@codacy/verity-cli 0.30.0 → 0.30.1-experimental.67b8921

package/bin/verity.js

@@ -10342,6 +10342,10 @@ function repoRoot() {
   }
   return _repoRoot;
 }
+function _resetRepoRoot() {
+  _repoRoot = null;
+  _mainRoot = void 0;
+}
 var _mainRoot;
 function mainWorktreeRoot() {
   if (_mainRoot !== void 0) return _mainRoot;
@@ -10383,6 +10387,7 @@ var CLAUDE_SETTINGS_FILE = ".claude/settings.json";
 var STANDARD_FILE = `${VERITY_DIR}/standard.yaml`;
 var MEMORY_DIR = `${VERITY_DIR}/memory`;
 var CODACY_CONFIG_FILE = ".codacy/codacy.config.json";
+var VERITYIGNORE_FILE = ".verityignore";
 function projectPath(relativePath) {
   return (0, import_node_path.join)(repoRoot(), relativePath);
 }
@@ -10473,7 +10478,8 @@ var REVIEWABLE_FILENAMES = /* @__PURE__ */ new Set([
   "Makefile",
   "Dockerfile",
   "Jenkinsfile",
-  "Vagrantfile"
+  "Vagrantfile",
+  ".verityignore"
 ]);
 var REVIEWABLE_PATH_PATTERNS = [
   /\.circleci\//,
@@ -10493,7 +10499,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -10503,6 +10509,7 @@ function githubAppInstallUrl(accountId) {
   return accountId != null ? `https://github.com/apps/${GITHUB_APP_SLUG}/installations/new/permissions?target_id=${accountId}` : GITHUB_APP_INSTALL_URL;
 }
 var ADVISORY_EPISODE_FILE = `${VERITY_DIR}/.advisory-episode`;
+var IGNORE_DECLARATION_FILE = `${VERITY_DIR}/.ignore-declaration`;
 
 // src/lib/output.ts
 var RED = "\x1B[0;31m";
@@ -10804,13 +10811,6 @@ function execGit(cmd) {
     return "";
   }
 }
-function execGitArgs(args) {
-  try {
-    return (0, import_node_child_process3.execFileSync)("git", args, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
-  }
-}
 function splitLines(s) {
   return s.split("\n").filter((l) => l.length > 0);
 }
@@ -10877,9 +10877,6 @@ function getChangedFiles() {
   const filtered = Array.from(sets).filter((f) => !isVerityOwnedPath(f));
   return { files: filtered, hasRecentCommitFiles };
 }
-function getStagedFiles() {
-  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !isVerityOwnedPath(f));
-}
 function getDirtyFiles() {
   const set = /* @__PURE__ */ new Set();
   for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
@@ -10900,33 +10897,6 @@ function showContentAtRef(ref, repoRelPath) {
     return null;
   }
 }
-function getPushRangeFiles() {
-  const diff = (range) => splitLines(execGitArgs(["diff", "--name-only", range])).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-  const resolvers = [
-    () => execGitArgs(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{push}"]) ? "@{push}..HEAD" : null,
-    () => execGitArgs(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"]) ? "@{upstream}..HEAD" : null,
-    () => {
-      const branch = execGitArgs(["rev-parse", "--abbrev-ref", "HEAD"]);
-      return branch && branch !== "HEAD" && execGitArgs(["rev-parse", "--verify", "-q", `origin/${branch}`]) ? `origin/${branch}..HEAD` : null;
-    }
-  ];
-  for (const resolve3 of resolvers) {
-    const range = resolve3();
-    if (range) return { files: diff(range), range };
-  }
-  const baseline = readBaselineSha();
-  if (baseline) {
-    const files = diff(`${baseline}..HEAD`);
-    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
-  }
-  const last = diff("HEAD~1..HEAD");
-  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
-}
-function getPushRangeMessages() {
-  const { range } = getPushRangeFiles();
-  if (!range) return "";
-  return execGitArgs(["log", range, "--format=%B%x00"]).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
-}
 function filterAnalyzable(files) {
   return files.filter((f) => {
     const ext = (0, import_node_path3.extname)(f).slice(1);
@@ -11417,7 +11387,7 @@ var readline = __toESM(require("node:readline/promises"));
 var import_node_os = require("node:os");
 
 // src/lib/provider-auth.ts
-var sleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
+var sleep = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
 var form = (fields) => new URLSearchParams(fields).toString();
 async function githubAccountId(owner) {
   try {
@@ -13563,6 +13533,42 @@ var LEGACY_MD_END = "<!-- gate-memory:end -->";
 var LEGACY_PRESERVE_START = "<!-- gate-memory:preserve -->";
 var LEGACY_PRESERVE_END = "<!-- /gate-memory:preserve -->";
 var CLAUDE_MD_PROSE = [
+  "## Project Memory",
+  "",
+  "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
+  "non-trivial work, scan `.verity/memory/index.md` for decisions, gotchas, and patterns",
+  "that may apply to the change you are about to make. Open specific node files via",
+  "the Read tool when the title or scope suggests relevance.",
+  "",
+  "The graph is auto-maintained by Verity. Files at `.verity/memory/_archive/` are",
+  "superseded \u2014 ignore them unless investigating history.",
+  "",
+  "> Durable, hand-curated guidance goes in the preserve region below (it survives",
+  "> regeneration) or anywhere OUTSIDE these markers. Everything else between the",
+  "> markers is tool-owned and overwritten on each run.",
+  "",
+  "## Housekeeping Turns",
+  "",
+  "When a turn will be pure housekeeping \u2014 pulling, installing dependencies,",
+  "rebasing, a formatting sweep you are not authoring \u2014 declare it BEFORE doing it:",
+  "",
+  "```bash",
+  'verity ignore --turn --agent --reason "pulling latest before starting"',
+  "```",
+  "",
+  "This skips the review for that turn, which saves the turn Verity would",
+  "otherwise spend saying it had nothing to say. Use `--for 30m` instead of",
+  "`--turn` when a single piece of housekeeping spans several turns.",
+  "",
+  "**It is a claim about the turn, not a way to silence review.** The declaration",
+  "is checked against what the turn actually did: if anything is authored \u2014 by you,",
+  "by a subagent, or by a shell command that can write files \u2014 it voids, the review",
+  "runs anyway, and the broken declaration is reported. So declare housekeeping you",
+  "are about to do, never work you have already done, and never as a way to get past",
+  "a finding. Declarations are budgeted per session and every one is recorded with",
+  "its reason."
+].join("\n");
+var CLAUDE_MD_PROSE_PRE_IGNORE = [
   "## Project Memory",
   "",
   "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
@@ -13687,7 +13693,7 @@ function extractPreserveContent(interior) {
 }
 function stripKnownProse(interior) {
   const trimmed = interior.replace(/^\n+/, "");
-  for (const prose of [CLAUDE_MD_PROSE, CLAUDE_MD_PROSE_LEGACY]) {
+  for (const prose of [CLAUDE_MD_PROSE, CLAUDE_MD_PROSE_PRE_IGNORE, CLAUDE_MD_PROSE_LEGACY]) {
     if (trimmed.startsWith(prose)) return trimmed.slice(prose.length);
   }
   return trimmed;
@@ -13747,6 +13753,160 @@ var import_node_fs14 = require("node:fs");
 var import_node_crypto7 = require("node:crypto");
 var import_node_path13 = require("node:path");
 
+// src/lib/analysis-mode.ts
+var DEBUG_PHRASES = [
+  "not working",
+  "doesn't work",
+  "doesn't work",
+  "does not work",
+  "isn't working",
+  "is not working",
+  "can't figure out",
+  "stack trace"
+];
+var DEBUG_WORDS = [
+  "fix",
+  "bug",
+  "broken",
+  "crash",
+  "crashing",
+  "failing",
+  "debug",
+  "debugging",
+  "investigate",
+  "troubleshoot",
+  "regression",
+  "wrong"
+];
+var DEBUG_PATTERN = new RegExp(
+  [
+    ...DEBUG_PHRASES.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")),
+    ...DEBUG_WORDS.map((w) => `\\b${w}\\b`)
+  ].join("|"),
+  "i"
+);
+var FALSE_POSITIVE_PATTERNS = [
+  /\b(?:add|create|implement|write|build|design|set\s*up)\b.{0,20}\berror\b/i,
+  /\berror\s+handling\b/i,
+  /\berror\s+boundar(?:y|ies)\b/i,
+  /\berror\s+(?:type|class|page|component|message|code|enum)\b/i,
+  /\b(?:add|create|implement|write|build)\b.{0,20}\b(?:fix|debug|issue)\b/i
+];
+function hasDebugIntent(prompt) {
+  if (!DEBUG_PATTERN.test(prompt)) return false;
+  for (const fp of FALSE_POSITIVE_PATTERNS) {
+    if (fp.test(prompt)) return false;
+  }
+  return true;
+}
+var GIT_ONLY_PATTERN = /\b(commit|push|deploy|merge|rebase|tag|release|publish|ship)\b/i;
+var CODE_AUTHORING_PATTERN = /\b(add|create|implement|build|write|fix|update|change|refactor|modify|remove|delete|move|rename)\b.*\b(function|component|feature|endpoint|test|file|module|class|type|interface|hook|page|route|style|migration|code|bug|error|issue)\b/i;
+function isGitOnlyPrompt(prompt) {
+  if (!GIT_ONLY_PATTERN.test(prompt)) return false;
+  if (CODE_AUTHORING_PATTERN.test(prompt)) return false;
+  return true;
+}
+function reconcileAnalysisMode(predictedMode, signals) {
+  const mode2 = resolveAnalysisMode(predictedMode, signals);
+  if (mode2 !== "skip") return mode2;
+  const windowIsOrphaned = signals.actionSummary?.transcript_windowed === "orphaned";
+  if (windowIsOrphaned && !signals.sessionAuthoredCode) return "standard";
+  return mode2;
+}
+function resolveAnalysisMode(predictedMode, signals) {
+  if (!predictedMode || !isValidMode(predictedMode)) {
+    return detectAnalysisMode(
+      signals.noFilesChanged,
+      signals.assistantResponse,
+      signals.conversationPrompts,
+      signals.actionSummary,
+      signals.sessionAuthoredCode
+    );
+  }
+  const agentAuthoredCode = !!(signals.actionSummary && (signals.actionSummary.files_edited.length > 0 || signals.actionSummary.files_created.length > 0)) || !!signals.sessionAuthoredCode;
+  const agentInvestigated = didAgentInvestigate(signals.actionSummary);
+  switch (predictedMode) {
+    case "skip":
+      if (agentAuthoredCode) return "standard";
+      return "skip";
+    case "plan":
+      if (agentAuthoredCode) return "standard";
+      return "plan";
+    case "debug":
+      return "debug";
+    case "standard":
+      if (!!signals.actionSummary && !agentAuthoredCode && !!signals.assistantResponse) {
+        return agentInvestigated ? "plan" : "skip";
+      }
+      return "standard";
+  }
+}
+function didAgentInvestigate(summary) {
+  if (!summary) return false;
+  return summary.files_read.length > 0 || summary.searches > 0 || summary.commands.length > 0 || summary.subagents > 0 || summary.web_fetches > 0;
+}
+function isValidMode(mode2) {
+  return mode2 === "standard" || mode2 === "plan" || mode2 === "debug" || mode2 === "skip";
+}
+function detectAnalysisMode(noFilesChanged, assistantResponse, conversationPrompts, actionSummary, sessionAuthoredCode) {
+  const agentAuthoredCode = !!(actionSummary && (actionSummary.files_edited.length > 0 || actionSummary.files_created.length > 0)) || !!sessionAuthoredCode;
+  if (conversationPrompts.length > 0 && conversationPrompts.every(isGitOnlyPrompt)) {
+    if (!agentAuthoredCode) return "skip";
+  }
+  if (noFilesChanged && !!assistantResponse && !agentAuthoredCode) {
+    return "plan";
+  }
+  if (!!actionSummary && !agentAuthoredCode && !!assistantResponse) {
+    return didAgentInvestigate(actionSummary) ? "plan" : "skip";
+  }
+  for (const prompt of conversationPrompts) {
+    if (hasDebugIntent(prompt)) {
+      return "debug";
+    }
+  }
+  return "standard";
+}
+var FILE_MUTATE_RE = /(?:^|[\s|&;(`])(?:sed\s+-i|perl\s+-i|awk\b|tee\b|dd\b|cp\b|mv\b|ln\b|install\b|touch\b|patch\b|git\s+(?:apply|am)\b|cargo\s+build|go\s+generate|make\b|--write\b|--fix\b|--in-place\b)|>>?(?![&>])/i;
+var GIT_PLUMBING_RE = /^\s*git\s+(?:merge|rebase|stash|cherry-pick|revert|pull|fetch|checkout|switch|reset|restore|clean)\b/i;
+var READ_ONLY_RE = /^\s*(?:git\s+(?:status|diff|log|show|branch|remote|config|rev-parse|ls-files|blame|describe)|ls|cat|head|tail|less|grep|rg|find|pwd|echo|printf|wc|which|type|tree|stat|file|env|printenv|date|whoami)\b/i;
+var CHAIN_RE = /&&|\||;|\$\(|\x60/;
+function isNonAuthoringCommand(cmd) {
+  if (typeof cmd !== "string" || cmd.trim().length === 0) return false;
+  if (FILE_MUTATE_RE.test(cmd)) return false;
+  if (CHAIN_RE.test(cmd)) return false;
+  return GIT_PLUMBING_RE.test(cmd) || READ_ONLY_RE.test(cmd);
+}
+function hasNonEditAuthorship(actionSummary, sessionAuthoredCode) {
+  if (!actionSummary) return sessionAuthoredCode;
+  if ((actionSummary.subagents ?? 0) > 0) return true;
+  if (Object.keys(actionSummary.tool_counts ?? {}).some((t) => t.startsWith("mcp__"))) return true;
+  const commands = actionSummary.commands ?? [];
+  if (commands.some((c) => FILE_MUTATE_RE.test(c))) return true;
+  if (sessionAuthoredCode) {
+    const allSafe = commands.length > 0 && commands.every(isNonAuthoringCommand);
+    if (!allSafe) return true;
+  }
+  return false;
+}
+function scopeToAuthored(files, actionSummary) {
+  if (!actionSummary) return { files, signal: "no-transcript" };
+  const touched = [...actionSummary.files_edited ?? [], ...actionSummary.files_created ?? []];
+  if (touched.length === 0) return { files: [], signal: "none-authored" };
+  return { files: narrowToAgentAuthored(files, actionSummary), signal: "authored" };
+}
+function narrowToAgentAuthored(files, actionSummary) {
+  if (!actionSummary) return files;
+  const touched = [
+    ...actionSummary.files_edited,
+    ...actionSummary.files_created
+  ];
+  if (touched.length === 0) return files;
+  return files.filter((f) => {
+    const suffix = "/" + f;
+    return touched.some((t) => t === f || t.endsWith(suffix));
+  });
+}
+
 // src/lib/skip-detection.ts
 function isBareAckPrompt(prompt) {
   if (typeof prompt !== "string") return false;
@@ -13810,6 +13970,15 @@ function shouldSkipForBareAck(input) {
   if (input.turnAuthoredCode) return false;
   return input.canSeeTurnAuthorship;
 }
+function isCommandOnlyTurn(input) {
+  if (!input.authorshipIsObservable) return false;
+  if (input.userCommandsTruncated) return false;
+  const commands = input.userCommands ?? [];
+  if (commands.length === 0) return false;
+  if (input.agentAuthoredFiles > 0) return false;
+  if (input.agentToolCalls > 0) return false;
+  return commands.every(isNonAuthoringCommand);
+}
 
 // src/lib/pending-repeat.ts
 var STOP = /* @__PURE__ */ new Set([
@@ -16119,17 +16288,17 @@ async function readHookStdin() {
   try {
     if (process.stdin.isTTY) return {};
     const chunks = [];
-    const timeout = new Promise((resolve3) => setTimeout(() => resolve3({}), 500));
-    const read = new Promise((resolve3) => {
+    const timeout = new Promise((resolve4) => setTimeout(() => resolve4({}), 500));
+    const read = new Promise((resolve4) => {
       process.stdin.on("data", (c) => chunks.push(c));
       process.stdin.on("end", () => {
         try {
-          resolve3(JSON.parse(Buffer.concat(chunks).toString("utf-8").trim() || "{}"));
+          resolve4(JSON.parse(Buffer.concat(chunks).toString("utf-8").trim() || "{}"));
         } catch {
-          resolve3({});
+          resolve4({});
         }
       });
-      process.stdin.on("error", () => resolve3({}));
+      process.stdin.on("error", () => resolve4({}));
       process.stdin.resume();
     });
     return await Promise.race([read, timeout]);
@@ -16140,7 +16309,145 @@ async function readHookStdin() {
 
