@cleocode/core 2026.9.20 → 2026.9.21

package/dist/tasks/evidence-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-paths.d.ts","sourceRoot":"","sources":["../../src/tasks/evidence-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAwCH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,MAAM,GAAG,IAAI,CA0Bf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAUnF"}

package/dist/tasks/evidence-paths.js

@@ -0,0 +1,150 @@
+/**
+ * Portable paths for `files:` and `test-run:` evidence atoms (T12476).
+ *
+ * A project is identified by its `project_id` (ADR-094); its path is only a
+ * per-device hint. Evidence that stores an absolute path therefore breaks the
+ * moment the checkout moves (another device, another OS, a rename): the
+ * re-validation at `cleo complete` looks for `/mnt/projects/x/src/a.ts` and
+ * reports "File removed since verify" for a file that is present, unchanged,
+ * under the new root.
+ *
+ * Atoms therefore record, next to the path as supplied, the ABSOLUTE file
+ * that was hashed (`resolvedPath`). Re-validation reads that file whatever
+ * directory `cleo complete` runs from; a relative form would be re-resolved
+ * against the completing process's tree and could hash a different copy. A
+ * move is handled only at re-validation, when that absolute path is gone:
+ * {@link rebaseLegacyEvidencePath} maps it through a vanished, recorded
+ * checkout root of this project onto the live root.
+ *
+ * Rebasing never decides validity. It only chooses WHICH bytes to hash;
+ * the caller still compares them against the sha256 captured at verify time,
+ * so a rebased path pointing at different content fails exactly as a modified
+ * file does.
+ *
+ * @task T12476
+ * @epic T12468
+ * @adr ADR-094
+ */
+import { existsSync, realpathSync } from 'node:fs';
+import { isAbsolute, join, relative, sep } from 'node:path';
+import { readPortableProjectId } from '@cleocode/paths';
+/** Resolve symlinks when the path exists; otherwise return it unchanged. */
+function realOrSelf(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+}
+/**
+ * The path of `target` relative to `root`, in POSIX form, or `null` when the
+ * target is not strictly inside the root.
+ */
+function relativeInside(root, target) {
+    const rel = relative(root, target);
+    if (rel === '' || rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+        return null;
+    return rel.split(sep).join('/');
+}
+/** Whether `target` resolves (through symlinks) strictly inside `root`. */
+function staysInside(root, target) {
+    return relativeInside(realOrSelf(root), realOrSelf(target)) !== null;
+}
+/**
+ * Split a path into segments on this platform's separators only: `/` on
+ * POSIX (where `\` is an ordinary file-name character), `\` and `/` on
+ * Windows.
+ */
+function pathSegments(path) {
+    const parts = sep === '\\' ? path.split(/[\\/]/) : path.split('/');
+    return parts.filter((s) => s.length > 0);
+}
+/**
+ * Map a legacy absolute evidence path onto the live project root.
+ *
+ * Rebasing happens ONLY through a recorded former checkout root of THIS
+ * project that no longer exists. There is no tail-matching heuristic: a file
+ * that moved or vanished inside a project that did NOT move is reported
+ * removed, never re-pointed at some other file that happens to share a name
+ * or a suffix.
+ *
+ * Returns `null` unless all of these hold:
+ *
+ * - the path is absolute, does not exist, and has no `.` / `..` segments;
+ * - a recorded root that is gone, and neither is nor nests with a live root,
+ *   contains the path;
+ * - the same relative position exists under a live root, and its realpath
+ *   stays inside that live root.
+ *
+ * The result is a candidate, not a verdict: the caller must still compare
+ * the bytes it reads against the recorded sha256.
+ *
+ * @param path - Path as stored in the atom.
+ * @param liveRoots - Live project roots (execution root first, store root second).
+ * @param recordedRoots - Checkout roots recorded for this project in the registry.
+ * @returns The absolute rebased path under a live root, or `null`.
+ * @example
+ * ```ts
+ * // Project moved from /mnt/projects/app to /home/me/app:
+ * rebaseLegacyEvidencePath('/mnt/projects/app/src/a.ts', ['/home/me/app'], ['/mnt/projects/app']);
+ * // → '/home/me/app/src/a.ts'
+ * ```
+ * @task T12476
+ */
+export function rebaseLegacyEvidencePath(path, liveRoots, recordedRoots) {
+    if (!isAbsolute(path) || existsSync(path))
+        return null;
+    if (pathSegments(path).some((s) => s === '.' || s === '..'))
+        return null;
+    for (const oldRoot of recordedRoots) {
+        if (existsSync(oldRoot))
+            continue;
+        // A former checkout is never nested inside (or around) the live one; a
+        // "root" that overlaps a live root describes a move WITHIN the project.
