRequirementNames(repo, change) {
+  const specsRoot = path.join(repo, "openspec", "changes", change, "specs");
+  const names = new Set();
+  let capabilities = [];
+  try {
+    capabilities = fs.readdirSync(specsRoot);
+  } catch {
+    return names;
+  }
+  for (const capability of capabilities) {
+    const specPath = path.join(specsRoot, capability, "spec.md");
+    let content = "";
+    try {
+      content = fs.readFileSync(specPath, "utf8");
+    } catch {
+      continue;
+    }
+    // Only the ADDED section, bounded by the next `## ` heading, so a
+    // requirement listed under MODIFIED or REMOVED is not read as new.
+    for (const section of content.split(/^##\s+/m).slice(1)) {
+      if (!/^ADDED Requirements\s*$/m.test(section.split(/\r?\n/)[0])) continue;
+      for (const match of section.matchAll(/^###\s+Requirement:\s*(.+?)\s*$/gm)) {
+        names.add(match[1]);
+      }
+    }
+  }
+  return names;
+}
+
+// A task's declared strategy, from the text it wrote. Both forms: the compact
+// `Strategy:` entry under `Verify`, and the expanded `Verification Strategy`
+// field beside `Commands`.
+function declaredStrategy(task) {
+  const compact = String(field(task, "Verify") || "").match(
+    /^\s*-?\s*Strategy:\s*(.+?)\s*$/m
+  );
+  const value = compact
+    ? compact[1]
+    : String(field(task, "Verification Strategy") || "");
+  return value.trim().toLowerCase();
+}
+
+// A `Covers` entry naming a spec scenario: `capability / Requirement / Scenario`.
+// Identifier entries (`D4`, `F1`, `E2`) have no slashes and are not spec claims.
+function specCoverEntries(task) {
+  return String(field(task, "Covers") || "")
+    .split(/\r?\n/)
+    .map((line) => line.replace(/^\s*-\s*/, "").trim())
+    .filter((entry) => entry.split("/").length >= 3)
+    .map((entry) => entry.split("/").map((part) => part.trim()));
+}
+
+// `equivalence` owes no red, which makes it the first strategy reached for by a
+// task that should have one. A task covering a scenario its own change *adds* is
+// claiming that behavior is new and that behavior is unchanged at the same time,
+// and without this guard one of the two claims has no proof anywhere in the
+// change. Satisfied only by a sibling covering the same entry, never by the mere
+// presence of a red-green task somewhere in the change.
+function equivalenceEscapeProblems(repo, selection, task, compiled) {
+  const strategy = String(
+    ((compiled.capsule || {}).verification || {}).strategy || ""
+  ).toLowerCase();
+  if (strategy !== "equivalence") return [];
+  const added = addedRequirementNames(repo, selection.change);
+  if (added.size === 0) return [];
+  const problems = [];
+  for (const parts of specCoverEntries(task)) {
+    const requirement = parts[1];
+    if (!added.has(requirement)) continue;
+    const entry = parts.join(" / ");
+    const scenario = parts.slice(2).join(" / ");
+    const covered = selection.tasks.some((sibling) => {
+      if (sibling.id === task.id) return false;
+      // Read from the sibling's own `Verify` text rather than by compiling it.
+      // Compiling made the guard depend on the sibling being otherwise valid: a
+      // sibling with any unrelated contract error produced no capsule, so its
+      // strategy read as absent and it silently stopped satisfying the guard.
+      const siblingStrategy = declaredStrategy(sibling);
+      if (!RED_GREEN_VERIFICATION_STRATEGIES.has(siblingStrategy)) return false;
+      // The same entry, not any entry. A guard satisfied by the presence of a
+      // red-green task would be a check that the change contains one, which
+      // every change with more than one task passes.
+      return specCoverEntries(sibling).some(
+        (other) => other.join(" / ") === entry
+      );
+    });
+    if (!covered) {
+      problems.push(
+        problem(
+          "equivalence-covers-added-behavior",
+          `This task declares \`Strategy: equivalence\` and covers `
+            + `"${scenario}", a scenario this change adds. Behavior that is new `
+            + "is not behavior that is unchanged, and no task of this change "
+            + "proves the new half: name a red-green task that covers the same "
+            + "entry, or move this Covers entry to the task that implements it."
+        )
+      );
+    }
+  }
+  return problems;
+}
+
 function taskStart(repo, options) {
   const selection = loadSelection(repo, options);
   const task = selection.selected[0];
@@ -300,6 +407,7 @@ function taskStart(repo, options) {
   const problems = [
     ...compiled.diagnostics,
     ...invalidationProblems(repo, selection.content, selection.tasks, selection.change),
+    ...equivalenceEscapeProblems(repo, selection, task, compiled),
   ];
   // Recording the current fingerprint is idempotent: --record replaces the
   // selected task's Contract anchor whatever it holds, so reauthorizing a task
@@ -454,6 +562,72 @@ function commandLabels(task) {
   ].map((match) => match[1]);
 }
 