 // src/commands/standard.ts
 var import_promises9 = require("node:fs/promises");
+var import_node_fs20 = require("node:fs");
 var import_yaml = __toESM(require_dist());
+
+// src/lib/verityignore.ts
+var import_node_fs19 = require("node:fs");
+var EMPTY = { rules: [], securityOverlap: [], problems: [] };
+var SECURITY_PROBES = [
+  ".env",
+  ".env.local",
+  ".env.production",
+  "config/.env",
+  "services/api/.env",
+  "package-lock.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "Cargo.lock",
+  "go.sum",
+  "Gemfile.lock",
+  "Dockerfile",
+  "docker/Dockerfile"
+];
+function isSecuritySensitive(path) {
+  return SECURITY_PATTERNS.some((p) => p.test(path));
+}
+function compile(pattern) {
+  let p = pattern;
+  const dirOnly = p.endsWith("/");
+  if (dirOnly) p = p.slice(0, -1);
+  const anchored = p.includes("/");
+  if (p.startsWith("/")) p = p.slice(1);
+  const base = anchored ? p : `**/${p}`;
+  const forms = dirOnly ? [`${base}/**/*`] : [base, `${base}/**`];
+  const regexes = [];
+  for (const f of forms) {
+    try {
+      regexes.push(globToRegex(f));
+    } catch {
+    }
+  }
+  if (regexes.length === 0) return () => false;
+  return (path) => regexes.some((r) => r.test(path));
+}
+function parseVerityIgnore(content) {
+  const rules = [];
+  const problems = [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const lineNo = i + 1;
+    let raw = lines[i];
+    raw = raw.replace(/(?<!\\)\s+$/, "");
+    if (raw.length === 0) continue;
+    if (raw.startsWith("#")) continue;
+    let negated = false;
+    if (raw.startsWith("!")) {
+      negated = true;
+      raw = raw.slice(1);
+    } else if (raw.startsWith("\\!") || raw.startsWith("\\#")) {
+      raw = raw.slice(1);
+    }
+    if (raw.length === 0) {
+      problems.push(`line ${lineNo}: "!" with no pattern after it`);
+      continue;
+    }
+    if (raw === "**" || raw === "*" || raw === "/" || raw === "**/*") {
+      problems.push(
+        `line ${lineNo}: "${raw}" would exclude the whole repository from review \u2014 refused. List the directories you mean instead.`
+      );
+      continue;
+    }
+    rules.push({ raw, line: lineNo, negated, test: compile(raw) });
+  }
+  const byRule = /* @__PURE__ */ new Map();
+  for (const probe of SECURITY_PROBES) {
+    let responsible = null;
+    for (const rule of rules) {
+      if (rule.test(probe)) responsible = rule.negated ? null : rule;
+    }
+    if (!responsible) continue;
+    const entry = byRule.get(responsible.line) ?? { raw: responsible.raw, line: responsible.line, hides: [] };
+    entry.hides.push(probe);
+    byRule.set(responsible.line, entry);
+  }
+  const securityOverlap = [...byRule.values()].sort((a, b) => a.line - b.line);
+  return { rules, securityOverlap, problems };
+}
+function decide(rules, path) {
+  let excluded = false;
+  for (const rule of rules) {
+    if (rule.test(path)) excluded = !rule.negated;
+  }
+  return excluded;
+}
+function isIgnored(ig, path) {
+  return decide(ig.rules, path);
+}
+function loadVerityIgnore() {
+  const file = projectPath(VERITYIGNORE_FILE);
+  if (!(0, import_node_fs19.existsSync)(file)) return EMPTY;
+  try {
+    return parseVerityIgnore((0, import_node_fs19.readFileSync)(file, "utf-8"));
+  } catch {
+    return EMPTY;
+  }
+}
+function partitionIgnored(paths, ig) {
+  const suspended = paths.some((p) => p === VERITYIGNORE_FILE);
+  if (suspended || ig.rules.length === 0) {
+    return { rules: ig.rules.length, kept: [...paths], ignored: [], securityExcluded: [], suspended };
+  }
+  const kept = [];
+  const ignored = [];
+  for (const p of paths) {
+    if (p !== VERITYIGNORE_FILE && isIgnored(ig, p)) ignored.push(p);
+    else kept.push(p);
+  }
+  return {
+    rules: ig.rules.length,
+    kept,
+    ignored,
+    securityExcluded: ignored.filter(isSecuritySensitive),
+    suspended: false
+  };
+}
+function ignoreShare(kept, ignored) {
+  const total = kept + ignored;
+  if (total === 0) return 0;
+  return Math.round(ignored / total * 1e3) / 1e3;
+}
+function describeSecurityOverlap(ig) {
+  if (ig.securityOverlap.length === 0) return null;
+  const lines = ig.securityOverlap.map(
+    (o) => `  line ${o.line}: "${o.raw}" would hide ${o.hides.slice(0, 3).join(", ")}` + (o.hides.length > 3 ? ` (+${o.hides.length - 3} more)` : "")
+  );
+  return `.verityignore: ${ig.securityOverlap.length} pattern(s) can hide security-sensitive files from review:
+${lines.join("\n")}
+These are still excluded \u2014 this is a warning, not a refusal. Add a \`!\` rule to keep one in scope, e.g. \`!.env*\`.`;
+}
+
+// src/commands/standard.ts
 function registerStandardCommands(program2) {
   const standard = program2.command("standard").description("Manage the project Standard");
   standard.command("push").description("Upload the project Standard to the service").option("--file <path>", "Path to standard YAML file", STANDARD_FILE).option("--created-by <name>", "Who created this version", "claude-code").action(async (opts) => {
@@ -16169,12 +16476,25 @@ function registerStandardCommands(program2) {
       printError(`Invalid YAML in ${opts.file}: ${err.message}`);
       process.exit(1);
     }
+    let ignoreRaw = null;
+    const ignorePath = projectPath(VERITYIGNORE_FILE);
+    if ((0, import_node_fs20.existsSync)(ignorePath)) {
+      try {
+        ignoreRaw = (0, import_node_fs20.readFileSync)(ignorePath, "utf-8");
+        const overlap = describeSecurityOverlap(parseVerityIgnore(ignoreRaw));
+        if (overlap) printWarn(overlap);
+      } catch {
+      }
+    }
     const result = await apiRequest({
       method: "POST",
       path: "/standards",
       serviceUrl: urlResult.data,
       token: tokenResult.data.token,
-      body: { content, created_by: opts.createdBy },
+      body: {
+        content: ignoreRaw === null ? content : { ...content, verityignore: ignoreRaw },
+        created_by: opts.createdBy
+      },
       verbose: globals.verbose
     });
     if (!result.ok) {
@@ -16392,27 +16712,330 @@ function formatRunDetail(run) {
   return lines;
 }
 
-// src/commands/status.ts
-function timeAgo(isoDate) {
-  const ms = Date.now() - new Date(isoDate).getTime();
-  const mins = Math.floor(ms / 6e4);
-  if (mins < 1) return "just now";
-  if (mins < 60) return `${mins}m ago`;
-  const hrs = Math.floor(mins / 60);
-  if (hrs < 24) return `${hrs}h ago`;
-  const days = Math.floor(hrs / 24);
-  return `${days}d ago`;
+// src/lib/ignore-declaration.ts
+var import_node_fs22 = require("node:fs");
+
+// src/lib/debounce.ts
+var import_node_fs21 = require("node:fs");
+var import_node_crypto10 = require("node:crypto");
+function scopedFile(base, sessionId) {
+  if (!sessionId) return base;
+  return `${base}.${(0, import_node_crypto10.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
 }
-function registerStatusCommand(program2) {
-  program2.command("status").description("Show project quality status").option("--history", "Include recent run history").option("--limit <n>", "Number of history entries", "5").option("--json", "Output raw JSON").action(async (opts) => {
-    const globals = program2.opts();
-    const tokenResult = await resolveToken(globals.token);
-    if (!tokenResult.ok) {
-      printError(tokenResult.error);
-      process.exit(1);
-    }
-    const urlResult = await resolveServiceUrl(globals.serviceUrl);
-    if (!urlResult.ok) {
+function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
+  const file = scopedFile(DEBOUNCE_FILE, sessionId);
+  if (!(0, import_node_fs21.existsSync)(file)) return null;
+  try {
+    const lastTs = parseInt((0, import_node_fs21.readFileSync)(file, "utf-8").trim(), 10);
+    const nowTs = Math.floor(Date.now() / 1e3);
+    const elapsed = nowTs - lastTs;
+    if (elapsed < debounceSeconds) {
+      return `Debounced \u2014 last analysis was ${elapsed}s ago`;
+    }
+  } catch {
+  }
+  return null;
+}
+function checkMtime(files, bypassForRecentCommits, sessionId) {
+  if (bypassForRecentCommits) return null;
+  const file = scopedFile(DEBOUNCE_FILE, sessionId);
+  if (!(0, import_node_fs21.existsSync)(file)) return null;
+  let debounceTime;
+  try {
+    debounceTime = (0, import_node_fs21.statSync)(file).mtimeMs;
+  } catch {
+    return null;
+  }
+  for (const f of files) {
+    const resolved = resolveFile(f);
+    if (!resolved) continue;
+    try {
+      const stat3 = (0, import_node_fs21.statSync)(resolved);
+      if (stat3.mtimeMs > debounceTime) {
+        return null;
+      }
+    } catch {
+      continue;
+    }
+  }
+  return "No files modified since last analysis";
+}
+function computeContentHash(files) {
+  const hash = (0, import_node_crypto10.createHash)("sha1");
+  const sorted = [...files].sort();
+  for (const f of sorted) {
+    const resolved = resolveFile(f) ?? f;
+    try {
+      if ((0, import_node_fs21.existsSync)(resolved)) {
+        hash.update((0, import_node_fs21.readFileSync)(resolved));
+      }
+    } catch {
+    }
+  }
+  return hash.digest("hex");
+}
+function checkContentHash(files, sessionId) {
+  const hash = computeContentHash(files);
+  const file = scopedFile(HASH_FILE, sessionId);
+  if ((0, import_node_fs21.existsSync)(file)) {
+    try {
+      const storedHash = (0, import_node_fs21.readFileSync)(file, "utf-8").trim();
+      if (hash === storedHash) {
+        return { skip: "No source changes since last analysis", hash };
+      }
+    } catch {
+    }
+  }
+  return { skip: null, hash };
+}
+function recordAnalysisStart(sessionId) {
+  (0, import_node_fs21.mkdirSync)(VERITY_DIR, { recursive: true });
+  (0, import_node_fs21.writeFileSync)(scopedFile(DEBOUNCE_FILE, sessionId), String(Math.floor(Date.now() / 1e3)));
+}
+function recordPassHash(hash, sessionId) {
+  (0, import_node_fs21.writeFileSync)(scopedFile(HASH_FILE, sessionId), hash);
+}
+function narrowToRecent(files, sessionId) {
+  const file = scopedFile(DEBOUNCE_FILE, sessionId);
+  if (!(0, import_node_fs21.existsSync)(file)) return files;
+  let debounceTime;
+  try {
+    debounceTime = (0, import_node_fs21.statSync)(file).mtimeMs;
+  } catch {
+    return files;
+  }
+  const recent = files.filter((f) => {
+    try {
+      return (0, import_node_fs21.existsSync)(f) && (0, import_node_fs21.statSync)(f).mtimeMs > debounceTime;
+    } catch {
+      return false;
+    }
+  });
+  return recent.length > 0 ? recent : files;
+}
+function readIteration(currentCommit, _contentHash) {
+  return Math.max(1, readBlockState(currentCommit).attempts);
+}
+var NO_BLOCKS = { attempts: 0, blocks: 0, fingerprint: null };
+function readBlockState(currentCommit, opts) {
+  if (opts?.newUserPrompt) return NO_BLOCKS;
+  if (!(0, import_node_fs21.existsSync)(ITERATION_FILE)) return NO_BLOCKS;
+  try {
+    const stored = (0, import_node_fs21.readFileSync)(ITERATION_FILE, "utf-8").trim();
+    const parsed = stored.startsWith("{") ? parseJsonState(stored) : parseLegacyState(stored);
+    if (!parsed) return NO_BLOCKS;
+    if (parsed.commit !== currentCommit) return NO_BLOCKS;
+    if (parsed.ts > 0 && Math.floor(Date.now() / 1e3) - parsed.ts > 600) return NO_BLOCKS;
+    return { attempts: parsed.attempts, blocks: parsed.blocks, fingerprint: parsed.fingerprint };
+  } catch {
+    return NO_BLOCKS;
+  }
+}
+function parseJsonState(raw) {
+  const o = JSON.parse(raw);
+  const attempts = typeof o.attempts === "number" ? o.attempts : NaN;
+  if (isNaN(attempts)) return null;
+  return {
+    attempts,
+    blocks: typeof o.blocks === "number" ? o.blocks : attempts,
+    fingerprint: typeof o.fingerprint === "string" && o.fingerprint ? o.fingerprint : null,
+    commit: typeof o.commit === "string" ? o.commit : "",
+    ts: typeof o.ts === "number" ? o.ts : 0
+  };
+}
+function parseLegacyState(raw) {
+  const parts = raw.split(":");
+  const n = parseInt(parts[0], 10);
+  if (isNaN(n)) return null;
+  return {
+    attempts: n,
+    // The old file has no separate block count; the old counter is the closest
+    // honest answer, and it errs toward releasing sooner rather than later.
+    blocks: n,
+    fingerprint: parts.slice(3).join(":") || null,
+    commit: parts[1] ?? "",
+    ts: parseInt(parts[2] ?? "0", 10)
+  };
+}
+function findingsFingerprint(findings) {
+  const keys = findings.map((f) => `${String(f.pattern_id ?? "?")}|${String(f.file ?? "?")}`).filter((k) => k !== "?|?");
+  return [...new Set(keys)].sort().join(",");
+}
+function isSameProblem(previous, current) {
+  if (!previous || !current) return false;
+  const prev = new Set(previous.split(","));
+  return current.split(",").some((k) => prev.has(k));
+}
+function writeBlockState(commit, state) {
+  (0, import_node_fs21.mkdirSync)(VERITY_DIR, { recursive: true });
+  (0, import_node_fs21.writeFileSync)(
+    ITERATION_FILE,
+    JSON.stringify({
+      v: 2,
+      attempts: state.attempts,
+      blocks: state.blocks,
+      commit,
+      ts: Math.floor(Date.now() / 1e3),
+      fingerprint: state.fingerprint ?? void 0
+    })
+  );
+}
+function resetBlockState(commit) {
+  writeBlockState(commit, { attempts: 0, blocks: 0, fingerprint: null });
+}
+
+// src/lib/ignore-declaration.ts
+var IGNORE_BUDGET = 3;
+var MAX_WINDOW_SECONDS = 60 * 60;
+var TURN_FUSE_SECONDS = 10 * 60;
+function parseDuration(input) {
+  const trimmed = input.trim().toLowerCase();
+  const m = /^(\d+)(s|m|h)?$/.exec(trimmed);
+  if (!m) {
+    return { ok: false, error: `Could not read "${input}" as a duration. Use 30m, 45s, or 1h.` };
+  }
+  const n = parseInt(m[1], 10);
+  if (!Number.isFinite(n) || n <= 0) {
+    return { ok: false, error: `A duration must be a positive number of seconds, minutes or hours \u2014 got "${input}".` };
+  }
+  const unit = m[2] ?? "m";
+  const seconds = unit === "s" ? n : unit === "h" ? n * 3600 : n * 60;
+  if (seconds > MAX_WINDOW_SECONDS) {
+    return {
+      ok: false,
+      error: `${input} is longer than the ${MAX_WINDOW_SECONDS / 60}-minute maximum. An ignore is meant to cover one piece of housekeeping, not a sitting \u2014 declare it again when you need it.`
+    };
+  }
+  return { ok: true, seconds };
+}
+function resolveActive(state, now) {
+  if (!state?.active) return null;
+  if (state.active.expires <= now) return null;
+  return state.active;
+}
+function verifyDeclaration(input) {
+  const d = input.declaration;
+  if (!d) return { honoured: false, void: false };
+  if (!input.authorshipIsObservable) {
+    return {
+      honoured: false,
+      void: true,
+      why: "the transcript window could not show what this turn did, so the declaration could not be checked"
+    };
+  }
+  if (input.commandRecordTruncated) {
+    return {
+      honoured: false,
+      void: true,
+      why: "the record of commands run this turn was incomplete, so the declaration could not be checked"
+    };
+  }
+  if (input.agentAuthoredFiles > 0) {
+    return {
+      honoured: false,
+      void: true,
+      why: `${input.agentAuthoredFiles} file${input.agentAuthoredFiles === 1 ? " was" : "s were"} authored during it`
+    };
+  }
+  if (input.subagents > 0) {
+    return {
+      honoured: false,
+      void: true,
+      why: "work was delegated to a subagent during it, whose authorship this turn cannot account for"
+    };
+  }
+  const authoring = [...input.agentCommands ?? [], ...input.userCommands ?? []].filter(
+    (c) => !isNonAuthoringCommand(c)
+  );
+  if (authoring.length > 0) {
+    return {
+      honoured: false,
+      void: true,
+      why: `a command that can write files ran during it (${authoring[0]})`
+    };
+  }
+  return { honoured: true };
+}
+function stateFile(sessionId) {
+  return projectPath(scopedFile(IGNORE_DECLARATION_FILE, sessionId));
+}
+function ignoreStateKeys(token, sessionId) {
+  const scoped = sessionScopeKey(token, sessionId);
+  const userOnly = sessionScopeKey(token, void 0);
+  return scoped === userOnly ? [scoped] : [scoped, userOnly];
+}
+function resolveIgnoreState(keys) {
+  for (const key of keys) {
+    const state = readIgnoreState(key);
+    if (state) return { state, key };
+  }
+  return null;
+}
+function readIgnoreState(sessionId) {
+  const file = stateFile(sessionId);
+  if (!(0, import_node_fs22.existsSync)(file)) return null;
+  try {
+    const o = JSON.parse((0, import_node_fs22.readFileSync)(file, "utf-8")) ?? {};
+    const spent = typeof o.spent === "number" ? o.spent : 0;
+    const raw = o.active;
+    let active = null;
+    if (raw && typeof raw === "object") {
+      const scope2 = raw.scope === "window" ? "window" : raw.scope === "turn" ? "turn" : null;
+      const expires = typeof raw.expires === "number" ? raw.expires : null;
+      if (scope2 && expires != null) {
+        active = {
+          scope: scope2,
+          origin: raw.origin === "agent" ? "agent" : "user",
+          reason: typeof raw.reason === "string" ? raw.reason : "",
+          at: typeof raw.at === "number" ? raw.at : 0,
+          expires
+        };
+      }
+    }
+    return { v: 1, active, spent };
+  } catch {
+    return null;
+  }
+}
+function writeIgnoreState(state, sessionId) {
+  try {
+    (0, import_node_fs22.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
+    (0, import_node_fs22.writeFileSync)(stateFile(sessionId), JSON.stringify({ v: 1, active: state.active, spent: state.spent }));
+  } catch {
+  }
+}
+function clearActiveDeclaration(sessionId) {
+  const prev = readIgnoreState(sessionId);
+  if (!prev) return;
+  writeIgnoreState({ v: 1, active: null, spent: prev.spent }, sessionId);
+}
+function describeRemaining(d, now) {
+  const left = Math.max(0, d.expires - now);
+  if (left >= 90) return `${Math.round(left / 60)}m left`;
+  return `${left}s left`;
+}
+
+// src/commands/status.ts
+function timeAgo(isoDate) {
+  const ms = Date.now() - new Date(isoDate).getTime();
+  const mins = Math.floor(ms / 6e4);
+  if (mins < 1) return "just now";
+  if (mins < 60) return `${mins}m ago`;
+  const hrs = Math.floor(mins / 60);
+  if (hrs < 24) return `${hrs}h ago`;
+  const days = Math.floor(hrs / 24);
+  return `${days}d ago`;
+}
+function registerStatusCommand(program2) {
+  program2.command("status").description("Show project quality status").option("--history", "Include recent run history").option("--limit <n>", "Number of history entries", "5").option("--json", "Output raw JSON").action(async (opts) => {
+    const globals = program2.opts();
+    const tokenResult = await resolveToken(globals.token);
+    if (!tokenResult.ok) {
+      printError(tokenResult.error);
+      process.exit(1);
+    }
+    const urlResult = await resolveServiceUrl(globals.serviceUrl);
+    if (!urlResult.ok) {
       printError(urlResult.error);
       process.exit(1);
     }
@@ -16500,6 +17123,39 @@ function registerStatusCommand(program2) {
       printInfo(`Trend:       ${r.trend}`);
       printInfo(`Runs:        ${r.count} recorded`);
     }
+    {
+      const tokenForScope = tokenResult.data.token;
+      const found = resolveIgnoreState(
+        ignoreStateKeys(tokenForScope, process.env.CLAUDE_SESSION_ID || void 0)
+      );
+      const now = Math.floor(Date.now() / 1e3);
+      const active = resolveActive(found?.state ?? null, now);
+      const spent = found?.state.spent ?? 0;
+      if (active) {
+        printInfo("");
+        printInfo("--- Ignore Declared ---");
+        printInfo(`Scope:       ${active.scope === "turn" ? "the next turn" : `a window, ${describeRemaining(active, now)}`}`);
+        printInfo(`Reason:      ${active.reason}`);
+        printInfo(`Declared by: ${active.origin === "agent" ? "the agent" : "you"}`);
+        printInfo(`Budget:      ${spent}/${IGNORE_BUDGET} declarations this session`);
+        printInfo('Turns that author anything are still reviewed \u2014 the declaration voids. "verity ignore clear" cancels it.');
+      } else if (spent > 0) {
+        printInfo("");
+        printInfo(`Ignore budget: ${spent}/${IGNORE_BUDGET} declarations used this session.`);
+      }
+    }
+    {
+      const ig = loadVerityIgnore();
+      if (ig.rules.length > 0 || ig.problems.length > 0) {
+        printInfo("");
+        printInfo("--- .verityignore ---");
+        printInfo(`Rules:       ${ig.rules.length}`);
+        for (const problem of ig.problems) printWarn(`  ${problem}`);
+        const overlap = describeSecurityOverlap(ig);
+        if (overlap) printWarn(overlap);
+        printInfo("An edit to .verityignore suspends every rule for that turn \u2014 the edit is always reviewed.");
+      }
+    }
     if (mem.pending_items && mem.pending_items.length > 0) {
       printInfo("");
       printInfo("--- Pending Items ---");
@@ -16647,6 +17303,7 @@ function createRun(opts, globals) {
     phaseReached: "",
     phasesCompleted: [],
     skipReason: null,
+    treeFrame: null,
     turnId: "",
     // The value `resolveReachability` itself returns when every rung declines.
     reachability: { human_reachable: "unknown", human_reachable_source: "inferred", rung: "none" },
@@ -16662,6 +17319,7 @@ function createRun(opts, globals) {
     allChanged: [],
     hasRecentCommitFiles: false,
     changedUniverse: [],
+    verityIgnored: { rules: 0, kept: [], ignored: [], securityExcluded: [], suspended: false },
     analyzable: [],
     reviewable: [],
     securityFiles: [],
@@ -16695,6 +17353,7 @@ function createRun(opts, globals) {
     deletedNodePaths: [],
     editedUploads: [],
     autoSeedNotice: null,
+    voidedIgnoreNotice: null,
     foldResult: null,
     foldConservation: null,
     memorySession: null,
@@ -16715,7 +17374,7 @@ function createRun(opts, globals) {
 }
 