+        if (liveRoots.some((live) => live === oldRoot ||
+            relativeInside(live, oldRoot) !== null ||
+            relativeInside(oldRoot, live) !== null)) {
+            continue;
+        }
+        const rel = relativeInside(oldRoot, path);
+        if (rel === null)
+            continue;
+        for (const root of liveRoots) {
+            const candidate = join(root, rel);
+            if (existsSync(candidate) && staysInside(root, candidate))
+                return candidate;
+        }
+    }
+    return null;
+}
+/**
+ * Former checkout roots recorded for the project at `storeRoot`.
+ *
+ * Read from the device-local path map (`nexus_project_paths`) by the
+ * project's portable id. Best-effort: a project without a valid
+ * `.cleo/project-id`, or a registry that cannot be opened, yields `[]`, and
+ * no rebase happens (there is no tail-matching fallback).
+ *
+ * @param storeRoot - The CLEO project root.
+ * @returns Absolute checkout roots of this project other than `storeRoot`.
+ * @example
+ * ```ts
+ * const oldRoots = await loadRecordedProjectRoots(projectRoot);
+ * ```
+ * @task T12476
+ */
+export async function loadRecordedProjectRoots(storeRoot) {
+    const identity = readPortableProjectId(storeRoot);
+    if (identity.status !== 'valid')
+        return [];
+    try {
+        const { listProjectCheckouts } = await import('../nexus/path-map.js');
+        const checkouts = await listProjectCheckouts(identity.projectId);
+        return checkouts.map((c) => c.projectPath).filter((p) => p !== storeRoot);
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=evidence-paths.js.map

package/dist/tasks/evidence-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-paths.js","sourceRoot":"","sources":["../../src/tasks/evidence-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,4EAA4E;AAC5E,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc;IAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7F,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,2EAA2E;AAC3E,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,OAAO,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,SAA4B,EAC5B,aAAgC;IAEhC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzE,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,IAAI,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QAClC,uEAAuE;QACvE,wEAAwE;QACxE,IACE,SAAS,CAAC,IAAI,CACZ,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,KAAK,OAAO;YAChB,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,IAAI;YACtC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,CACzC,EACD,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAC3B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAClC,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,SAAiB;IAC9D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/tasks/evidence.d.ts

@@ -157,6 +157,16 @@ export type ParsedAtom = {
     kind: 'pr';
     /** PR number (positive integer). */
     prNumber: number;
+} | {
+    /**
+     * Merge-commit CI atom — required checks green on a merged PR's merge
+     * commit (D11149). Accepted only with `evidence.ciSatisfies`.
+     *
+     * @task T12634
+     */
+    kind: 'ci';
+    /** PR number (positive integer). */
+    prNumber: number;
 } | {
     /**
      * Cross-task AC-binding atom — references an acceptance criterion on
@@ -532,6 +542,51 @@ export declare function checkEngineMigrationLocDrop(atoms: EvidenceAtom[], minRe
  * @task T1605
  */
 export declare const CALLSITE_COVERAGE_LABEL = "callsite-coverage";
+/**
+ * The task linkage `pr:` provenance requires, shared with `ci:<pr>` (T12634):
+ * the PR's changed-file inventory is complete, and the PR either cites the
+ * task in its title, body or head branch, or its diff intersects the task's
+ * declared files — and when files are declared, the diff MUST intersect them.
+ *
+ * @param prNumber - The PR being linked.
+ * @param pr - The verified PR (title, body, head branch, changed files).
+ * @param context - The task the evidence is being recorded for.
+ * @returns The refusal, or null when the PR is linked to the task.
+ * @task T12634
+ */
+export declare function checkPrTaskLinkage(prNumber: number, pr: {
+    title: string;
+    body: string;
+    headRefName: string;
+    changedPaths: string[];
+    changedFileCount: number;
+    changedFilesError?: string;
+}, context: EvidenceValidationContext): {
+    ok: false;
+    reason: string;
+    codeName: string;
+} | null;
+/**
+ * Whether a path is a documentation artifact (`.md`/`.mdx`/`.rst`/`.adoc`/`.txt`,
+ * README, LICENSE, CHANGELOG) — the rule `pr:` uses to refuse a docs-only PR
+ * as implementation of a code task.
+ *
+ * @param path - Repo-relative path.
+ * @returns True for a documentation artifact.
+ */
+export declare function isDocumentArtifact(path: string): boolean;
+/**
+ * Classify a task for evidence purposes: `research` (research/spike kind),
+ * `documentation` (docs-only declared files or a docs label) or `code`.
+ *
+ * Exported so the read-only `cleo done --plan` planner chooses the same
+ * documentary path the validators accept — one classification, not two.
+ *
+ * @param context - Task context; only `task` is read.
+ * @returns The evidence classification.
+ * @task T12624
+ */
+export declare function classifyEvidenceTask(context: Pick<EvidenceValidationContext, 'task'>): 'code' | 'documentation' | 'research';
 /**
  * Require explicit criterion linkage to inspected artifacts and real gate results.