+// `artifact <path> sha256:<digest>`, or null for prose. The path is
+// repo-relative; the digest is what Review is entitled to assume it is reading.
+const ARTIFACT_EVIDENCE =
+  /^artifact\s+(\S+)\s+sha256:([0-9a-f]{64})\s*$/i;
+
+function artifactReference(value) {
+  const match = String(value || "").trim().match(ARTIFACT_EVIDENCE);
+  return match ? { path: match[1], digest: match[2].toLowerCase() } : null;
+}
+
+// Keel checks identity and reads nothing else: it does not parse the artifact,
+// does not know what a field is, and compares nothing in it. The claim that the
+// numbers agree stays the author's, recorded before Review exactly as
+// `Fails with:` and `Detects:` are. What the digest buys is that the file Review
+// opens is the file the author meant, which a retelling cannot offer.
+function artifactProblems(repo, change, label, reference) {
+  if (!reference) return [];
+  // The inverse of the `Durable owner:` rule, and for the opposite reason: a
+  // follow-up pointer has to outlive the change, while an evidence artifact has
+  // to travel with it. `openspec archive` moves the change directory and
+  // nothing else, so a path outside it is one the archive is guaranteed to
+  // leave behind — and an evidence pointer that breaks on archive is worse than
+  // a retelling, which at least survives.
+  const changeDir = path.join("openspec", "changes", change);
+  const normalized = reference.path.split(path.sep).join("/");
+  if (!normalized.startsWith(`${changeDir.split(path.sep).join("/")}/`)) {
+    return [
+      problem(
+        "artifact-outside-change",
+        `${label} Evidence references \`${reference.path}\`, which is outside `
+          + `\`${changeDir}\`. Archiving moves the change directory and nothing `
+          + "else, so this pointer breaks the moment the change is archived. "
+          + "Put the artifact inside the change's own directory."
+      ),
+    ];
+  }
+  const absolute = path.join(repo, reference.path);
+  if (!fs.existsSync(absolute) || !fs.statSync(absolute).isFile()) {
+    return [
+      problem(
+        "artifact-missing",
+        `${label} Evidence references the artifact \`${reference.path}\`, and `
+          + "no file is there. An unresolvable reference is worse than a "
+          + "retelling: the retelling at least carries the result."
+      ),
+    ];
+  }
+  const actual = crypto
+    .createHash("sha256")
+    .update(fs.readFileSync(absolute))
+    .digest("hex");
+  if (actual !== reference.digest) {
+    return [
+      problem(
+        "artifact-digest-mismatch",
+        `${label} Evidence records \`${reference.path}\` at `
+          + `sha256:${reference.digest}, and the file there hashes to `
+          + `sha256:${actual}. Re-record the digest if the command was re-run, `
+          + "or correct the path — naming both is what lets a reader tell a "
+          + "stale record from a pointer at the wrong file."
+      ),
+    ];
+  }
+  return [];
+}
+
 function evidenceValue(task, label) {
   const escaped = label.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const match = field(task, "Evidence").match(
@@ -1049,11 +1223,21 @@ function completionChecks(repo, task, contract = null, changeVerify = null, chan
     problems.push(problem("missing-commands", "Commands must define at least one M<n>."));
   }
   for (const label of commands) {
-    if (!isConcrete(evidenceValue(task, label))) {
+    const recorded = evidenceValue(task, label);
+    if (!isConcrete(recorded)) {
       problems.push(
         problem("missing-evidence", `Missing concrete Evidence for ${label}.`)
       );
+      continue;
     }
+    // An A/B pairing or a sweep summary *is* the output of one command, and
+    // retelling it into tasks.md is a transcription that can be wrong and that
+    // nobody can re-check (issue #142). A reference is checked rather than
+    // tolerated: as prose it would already have passed as concrete, so without
+    // this the form would buy nothing at all.
+    problems.push(
+      ...artifactProblems(repo, change, label, artifactReference(recorded))
+    );
   }
   // A declared measurement is held against the check's own bare `M<n>` Evidence
   // — the entry where the command and its output are recorded. A literal that