 // src/lib/stderr-log.ts
-var import_node_fs19 = require("node:fs");
+var import_node_fs23 = require("node:fs");
 var TOKEN_RE2 = /verity_[0-9a-f]{16,}/g;
 var ANSI_RE = /\u001b\[[0-?]*[ -/]*[@-~]/g;
 function scrub(s) {
@@ -16728,9 +17387,9 @@ function append(text) {
   try {
     const dir = projectPath(DEBUG_LOG_DIR);
     const file = projectPath(STDERR_LOG_FILE);
-    (0, import_node_fs19.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs23.mkdirSync)(dir, { recursive: true });
     rotateIfNeeded(file);
-    (0, import_node_fs19.appendFileSync)(file, text);
+    (0, import_node_fs23.appendFileSync)(file, text);
   } catch {
   }
 }
@@ -16786,6 +17445,10 @@ function formatRunEvidence(run, startedAt) {
 `;
   out += row("turn", `${run.turnId || "(unminted)"}${run.sessionId ? ` \xB7 session ${run.sessionId}` : ""}`);
   out += row("reached", `${run.phaseReached || "(none)"}${run.skipReason ? ` \xB7 SKIPPED: ${run.skipReason}` : ""} \xB7 ${ms}ms`);
+  if (run.treeFrame) {
+    const f = run.treeFrame;
+    out += row("tree", f.worktreeRoot ? `${f.worktreeRoot}${f.isLinkedWorktree ? " \xB7 linked worktree" : ""}${f.branch ? ` \xB7 branch ${f.branch}` : " \xB7 detached"}` : `(unresolved: ${f.refusal ?? "unknown"})`);
+  }
   out += row("changed", `${run.changedUniverse.length} from git \xB7 analyzable ${run.analyzable.length} \xB7 reviewable ${run.reviewable.length} \xB7 security ${run.securityFiles.length} \xB7 forReview ${run.allForReview.length}`);
   const done = (phase) => run.phasesCompleted.includes(phase);
   const ifDone = (phase, value) => done(phase) ? value : "?";
@@ -16882,17 +17545,312 @@ function installRunEvidence(run) {
   });
 }
 
-// src/lib/reachability.ts
-function resolveReachability(input = {}) {
-  const env = input.env ?? {};
-  if (input.autonomousFlag === true) {
-    return { human_reachable: "no", human_reachable_source: "declared", rung: "flag" };
+// src/lib/git-frame.ts
+var import_node_child_process7 = require("node:child_process");
+var import_node_fs24 = require("node:fs");
+var import_node_os3 = require("node:os");
+var import_node_path18 = require("node:path");
+var import_node_path19 = require("node:path");
+var VALUE_TOKEN = `(?:'[^']*'|"[^"]*"|\\S+)`;
+var GIT_GLOBAL_OPTS = `(?:\\s+(?:-[Cc]\\s+${VALUE_TOKEN}|--?[\\w-]+(?:=\\S+)?))*`;
+var COMMIT_HEAD = `git${GIT_GLOBAL_OPTS}\\s+commit(?![\\w-])`;
+var PUSH_HEAD = `git${GIT_GLOBAL_OPTS}\\s+push\\b`;
+var GH_PR_HEAD = `gh${GIT_GLOBAL_OPTS}\\s+pr\\s+create\\b`;
+var COMMIT_RE = new RegExp(`(?:^|[\\s;&|(])${COMMIT_HEAD}|(?:^|[;&|(])\\s*[^\\s;&|()'"]*\\/${COMMIT_HEAD}`);
+var PUSH_RE = new RegExp(`(?:^|[\\s;&|(])${PUSH_HEAD}|(?:^|[;&|(])\\s*[^\\s;&|()'"]*\\/${PUSH_HEAD}`);
+var GH_PR_RE = new RegExp(`(?:^|[\\s;&|(])${GH_PR_HEAD}|(?:^|[;&|(])\\s*[^\\s;&|()'"]*\\/${GH_PR_HEAD}`);
+function splitSegments(command) {
+  return (command ?? "").split(/&&|\|\||;|\n/);
+}
+function findMomentSegment(command, on) {
+  const segments = splitSegments(command);
+  let commitIdx = -1;
+  let pushIdx = -1;
+  for (let i = 0; i < segments.length; i++) {
+    const seg = segments[i];
+    if (/--dry-run\b/.test(seg)) continue;
+    if (commitIdx === -1 && COMMIT_RE.test(seg)) commitIdx = i;
+    if (pushIdx === -1 && (PUSH_RE.test(seg) || GH_PR_RE.test(seg))) pushIdx = i;
   }
-  if (truthy(env.VERITY_AUTONOMOUS)) {
-    return { human_reachable: "no", human_reachable_source: "declared", rung: "env" };
+  if (commitIdx !== -1 && on.includes("commit")) return { moment: "pre-commit", segmentIndex: commitIdx };
+  if (pushIdx !== -1 && on.includes("push")) return { moment: "pre-push", segmentIndex: pushIdx };
+  return null;
+}
+function classifyCommand(command, on) {
+  return findMomentSegment(command, on)?.moment ?? null;
+}
+function unquote(token) {
+  if (token.length >= 2) {
+    const first = token[0];
+    if ((first === "'" || first === '"') && token.endsWith(first)) return token.slice(1, -1);
+  }
+  return token;
+}
+var SHELL_DYNAMIC = /[$`\\]/;
+function extractCommandTarget(command, segmentIndex, baseDir) {
+  const segments = splitSegments(command);
+  let dir = baseDir;
+  let named = false;
+  for (let i = 0; i < segmentIndex; i++) {
+    const m = segments[i].match(new RegExp(`^\\s*cd(?:\\s+(${VALUE_TOKEN}))?\\s*$`));
+    if (!m) continue;
+    named = true;
+    if (m[1] === void 0) {
+      dir = (0, import_node_os3.homedir)();
+      continue;
+    }
+    const raw = unquote(m[1]);
+    if (SHELL_DYNAMIC.test(raw) || raw === "-") {
+      return { dir: null, named: true, unresolvable: `cd target not statically resolvable: ${raw}` };
+    }
+    const expanded = raw === "~" ? (0, import_node_os3.homedir)() : raw.startsWith("~/") ? (0, import_node_path19.join)((0, import_node_os3.homedir)(), raw.slice(2)) : raw;
+    dir = (0, import_node_path18.isAbsolute)(expanded) ? expanded : (0, import_node_path18.resolve)(dir, expanded);
+  }
+  const seg = segments[segmentIndex];
+  const overrideMatch = /--(?:git-dir|work-tree)(?:=|\s)|\bGIT_(?:DIR|WORK_TREE|INDEX_FILE)=/.exec(seg);
+  if (overrideMatch) {
+    return { dir: null, named: true, unresolvable: `git-dir/work-tree/index override in command: ${overrideMatch[0].trim()}` };
+  }
+  const gitMatch = seg.match(new RegExp(`(?:^|[\\s;&|(])(?:[^\\s;&|()'"]*\\/)?git(${GIT_GLOBAL_OPTS})\\s`));
+  if (gitMatch) {
+    const optsRegion = gitMatch[1] ?? "";
+    const cRe = new RegExp(`-C\\s+(${VALUE_TOKEN})`, "g");
+    let cm;
+    while ((cm = cRe.exec(optsRegion)) !== null) {
+      named = true;
+      const raw = unquote(cm[1]);
+      if (SHELL_DYNAMIC.test(raw)) {
+        return { dir: null, named: true, unresolvable: `-C target not statically resolvable: ${raw}` };
+      }
+      const expanded = raw === "~" ? (0, import_node_os3.homedir)() : raw.startsWith("~/") ? (0, import_node_path19.join)((0, import_node_os3.homedir)(), raw.slice(2)) : raw;
+      dir = (0, import_node_path18.isAbsolute)(expanded) ? expanded : (0, import_node_path18.resolve)(dir, expanded);
+    }
+  }
+  return { dir, named, unresolvable: null };
+}
+var PUSH_VALUE_FLAGS = /* @__PURE__ */ new Set(["-o", "--push-option", "--receive-pack", "--exec"]);
+function parsePushTarget(segment) {
+  const none = { remote: null, srcRef: null, dstRef: null, isDelete: false };
+  const m = PUSH_RE.exec(segment);
+  if (!m) return none;
+  const rest = segment.slice(m.index + m[0].length);
+  const tokens = (rest.match(new RegExp(`'[^']*'|"[^"]*"|\\S+`, "g")) ?? []).map(unquote);
+  let remote = null;
+  let refspec = null;
+  let isDelete = false;
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t === "-d" || t === "--delete") {
+      isDelete = true;
+      continue;
+    }
+    if (t.startsWith("--repo=")) {
+      remote = t.slice("--repo=".length);
+      continue;
+    }
+    if (t === "--repo") {
+      remote = tokens[++i] ?? null;
+      continue;
+    }
+    if (PUSH_VALUE_FLAGS.has(t)) {
+      i++;
+      continue;
+    }
+    if (t.startsWith("-")) continue;
+    if (SHELL_DYNAMIC.test(t)) return none;
+    if (remote === null) {
+      remote = t;
+      continue;
+    }
+    if (refspec === null) {
+      refspec = t;
+      continue;
+    }
+    break;
   }
-  if (truthy(env.CI) || truthy(env.GITHUB_ACTIONS) || truthy(env.BUILDKITE) || truthy(env.JENKINS_URL)) {
-    return { human_reachable: "no", human_reachable_source: "declared", rung: "env" };
+  if (refspec === null) return { remote, srcRef: null, dstRef: null, isDelete };
+  const spec = refspec.startsWith("+") ? refspec.slice(1) : refspec;
+  const colon = spec.indexOf(":");
+  if (colon === -1) return { remote, srcRef: spec, dstRef: null, isDelete };
+  const src = spec.slice(0, colon);
+  const dst = spec.slice(colon + 1);
+  if (src === "") return { remote, srcRef: null, dstRef: dst || null, isDelete: true };
+  return { remote, srcRef: src, dstRef: dst || null, isDelete };
+}
+function gitAt(dir, args) {
+  try {
+    return (0, import_node_child_process7.execFileSync)("git", args, { cwd: dir, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+    return "";
+  }
+}
+function realpathOr(p) {
+  try {
+    return import_node_fs24.realpathSync.native(p);
+  } catch {
+    return (0, import_node_path18.resolve)(p);
+  }
+}
+function resolveFrame(input) {
+  const found = findMomentSegment(input.command, input.on);
+  const hookDirUsable = !!input.hookCwd && (0, import_node_fs24.existsSync)(input.hookCwd);
+  const baseDir = hookDirUsable ? input.hookCwd : process.cwd();
+  let anchor = hookDirUsable ? "hook-cwd" : "process-cwd";
+  const refuse = (refusal) => ({
+    moment: found?.moment ?? null,
+    frame: { worktreeRoot: null, gitDir: null, commonDir: null, isLinkedWorktree: false, branch: null, anchor, refusal }
+  });
+  let dir = baseDir;
+  if (found) {
+    const segments = splitSegments(input.command);
+    const kindRes = found.moment === "pre-commit" ? [COMMIT_RE] : [PUSH_RE, GH_PR_RE];
+    const dirs = /* @__PURE__ */ new Set();
+    for (let i = 0; i < segments.length; i++) {
+      if (/--dry-run\b/.test(segments[i])) continue;
+      if (!kindRes.some((re) => re.test(segments[i]))) continue;
+      const target = extractCommandTarget(input.command, i, baseDir);
+      if (target.named) anchor = "command-target";
+      if (target.unresolvable) return refuse(`target:${target.unresolvable}`);
+      dirs.add(target.dir ?? baseDir);
+    }
+    if (dirs.size > 1) return refuse(`target:multiple ${found.moment} targets in one command`);
+    const targetDir = dirs.size === 1 ? [...dirs][0] : baseDir;
+    if (targetDir !== baseDir) {
+      if (!(0, import_node_fs24.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
+      dir = targetDir;
+    }
+  }
+  const toplevel = gitAt(dir, ["rev-parse", "--show-toplevel"]);
+  if (!toplevel) {
+    return refuse(anchor === "command-target" ? `target:not a git repository: ${dir}` : `anchor:not a git repository: ${dir}`);
+  }
+  const gitDirRaw = gitAt(dir, ["rev-parse", "--absolute-git-dir"]);
+  const commonRaw = gitAt(dir, ["rev-parse", "--git-common-dir"]);
+  const gitDir = gitDirRaw ? realpathOr(gitDirRaw) : null;
+  const commonDir = commonRaw ? realpathOr((0, import_node_path18.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path18.resolve)(dir, commonRaw)) : null;
+  const branchRaw = gitAt(dir, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  return {
+    moment: found?.moment ?? null,
+    frame: {
+      worktreeRoot: realpathOr(toplevel),
+      gitDir,
+      commonDir,
+      // The one honest definition: a linked worktree's own git dir differs from
+      // the shared one. No path convention involved — see the header.
+      isLinkedWorktree: !!gitDir && !!commonDir && gitDir !== commonDir,
+      branch: !branchRaw || branchRaw === "HEAD" ? null : branchRaw,
+      anchor,
+      refusal: null
+    }
+  };
+}
+function frameGit(frame, args) {
+  if (!frame.worktreeRoot) return "";
+  return gitAt(frame.worktreeRoot, args);
+}
+function refResolves(frame, ref) {
+  return frameGit(frame, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]) !== "";
+}
+var SHA_RE2 = /^[0-9a-f]{40}$/;
+function baselineShaAt(frame) {
+  if (!frame.worktreeRoot) return null;
+  try {
+    const sha = (0, import_node_fs24.readFileSync)((0, import_node_path19.join)(frame.worktreeRoot, BASELINE_SHA_FILE), "utf-8").trim();
+    if (!SHA_RE2.test(sha)) return null;
+    return refResolves(frame, sha) ? sha : null;
+  } catch {
+    return null;
+  }
+}
+function stagedRange() {
+  return { kind: "staged", base: "HEAD", head: "INDEX", via: "index" };
+}
+function resolvePushRange(frame, command, on) {
+  const nothing = (via) => ({ kind: "nothing", base: null, head: "HEAD", via });
+  if (!frame.worktreeRoot) return nothing("refused");
+  const found = findMomentSegment(command, on);
+  const segment = found ? splitSegments(command)[found.segmentIndex] : "";
+  const target = parsePushTarget(segment);
+  if (target.isDelete) return nothing("deletion");
+  const head = target.srcRef ?? "HEAD";
+  if (!refResolves(frame, head)) return nothing(`src-unresolvable:${head}`);
+  const srcName = target.srcRef;
+  const branchForRemote = srcName ?? frame.branch;
+  const candidates = [];
+  if (target.remote && (target.dstRef ?? srcName)) {
+    const dstName = (target.dstRef ?? srcName).replace(/^refs\/heads\//, "");
+    candidates.push({ ref: `refs/remotes/${target.remote}/${dstName}`, via: `refspec:${target.remote}/${dstName}` });
+  }
+  if (target.remote && !srcName && !target.dstRef && frame.branch) {
+    candidates.push({ ref: `refs/remotes/${target.remote}/${frame.branch}`, via: `remote:${target.remote}/${frame.branch}` });
+  }
+  candidates.push({ ref: srcName ? `${srcName}@{push}` : "@{push}", via: "@{push}" });
+  candidates.push({ ref: srcName ? `${srcName}@{upstream}` : "@{upstream}", via: "@{upstream}" });
+  if (branchForRemote) {
+    candidates.push({
+      ref: `refs/remotes/origin/${branchForRemote.replace(/^refs\/heads\//, "")}`,
+      via: `origin/${branchForRemote.replace(/^refs\/heads\//, "")}`
+    });
+  }
+  for (const c of candidates) {
+    if (!refResolves(frame, c.ref)) continue;
+    const mergeBase = frameGit(frame, ["merge-base", c.ref, head]);
+    if (SHA_RE2.test(mergeBase)) return { kind: "push", base: mergeBase, head, via: c.via };
+  }
+  const baseline = baselineShaAt(frame);
+  if (baseline) return { kind: "baseline", base: baseline, head, via: "review-baseline" };
+  if (refResolves(frame, `${head}~1`)) return { kind: "last-commit", base: `${head}~1`, head, via: `${head}~1` };
+  return nothing("no-parent");
+}
+function rangeFiles(frame, range) {
+  let out;
+  switch (range.kind) {
+    case "staged":
+      out = frameGit(frame, ["diff", "--cached", "--name-only"]);
+      break;
+    case "push":
+    case "baseline":
+    case "last-commit":
+      out = frameGit(frame, ["diff", "--name-only", range.base, range.head === "INDEX" ? "HEAD" : range.head]);
+      break;
+    case "nothing":
+      return [];
+  }
+  return out.split("\n").filter((l) => l.length > 0).filter((f) => !isVerityOwnedPath(f));
+}
+function rangeMessages(frame, range) {
+  if (range.kind === "staged" || range.kind === "nothing" || !range.base) return "";
+  return frameGit(frame, ["log", `${range.base}..${range.head === "INDEX" ? "HEAD" : range.head}`, "--format=%B%x00"]).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
+}
+function frameTelemetry(frame, range, divergence) {
+  const t = {
+    anchor: frame.anchor,
+    linked_worktree: frame.isLinkedWorktree,
+    range_via: range?.via ?? null,
+    refusal: frame.refusal
+  };
+  if (divergence) {
+    t.root_differs = !!frame.worktreeRoot && !!divergence.actualRoot && realpathOr(frame.worktreeRoot) !== realpathOr(divergence.actualRoot);
+    const a = [...divergence.actualFiles].sort().join("\n");
+    const b = [...divergence.frameFiles].sort().join("\n");
+    t.files_differ = a !== b;
+    t.frame_file_count = divergence.frameFiles.length;
+    t.actual_file_count = divergence.actualFiles.length;
+  }
+  return t;
+}
+
+// src/lib/reachability.ts
+function resolveReachability(input = {}) {
+  const env = input.env ?? {};
+  if (input.autonomousFlag === true) {
+    return { human_reachable: "no", human_reachable_source: "declared", rung: "flag" };
+  }
+  if (truthy(env.VERITY_AUTONOMOUS)) {
+    return { human_reachable: "no", human_reachable_source: "declared", rung: "env" };
+  }
+  if (truthy(env.CI) || truthy(env.GITHUB_ACTIONS) || truthy(env.BUILDKITE) || truthy(env.JENKINS_URL)) {
+    return { human_reachable: "no", human_reachable_source: "declared", rung: "env" };
   }
   if (truthy(env.VERITY_INTERACTIVE)) {
     return { human_reachable: "yes", human_reachable_source: "declared", rung: "env" };
@@ -16910,7 +17868,7 @@ function truthy(v) {
 }
 