  * @param context - Current task classification, requested gates and criterion records.

package/dist/tasks/evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/tasks/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,OAAO,KAAK,EACV,YAAY,EACZ,yBAAyB,EACzB,YAAY,EAEZ,gBAAgB,EACjB,MAAM,qBAAqB,CAAC;AA4B7B,OAAO,EACL,eAAe,EACf,KAAK,aAAa,EAGnB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAwC,CAAC;AAElF;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,MAAM,CAAC;AAElD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAqB,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,CAS7B,CAAC;AAE1D;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAMrD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC7E;IACE;;;;;;OAMG;IACH,IAAI,EAAE,UAAU,CAAC;IACjB,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE;;;;;;;;OAQG;IACH,IAAI,EAAE,IAAI,CAAC;IACX,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;CAClB,GACD;IACE;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,WAAW,CAAC;IAClB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAUzD;AAMD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM;AACnB,yEAAyE;AACzE,MAAM,CAAC,EAAE,MAAM;AACf,2EAA2E;AAC3E,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,cAAc,CAAC,CA4FzB;AA6RD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAqGvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAWrD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C,GAAG,MAAM,EAAE,GAAG,IAAI,CAElB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,SAAS,CAAC;AAsCvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,iBAAiB,CAAA;CAAE,CA4B5D;AA2CD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CA2BhF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CA4BvE;AA6TD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,EASnB,GAAG,GAAE,MAAsB,EAAE,oGAAoG;AACjI,KAAK,GAAE,0BAA+B,GACrC,MAAM,CAuDR;AAyPD,OAAO,EAAE,eAAe,EAAE,CAAC;AA+E3B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,YAAY,EAAE,EACrB,eAAe,GAAE,MAA2C,GAC3D,MAAM,GAAG,IAAI,CAuBf;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAgV3D;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,EAClC,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,YAAY,EAAE,GACpB,MAAM,GAAG,IAAI,CAoDf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CAU9E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,4BAA4B,CAC1C,mBAAmB,EAAE;IAAE,KAAK,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAClF,OAAO,CAOT;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,EAAE,SAAS,gBAAgB,EAGtE,CAAC;AAMH;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,YAAY,EAAE,GACpB,MAAM,GAAG,IAAI,CAiBf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,YAAY,EAAE,GACpB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAS1C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,YAAY,EAAE,EACrB,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,OAAO,EAClB,cAAc,CAAC,EAAE,MAAM,EACvB,OAAO,CAAC,EAAE,yBAAyB,EACnC,IAAI,CAAC,EAAE,gBAAgB,GACtB,YAAY,CA+Cd;AAMD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5D;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,gBAAgB,EAGhE,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAEtD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,YAAY,EACtB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,gBAAgB,EACvB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CA8N7B"}
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/tasks/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,OAAO,KAAK,EACV,YAAY,EACZ,yBAAyB,EACzB,YAAY,EAEZ,gBAAgB,EACjB,MAAM,qBAAqB,CAAC;AA6B7B,OAAO,EACL,eAAe,EACf,KAAK,aAAa,EAGnB,MAAM,oBAAoB,CAAC;AAG5B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAwC,CAAC;AAElF;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,MAAM,CAAC;AAElD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAqB,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,CAS7B,CAAC;AAE1D;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAMrD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC7E;IACE;;;;;;OAMG;IACH,IAAI,EAAE,UAAU,CAAC;IACjB,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE;;;;;;;;OAQG;IACH,IAAI,EAAE,IAAI,CAAC;IACX,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;CAClB,GACD;IACE;;;;;OAKG;IACH,IAAI,EAAE,IAAI,CAAC;IACX,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;CAClB,GACD;IACE;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,WAAW,CAAC;IAClB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAUzD;AAMD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM;AACnB,yEAAyE;AACzE,MAAM,CAAC,EAAE,MAAM;AACf,2EAA2E;AAC3E,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,cAAc,CAAC,CA0GzB;AA6RD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAqGvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAWrD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C,GAAG,MAAM,EAAE,GAAG,IAAI,CAElB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,SAAS,CAAC;AAsCvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,iBAAiB,CAAA;CAAE,CA4B5D;AA2CD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CA2BhF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CA4BvE;AA6UD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAqCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,EASnB,GAAG,GAAE,MAAsB,EAAE,oGAAoG;AACjI,KAAK,GAAE,0BAA+B,GACrC,MAAM,CAuDR;AA2RD,OAAO,EAAE,eAAe,EAAE,CAAC;AA+E3B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,YAAY,EAAE,EACrB,eAAe,GAAE,MAA2C,GAC3D,MAAM,GAAG,IAAI,CAuBf;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AA8N3D;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE;IACF,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