package/src/core/task-contract.js

@@ -1,6 +1,7 @@
 "use strict";
 
 const crypto = require("crypto");
+const { execFileSync } = require("child_process");
 const fs = require("fs");
 const path = require("path");
 
@@ -143,6 +144,13 @@ const SUPPORTED_VERIFICATION_STRATEGIES = [
   "snapshot-characterization",
   "rendered-behavior",
   "evidence-first",
+  // Zero difference, not "nothing could fail first". `evidence-first` is the
+  // only other strategy without a red-green obligation, and it is scoped by an
+  // absence; an A/B against a base is the opposite — a criterion stronger than
+  // red-green, because it also catches the change that incidentally moved a
+  // result. Issue #142 measured a task re-recording its contract twice to get
+  // past the shape rather than the criterion.
+  "equivalence",
 ];
 
 const RED_GREEN_VERIFICATION_STRATEGIES = new Set([
@@ -257,6 +265,77 @@ function isPassingReviewStatus(value) {
   );
 }
 
+// A git ref resolved locally, or null. Reads the repository the gate is already
+// reading and reaches nothing else: a gate that fetched would stop being local
+// and offline, which is the property its verdict rests on.
+function resolveCommit(repo, ref) {
+  try {
+    return execFileSync(
+      "git",
+      ["-C", repo, "rev-parse", "--verify", "--quiet", `${ref}^{commit}`],
+      { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
+    ).trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+// Four ways an `equivalence` task's shape can be complete and still compare
+// nothing. Each names the declaration it is about: a diagnostic naming the
+// strategy would send the author to the one line that is correct.
+function equivalenceProblems(repo, taskVerification) {
+  const problems = [];
+  const declaredFields = taskVerification.fieldsDeclared;
+  if (!isConcrete(taskVerification.base)) {
+    problems.push({
+      code: "missing-equivalence-base",
+      message:
+        "equivalence compares one code path at two commits and declares which "
+        + "one it is compared against. Add a `Base:` entry beside `Strategy:` "
+        + "naming a git ref — without it the criterion is `the numbers are the "
+        + "same as some other numbers`.",
+    });
+  }
+  if (taskVerification.fields.length === 0) {
+    problems.push({
+      code: "missing-equivalence-fields",
+      message: declaredFields
+        ? "`Fields:` is declared and resolves to an empty set, so the "
+          + "comparison has nothing to compare. It reads as a declaration to "
+          + "every reader except the comparison; name the fields, separated by "
+          + "commas."
+        : "equivalence declares which fields are compared. Add a `Fields:` "
+          + "entry beside `Strategy:` listing them, separated by commas — a "
+          + "comparison with no field set agrees with everything.",
+    });
+  }
+  if (isConcrete(taskVerification.base)) {
+    const base = resolveCommit(repo, taskVerification.base);
+    if (!base) {
+      problems.push({
+        code: "unresolvable-equivalence-base",
+        message:
+          `\`Base: ${taskVerification.base}\` resolves to no commit in this `
+          + "repository. The base is read locally and never fetched, so a ref "
+          + "that exists only on a remote is not one this gate can see.",
+      });
+    } else {
+      const head = resolveCommit(repo, "HEAD");
+      if (head && head === base) {
+        problems.push({
+          code: "equivalence-base-is-head",
+          message:
+            `\`Base: ${taskVerification.base}\` resolves to ${base}, which is `
+            + "HEAD. An A/B against itself always agrees, so the check would "
+            + "pass having compared nothing — the one shape here that is "
+            + "complete, resolvable, and still empty.",
+        });
+      }
+    }
+  }
+  return problems;
+}
+
 function verification(task) {