 // src/lib/transcript.ts
-var import_node_fs20 = require("node:fs");
+var import_node_fs25 = require("node:fs");
 var MAX_READ_BYTES = 256 * 1024;
 var SMALL_FILE_BYTES = 64 * 1024;
 var MAX_FILES_LIST = 20;
@@ -16920,6 +17878,8 @@ var MAX_COMMAND_CHARS = 80;
 var MAX_TOOL_BLOCKS = 200;
 var MAX_SUMMARY_BYTES = 4096;
 var HOME = process.env.HOME ?? "";
+var BASH_INPUT_RE = /^\s*<bash-input>([\s\S]*?)<\/bash-input>/;
+var BASH_ECHO_RE = /^\s*<bash-(?:stdout|stderr)>/;
 async function extractActionSummary(transcriptPath) {
   try {
     const read = readTurnLines(transcriptPath);
@@ -16934,7 +17894,7 @@ async function extractActionSummary(transcriptPath) {
 function readTurnLines(transcriptPath) {
   let size;
   try {
-    size = (0, import_node_fs20.statSync)(transcriptPath).size;
+    size = (0, import_node_fs25.statSync)(transcriptPath).size;
   } catch {
     return null;
   }
@@ -16942,7 +17902,7 @@ function readTurnLines(transcriptPath) {
   let raw;
   let windowed = false;
   if (size <= SMALL_FILE_BYTES) {
-    raw = (0, import_node_fs20.readFileSync)(transcriptPath, "utf-8");
+    raw = (0, import_node_fs25.readFileSync)(transcriptPath, "utf-8");
   } else {
     windowed = true;
     const buf = Buffer.alloc(Math.min(MAX_READ_BYTES, size));
@@ -16983,7 +17943,7 @@ function isRealUserMessage(parsed) {
   const message = parsed.message;
   if (!message) return false;
   const content = message.content;
-  if (typeof content === "string") return true;
+  if (typeof content === "string") return !BASH_ECHO_RE.test(content);
   if (Array.isArray(content)) {
     return content.some((b) => {
       if (typeof b !== "object" || b === null) return false;
@@ -16998,6 +17958,9 @@ function buildSummary(lines) {
   const filesEdited = /* @__PURE__ */ new Set();
   const filesCreated = /* @__PURE__ */ new Set();
   const commands = [];
+  const userCommands = [];
+  let userCommandsTruncated = false;
+  let commandsTruncated = false;
   let searches = 0;
   let subagents = 0;
   let webFetches = 0;
@@ -17015,6 +17978,17 @@ function buildSummary(lines) {
     if (entry.type === "user" && !firstTimestamp) {
       firstTimestamp = entry.timestamp ?? null;
     }
+    if (entry.type === "user") {
+      const typed = userTypedCommands(entry);
+      if (typed.truncated) userCommandsTruncated = true;
+      for (const cmd of typed.commands) {
+        if (userCommands.length >= MAX_COMMANDS) {
+          userCommandsTruncated = true;
+          break;
+        }
+        userCommands.push(cmd);
+      }
+    }
     if (entry.type !== "assistant") continue;
     turnMessages++;
     lastTimestamp = entry.timestamp ?? lastTimestamp;
@@ -17027,7 +18001,10 @@ function buildSummary(lines) {
       totalToolCalls++;
       const toolName = block.name ?? "unknown";
       toolCounts[toolName] = (toolCounts[toolName] ?? 0) + 1;
-      if (totalToolCalls > MAX_TOOL_BLOCKS) continue;
+      if (totalToolCalls > MAX_TOOL_BLOCKS) {
+        if (toolName === "Bash") commandsTruncated = true;
+        continue;
+      }
       const input = block.input ?? {};
       switch (toolName) {
         case "Read":
@@ -17047,9 +18024,11 @@ function buildSummary(lines) {
           addPath(filesEdited, input.file_path);
           break;
         case "Bash": {
-          const cmd = sanitizeCommand(input.command);
-          if (cmd && commands.length < MAX_COMMANDS) {
-            commands.push(cmd);
+          const { cmd, lost } = sanitizeCommandWithLoss(input.command);
+          if (lost) commandsTruncated = true;
+          if (cmd) {
+            if (commands.length < MAX_COMMANDS) commands.push(cmd);
+            else commandsTruncated = true;
           }
           break;
         }
@@ -17092,6 +18071,9 @@ function buildSummary(lines) {
     ],
     searches,
     commands,
+    ...commandsTruncated ? { commands_truncated: true } : {},
+    user_commands: userCommands,
+    ...userCommandsTruncated ? { user_commands_truncated: true } : {},
     subagents,
     web_fetches: webFetches,
     total_tool_calls: totalToolCalls,
@@ -17100,6 +18082,9 @@ function buildSummary(lines) {
   };
   if (JSON.stringify(summary).length > MAX_SUMMARY_BYTES) {
     summary.commands = [];
+    summary.commands_truncated = true;
+    summary.user_commands = [];
+    summary.user_commands_truncated = true;
     if (JSON.stringify(summary).length > MAX_SUMMARY_BYTES) {
       summary.files_read = summary.files_read.slice(0, 10);
       summary.files_edited = summary.files_edited.slice(0, 10);
@@ -17117,12 +18102,38 @@ function addPath(set, rawPath) {
   if (p.length > 200) p = p.slice(0, 200);
   set.add(p);
 }
+function userTypedCommands(entry) {
+  const none = { commands: [], truncated: false };
+  const message = entry.message;
+  const content = message?.content;
+  if (typeof content !== "string") return none;
+  const m = BASH_INPUT_RE.exec(content);
+  if (!m) return none;
+  const commands = [];
+  let truncated = false;
+  for (const line of m[1].split("\n")) {
+    if (line.length > MAX_COMMAND_CHARS) truncated = true;
+    const cmd = sanitizeCommand(line);
+    if (cmd) commands.push(cmd);
+  }
+  return { commands, truncated };
+}
+function sanitizeCommandWithLoss(rawCmd) {
+  if (typeof rawCmd !== "string" || !rawCmd) return { cmd: null, lost: false };
+  const lines = rawCmd.split("\n");
+  const lost = lines.slice(1).some((l) => l.trim().length > 0);
+  const first = lines[0];
+  const cmd = sanitizeCommand(first);
+  const hadSeparator = SEPARATORS.some((sep2) => first.indexOf(sep2) > 0);
+  return { cmd, lost: lost || !hadSeparator && first.length > MAX_COMMAND_CHARS };
+}
+var SEPARATORS = [" | ", " > ", " >> ", " 2>", " && ", " ; "];
 function sanitizeCommand(rawCmd) {
   if (typeof rawCmd !== "string" || !rawCmd) return null;
   let cmd = rawCmd.split("\n")[0];
   let cut = -1;
   let marker = "";
-  for (const sep2 of [" | ", " > ", " >> ", " 2>", " && ", " ; "]) {
+  for (const sep2 of SEPARATORS) {
     const idx = cmd.indexOf(sep2);
     if (idx > 0 && (cut === -1 || idx < cut)) {
       cut = idx;
@@ -17150,28 +18161,28 @@ async function readStopHookStdin() {
   try {
     if (process.stdin.isTTY) return empty;
     const chunks = [];
-    const timeout = new Promise((resolve3) => setTimeout(() => resolve3(empty), 500));
-    const read = new Promise((resolve3) => {
+    const timeout = new Promise((resolve4) => setTimeout(() => resolve4(empty), 500));
+    const read = new Promise((resolve4) => {
       process.stdin.on("data", (chunk) => chunks.push(chunk));
       process.stdin.on("end", () => {
         const raw = Buffer.concat(chunks).toString("utf-8").trim();
         if (!raw) {
-          resolve3(empty);
+          resolve4(empty);
           return;
         }
         try {
           const data = JSON.parse(raw);
-          resolve3({
+          resolve4({
             assistantMessage: typeof data.last_assistant_message === "string" ? data.last_assistant_message : null,
             stopReason: typeof data.stop_reason === "string" ? data.stop_reason : null,
             transcriptPath: typeof data.transcript_path === "string" ? data.transcript_path : null,
             sessionId: typeof data.session_id === "string" ? data.session_id : null
           });
         } catch {
-          resolve3(empty);
+          resolve4(empty);
         }
       });
-      process.stdin.on("error", () => resolve3(empty));
+      process.stdin.on("error", () => resolve4(empty));
       process.stdin.resume();
     });
     return await Promise.race([read, timeout]);
@@ -17185,6 +18196,7 @@ async function bootstrap(run) {
     process.chdir(repoRoot());
   } catch {
   }
+  run.treeFrame = resolveFrame({ command: "", on: [], hookCwd: null }).frame;
   const turnId = `t-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
   let reachability = resolveReachability({
     autonomousFlag: process.env.VERITY_AUTONOMOUS === "1" || opts.mode === "autonomous",
@@ -17350,7 +18362,7 @@ function truncateToCap(text) {
 function buildHookOutput(gateDecision, systemMessage, agentContext) {
   return {
     gate_decision: gateDecision,
-    systemMessage,
+    ...systemMessage === null ? {} : { systemMessage },
     ...agentContext ? {
       hookSpecificOutput: {
         hookEventName: "Stop",
@@ -17371,7 +18383,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.30.0" : "dev";
+    return true ? "0.30.1-experimental.67b8921" : "dev";
   } catch {
     return "dev";
   }
@@ -17411,8 +18423,8 @@ async function sendSkipBeacon(ctx, reason) {
 }
 
 // src/lib/static-analysis.ts
-var import_node_child_process7 = require("node:child_process");
-var import_node_fs21 = require("node:fs");
+var import_node_child_process8 = require("node:child_process");
+var import_node_fs26 = require("node:fs");
 var SEVERITY_ORDER = {
   Error: 0,
   Critical: 0,
@@ -17424,7 +18436,7 @@ var SEVERITY_ORDER = {
 };
 function isCodacyAvailable() {
   try {
-    (0, import_node_child_process7.execSync)("which codacy-analysis", { stdio: "pipe" });
+    (0, import_node_child_process8.execSync)("which codacy-analysis", { stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -17460,13 +18472,13 @@ function runCodacyAnalysis(files) {
   if (files.length === 0) return empty;
   const existingFiles = files.filter((f) => {
     try {
-      return (0, import_node_fs21.existsSync)(f);
+      return (0, import_node_fs26.existsSync)(f);
     } catch {
       return false;
     }
   });
   if (existingFiles.length === 0) return empty;
-  const proc = (0, import_node_child_process7.spawnSync)("codacy-analysis", buildAnalyzerArgv(existingFiles), {
+  const proc = (0, import_node_child_process8.spawnSync)("codacy-analysis", buildAnalyzerArgv(existingFiles), {
     encoding: "utf-8",
     maxBuffer: 10 * 1024 * 1024
   });
@@ -17657,6 +18669,8 @@ async function passAndExit(run, reason, skip, kindOverride) {
     "verity-command",
     "bare-acknowledgment",
     "reflection-prompt",
+    "command-only-turn",
+    "declared-ignore",
     "skip-mode",
     "zero-increment",
     "debounce",
@@ -17675,10 +18689,12 @@ async function passAndExit(run, reason, skip, kindOverride) {
   }
   const AGENT_SILENT_SKIPS = /* @__PURE__ */ new Set([]);
   const agentNote = AGENT_SILENT_SKIPS.has(skip) ? null : note;
+  const HUMAN_SILENT_SKIPS = /* @__PURE__ */ new Set(["command-only-turn"]);
+  const humanNote = HUMAN_SILENT_SKIPS.has(skip) ? null : `Verity: ${reason}`;
   printJsonCompact(
     buildHookOutput(
       verdict,
-      `Verity: ${reason}`,
+      humanNote,
       // `additionalContext` is the agent's ONLY input. Writing only
       // `systemMessage` — the human's field — tells the agent nothing at all,
       // which is what sixteen of the nineteen terminating paths used to do.
@@ -17694,20 +18710,38 @@ async function scope(run) {
   const { files: allChanged, hasRecentCommitFiles } = getChangedFiles();
   run.changedUniverse = allChanged;
   const { kept: external } = partitionVerityOwned(allChanged);
-  const analyzable = filterAnalyzable(external);
-  const reviewable = filterReviewable(external);
-  const securityFiles = filterSecurity(external);
+  const verityIgnore = loadVerityIgnore();
+  const ignored = partitionIgnored(external, verityIgnore);
+  for (const problem of verityIgnore.problems) {
+    process.stderr.write(`Verity: .verityignore ${problem}
+`);
+  }
+  if (ignored.securityExcluded.length > 0) {
+    process.stderr.write(
+      `Verity: .verityignore excluded ${ignored.securityExcluded.length} security-sensitive file(s) from review this run: ${ignored.securityExcluded.slice(0, 5).join(", ")}. Add a \`!\` rule to keep them in scope.
+`
+    );
+  }
+  if (ignored.suspended) {
+    process.stderr.write(
+      "Verity: .verityignore changed this turn \u2014 its rules are suspended for this run, so nothing is excluded by them. They take effect once this turn has been reviewed.\n"
+    );
+  }
+  const inScope = ignored.kept;
+  const analyzable = filterAnalyzable(inScope);
+  const reviewable = filterReviewable(inScope);
+  const securityFiles = filterSecurity(inScope);
   const noFilesChanged = analyzable.length === 0 && reviewable.length === 0 && securityFiles.length === 0;
   if (noFilesChanged && !assistantResponse) {
     await passAndExit(run, "No analyzable files changed", "no-analyzable-files");
   }
   const allForReview = Array.from(/* @__PURE__ */ new Set([...analyzable, ...reviewable]));
-  Object.assign(run, { allChanged, allForReview, analyzable, hasRecentCommitFiles, noFilesChanged, reviewable, securityFiles });
+  Object.assign(run, { allChanged, allForReview, analyzable, hasRecentCommitFiles, noFilesChanged, reviewable, securityFiles, verityIgnored: ignored });
 }
 