,EACD,OAAO,EAAE,yBAAyB,GACjC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAqBxD;AA8ED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,IAAI,CAAC,yBAAyB,EAAE,MAAM,CAAC,GAC/C,MAAM,GAAG,eAAe,GAAG,UAAU,CAQvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,EAClC,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,YAAY,EAAE,GACpB,MAAM,GAAG,IAAI,CA4Df;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CAU9E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,4BAA4B,CAC1C,mBAAmB,EAAE;IAAE,KAAK,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAClF,OAAO,CAOT;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,EAAE,SAAS,gBAAgB,EAGtE,CAAC;AAMH;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,YAAY,EAAE,GACpB,MAAM,GAAG,IAAI,CAiBf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,YAAY,EAAE,GACpB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAS1C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,YAAY,EAAE,EACrB,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,OAAO,EAClB,cAAc,CAAC,EAAE,MAAM,EACvB,OAAO,CAAC,EAAE,yBAAyB,EACnC,IAAI,CAAC,EAAE,gBAAgB,GACtB,YAAY,CA+Cd;AAMD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5D;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,gBAAgB,EAGhE,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAEtD;AAkDD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,YAAY,EACtB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,gBAAgB,EACvB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAyP7B"}

package/dist/tasks/evidence.js

@@ -29,10 +29,12 @@ import { CleoError } from '../errors.js';
 import { describeUnusableEvidenceGitRoot, E_EVIDENCE_GIT_ROOT, findNestedGitWorkTrees, findWorkTreeContainingCommit, gitToplevel, isGitWorkTree, resolveDeclaredEvidenceGitRoot, } from '../git/work-tree.js';
 import { pushWarning } from '../output.js';
 import { getEffectiveHead } from '../worktree/effective-head.js';
+import { loadRecordedProjectRoots, rebaseLegacyEvidencePath } from './evidence-paths.js';
 import { DISABLE_ENV, describeMemoryLimit } from './heavy-tool-limit.js';
 import { computeCommitRevalidationKey, readCommitRevalidationEntry, writeCommitRevalidationEntry, } from './revalidation-cache.js';
 import { resolveSpawnTimeoutMs, runToolCached } from './tool-cache.js';
 import { CANONICAL_TOOLS, listValidToolNames, resolveToolCommand, } from './tool-resolver.js';
+import { detectStaticVacuity, probeTscFileCount, VACUOUS_TOOL_FIX } from './tool-vacuity.js';
 /**
  * Valid tool names recognised by the `tool:<name>` evidence atom.
  *
@@ -218,6 +220,20 @@ siblingCommitSha, context) {
             return validateDecision(parsed.decisionId, roots);
         case 'pr':
             return validatePrAtom(parsed.prNumber, roots, context);
+        case 'ci': {
+            // T12634 (D11149): `gh` runs in the repo (executionRoot); the opt-in,
+            // required-check list and PR cache are CLEO's own records (storeRoot).
+            const { resolveCiEvidenceAtom } = await import('../release/ci-evidence.js');
+            const { loadProjectContext } = await import('../agents/variable-substitution.js');
+            const ctx = loadProjectContext(roots.storeRoot);
+            const result = await resolveCiEvidenceAtom(parsed.prNumber, roots, {
+                projectContext: ctx.loaded ? ctx.context : null,
+                ...(context ? { context } : {}),
+            });
+            return result.ok
+                ? { ok: true, atom: result.atom }
+                : { ok: false, reason: result.reason, codeName: result.codeName };
+        }
         case 'satisfies': {
             // ADR-079-r2: 5-check validator pipeline shipped by T10507.
             // Delegates to the dedicated validator module to keep the dispatch
@@ -1012,6 +1028,14 @@ async function gitShowFileContent(relPath, taskId, projectRoot) {
     // Normalise the path: strip leading "./" so git:show works correctly.
     const norm = relPath.replace(/^\.\//, '');
     // Try task/<taskId> first, then main, then master, then HEAD.
+    //
+    // Ref order is unchanged since T11959 and is identical at verify and at
+    // re-validation. This fallback runs only when the file is absent from disk,
+    // so it answers "does the branch the work was verified on still carry these
+    // bytes?". A tamper committed to main while task/<id> stays pristine is NOT
+    // detected here: that is a change to a different ref, and it surfaces on
+    // disk (checked first) wherever main is checked out. API callers passing a
+    // taskId get this order; `cleo complete` passes none.
     const refs = [`task/${taskId}`, 'main', 'master', 'HEAD'];
     for (const ref of refs) {
         const r = await runCommand('git', ['show', `${ref}:${norm}`], projectRoot);
@@ -1116,6 +1140,7 @@ async function validateFiles(paths, roots, taskId, commitSha, requireCommitArtif
                 reason: `Cannot inspect ${p} at PR merge ${commitSha}; fetch that commit before recording evidence. Current checkout bytes cannot substitute.`,
             };
         }
+        let readFromDisk = false;
         if (content === null && existsSync(abs)) {
             // Happy path — file exists on disk.
             const st = await stat(abs);
@@ -1127,6 +1152,7 @@ async function validateFiles(paths, roots, taskId, commitSha, requireCommitArtif
                 };
             }
             content = await readFile(abs);
+            readFromDisk = true;
         }
         if (content === null && taskId) {
             // T11959: Git-show fallback for branch-only files (worktree context).