   const compact = fieldValues(task, "Verify");
   const strategyEntry = compact.find((entry) => /^Strategy:\s*/i.test(entry));
@@ -266,8 +345,19 @@ function verification(task) {
   // command, and a reason that took an `M<n>` label would be a check the author
   // never wrote and evidence nobody can record.
   const reasonEntry = compact.find((entry) => /^Reason:\s*/i.test(entry));
+  // `equivalence` compares one code path at two commits. Neither half of that
+  // fits in a check: the check is the command, and what it cannot say by itself
+  // is which commit it is compared against and which fields are compared. #142
+  // proposed a third field for the command too; commands already have exactly
+  // one home here, and a second would put half of them outside the labelled
+  // evidence `task-complete` enforces.
+  const baseEntry = compact.find((entry) => /^Base:\s*/i.test(entry));
+  const fieldsEntry = compact.find((entry) => /^Fields:\s*/i.test(entry));
   const isVerificationField = (entry) =>
-    /^Strategy:\s*/i.test(entry) || /^Reason:\s*/i.test(entry);
+    /^Strategy:\s*/i.test(entry)
+    || /^Reason:\s*/i.test(entry)
+    || /^Base:\s*/i.test(entry)
+    || /^Fields:\s*/i.test(entry);
   const commandSource = compact.length > 0
     ? compact.filter((entry) => !isVerificationField(entry))
     : fieldValues(task, "Commands");
@@ -342,6 +432,24 @@ function verification(task) {
         ? reasonEntry.replace(/^Reason:\s*/i, "")
         : field(task, "Verification Reason")
     ),
+    base: normalizeText(
+      baseEntry ? baseEntry.replace(/^Base:\s*/i, "") : field(task, "Verification Base")
+    ),
+    // A set, so "declared but empty" is a state the gate can see. `Fields:` with
+    // nothing behind it is the shape that passes while comparing nothing, and it
+    // reads as a declaration to everyone except the comparison.
+    // Whether the line was written at all, kept beside the parsed set so a
+    // refusal can tell an author who wrote nothing from one who wrote an empty
+    // set. To the comparison they are the same state; to the author they are
+    // opposite mistakes.
+    fieldsDeclared: Boolean(fieldsEntry || field(task, "Verification Fields")),
+    fields: (fieldsEntry
+      ? fieldsEntry.replace(/^Fields:\s*/i, "")
+      : field(task, "Verification Fields") || ""
+    )
+      .split(",")
+      .map((entry) => normalizeText(entry))
+      .filter(Boolean),
     commands,
   };
 }
@@ -1191,6 +1299,11 @@ function compileTaskContract(repo, change, task) {
         + "needs no reason.",
     });
   }
+  if (taskVerification.strategy.toLowerCase() === "equivalence") {
+    resolved.diagnostics.push(
+      ...equivalenceProblems(repo, taskVerification)
+    );
+  }
   const couplingMode = normalizeText(field(task, "Coupling")).toLowerCase()
     || "none";
   const candidateBoundary = normalizedValues(task, "Candidate Boundary", {
@@ -1311,6 +1424,14 @@ function compileTaskContract(repo, change, task) {
       // other task keeps the capsule shape and fingerprint it had before the
       // field existed.
       ...(taskVerification.reason ? { reason: taskVerification.reason } : {}),
+      // Same rule: emitted only by the strategy that declares them, so every
+      // existing task's capsule shape and fingerprint are untouched. They belong
+      // in the capsule rather than only in the file because a declaration
+      // outside the fingerprint could be edited after the run it describes.
+      ...(taskVerification.base ? { base: taskVerification.base } : {}),
+      ...(taskVerification.fields.length > 0
+        ? { fields: taskVerification.fields }
+        : {}),
       // Emit a tag only when the check opts out of a default, so an untagged
       // check keeps the capsule shape and fingerprint it had before either tag
       // existed. `layer` appears only for `fast`, `regression` only when true.