 // src/lib/specs.ts
-var import_node_fs22 = require("node:fs");
-var import_node_path18 = require("node:path");
+var import_node_fs27 = require("node:fs");
+var import_node_path20 = require("node:path");
 var SPEC_CANDIDATES = [
   "CLAUDE.md",
   "AGENTS.md",
@@ -17738,16 +18772,16 @@ function discoverSpecs(consulted = []) {
     const totalCap = relevant ? MAX_TOTAL_SPEC_BYTES : UNCONSULTED_TOTAL_BYTES;
     if (totalBytes >= totalCap) return false;
     if (seen.has(specPath)) return true;
-    if (!(0, import_node_fs22.existsSync)(specPath)) return true;
+    if (!(0, import_node_fs27.existsSync)(specPath)) return true;
     seen.add(specPath);
     const remaining = totalCap - totalBytes;
     const fileCap = relevant ? MAX_SPEC_FILE_BYTES : UNCONSULTED_FILE_BYTES;
     const readBytes = Math.min(fileCap, remaining);
     try {
       const buf = Buffer.alloc(readBytes);
-      const fd = (0, import_node_fs22.openSync)(specPath, "r");
-      const bytesRead = (0, import_node_fs22.readSync)(fd, buf, 0, readBytes, 0);
-      (0, import_node_fs22.closeSync)(fd);
+      const fd = (0, import_node_fs27.openSync)(specPath, "r");
+      const bytesRead = (0, import_node_fs27.readSync)(fd, buf, 0, readBytes, 0);
+      (0, import_node_fs27.closeSync)(fd);
       const content = buf.slice(0, bytesRead).toString("utf-8");
       if (!content) return true;
       result.push({ path: specPath, content });
@@ -17763,7 +18797,7 @@ function discoverSpecs(consulted = []) {
     if (!addSpec(candidate)) break;
   }
   for (const dir of ["spec", "docs"]) {
-    if (!(0, import_node_fs22.existsSync)(dir)) continue;
+    if (!(0, import_node_fs27.existsSync)(dir)) continue;
     try {
       const mdFiles = findMdFiles(dir, 2).sort();
       for (const mdFile of mdFiles) {
@@ -17778,9 +18812,9 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   if (depth >= maxDepth) return [];
   const result = [];
   try {
-    const entries = (0, import_node_fs22.readdirSync)(dir, { withFileTypes: true });
+    const entries = (0, import_node_fs27.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = (0, import_node_path18.join)(dir, entry.name);
+      const fullPath = (0, import_node_path20.join)(dir, entry.name);
       if (entry.isFile() && entry.name.endsWith(".md")) {
         result.push(fullPath);
       } else if (entry.isDirectory() && depth < maxDepth - 1) {
@@ -17792,19 +18826,19 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   return result;
 }
 function discoverPlans() {
-  const homePlansDir = (0, import_node_path18.join)(process.env.HOME ?? "", ".claude", "plans");
+  const homePlansDir = (0, import_node_path20.join)(process.env.HOME ?? "", ".claude", "plans");
   const localPlansDir = ".claude/plans";
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
   for (const plansDir of [localPlansDir, homePlansDir]) {
-    if (!(0, import_node_fs22.existsSync)(plansDir)) continue;
+    if (!(0, import_node_fs27.existsSync)(plansDir)) continue;
     try {
-      for (const f of (0, import_node_fs22.readdirSync)(plansDir)) {
+      for (const f of (0, import_node_fs27.readdirSync)(plansDir)) {
         if (!f.endsWith(".md") || seen.has(f)) continue;
         seen.add(f);
-        const fullPath = (0, import_node_path18.join)(plansDir, f);
+        const fullPath = (0, import_node_path20.join)(plansDir, f);
         try {
-          const stat3 = (0, import_node_fs22.statSync)(fullPath);
+          const stat3 = (0, import_node_fs27.statSync)(fullPath);
           candidates.push({ name: f, path: fullPath, mtime: stat3.mtimeMs, size: stat3.size });
         } catch {
         }
@@ -17817,7 +18851,7 @@ function discoverPlans() {
   for (const entry of candidates.slice(0, MAX_PLAN_FILES)) {
     if (entry.size > MAX_PLAN_FILE_BYTES) continue;
     try {
-      const content = (0, import_node_fs22.readFileSync)(entry.path, "utf-8");
+      const content = (0, import_node_fs27.readFileSync)(entry.path, "utf-8");
       result.push({ name: entry.name, content });
     } catch {
     }
@@ -17828,6 +18862,59 @@ function discoverPlans() {
 // src/commands/analyze/phases/03-intent-inputs.ts
 async function intentInputs(run) {
   const { actionSummary, allForReview, assistantResponse, baseline, baselineSessionId } = run;
+  if (isCommandOnlyTurn({
+    userCommands: actionSummary?.user_commands,
+    userCommandsTruncated: actionSummary?.user_commands_truncated,
+    agentAuthoredFiles: (actionSummary?.files_edited.length ?? 0) + (actionSummary?.files_created.length ?? 0),
+    agentToolCalls: actionSummary?.total_tool_calls ?? 0,
+    authorshipIsObservable: !!actionSummary && actionSummary.transcript_windowed !== "orphaned"
+  })) {
+    await passAndExit(run, "User command only \u2014 skipping analysis", "command-only-turn");
+  }
+  {
+    const ignoreKeys = ignoreStateKeys(
+      run.tokenResult.ok ? run.tokenResult.data.token : void 0,
+      null
+    );
+    const found = resolveIgnoreState([baselineSessionId, ...ignoreKeys]);
+    const declaration = resolveActive(found?.state ?? null, Math.floor(Date.now() / 1e3));
+    if (declaration) {
+      const commandRecordTruncated = actionSummary?.commands_truncated === true || actionSummary?.user_commands_truncated === true || // The derived signal, and the only one an older client's summary can
+      // give: `tool_counts` keeps counting Bash calls past every cap that
+      // stops the list growing, so a mismatch IS a loss. See
+      // `ActionSummary.commands_truncated`.
+      (actionSummary?.tool_counts?.Bash ?? 0) > (actionSummary?.commands?.length ?? 0);
+      const outcome = verifyDeclaration({
+        declaration,
+        agentAuthoredFiles: (actionSummary?.files_edited.length ?? 0) + (actionSummary?.files_created.length ?? 0),
+        subagents: actionSummary?.subagents ?? 0,
+        agentCommands: actionSummary?.commands,
+        userCommands: actionSummary?.user_commands,
+        commandRecordTruncated,
+        authorshipIsObservable: !!actionSummary && actionSummary.transcript_windowed !== "orphaned"
+      });
+      if (outcome.honoured) {
+        if (declaration.scope === "turn" && found) clearActiveDeclaration(found.key);
+        logEvent("ignore_honoured", { scope: declaration.scope, origin: declaration.origin });
+        await passAndExit(
+          run,
+          `skipping this turn \u2014 declared housekeeping ("${declaration.reason}")`,
+          "declared-ignore"
+        );
+      } else if (outcome.void) {
+        if (found) clearActiveDeclaration(found.key);
+        logEvent("ignore_voided", {
+          scope: declaration.scope,
+          origin: declaration.origin,
+          why: outcome.why
+        });
+        const notice = `Verity: the ignore declared for this window ("${declaration.reason}") was voided \u2014 ${outcome.why}. Reviewing normally.`;
+        process.stderr.write(`${notice}
+`);
+        run.voidedIgnoreNotice = notice;
+      }
+    }
+  }
   const conversation = await readAndClearConversationBuffer(baselineSessionId);
   const specs = discoverSpecs(actionSummary?.files_read ?? []);
   const plans = discoverPlans();
@@ -17868,156 +18955,6 @@ async function connect(run) {
   Object.assign(run, { urlResult, serviceUrl: urlResult.data, token: tokenResult.data.token });
 }
 
-// src/lib/analysis-mode.ts
-var DEBUG_PHRASES = [
-  "not working",
-  "doesn't work",
-  "doesn't work",
-  "does not work",
-  "isn't working",
-  "is not working",
-  "can't figure out",
-  "stack trace"
-];
-var DEBUG_WORDS = [
-  "fix",
-  "bug",
-  "broken",
-  "crash",
-  "crashing",
-  "failing",
-  "debug",
-  "debugging",
-  "investigate",
-  "troubleshoot",
-  "regression",
-  "wrong"
-];
-var DEBUG_PATTERN = new RegExp(
-  [
-    ...DEBUG_PHRASES.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")),
-    ...DEBUG_WORDS.map((w) => `\\b${w}\\b`)
-  ].join("|"),
-  "i"
-);
-var FALSE_POSITIVE_PATTERNS = [
-  /\b(?:add|create|implement|write|build|design|set\s*up)\b.{0,20}\berror\b/i,
-  /\berror\s+handling\b/i,
-  /\berror\s+boundar(?:y|ies)\b/i,
-  /\berror\s+(?:type|class|page|component|message|code|enum)\b/i,
-  /\b(?:add|create|implement|write|build)\b.{0,20}\b(?:fix|debug|issue)\b/i
-];
-function hasDebugIntent(prompt) {
-  if (!DEBUG_PATTERN.test(prompt)) return false;
-  for (const fp of FALSE_POSITIVE_PATTERNS) {
-    if (fp.test(prompt)) return false;
-  }
-  return true;
-}
-var GIT_ONLY_PATTERN = /\b(commit|push|deploy|merge|rebase|tag|release|publish|ship)\b/i;
-var CODE_AUTHORING_PATTERN = /\b(add|create|implement|build|write|fix|update|change|refactor|modify|remove|delete|move|rename)\b.*\b(function|component|feature|endpoint|test|file|module|class|type|interface|hook|page|route|style|migration|code|bug|error|issue)\b/i;
-function isGitOnlyPrompt(prompt) {
-  if (!GIT_ONLY_PATTERN.test(prompt)) return false;
-  if (CODE_AUTHORING_PATTERN.test(prompt)) return false;
-  return true;
-}
-function reconcileAnalysisMode(predictedMode, signals) {
-  const mode2 = resolveAnalysisMode(predictedMode, signals);
-  if (mode2 !== "skip") return mode2;
-  const windowIsOrphaned = signals.actionSummary?.transcript_windowed === "orphaned";
-  if (windowIsOrphaned && !signals.sessionAuthoredCode) return "standard";
-  return mode2;
-}
-function resolveAnalysisMode(predictedMode, signals) {
-  if (!predictedMode || !isValidMode(predictedMode)) {
-    return detectAnalysisMode(
-      signals.noFilesChanged,
-      signals.assistantResponse,
-      signals.conversationPrompts,
-      signals.actionSummary,
-      signals.sessionAuthoredCode
-    );
-  }
-  const agentAuthoredCode = !!(signals.actionSummary && (signals.actionSummary.files_edited.length > 0 || signals.actionSummary.files_created.length > 0)) || !!signals.sessionAuthoredCode;
-  const agentInvestigated = didAgentInvestigate(signals.actionSummary);
-  switch (predictedMode) {
-    case "skip":
-      if (agentAuthoredCode) return "standard";
-      return "skip";
-    case "plan":
-      if (agentAuthoredCode) return "standard";
-      return "plan";
-    case "debug":
-      return "debug";
-    case "standard":
-      if (!!signals.actionSummary && !agentAuthoredCode && !!signals.assistantResponse) {
-        return agentInvestigated ? "plan" : "skip";
-      }
-      return "standard";
-  }
-}
-function didAgentInvestigate(summary) {
-  if (!summary) return false;
-  return summary.files_read.length > 0 || summary.searches > 0 || summary.commands.length > 0 || summary.subagents > 0 || summary.web_fetches > 0;
-}
-function isValidMode(mode2) {
-  return mode2 === "standard" || mode2 === "plan" || mode2 === "debug" || mode2 === "skip";
-}
-function detectAnalysisMode(noFilesChanged, assistantResponse, conversationPrompts, actionSummary, sessionAuthoredCode) {
-  const agentAuthoredCode = !!(actionSummary && (actionSummary.files_edited.length > 0 || actionSummary.files_created.length > 0)) || !!sessionAuthoredCode;
-  if (conversationPrompts.length > 0 && conversationPrompts.every(isGitOnlyPrompt)) {
-    if (!agentAuthoredCode) return "skip";
-  }
-  if (noFilesChanged && !!assistantResponse && !agentAuthoredCode) {
-    return "plan";
-  }
-  if (!!actionSummary && !agentAuthoredCode && !!assistantResponse) {
-    return didAgentInvestigate(actionSummary) ? "plan" : "skip";
-  }
-  for (const prompt of conversationPrompts) {
-    if (hasDebugIntent(prompt)) {
-      return "debug";
-    }
-  }
-  return "standard";
-}
-var FILE_MUTATE_RE = /(?:^|[\s|&;(`])(?:sed\s+-i|perl\s+-i|awk\b|tee\b|dd\b|cp\b|mv\b|ln\b|install\b|touch\b|patch\b|git\s+(?:apply|am)\b|cargo\s+build|go\s+generate|make\b|--write\b|--fix\b|--in-place\b)|>>?(?![&>])/i;
-var GIT_PLUMBING_RE = /^\s*git\s+(?:merge|rebase|stash|cherry-pick|revert|pull|fetch|checkout|switch|reset|restore|clean)\b/i;
-var READ_ONLY_RE = /^\s*(?:git\s+(?:status|diff|log|show|branch|remote|config|rev-parse|ls-files|blame|describe)|ls|cat|head|tail|less|grep|rg|find|pwd|echo|printf|wc|which|type|tree|stat|file|env|printenv|date|whoami)\b/i;
-var CHAIN_RE = /&&|\||;|\$\(|\x60/;
-function hasNonEditAuthorship(actionSummary, sessionAuthoredCode) {
-  if (!actionSummary) return sessionAuthoredCode;
-  if ((actionSummary.subagents ?? 0) > 0) return true;
-  if (Object.keys(actionSummary.tool_counts ?? {}).some((t) => t.startsWith("mcp__"))) return true;
-  const commands = actionSummary.commands ?? [];
-  if (commands.some((c) => FILE_MUTATE_RE.test(c))) return true;
-  if (sessionAuthoredCode) {
-    const allSafe = commands.length > 0 && commands.every(
-      (c) => !CHAIN_RE.test(c) && (GIT_PLUMBING_RE.test(c) || READ_ONLY_RE.test(c))
-    );
-    if (!allSafe) return true;
-  }
-  return false;
-}
-function scopeToAuthored(files, actionSummary) {
-  if (!actionSummary) return { files, signal: "no-transcript" };
-  const touched = [...actionSummary.files_edited ?? [], ...actionSummary.files_created ?? []];
-  if (touched.length === 0) return { files: [], signal: "none-authored" };
-  return { files: narrowToAgentAuthored(files, actionSummary), signal: "authored" };
-}
-function narrowToAgentAuthored(files, actionSummary) {
-  if (!actionSummary) return files;
-  const touched = [
-    ...actionSummary.files_edited,
-    ...actionSummary.files_created
-  ];
-  if (touched.length === 0) return files;
-  return files.filter((f) => {
-    const suffix = "/" + f;
-    return touched.some((t) => t === f || t.endsWith(suffix));
-  });
-}
-
 // src/commands/analyze/phases/05-mode.ts
 async function mode(run) {
   const { opts, globals } = run;
@@ -18038,231 +18975,62 @@ async function mode(run) {
     });
     if (memoryResult.ok) {
       if (Array.isArray(memoryResult.data.context_files)) {
-        contextFilePaths = memoryResult.data.context_files;
-      }
-      const rawMode = memoryResult.data.predicted_mode;
-      if (rawMode && ["standard", "plan", "debug", "skip"].includes(rawMode)) {
-        predictedMode = rawMode;
-      }
-    }
-  } catch {
-    logEvent("memory_fetch_failed", { reason: "exception" });
-  }
-  const conversationPrompts = (conversation?.prompts ?? []).map((p) => p.prompt);
-  let analysisMode;
-  const sessionAuthoredCode = !!baseline && allForReview.some((f) => changedSinceBaseline(f, baseline));
-  const modeOverride = opts.mode;
-  const forced = !!modeOverride && ["standard", "plan", "debug", "skip"].includes(modeOverride);
-  if (forced) {
-    analysisMode = modeOverride;
-  } else {
-    analysisMode = reconcileAnalysisMode(
-      predictedMode,
-      { noFilesChanged, assistantResponse, actionSummary, conversationPrompts, sessionAuthoredCode }
-    );
-  }
-  const investigated = didAgentInvestigate(actionSummary);
-  run.modeDecision = {
-    predicted: predictedMode ?? null,
-    resolved: analysisMode,
-    authored: turnAuthoredCode,
-    investigated,
-    forced
-  };
-  logEvent("mode_resolved", {
-    predicted: predictedMode ?? null,
-    resolved: analysisMode,
-    forced,
-    authored: turnAuthoredCode,
-    investigated,
-    // The two counters that decide `investigated`, so a false reading is
-    // traceable to the tool that was not recognised.
-    subagents: actionSummary?.subagents ?? null,
-    files_read: actionSummary?.files_read.length ?? null
-  });
-  if (analysisMode === "skip") {
-    await passAndExit(
-      run,
-      "Skip mode \u2014 no code work to analyze",
-      "skip-mode",
-      turnAuthoredCode ? "capacity" : void 0
-    );
-  }
-  Object.assign(run, { analysisMode, contextFilePaths, sessionAuthoredCode, sessionIdForMemory });
-}
-
-// src/lib/debounce.ts
-var import_node_fs23 = require("node:fs");
-var import_node_crypto10 = require("node:crypto");
-function scopedFile(base, sessionId) {
-  if (!sessionId) return base;
-  return `${base}.${(0, import_node_crypto10.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
-}
-function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
-  const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs23.existsSync)(file)) return null;
-  try {
-    const lastTs = parseInt((0, import_node_fs23.readFileSync)(file, "utf-8").trim(), 10);
-    const nowTs = Math.floor(Date.now() / 1e3);
-    const elapsed = nowTs - lastTs;
-    if (elapsed < debounceSeconds) {
-      return `Debounced \u2014 last analysis was ${elapsed}s ago`;
-    }
-  } catch {
-  }
-  return null;
-}
-function checkMtime(files, bypassForRecentCommits, sessionId) {
-  if (bypassForRecentCommits) return null;
-  const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs23.existsSync)(file)) return null;
-  let debounceTime;
-  try {
-    debounceTime = (0, import_node_fs23.statSync)(file).mtimeMs;
-  } catch {
-    return null;
-  }
-  for (const f of files) {
-    const resolved = resolveFile(f);
-    if (!resolved) continue;
-    try {
-      const stat3 = (0, import_node_fs23.statSync)(resolved);
-      if (stat3.mtimeMs > debounceTime) {
-        return null;
-      }
-    } catch {
-      continue;
-    }
-  }
-  return "No files modified since last analysis";
-}
-function computeContentHash(files) {
-  const hash = (0, import_node_crypto10.createHash)("sha1");
-  const sorted = [...files].sort();
-  for (const f of sorted) {
-    const resolved = resolveFile(f) ?? f;
-    try {
-      if ((0, import_node_fs23.existsSync)(resolved)) {
-        hash.update((0, import_node_fs23.readFileSync)(resolved));
+        contextFilePaths = memoryResult.data.context_files;
       }
-    } catch {
-    }
-  }
-  return hash.digest("hex");
-}
-function checkContentHash(files, sessionId) {
-  const hash = computeContentHash(files);
-  const file = scopedFile(HASH_FILE, sessionId);
-  if ((0, import_node_fs23.existsSync)(file)) {
-    try {
-      const storedHash = (0, import_node_fs23.readFileSync)(file, "utf-8").trim();
-      if (hash === storedHash) {
-        return { skip: "No source changes since last analysis", hash };
+      const rawMode = memoryResult.data.predicted_mode;
+      if (rawMode && ["standard", "plan", "debug", "skip"].includes(rawMode)) {
+        predictedMode = rawMode;
       }
-    } catch {
     }
-  }
-  return { skip: null, hash };
-}
-function recordAnalysisStart(sessionId) {
-  (0, import_node_fs23.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs23.writeFileSync)(scopedFile(DEBOUNCE_FILE, sessionId), String(Math.floor(Date.now() / 1e3)));
-}
-function recordPassHash(hash, sessionId) {
-  (0, import_node_fs23.writeFileSync)(scopedFile(HASH_FILE, sessionId), hash);
-}
-function narrowToRecent(files, sessionId) {
-  const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs23.existsSync)(file)) return files;
-  let debounceTime;
-  try {
-    debounceTime = (0, import_node_fs23.statSync)(file).mtimeMs;
   } catch {
-    return files;
+    logEvent("memory_fetch_failed", { reason: "exception" });
   }
-  const recent = files.filter((f) => {
-    try {
-      return (0, import_node_fs23.existsSync)(f) && (0, import_node_fs23.statSync)(f).mtimeMs > debounceTime;
-    } catch {
-      return false;
-    }
-  });
-  return recent.length > 0 ? recent : files;
-}
-function readIteration(currentCommit, _contentHash) {
-  return Math.max(1, readBlockState(currentCommit).attempts);
-}
-var NO_BLOCKS = { attempts: 0, blocks: 0, fingerprint: null };
-function readBlockState(currentCommit, opts) {
-  if (opts?.newUserPrompt) return NO_BLOCKS;
-  if (!(0, import_node_fs23.existsSync)(ITERATION_FILE)) return NO_BLOCKS;
-  try {
-    const stored = (0, import_node_fs23.readFileSync)(ITERATION_FILE, "utf-8").trim();
-    const parsed = stored.startsWith("{") ? parseJsonState(stored) : parseLegacyState(stored);
-    if (!parsed) return NO_BLOCKS;
-    if (parsed.commit !== currentCommit) return NO_BLOCKS;
-    if (parsed.ts > 0 && Math.floor(Date.now() / 1e3) - parsed.ts > 600) return NO_BLOCKS;
-    return { attempts: parsed.attempts, blocks: parsed.blocks, fingerprint: parsed.fingerprint };
-  } catch {
-    return NO_BLOCKS;
+  const conversationPrompts = (conversation?.prompts ?? []).map((p) => p.prompt);
+  let analysisMode;
+  const sessionAuthoredCode = !!baseline && allForReview.some((f) => changedSinceBaseline(f, baseline));
+  const modeOverride = opts.mode;
+  const forced = !!modeOverride && ["standard", "plan", "debug", "skip"].includes(modeOverride);
+  if (forced) {
+    analysisMode = modeOverride;
+  } else {
+    analysisMode = reconcileAnalysisMode(
+      predictedMode,
+      { noFilesChanged, assistantResponse, actionSummary, conversationPrompts, sessionAuthoredCode }
+    );
   }
-}
-function parseJsonState(raw) {
-  const o = JSON.parse(raw);
-  const attempts = typeof o.attempts === "number" ? o.attempts : NaN;
-  if (isNaN(attempts)) return null;
-  return {
-    attempts,
-    blocks: typeof o.blocks === "number" ? o.blocks : attempts,
-    fingerprint: typeof o.fingerprint === "string" && o.fingerprint ? o.fingerprint : null,
-    commit: typeof o.commit === "string" ? o.commit : "",
-    ts: typeof o.ts === "number" ? o.ts : 0
-  };
-}
-function parseLegacyState(raw) {
-  const parts = raw.split(":");
-  const n = parseInt(parts[0], 10);
-  if (isNaN(n)) return null;
-  return {
-    attempts: n,
-    // The old file has no separate block count; the old counter is the closest
-    // honest answer, and it errs toward releasing sooner rather than later.
-    blocks: n,
-    fingerprint: parts.slice(3).join(":") || null,
-    commit: parts[1] ?? "",
-    ts: parseInt(parts[2] ?? "0", 10)
+  const investigated = didAgentInvestigate(actionSummary);
+  run.modeDecision = {
+    predicted: predictedMode ?? null,
+    resolved: analysisMode,
+    authored: turnAuthoredCode,
+    investigated,
+    forced
   };
-}
-function findingsFingerprint(findings) {
-  const keys = findings.map((f) => `${String(f.pattern_id ?? "?")}|${String(f.file ?? "?")}`).filter((k) => k !== "?|?");
-  return [...new Set(keys)].sort().join(",");
-}
-function isSameProblem(previous, current) {
-  if (!previous || !current) return false;
-  const prev = new Set(previous.split(","));
-  return current.split(",").some((k) => prev.has(k));
-}
-function writeBlockState(commit, state) {
-  (0, import_node_fs23.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs23.writeFileSync)(
-    ITERATION_FILE,
-    JSON.stringify({
-      v: 2,
-      attempts: state.attempts,
-      blocks: state.blocks,
-      commit,
-      ts: Math.floor(Date.now() / 1e3),
-      fingerprint: state.fingerprint ?? void 0
-    })
-  );
-}
-function resetBlockState(commit) {
-  writeBlockState(commit, { attempts: 0, blocks: 0, fingerprint: null });
+  logEvent("mode_resolved", {
+    predicted: predictedMode ?? null,
+    resolved: analysisMode,
+    forced,
+    authored: turnAuthoredCode,
+    investigated,
+    // The two counters that decide `investigated`, so a false reading is
+    // traceable to the tool that was not recognised.
+    subagents: actionSummary?.subagents ?? null,
+    files_read: actionSummary?.files_read.length ?? null
+  });
+  if (analysisMode === "skip") {
+    await passAndExit(
+      run,
+      "Skip mode \u2014 no code work to analyze",
+      "skip-mode",
+      turnAuthoredCode ? "capacity" : void 0
+    );
+  }
+  Object.assign(run, { analysisMode, contextFilePaths, sessionAuthoredCode, sessionIdForMemory });
 }
 