@@ -1151,10 +1177,51 @@ async function validateFiles(paths, roots, taskId, commitSha, requireCommitArtif
             };
         }
         const sha256 = createHash('sha256').update(content).digest('hex');
-        files.push({ path: p, sha256 });
+        // T12476: `path` stays exactly as supplied (consumers match it against
+        // repo-relative PR paths). When the bytes came from disk, the absolute
+        // file that was hashed is recorded too, so re-validation reads THAT file
+        // whatever directory `cleo complete` runs from. `resolvedPath` is a
+        // DEVICE-LOCAL hint (an absolute path on this device) and is never
+        // authoritative across devices; re-validation falls back when it is gone.
+        files.push(readFromDisk ? { path: p, sha256, resolvedPath: abs } : { path: p, sha256 });
     }
     return { ok: true, atom: { kind: 'files', files } };
 }
+/**
+ * `tool:test-affected` (D11150, T12635): run `testing.affectedCommand` over the
+ * packages the branch diff touches plus their dependents, through the same
+ * ADR-061 cache and heavy-tool caps as `tool:test` (canonical `test`, so the
+ * memory and timeout limits apply). The atom records `scope: 'affected'` and
+ * the packages, so a receipt never passes for a full run.
+ */
+async function validateAffectedTests(roots) {
+    const { storeRoot, executionRoot } = roots;
+    const { planAffectedTestRun } = await import('./affected-packages.js');
+    const run = await planAffectedTestRun(storeRoot, executionRoot);
+    if (!run.ok)
+        return { ok: false, codeName: run.codeName, reason: run.reason };
+    const result = await runToolCached(run.command, storeRoot, { executionRoot });
+    if (result.exitCode !== 0) {
+        return {
+            ok: false,
+            codeName: result.timedOut ? 'E_EVIDENCE_TOOL_TIMEOUT' : 'E_EVIDENCE_TOOL_FAILED',
+            reason: `tool:test-affected (${[run.command.cmd, ...run.command.args].join(' ')}) exited ${result.exitCode}: ${(result.stderrTail || result.stdoutTail).trim().slice(-300)}`,
+        };
+    }
+    return {
+        ok: true,
+        atom: {
+            kind: 'tool',
+            tool: 'test-affected',
+            exitCode: 0,
+            stdoutTail: result.stdoutTail,
+            scope: 'affected',
+            affectedPackages: run.packages,
+            affectedProjects: run.projects,
+            ...(run.untested.length > 0 ? { untestedPackages: run.untested } : {}),
+        },
+    };
+}
 /**
  * Resolve the tree that evidence tools should RUN in, given the CLEO store
  * root.
@@ -1351,7 +1418,11 @@ async function validateTestRun(path, roots) {
         ok: true,
         atom: {
             kind: 'test-run',
+            // T12476: `path` exactly as supplied; `resolvedPath` is the report that
+            // was hashed, which re-validation reads regardless of cwd. DEVICE-LOCAL:
+            // an absolute path on this device, never authoritative cross-device.
             path,
+            resolvedPath: abs,
             sha256,
             passCount: passed,
             failCount: failed,
@@ -1360,8 +1431,12 @@ async function validateTestRun(path, roots) {
     };
 }
 async function validateTool(tool, roots) {
+    if (tool === 'test-affected')
+        return validateAffectedTests(roots);
     const { storeRoot: projectRoot, executionRoot } = roots;
-    const resolution = resolveToolCommand(tool, projectRoot);
+    // T12633: project-context lives in the store; package.json scripts and
+    // tsconfig describe the code under test, so they are read where it runs.
+    const resolution = resolveToolCommand(tool, projectRoot, { executionRoot });
     // T12083: the project has no such toolchain. This is a fact about the
     // project, not a failure of the work — a plain JavaScript project cannot
     // typecheck, and demanding it means no task in that project can ever be
@@ -1388,6 +1463,18 @@ async function validateTool(tool, roots) {
                 : 'E_EVIDENCE_TOOL_UNAVAILABLE',
         };
     }
+    // T12633: a checker that provably checks nothing is not evidence. Decided
+    // BEFORE the cache lookup, so a pass cached for the vacuous command (every
+    // `npx tsc --noEmit` against a references-only tsconfig) is never served.
+    const staticVacuity = detectStaticVacuity(resolution.command, executionRoot);
+    if (staticVacuity !== null) {
+        return {
+            ok: false,
+            reason: `Tool "${tool}" → ${resolution.command.cmd} ${resolution.command.args.join(' ')} ` +
+                `(${resolution.command.source}) is VACUOUS: ${staticVacuity} Fix: ${VACUOUS_TOOL_FIX}`,
+            codeName: 'E_EVIDENCE_TOOL_VACUOUS',
+        };
+    }
     // gh#1220/#1226/#1230: spawn in — and fingerprint against — the tree the
     // operator actually invoked from, not the shared store root. gh#1365: the
     // root arrives as a parameter now; it is NOT re-resolved here.
@@ -1489,6 +1576,17 @@ async function validateTool(tool, roots) {
             codeName: 'E_EVIDENCE_TOOL_FAILED',
         };
     }
+    // T12633: exit 0 from a direct `tsc` run is only a pass if it compiled
+    // something. `--listFilesOnly` answers that without re-checking.
+    if (probeTscFileCount(resolution.command, result.executionRoot) === 0) {
+        return {
+            ok: false,
+            reason: `Tool "${tool}" → ${resolution.command.cmd} ${resolution.command.args.join(' ')} ` +
+                `exited 0 but is VACUOUS: \`--listFilesOnly\` reports 0 project files in ` +
+                `${result.executionRoot}, so it checked nothing. Fix: ${VACUOUS_TOOL_FIX}`,
+            codeName: 'E_EVIDENCE_TOOL_VACUOUS',
+        };
+    }
     return {
         ok: true,
         atom: { kind: 'tool', tool, exitCode: 0, stdoutTail: result.stdoutTail },
@@ -1808,6 +1906,39 @@ async function validateDecision(decisionId, roots) {
 // ---------------------------------------------------------------------------
 // PR atom (T9764)
 // ---------------------------------------------------------------------------
+/**
+ * The task linkage `pr:` provenance requires, shared with `ci:<pr>` (T12634):
+ * the PR's changed-file inventory is complete, and the PR either cites the
+ * task in its title, body or head branch, or its diff intersects the task's
+ * declared files — and when files are declared, the diff MUST intersect them.
+ *
+ * @param prNumber - The PR being linked.
+ * @param pr - The verified PR (title, body, head branch, changed files).
+ * @param context - The task the evidence is being recorded for.
+ * @returns The refusal, or null when the PR is linked to the task.
+ * @task T12634
+ */
+export function checkPrTaskLinkage(prNumber, pr, context) {
+    if (pr.changedFileCount !== pr.changedPaths.length || pr.changedPaths.length === 0) {
+        return {
+            ok: false,
+            codeName: 'E_EVIDENCE_INSUFFICIENT',
+            reason: `PR #${prNumber} changed-file coverage is incomplete or empty (${pr.changedPaths.length}/${pr.changedFileCount})${pr.changedFilesError ? ` — ${pr.changedFilesError}` : ''}; inspect the full diff before recording evidence.`,
+        };
+    }
+    const declaredFiles = context.task.files ?? [];
+    const taskMention = new RegExp(`(^|[^A-Za-z0-9])${context.task.id}([^A-Za-z0-9]|$)`);
+    const explicitlyLinked = taskMention.test(`${pr.title}\n${pr.body}\n${pr.headRefName}`);
+    const scopeIntersects = declaredFiles.length > 0 && diffIntersectsAc(pr.changedPaths, declaredFiles);
+    if ((!explicitlyLinked && !scopeIntersects) || (declaredFiles.length > 0 && !scopeIntersects)) {
+        return {
+            ok: false,
+            codeName: 'E_EVIDENCE_CONTENT_MISMATCH',
+            reason: `PR #${prNumber} does not establish a relationship to task ${context.task.id}. Changed artifacts: ${pr.changedPaths.join(', ')}. Declare task files or cite the exact task in the PR; declared scope must intersect the diff.`,
+        };
+    }
+    return null;
+}
 /**
  * Validate a `pr:<number>` atom by resolving the PR via the `gh` CLI.