 // src/lib/fold.ts
-var import_node_fs24 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_fs28 = require("node:fs");
+var import_node_path21 = require("node:path");
 var KNOWN_RECORD_TYPES = /* @__PURE__ */ new Set([
   "user",
   "assistant",
@@ -18300,7 +19068,7 @@ var COMMAND_CLASSES = [
   [/\btsc\b|\bmypy\b|\btypecheck\b/, "typecheck"],
   [/^git\s/, "git"]
 ];
-function classifyCommand(cmd) {
+function classifyCommand2(cmd) {
   for (const [re, cls] of COMMAND_CLASSES) if (re.test(cmd)) return cls;
   return "other";
 }
@@ -18399,7 +19167,7 @@ function candidateRoots(repoRoot2) {
   const norm = repoRoot2.replace(/\\/g, "/").replace(/\/+$/, "");
   const out = [norm];
   try {
-    const real = import_node_fs24.realpathSync.native(norm).replace(/\\/g, "/").replace(/\/+$/, "");
+    const real = import_node_fs28.realpathSync.native(norm).replace(/\\/g, "/").replace(/\/+$/, "");
     if (real !== norm) out.push(real);
   } catch {
   }
@@ -18487,31 +19255,31 @@ function fold(transcriptPath, opts = {}) {
     }
   };
   try {
-    if (!(0, import_node_fs24.existsSync)(transcriptPath)) return result;
-    ingest((0, import_node_fs24.readFileSync)(transcriptPath, "utf8"), "agent");
+    if (!(0, import_node_fs28.existsSync)(transcriptPath)) return result;
+    ingest((0, import_node_fs28.readFileSync)(transcriptPath, "utf8"), "agent");
     result.coverage.complete = true;
   } catch {
     return result;
   }
   try {
-    const sidecarDir = (0, import_node_path19.join)(
-      (0, import_node_path19.dirname)(transcriptPath),
-      (0, import_node_path19.basename)(transcriptPath).replace(/\.jsonl$/, ""),
+    const sidecarDir = (0, import_node_path21.join)(
+      (0, import_node_path21.dirname)(transcriptPath),
+      (0, import_node_path21.basename)(transcriptPath).replace(/\.jsonl$/, ""),
       "subagents"
     );
-    if ((0, import_node_fs24.existsSync)(sidecarDir)) {
+    if ((0, import_node_fs28.existsSync)(sidecarDir)) {
       const maxFiles = opts.maxSidecars ?? 200;
       const maxBytes = opts.maxSidecarBytes ?? 16 * 1024 * 1024;
       const found = [];
       const walk = (d, depth) => {
         if (depth > 4) return;
-        for (const e of (0, import_node_fs24.readdirSync)(d, { withFileTypes: true })) {
-          const p = (0, import_node_path19.join)(d, e.name);
+        for (const e of (0, import_node_fs28.readdirSync)(d, { withFileTypes: true })) {
+          const p = (0, import_node_path21.join)(d, e.name);
           if (e.isDirectory()) {
             walk(p, depth + 1);
           } else if (e.name.startsWith("agent-") && e.name.endsWith(".jsonl")) {
             try {
-              const st = (0, import_node_fs24.statSync)(p);
+              const st = (0, import_node_fs28.statSync)(p);
               found.push({ path: p, size: st.size, mtimeMs: st.mtimeMs });
             } catch {
               result.coverage.malformed++;
@@ -18528,7 +19296,7 @@ function fold(transcriptPath, opts = {}) {
           continue;
         }
         try {
-          ingest((0, import_node_fs24.readFileSync)(f.path, "utf8"), "subagent");
+          ingest((0, import_node_fs28.readFileSync)(f.path, "utf8"), "subagent");
           bytes += f.size;
           result.coverage.subagentFiles++;
         } catch {
@@ -18563,7 +19331,7 @@ function fold(transcriptPath, opts = {}) {
 }
 function classifyUnobserved(path) {
   try {
-    const st = (0, import_node_fs24.statSync)(path);
+    const st = (0, import_node_fs28.statSync)(path);
     if (!st.isFile()) return "unreadable";
   } catch {
     return "unreadable";
@@ -18629,7 +19397,7 @@ function collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse
       if (name === "Bash") {
         const cmd = typeof input.command === "string" ? input.command : "";
         if (cmd) {
-          const cls = classifyCommand(cmd);
+          const cls = classifyCommand2(cmd);
           const prev = commandStats.get(cls) ?? { last_status: null, runs: 0, head: "" };
           commandStats.set(cls, {
             // UNKNOWN until this command's OWN result arrives. Inheriting the
@@ -18867,20 +19635,20 @@ async function evidence(run) {
 }
 
 // src/lib/cache-cleanup.ts
-var import_node_fs25 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_fs29 = require("node:fs");
+var import_node_path22 = require("node:path");
 var CACHE_TTL_DAYS = 7;
 function pruneStaleCache() {
   try {
     const dir = projectPath(CACHE_DIR);
     const cutoff = Date.now() - CACHE_TTL_DAYS * 24 * 3600 * 1e3;
-    for (const entry of (0, import_node_fs25.readdirSync)(dir)) {
+    for (const entry of (0, import_node_fs29.readdirSync)(dir)) {
       if (!entry.startsWith("pending-")) continue;
-      const path = (0, import_node_path20.join)(dir, entry);
+      const path = (0, import_node_path22.join)(dir, entry);
       try {
-        const stat3 = (0, import_node_fs25.statSync)(path);
+        const stat3 = (0, import_node_fs29.statSync)(path);
         if (stat3.mtimeMs < cutoff) {
-          (0, import_node_fs25.unlinkSync)(path);
+          (0, import_node_fs29.unlinkSync)(path);
           logEvent("cache_entry_pruned", {
             path: entry,
             age_days: Math.round((Date.now() - stat3.mtimeMs) / 864e5)
@@ -18894,7 +19662,7 @@ function pruneStaleCache() {
 }
 
 // src/lib/context-files.ts
-var import_node_fs26 = require("node:fs");
+var import_node_fs30 = require("node:fs");
 var MAX_CONTEXT_FILES = 10;
 var MAX_CONTEXT_FILE_BYTES = 10240;
 var MAX_CONTEXT_TOTAL_BYTES = 51200;
@@ -18915,7 +19683,7 @@ function gatherContextFiles(contextPaths, deltaFiles) {
       continue;
     }
     try {
-      const content = (0, import_node_fs26.readFileSync)(safePath, "utf8");
+      const content = (0, import_node_fs30.readFileSync)(safePath, "utf8");
       const bytes = Buffer.byteLength(content);
       if (bytes > MAX_CONTEXT_FILE_BYTES) {
         logEvent("context_file_skipped", { path: filePath, reason: "too_large", bytes });
@@ -18977,8 +19745,8 @@ async function contextFiles(run) {
 
 // src/lib/seed-runner.ts
 var import_promises11 = require("node:fs/promises");
-var import_node_fs27 = require("node:fs");
-var import_node_path21 = require("node:path");
+var import_node_fs31 = require("node:fs");
+var import_node_path23 = require("node:path");
 var import_yaml2 = __toESM(require_dist());
 
 // src/lib/seed.ts
@@ -19217,7 +19985,7 @@ function renderNodeMarkdown(candidate, nodeId, createdAt) {
   return fm;
 }
 async function runSeed(opts) {
-  if (!(0, import_node_fs27.existsSync)(STANDARD_FILE)) {
+  if (!(0, import_node_fs31.existsSync)(STANDARD_FILE)) {
     return { created: 0, failed: 0, skipped: "no_standard", candidates: [] };
   }
   let standardDoc;
@@ -19229,7 +19997,7 @@ async function runSeed(opts) {
   }
   const knowledgeSpec = standardDoc.knowledge_spec ?? {};
   let readmeContent;
-  if ((0, import_node_fs27.existsSync)("README.md")) {
+  if ((0, import_node_fs31.existsSync)("README.md")) {
     try {
       readmeContent = await (0, import_promises11.readFile)("README.md", "utf-8");
     } catch {
@@ -19237,7 +20005,7 @@ async function runSeed(opts) {
   }
   let claudeMdContent;
   for (const p of ["CLAUDE.md", ".claude/CLAUDE.md"]) {
-    if ((0, import_node_fs27.existsSync)(p)) {
+    if ((0, import_node_fs31.existsSync)(p)) {
       try {
         claudeMdContent = await (0, import_promises11.readFile)(p, "utf-8");
         break;
@@ -19260,8 +20028,8 @@ async function runSeed(opts) {
   if (candidates.length === 0) {
     return { created: 0, failed: 0, skipped: "no_candidates", candidates: [] };
   }
-  const overviewPath = (0, import_node_path21.join)(MEMORY_DIR, "domain", "project-overview.md");
-  if ((0, import_node_fs27.existsSync)(overviewPath) && !opts.force) {
+  const overviewPath = (0, import_node_path23.join)(MEMORY_DIR, "domain", "project-overview.md");
+  if ((0, import_node_fs31.existsSync)(overviewPath) && !opts.force) {
     return { created: 0, failed: 0, skipped: "already_seeded", candidates };
   }
   if (opts.dryRun) {
@@ -19303,7 +20071,7 @@ async function runSeed(opts) {
       continue;
     }
     try {
-      await (0, import_promises11.mkdir)((0, import_node_path21.dirname)(targetPath), { recursive: true });
+      await (0, import_promises11.mkdir)((0, import_node_path23.dirname)(targetPath), { recursive: true });
       await (0, import_promises11.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
       created++;
       opts.onCreated?.(nodeId, filePathRel, c);
@@ -19316,8 +20084,8 @@ async function runSeed(opts) {
 }
 
 // src/commands/analyze/phases/08-memory-manifest.ts
-var import_node_fs28 = require("node:fs");
-var import_node_path22 = require("node:path");
+var import_node_fs32 = require("node:fs");
+var import_node_path24 = require("node:path");
 async function memoryManifest(run) {
   const { globals } = run;
   const { serviceUrl, token } = run;
@@ -19327,9 +20095,9 @@ async function memoryManifest(run) {
   let autoSeedNotice = null;
   try {
     await ensureMemoryDir();
-    const seedMarker = (0, import_node_path22.join)(VERITY_DIR, ".seeded");
-    const hasStandard = (0, import_node_fs28.existsSync)(STANDARD_FILE);
-    const alreadyTried = (0, import_node_fs28.existsSync)(seedMarker);
+    const seedMarker = (0, import_node_path24.join)(VERITY_DIR, ".seeded");
+    const hasStandard = (0, import_node_fs32.existsSync)(STANDARD_FILE);
+    const alreadyTried = (0, import_node_fs32.existsSync)(seedMarker);
     if (hasStandard && !alreadyTried) {
       const preManifest = await buildManifest();
       if (preManifest.nodes.length === 0) {
@@ -19342,7 +20110,7 @@ async function memoryManifest(run) {
             dryRun: false
           });
           if (seedResult.created > 0) {
-            (0, import_node_fs28.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created}
+            (0, import_node_fs32.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created}
 `);
             autoSeedNotice = `Seeded ${seedResult.created} knowledge node(s) from your existing Standard (one-time).`;
             logEvent("auto_seed_ran", {
@@ -19350,7 +20118,7 @@ async function memoryManifest(run) {
               failed: seedResult.failed
             });
           } else if (seedResult.skipped === "already_seeded") {
-            (0, import_node_fs28.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
+            (0, import_node_fs32.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
 `);
           } else {
             logEvent("auto_seed_noop", {
@@ -19445,7 +20213,7 @@ function computeIncrement(reviewedPaths, hashOf, priorAuthored) {
 }
 
 // src/commands/analyze/phases/10-working-memory.ts
-var import_node_path23 = require("node:path");
+var import_node_path25 = require("node:path");
 async function workingMemory(run) {
   const { opts } = run;
   const { allForReview, baseline, conversation, foldResult, sessionId, token, transcriptPath } = run;
@@ -19457,7 +20225,7 @@ async function workingMemory(run) {
     const priorState = foldForMarks(memorySession.d);
     incrementReport = computeIncrement(
       allForReview,
-      (p) => fileHash((0, import_node_path23.join)(repoRoot(), p)),
+      (p) => fileHash((0, import_node_path25.join)(repoRoot(), p)),
       priorState.authored_all.map((a) => ({
         path: a.path,
         hash_at_last_verdict: a.hash_at_last_verdict
@@ -19539,7 +20307,7 @@ async function workingMemory(run) {
 }
 
 // src/lib/note-budget.ts
-var import_node_fs29 = require("node:fs");
+var import_node_fs33 = require("node:fs");
 var ADVISORY_BUDGET = { PASS: 1, WARN: 2 };
 var EPISODE_STALE_SECONDS = 30 * 60;
 var FRESH = { delivered: 0, tasksCompleted: 0, ts: 0 };
@@ -19561,9 +20329,9 @@ function advisoryBudgetSpent(episode, rawDecision) {
 }
 function readAdvisoryEpisode(sessionId) {
   const file = scopedFile(ADVISORY_EPISODE_FILE, sessionId);
-  if (!(0, import_node_fs29.existsSync)(file)) return null;
+  if (!(0, import_node_fs33.existsSync)(file)) return null;
   try {
-    const o = JSON.parse((0, import_node_fs29.readFileSync)(file, "utf-8")) ?? {};
+    const o = JSON.parse((0, import_node_fs33.readFileSync)(file, "utf-8")) ?? {};
     const delivered = typeof o.delivered === "number" ? o.delivered : NaN;
     if (isNaN(delivered)) return null;
     return {
@@ -19577,8 +20345,8 @@ function readAdvisoryEpisode(sessionId) {
 }
 function writeAdvisoryEpisode(episode, sessionId) {
   try {
-    (0, import_node_fs29.mkdirSync)(VERITY_DIR, { recursive: true });
-    (0, import_node_fs29.writeFileSync)(
+    (0, import_node_fs33.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs33.writeFileSync)(
       scopedFile(ADVISORY_EPISODE_FILE, sessionId),
       JSON.stringify({ v: 1, ...episode })
     );
@@ -19608,7 +20376,7 @@ function isExplicitlyAutonomous(env = process.env) {
 }
 
 // src/lib/task-context.ts
-var import_node_child_process8 = require("node:child_process");
+var import_node_child_process9 = require("node:child_process");
 var CLOSING_RE = /\b(close[sd]?|fix(?:e[sd])?|resolve[sd]?)\b[\s:]*#(\d+)/i;
 var BRANCH_RE = /(?:^|[/_-])(?:issue|gh|fix)[-_/]?(\d+)\b/i;
 function parseLinkedIssue(sources) {
@@ -19624,7 +20392,7 @@ function parseLinkedIssue(sources) {
 }
 function safeExec(cmd, timeout) {
   try {
-    return (0, import_node_child_process8.execSync)(cmd, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout }).trim();
+    return (0, import_node_child_process9.execSync)(cmd, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout }).trim();
   } catch {
     return "";
   }
@@ -19685,7 +20453,16 @@ async function buildRequest(run) {
     // the state, so the number is one turn lagged by construction. The
     // degenerate win for the budget is a dead channel that looks like clean
     // code; this is what makes "did delivery rate collapse" a query.
-    advisory_delivered_prior: readAdvisoryEpisode(run.baselineSessionId)?.delivered ?? 0
+    advisory_delivered_prior: readAdvisoryEpisode(run.baselineSessionId)?.delivered ?? 0,
+    // `.verityignore` — see CoverageTelemetry.verityignore for why the SHARE is
+    // the number that matters and why no paths travel with it.
+    verityignore: {
+      rules: run.verityIgnored.rules,
+      excluded: run.verityIgnored.ignored.length,
+      share: ignoreShare(run.verityIgnored.kept.length, run.verityIgnored.ignored.length),
+      security_excluded: run.verityIgnored.securityExcluded.length,
+      suspended: run.verityIgnored.suspended
+    }
   };
   const requestBody = {
     coverage_telemetry: coverageTelemetry,
@@ -19870,7 +20647,10 @@ async function buildRequest(run) {
     }
     if (specs.length > 0) intentContext.specs = specs;
     if (plans.length > 0) intentContext.plans = plans;
-    if (actionSummary) intentContext.action_summary = actionSummary;
+    if (actionSummary) {
+      const { user_commands: _uc, user_commands_truncated: _uct, ...onTheWire } = actionSummary;
+      intentContext.action_summary = onTheWire;
+    }
     for (const key of Object.keys(intentContext)) {
       if (intentContext[key] == null) delete intentContext[key];
     }
@@ -19880,14 +20660,14 @@ async function buildRequest(run) {
 }
 
 // src/lib/offline.ts
-var import_node_fs30 = require("node:fs");
+var import_node_fs34 = require("node:fs");
 var import_node_crypto11 = require("node:crypto");
 function cacheRequest(body) {
   try {
-    (0, import_node_fs30.mkdirSync)(CACHE_DIR, { recursive: true });
+    (0, import_node_fs34.mkdirSync)(CACHE_DIR, { recursive: true });
     const suffix = (0, import_node_crypto11.randomBytes)(4).toString("hex");
     const filename = `pending-${Math.floor(Date.now() / 1e3)}-${suffix}.json`;
-    (0, import_node_fs30.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body)));
+    (0, import_node_fs34.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body)));
   } catch {
   }
 }
@@ -20006,8 +20786,8 @@ async function transmit(run) {
 }
 
 // src/commands/analyze/phases/13-reconcile.ts
-var import_node_fs31 = require("node:fs");
-var import_node_path24 = require("node:path");
+var import_node_fs35 = require("node:fs");
+var import_node_path26 = require("node:path");
 async function reconcile(run) {
   const { actionSummary, allChanged, analyzable, baseline, baselineSessionId, codeDelta, contentHash, conversation, decision, foldResult, memory, memorySession, response, reviewable, securityFiles, turnId } = run;
   const sentPaths = codeDelta.files.map((f) => f.path);
@@ -20017,7 +20797,7 @@ async function reconcile(run) {
       const st = foldDossier(memorySession.d);
       openElsewhere = openBlockingElsewhere(st.statements, sentPaths, (file, line) => {
         try {
-          const src = (0, import_node_fs31.readFileSync)((0, import_node_path24.join)(repoRoot(), file), "utf8").split("\n");
+          const src = (0, import_node_fs35.readFileSync)((0, import_node_path26.join)(repoRoot(), file), "utf8").split("\n");
           const at = src[line - 1];
           return at === void 0 ? null : lineSha(at);
         } catch {
@@ -20078,6 +20858,25 @@ async function reconcile(run) {
         stage: "self-scope",
         kind: "policy"
       })),
+      // ⚠ WHAT THE TEAM'S OWN `.verityignore` REMOVED — every path, named
+      // (VRT-135 · 3/3). The 0.30 principle: an exclusion the ledger cannot see
+      // is a scoping decision nobody can audit, and this is the one exclusion
+      // stage a user can edit, so it is the one that most needs to be visible.
+      //
+      // `policy`, by D2's bar — no version of this product would have reviewed a
+      // file the project declared out of scope, so it must not downgrade PASS to
+      // WARN. That is also why it is not narrated per-turn by `describeCoverage`
+      // (policy exclusions are recorded, not announced): repeating "your dist/
+      // went unreviewed" on every turn is how a channel gets muted. The SHARE
+      // below is the signal that replaces the noise.
+      //
+      // Taken from the run, not recomputed — see context.ts `verityIgnored`.
+      ...run.verityIgnored.ignored.map((path) => ({
+        path,
+        reason: "verityignore",
+        stage: "verityignore",
+        kind: "policy"
+      })),
       // The extension allowlist. POLICY: a changed README was never going to be
       // reviewed, and calling that a coverage gap would downgrade nearly every
       // PASS to WARN until WARN meant nothing. Recorded so the ledger balances and
@@ -20307,7 +21106,7 @@ function agentContextFor(response, intentRepeat = 0, priorPendingFingerprints =
 }
 async function render(run) {
   const { opts, globals } = run;
-  const { actionSummary, assistantResponse, autoSeedNotice, baselineSessionId, codeDelta, contentHash, conversation, currentCommit, decision, intentRepeatCount, memory, openElsewhere, priorPendingFingerprints, response, reviewCoverage, serviceUrl, sessionIdForMemory, silenced, token, watermarkHash, watermarkIsPartial } = run;
+  const { actionSummary, assistantResponse, autoSeedNotice, voidedIgnoreNotice, baselineSessionId, codeDelta, contentHash, conversation, currentCommit, decision, intentRepeatCount, memory, openElsewhere, priorPendingFingerprints, response, reviewCoverage, serviceUrl, sessionIdForMemory, silenced, token, watermarkHash, watermarkIsPartial } = run;
   let { iteration } = run;
   const metadata = response.metadata ?? {};
   const intentAmbiguity = metadata.intent_ambiguity;
@@ -20559,6 +21358,7 @@ ${YELLOW}${grantNudge.trim()}${NC}
       const viewUrl = response.view_url ?? "";
       if (viewUrl) userSummary += ` Report: ${viewUrl}`;
       if (autoSeedNotice) userSummary = `${autoSeedNotice} ${userSummary}`;
+      if (voidedIgnoreNotice) userSummary = `${voidedIgnoreNotice} ${userSummary}`;
       userSummary += loginNudge + grantNudge;
       emitVerdict({
         proposed: "PASS",
@@ -20580,6 +21380,7 @@ ${YELLOW}${grantNudge.trim()}${NC}
       const viewUrl = response.view_url ?? "";
       if (viewUrl) userSummary += ` Report: ${viewUrl}`;
       if (autoSeedNotice) userSummary = `${autoSeedNotice} ${userSummary}`;
+      if (voidedIgnoreNotice) userSummary = `${voidedIgnoreNotice} ${userSummary}`;
       userSummary += loginNudge + grantNudge;
       emitVerdict({
         proposed: "WARN",
@@ -20595,7 +21396,11 @@ ${YELLOW}${grantNudge.trim()}${NC}
     }
     default: {
       const raw = String(decision ?? "(missing)");
-      const msg = (autoSeedNotice ? `${autoSeedNotice} Verity: unrecognised verdict \u2014 treating as WARN` : "Verity: unrecognised verdict \u2014 treating as WARN") + loginNudge + grantNudge;
+      const msg = [
+        voidedIgnoreNotice,
+        autoSeedNotice,
+        "Verity: unrecognised verdict \u2014 treating as WARN"
+      ].filter(Boolean).join(" ") + loginNudge + grantNudge;
       process.stderr.write(
         `Verity: server returned an unrecognised gate_decision (${raw}). Rendering WARN rather than PASS. Update the CLI: npm i -g @codacy/verity-cli
 `
@@ -20672,7 +21477,7 @@ async function runAnalyze(opts, globals) {
 }
 
 // src/commands/baseline.ts
-var import_node_fs32 = require("node:fs");
+var import_node_fs36 = require("node:fs");
 function registerBaselineCommands(program2) {
   const baseline = program2.command("baseline").description("Manage the task-start working-tree baseline");
   baseline.command("capture").description("Snapshot the working tree at task start (used by SessionStart hook)").option("--session-id <id>", "Session id (overrides any value from stdin)").option("--source <source>", "Lifecycle hint: startup|resume|clear|compact").action(async (opts) => {
@@ -20681,7 +21486,7 @@ function registerBaselineCommands(program2) {
         process.chdir(repoRoot());
       } catch {
       }
-      if (!(0, import_node_fs32.existsSync)(VERITY_DIR)) {
+      if (!(0, import_node_fs36.existsSync)(VERITY_DIR)) {
         process.exit(0);
       }
       let sessionId = opts.sessionId;
@@ -20721,7 +21526,7 @@ async function readStdin() {
 }
 
 // src/commands/review.ts
-var import_node_fs33 = require("node:fs");
+var import_node_fs37 = require("node:fs");
 function registerReviewCommand(program2) {
   program2.command("review").description("Run on-demand Verity analysis (advisory, never blocks)").requiredOption("--files <paths>", "Comma-separated file list").option("--changed <paths>", "Subset of --files that were modified").option("--intent <text>", "User intent description (max 2000 chars)").option("--specs <paths>", "Comma-separated spec file paths").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -20740,7 +21545,7 @@ async function runReview(opts, globals) {
   const securityFiles = filterSecurity(allFiles);
   let staticResults;
   if (isCodacyAvailable()) {
-    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs33.existsSync)(f) || resolveFile(f) !== null);
+    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs37.existsSync)(f) || resolveFile(f) !== null);
     staticResults = runCodacyAnalysis(scannable);
   } else {
     staticResults = {
@@ -20766,10 +21571,10 @@ async function runReview(opts, globals) {
     const specPaths = opts.specs.split(",").map((f) => f.trim()).filter(Boolean);
     specs = [];
     for (const p of specPaths) {
-      if (!(0, import_node_fs33.existsSync)(p)) continue;
+      if (!(0, import_node_fs37.existsSync)(p)) continue;
       try {
-        const { readFileSync: readFileSync19 } = await import("node:fs");
-        const content = readFileSync19(p, "utf-8");
+        const { readFileSync: readFileSync23 } = await import("node:fs");
+        const content = readFileSync23(p, "utf-8");
         specs.push({ path: p, content: content.slice(0, 10240) });
       } catch {
       }
@@ -20826,15 +21631,15 @@ async function runReview(opts, globals) {
 }
 