  *
@@ -1852,24 +1983,9 @@ async function validatePrAtom(prNumber, roots, context) {
     if (!result.ok) {
         return { ok: false, reason: result.reason, codeName: result.codeName };
     }
-    if (result.changedFileCount !== result.changedPaths.length || result.changedPaths.length === 0) {
-        return {
-            ok: false,
-            codeName: 'E_EVIDENCE_INSUFFICIENT',
-            reason: `PR #${prNumber} changed-file coverage is incomplete or empty (${result.changedPaths.length}/${result.changedFileCount})${result.changedFilesError ? ` — ${result.changedFilesError}` : ''}; inspect the full diff before recording evidence.`,
-        };
-    }
-    const declaredFiles = context.task.files ?? [];
-    const taskMention = new RegExp(`(^|[^A-Za-z0-9])${context.task.id}([^A-Za-z0-9]|$)`);
-    const explicitlyLinked = taskMention.test(`${result.title}\n${result.body}\n${result.headRefName}`);
-    const scopeIntersects = declaredFiles.length > 0 && diffIntersectsAc(result.changedPaths, declaredFiles);
-    if ((!explicitlyLinked && !scopeIntersects) || (declaredFiles.length > 0 && !scopeIntersects)) {
-        return {
-            ok: false,
-            codeName: 'E_EVIDENCE_CONTENT_MISMATCH',
-            reason: `PR #${prNumber} does not establish a relationship to task ${context.task.id}. Changed artifacts: ${result.changedPaths.join(', ')}. Declare task files or cite the exact task in the PR; declared scope must intersect the diff.`,
-        };
-    }
+    const unlinked = checkPrTaskLinkage(prNumber, result, context);
+    if (unlinked)
+        return unlinked;
     if (context.gates.includes('implemented') &&
         classifyEvidenceTask(context) === 'code' &&
         result.changedPaths.every(isDocumentArtifact)) {
@@ -1893,11 +2009,30 @@ async function validatePrAtom(prNumber, roots, context) {
         },
     };
 }
-function isDocumentArtifact(path) {
+/**
+ * Whether a path is a documentation artifact (`.md`/`.mdx`/`.rst`/`.adoc`/`.txt`,
+ * README, LICENSE, CHANGELOG) — the rule `pr:` uses to refuse a docs-only PR
+ * as implementation of a code task.
+ *
+ * @param path - Repo-relative path.
+ * @returns True for a documentation artifact.
+ */
+export function isDocumentArtifact(path) {
     return (/\.(md|mdx|rst|adoc|txt)$/i.test(path) ||
         /(?:^|\/)(README|LICENSE|CHANGELOG)(?:\.[^/]*)?$/i.test(path));
 }
-function classifyEvidenceTask(context) {
+/**
+ * Classify a task for evidence purposes: `research` (research/spike kind),
+ * `documentation` (docs-only declared files or a docs label) or `code`.
+ *
+ * Exported so the read-only `cleo done --plan` planner chooses the same
+ * documentary path the validators accept — one classification, not two.
+ *
+ * @param context - Task context; only `task` is read.
+ * @returns The evidence classification.
+ * @task T12624
+ */
+export function classifyEvidenceTask(context) {
     if (context.task.kind === 'research' || context.task.kind === 'spike')
         return 'research';
     if (context.task.files?.length && context.task.files.every(isDocumentArtifact))
@@ -1922,6 +2057,9 @@ function classifyEvidenceTask(context) {
  */
 export function checkTaskEvidenceContext(context, gate, atoms) {
     const filePaths = atoms.flatMap((atom) => atom.kind === 'files' ? atom.files.map((file) => file.path) : []);
+    // T12634: a `ci:` result is bound to the task it was validated for, like `pr:`.
+    if (atoms.some((atom) => atom.kind === 'ci' && atom.taskId !== context.task.id))
+        return 'CI evidence lacks verified task linkage; re-verify with current task context.';
     const prAtoms = atoms.filter((atom) => atom.kind === 'pr');
     if (prAtoms.length > 1)
         return 'Record one PR and its merge-pinned artifacts per verification attempt; multiple merge identities are ambiguous.';
@@ -1939,7 +2077,9 @@ export function checkTaskEvidenceContext(context, gate, atoms) {
         return null;
     if (classifyEvidenceTask(context) === 'code' &&
         (gate === 'testsPassed' || gate === 'qaPassed') &&
-        !atoms.some((atom) => atom.kind === 'test-run' || (atom.kind === 'tool' && !atom.notApplicable))) {
+        !atoms.some((atom) => atom.kind === 'test-run' ||
+            atom.kind === 'ci' ||
+            (atom.kind === 'tool' && !atom.notApplicable))) {
         return `Code task ${context.task.id} requires an actual verification result for ${gate}; absence of a toolchain is not a passing result.`;
     }
     const linked = atoms.filter((atom) => atom.kind === 'satisfies' && atom.targetTaskId === context.task.id);
@@ -2130,7 +2270,7 @@ export function composeGateEvidence(atoms, capturedBy, override, overrideReason,
                 return atom.kind === 'commit' || atom.kind === 'pr' || atom.kind === 'decision'
                     ? [index]
                     : [];
-            return atom.kind === 'tool' || atom.kind === 'test-run' ? [index] : [];
+            return atom.kind === 'tool' || atom.kind === 'test-run' || atom.kind === 'ci' ? [index] : [];
         });
         result.scope = {
             taskId: context.task.id,
@@ -2187,6 +2327,46 @@ export const CRITICAL_GATES_NO_OVERRIDE = Object.freeze([
 export function isHardAtom(atom) {
     return atom.kind !== 'override' && atom.kind !== 'note' && atom.kind !== 'url';
 }
+/**
+ * The on-disk file re-validation should hash for a `files:` / `test-run:`
+ * entry.
+ *
+ * 1. `resolvedPath`, when it still exists. It pins the file attested at verify
+ *    time, independent of the completing process's cwd.
+ * 2. The first candidate that is gone (`resolvedPath`, else `mainResolution`),
+ *    rebased through a vanished, recorded checkout root of this project.
+ * 3. `mainResolution`: how the atom resolved before T12476. It covers a
+ *    verified worktree that was removed after merge.
+ *
+ * This only chooses bytes; the caller's sha256 comparison is the verdict.
+ *
+ * @internal
+ * @task T12476
+ */
+async function resolveAttestedPath(resolvedPath, mainResolution, executionRoot, storeRoot) {
+    if (resolvedPath !== undefined && existsSync(resolvedPath))
+        return resolvedPath;
+    const pinned = resolvedPath ?? mainResolution;
+    const rebased = await rebaseForRevalidation(pinned, executionRoot, storeRoot);
+    if (rebased !== null)
+        return rebased;
+    return mainResolution;
+}
+/**
+ * Rebase a legacy absolute evidence path whose checkout moved onto the live
+ * root. Returns the absolute rebased path, or `null` when the path is
+ * relative, still exists, or cannot be mapped safely (see
+ * {@link rebaseLegacyEvidencePath} for the guards).
+ *
+ * @internal
+ * @task T12476
+ */
+async function rebaseForRevalidation(path, executionRoot, storeRoot) {
+    if (!isAbsolute(path) || existsSync(path))
+        return null;
+    const recordedRoots = await loadRecordedProjectRoots(storeRoot);
+    return rebaseLegacyEvidencePath(path, [executionRoot, storeRoot], recordedRoots);
+}
 /**
  * Re-validate stored evidence to detect tampering between verify and complete.
  *
@@ -2318,7 +2498,17 @@ export async function revalidateEvidence(evidence, projectRoot, gate, taskId, op
                 const siblingCommitSha = siblingPr?.mergeCommitSha ?? siblingCommit?.sha;
                 const executionRoot = resolveEvidenceExecutionRoot(projectRoot, undefined, siblingCommitSha === undefined ? {} : { commitSha: siblingCommitSha });
                 for (const f of atom.files) {
-                    const abs = isAbsolute(f.path) ? f.path : resolvePath(executionRoot, f.path);
+                    // T12476: read the file hashed at verify time, in this order:
+                    //   1. `resolvedPath` — pins the attested file regardless of cwd;
+                    //   2. that path rebased through a vanished recorded project root;
+                    //   3. main's resolution of `path` (execution root). This covers the
+                    //      ADR-055 lifecycle — verify in a worktree, remove it after
+                    //      merge, complete from main — where the pinned file is gone but
+                    //      the merged copy is present.
+                    // Every step only chooses which bytes to hash; the sha256 comparison
+                    // below decides, so none of them can pass a modified file.
+                    const mainResolution = isAbsolute(f.path) ? f.path : resolvePath(executionRoot, f.path);
+                    const abs = await resolveAttestedPath(f.resolvedPath, mainResolution, executionRoot, projectRoot);
                     let content = null;
                     if (siblingCommitSha) {
                         content = await gitShowFileContentAtCommit(f.path, siblingCommitSha, executionRoot);
@@ -2360,7 +2550,10 @@ export async function revalidateEvidence(evidence, projectRoot, gate, taskId, op
                 // Deliberately NOT cached (T12102): same reasoning as files: — the
                 // content hash comparison IS the staleness guarantee.
                 const startedAt = Date.now();
-                const abs = isAbsolute(atom.path) ? atom.path : resolvePath(projectRoot, atom.path);
+                // T12476: same order as `files:` — pinned `resolvedPath`, then a
+                // rebase through a vanished recorded root, then main's store-root
+                // resolution of `path`. The sha256 comparison below decides.
+                const abs = await resolveAttestedPath(atom.resolvedPath, isAbsolute(atom.path) ? atom.path : resolvePath(projectRoot, atom.path), resolveEvidenceExecutionRoot(projectRoot), projectRoot);
                 if (!existsSync(abs)) {
                     failed.push({ atom, reason: `test-run file removed since verify: ${atom.path}` });
                     options?.onProgress?.(`test-run:${atom.path} FAILED ${Date.now() - startedAt}ms`);
@@ -2394,6 +2587,10 @@ export async function revalidateEvidence(evidence, projectRoot, gate, taskId, op
                 // once accepted/proposed. Re-validation is not performed at complete
                 // time — the DB row is trusted as captured at verify time.
                 break;
+            case 'ci':
+                // T12634: check conclusions on a merge commit are immutable once
+                // completed; the atom is trusted as captured, like `pr:`.
+                break;
             case 'pr':
                 // PR atoms capture (prNumber, mergedAt, mergeCommitSha) at verify
                 // time. A merged PR's mergedAt is immutable, so the atom is trusted