 // src/commands/guard.ts
-var import_node_fs34 = require("node:fs");
-var import_node_path25 = require("node:path");
+var import_node_fs38 = require("node:fs");
+var import_node_path27 = require("node:path");
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path25.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path27.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     try {
-      if (process.stdin.isTTY) return resolve3(empty);
+      if (process.stdin.isTTY) return resolve4(empty);
       const chunks = [];
       let timer;
       let settled = false;
@@ -20847,7 +21652,7 @@ function readPreToolUseStdin() {
         process.stdin.removeListener("end", onEnd);
         process.stdin.removeListener("error", onError);
         process.stdin.pause();
-        resolve3(value);
+        resolve4(value);
       };
       const onEnd = () => {
         try {
@@ -20868,32 +21673,13 @@ function readPreToolUseStdin() {
       process.stdin.on("error", onError);
       process.stdin.resume();
     } catch {
-      resolve3(empty);
+      resolve4(empty);
     }
   });
 }
-function buildCommandRe(head) {
-  return new RegExp(`(?:^|[\\s;&|(])${head}|(?:^|[;&|(])\\s*[^\\s;&|()'"]*\\/${head}`);
-}
-var GIT_GLOBAL_OPTS = "(?:\\s+(?:-[Cc]\\s+\\S+|--?[\\w-]+(?:=\\S+)?))*";
-var COMMIT_RE = buildCommandRe(`git${GIT_GLOBAL_OPTS}\\s+commit(?![\\w-])`);
-var PUSH_RE = buildCommandRe(`git${GIT_GLOBAL_OPTS}\\s+push\\b`);
-var GH_PR_RE = buildCommandRe(`gh${GIT_GLOBAL_OPTS}\\s+pr\\s+create\\b`);
-function classifyCommand2(command, on) {
-  let commit = false;
-  let push = false;
-  for (const seg of (command ?? "").split(/&&|\|\||;|\n/)) {
-    if (/--dry-run\b/.test(seg)) continue;
-    if (COMMIT_RE.test(seg)) commit = true;
-    if (PUSH_RE.test(seg) || GH_PR_RE.test(seg)) push = true;
-  }
-  if (commit && on.includes("commit")) return "pre-commit";
-  if (push && on.includes("push")) return "pre-push";
-  return null;
-}
 function readIterMap() {
   try {
-    const raw = JSON.parse((0, import_node_fs34.readFileSync)(GUARD_ITER_FILE, "utf-8"));
+    const raw = JSON.parse((0, import_node_fs38.readFileSync)(GUARD_ITER_FILE, "utf-8"));
     if (raw && typeof raw === "object") {
       if (typeof raw.moment === "string" && typeof raw.count === "number") {
         return { [raw.moment]: raw.count };
@@ -20913,10 +21699,10 @@ function readIter(moment) {
 }
 function writeIter(moment, count) {
   try {
-    (0, import_node_fs34.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs38.mkdirSync)(VERITY_DIR, { recursive: true });
     const map = readIterMap();
     map[moment] = count;
-    (0, import_node_fs34.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+    (0, import_node_fs38.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
   } catch {
   }
 }
@@ -20926,10 +21712,10 @@ function resetIter(moment) {
     if (!(moment in map)) return;
     delete map[moment];
     if (Object.keys(map).length === 0) {
-      if ((0, import_node_fs34.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs34.unlinkSync)(GUARD_ITER_FILE);
+      if ((0, import_node_fs38.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs38.unlinkSync)(GUARD_ITER_FILE);
     } else {
-      (0, import_node_fs34.mkdirSync)(VERITY_DIR, { recursive: true });
-      (0, import_node_fs34.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+      (0, import_node_fs38.mkdirSync)(VERITY_DIR, { recursive: true });
+      (0, import_node_fs38.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
     }
   } catch {
   }
@@ -20944,8 +21730,14 @@ function registerGuardCommand(program2) {
     }
   });
 }
-function getMomentFiles(moment) {
-  return moment === "pre-commit" ? getStagedFiles() : getPushRangeFiles().files;
+function resolveMomentRange(moment, frame, command, on) {
+  return moment === "pre-commit" ? stagedRange() : resolvePushRange(frame, command, on);
+}
+function describeRange(range) {
+  if (range.kind === "staged") return "staged";
+  if (range.kind === "nothing" || !range.base) return null;
+  const base = /^[0-9a-f]{40}$/.test(range.base) ? range.base.slice(0, 7) : range.base;
+  return `${base}..${range.head} via ${range.via}`;
 }
 function matchFlagValue(command, flags) {
   const re = new RegExp(`(?<![\\w-])(?:${flags})(?:=|\\s+)('((?:[^'\\\\]|\\\\.)*)'|"((?:[^"\\\\]|\\\\.)*)"|([^\\s'"-][^\\s]*))`);
@@ -20980,26 +21772,24 @@ function isSubstantiveIntent(text) {
   if (SHELL_PLUMBING.test(t)) return false;
   return true;
 }
-function extractStatedIntent(moment, command) {
-  const text = moment === "pre-commit" ? parseCommitMessage(command) : parsePrIntent(command) ?? (getPushRangeMessages() || null);
+function extractStatedIntent(moment, command, pushedMessages = null) {
+  const text = moment === "pre-commit" ? parseCommitMessage(command) : parsePrIntent(command) ?? pushedMessages;
   return isSubstantiveIntent(text) ? text : null;
 }
 function hasBlockingFinding(response) {
   const findings = response.findings ?? [];
   return findings.some((f) => f.scope !== "pre-existing" && ["critical", "high"].includes((f.severity ?? "").toLowerCase()));
 }
-function buildGuardRequest(moment, files, iter, sessionId, command) {
+function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedIntent, coverageTelemetry) {
   const analyzable = filterAnalyzable(files);
   const securityFiles = filterSecurity(files);
   let staticResults;
   if (isCodacyAvailable()) {
-    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs34.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs38.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
     staticResults = runCodacyAnalysis(scannable);
   } else {
     staticResults = { tool: "@codacy/analysis-cli", findings: [], summary: { total_findings: 0, by_severity: {}, tools_run: [] } };
   }
-  const codeDelta = collectCodeDelta(files);
-  if (codeDelta.total_files === 0) return null;
   const trigger = moment === "pre-commit" ? "hook:pre-commit" : "hook:pre-push";
   const requestBody = {
     static_results: staticResults,
@@ -21016,9 +21806,9 @@ function buildGuardRequest(moment, files, iter, sessionId, command) {
       iteration: iter + 1
     }
   };
+  if (coverageTelemetry) requestBody.coverage_telemetry = coverageTelemetry;
   const specs = discoverSpecs();
   const plans = discoverPlans();
-  const statedIntent = extractStatedIntent(moment, command);
   if (specs.length > 0 || plans.length > 0 || statedIntent) {
     const intentContext = {};
     if (statedIntent) intentContext.user_prompt = statedIntent;
@@ -21028,6 +21818,39 @@ function buildGuardRequest(moment, files, iter, sessionId, command) {
   }
   return requestBody;
 }
+function buildGuardCoverage(files, codeDelta, frame, frameRange) {
+  const byReason = {};
+  for (const e of codeDelta.excluded) byReason[e.reason] = (byReason[e.reason] ?? 0) + 1;
+  return {
+    changed_all: files.length,
+    analyzable: filterAnalyzable(files).length,
+    reviewable: filterReviewable(files).length,
+    security: filterSecurity(files).length,
+    for_review: files.length,
+    sent: codeDelta.total_files,
+    capped_out: codeDelta.truncated?.dropped ?? 0,
+    excluded: codeDelta.excluded.length,
+    excluded_by_reason: byReason,
+    transcript_windowed: null,
+    guard_frame: frameTelemetry(frame, frameRange)
+  };
+}
+function coverageSummary(c) {
+  const range = c.range ? ` @ ${c.range}` : "";
+  return `reviewed ${c.sent.length} file(s)${range}`;
+}
+function coverageBlock(c) {
+  const lines = [];
+  const tree = c.root ? `${c.root}${c.linked ? " (linked worktree)" : ""}${c.branch ? ` \xB7 branch ${c.branch}` : ""}` : "(no tree resolved)";
+  lines.push(`Reviewed (${c.moment}): ${c.sent.length} file(s)${c.range ? ` @ ${c.range}` : ""}`);
+  lines.push(`  Tree: ${tree}`);
+  for (const f of c.sent) lines.push(`  - ${f}`);
+  if (c.excluded.length > 0) {
+    lines.push(`  Excluded (${c.excluded.length}):`);
+    for (const e of c.excluded) lines.push(`  - ${e.path} (${e.reason})`);
+  }
+  return lines.join("\n");
+}
 function emitAllowNotice(userMsg, agentMsg) {
   process.stdout.write(JSON.stringify({
     systemMessage: userMsg,
@@ -21038,15 +21861,24 @@ function emitAllowNotice(userMsg, agentMsg) {
 async function runGuard(opts, globals) {
   const on = opts.on.split(",").map((s) => s.trim()).filter((s) => s === "commit" || s === "push");
   const { command, cwd, sessionId } = await readPreToolUseStdin();
-  if (cwd && (0, import_node_fs34.existsSync)(cwd)) {
-    try {
-      process.chdir(cwd);
-    } catch {
-    }
-  }
-  const moment = classifyCommand2(command, on);
+  const moment = classifyCommand(command, on);
   if (!moment) process.exit(0);
   const verb = moment === "pre-commit" ? "commit" : "push";
+  const { frame } = resolveFrame({ command, on, hookCwd: cwd });
+  if (frame.refusal || !frame.worktreeRoot) {
+    logEvent("guard_frame", { moment, ...frameTelemetry(frame, null) });
+    if ((frame.refusal ?? "").startsWith("anchor:")) process.exit(0);
+    emitAllowNotice(
+      `\u26A0 Verity ${moment}: could not resolve the tree this ${verb} targets \u2014 ${verb}ed WITHOUT review`,
+      `Verity ${moment}: the target tree could not be resolved (${frame.refusal}); the ${verb} was allowed WITHOUT a Verity review.`
+    );
+  }
+  try {
+    process.chdir(frame.worktreeRoot);
+  } catch {
+    process.exit(0);
+  }
+  _resetRepoRoot();
   const iter = readIter(moment);
   if (iter >= GUARD_BLOCK_CAP) {
     resetIter(moment);
@@ -21055,13 +21887,39 @@ async function runGuard(opts, globals) {
       `Verity ${moment}: review-cycle cap (${GUARD_BLOCK_CAP}) reached; the ${verb} was allowed without a further block.`
     );
   }
-  const files = getMomentFiles(moment);
+  const range = resolveMomentRange(moment, frame, command, on);
+  const files = rangeFiles(frame, range);
   if (files.length === 0) process.exit(0);
   const tokenResult = await resolveToken(globals.token);
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
   if (!tokenResult.ok || !urlResult.ok) process.exit(0);
-  const requestBody = buildGuardRequest(moment, files, iter, sessionId, command);
-  if (!requestBody) process.exit(0);
+  logEvent("guard_frame", { moment, ...frameTelemetry(frame, range) });
+  const codeDelta = collectCodeDelta(files);
+  if (codeDelta.total_files === 0) process.exit(0);
+  const statedIntent = extractStatedIntent(
+    moment,
+    command,
+    moment === "pre-push" ? rangeMessages(frame, range) || null : null
+  );
+  const requestBody = buildGuardRequest(
+    moment,
+    files,
+    codeDelta,
+    iter,
+    sessionId,
+    statedIntent,
+    buildGuardCoverage(files, codeDelta, frame, range)
+  );
+  const coverage = {
+    moment,
+    root: frame.worktreeRoot,
+    branch: frame.branch,
+    linked: frame.isLinkedWorktree,
+    range: describeRange(range),
+    sent: codeDelta.files.map((f) => f.path),
+    excluded: codeDelta.excluded.map((e) => ({ path: e.path, reason: e.reason }))
+  };
+  logToFileOnly(coverageBlock(coverage));
   const result = await analyzeRequest({
     serviceUrl: urlResult.data,
     token: tokenResult.data.token,
@@ -21082,31 +21940,39 @@ async function runGuard(opts, globals) {
   const decision = response.gate_decision ?? "(unrecognised)";
   const viewUrl = response.view_url ?? "";
   const link = viewUrl ? ` \u2014 ${viewUrl}` : "";
+  const covLine = coverageSummary(coverage);
+  const covDetail = coverageBlock(coverage);
   if (decision === "FAIL" && hasBlockingFinding(response)) {
     writeIter(moment, iter + 1);
-    writeBlockMessage(moment, response);
+    writeBlockMessage(moment, response, covDetail);
     process.exit(2);
   }
   resetIter(moment);
   if (decision === "FAIL") {
     const narrative = response.assessment?.narrative ?? "";
     emitAllowNotice(
-      `\u26A0 Verity ${moment}: the ${verb} may not match its stated purpose \u2014 proceeding${link}`,
-      `Verity ${moment}: intent-alignment WARNING (not blocked).${narrative ? " " + narrative : ""}${viewUrl ? ` Report: ${viewUrl}` : ""}`
+      `\u26A0 Verity ${moment}: the ${verb} may not match its stated purpose \u2014 proceeding (${covLine})${link}`,
+      `Verity ${moment}: intent-alignment WARNING (not blocked).${narrative ? " " + narrative : ""}
+${covDetail}${viewUrl ? `
+Report: ${viewUrl}` : ""}`
     );
   }
   if (decision === "WARN") {
     emitAllowNotice(
-      `\u26A0 Verity ${moment}: WARN \u2014 proceeding${link}`,
-      `Verity ${moment} review: WARN (proceeding).${viewUrl ? ` Report: ${viewUrl}` : ""}`
+      `\u26A0 Verity ${moment}: WARN \u2014 proceeding (${covLine})${link}`,
+      `Verity ${moment} review: WARN (proceeding).
+${covDetail}${viewUrl ? `
+Report: ${viewUrl}` : ""}`
     );
   }
   emitAllowNotice(
-    `\u2713 Verity ${moment}: PASS${link}`,
-    `Verity ${moment} review: PASS.${viewUrl ? ` Report: ${viewUrl}` : ""}`
+    `\u2713 Verity ${moment}: PASS (${covLine})${link}`,
+    `Verity ${moment} review: PASS.
+${covDetail}${viewUrl ? `
+Report: ${viewUrl}` : ""}`
   );
 }
-function writeBlockMessage(moment, response) {
+function writeBlockMessage(moment, response, covDetail) {
   const label2 = moment === "pre-commit" ? "pre-commit" : "pre-push";
   const verb = moment === "pre-commit" ? "commit" : "push";
   const assessment = response.assessment;
@@ -21136,6 +22002,9 @@ function writeBlockMessage(moment, response) {
 `);
     }
   }
+  process.stderr.write(`${DIM}${covDetail}${NC}
+
+`);
   if (viewUrl) process.stderr.write(`${CYAN}Full report: ${viewUrl}${NC}
 
 `);
@@ -21143,17 +22012,109 @@ function writeBlockMessage(moment, response) {
 `);
 }
 
+// src/commands/ignore.ts
+function registerIgnoreCommand(program2) {
+  const ignore = program2.command("ignore").description("Declare the next turn (or a short window) as housekeeping \u2014 no review needed").option("--turn", "Cover the next turn only (the default)").option("--for <duration>", "Cover a window: 30m, 45s, 1h (max 60m)").option("--reason <reason>", "Why this window needs no review \u2014 required, and recorded").option("--agent", "Mark the declaration as agent-invoked (a ledger label, not a permission)").option("--session-id <id>", "Session id (defaults to $CLAUDE_SESSION_ID)").option("--json", "Output raw JSON").action(async (opts) => {
+    const globals = program2.opts();
+    const now = Math.floor(Date.now() / 1e3);
+    const reason = opts.reason?.trim();
+    if (!reason) {
+      printError(
+        'A reason is required: verity ignore --turn --reason "pulling latest before starting".\nIt is recorded with the declaration and is the only trace a skipped turn leaves.'
+      );
+      process.exit(1);
+    }
+    if (opts.for && opts.turn) {
+      printError("Use either --turn or --for, not both \u2014 they are two different windows.");
+      process.exit(1);
+    }
+    let scope2 = "turn";
+    let ttl = TURN_FUSE_SECONDS;
+    if (opts.for) {
+      const parsed = parseDuration(opts.for);
+      if (!parsed.ok) {
+        printError(parsed.error);
+        process.exit(1);
+      }
+      scope2 = "window";
+      ttl = parsed.seconds;
+    }
+    const tokenResult = await resolveToken(globals.token);
+    const token = tokenResult.ok ? tokenResult.data.token : void 0;
+    const sessionId = opts.sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+    const keys = ignoreStateKeys(token, sessionId);
+    const existing = resolveIgnoreState(keys);
+    const spent = existing?.state.spent ?? 0;
+    const writeKey = existing?.key ?? keys[0];
+    if (spent >= IGNORE_BUDGET) {
+      const msg = `Ignore budget spent for this session (${spent}/${IGNORE_BUDGET} declarations). The next turn will be reviewed normally. The budget is per session \u2014 it is what stops an ignore from becoming a standing mute.`;
+      if (opts.json) {
+        printJson({ declared: false, reason_refused: "budget-spent", spent, budget: IGNORE_BUDGET });
+      } else {
+        printWarn(msg);
+      }
+      logEvent("ignore_refused", { why: "budget-spent", spent, budget: IGNORE_BUDGET });
+      process.exit(0);
+    }
+    const declaration = {
+      scope: scope2,
+      origin: opts.agent ? "agent" : "user",
+      reason,
+      at: now,
+      expires: now + ttl
+    };
+    writeIgnoreState({ v: 1, active: declaration, spent: spent + 1 }, writeKey);
+    logEvent("ignore_declared", {
+      scope: scope2,
+      origin: declaration.origin,
+      ttl_seconds: ttl,
+      spent: spent + 1,
+      budget: IGNORE_BUDGET
+    });
+    if (opts.json) {
+      printJson({
+        declared: true,
+        scope: scope2,
+        origin: declaration.origin,
+        reason,
+        expires_at: new Date(declaration.expires * 1e3).toISOString(),
+        spent: spent + 1,
+        budget: IGNORE_BUDGET
+      });
+      return;
+    }
+    const window = scope2 === "turn" ? "the next turn" : `the next ${describeRemaining(declaration, now).replace(" left", "")}`;
+    printInfo(`Verity will skip ${window} \u2014 "${reason}" (${spent + 1}/${IGNORE_BUDGET} this session).`);
+    printInfo("It covers turns that author nothing. If anything is written, the declaration voids and the review runs.");
+  });
+  ignore.command("clear").description("Cancel the active declaration (the spent budget is not refunded)").option("--session-id <id>", "Session id (defaults to $CLAUDE_SESSION_ID)").action(async (opts) => {
+    const globals = program2.opts();
+    const tokenResult = await resolveToken(globals.token);
+    const token = tokenResult.ok ? tokenResult.data.token : void 0;
+    const sessionId = opts.sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+    const found = resolveIgnoreState(ignoreStateKeys(token, sessionId));
+    const active = resolveActive(found?.state ?? null, Math.floor(Date.now() / 1e3));
+    if (!found || !active) {
+      printInfo("No active ignore declaration.");
+      return;
+    }
+    clearActiveDeclaration(found.key);
+    logEvent("ignore_cleared", { scope: active.scope, origin: active.origin });
+    printInfo(`Cleared: "${active.reason}". The next turn will be reviewed normally.`);
+  });
+}
+
 // src/commands/init.ts
-var import_node_fs36 = require("node:fs");
+var import_node_fs40 = require("node:fs");
 var import_promises13 = require("node:fs/promises");
-var import_node_path27 = require("node:path");
-var import_node_child_process10 = require("node:child_process");
+var import_node_path29 = require("node:path");
+var import_node_child_process11 = require("node:child_process");
 var readline2 = __toESM(require("node:readline/promises"));
 
 // src/commands/migrate.ts
-var import_node_fs35 = require("node:fs");
-var import_node_path26 = require("node:path");
-var import_node_child_process9 = require("node:child_process");
+var import_node_fs39 = require("node:fs");
+var import_node_path28 = require("node:path");
+var import_node_child_process10 = require("node:child_process");
 
 // src/lib/telemetry.ts
 var import_promises12 = require("node:fs/promises");
@@ -21248,11 +22209,11 @@ async function uninstallTelemetry() {
 // src/commands/migrate.ts
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
-  (0, import_node_child_process9.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
+  (0, import_node_child_process10.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
 }
 function isGitTracked(cwd, relPath) {
   try {
-    (0, import_node_child_process9.execSync)(`git ls-files --error-unmatch ${relPath}`, { cwd, stdio: "pipe" });
+    (0, import_node_child_process10.execSync)(`git ls-files --error-unmatch ${relPath}`, { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -21260,7 +22221,7 @@ function isGitTracked(cwd, relPath) {
 }
 function isGitRepo(cwd) {
   try {
-    (0, import_node_child_process9.execSync)("git rev-parse --is-inside-work-tree", { cwd, stdio: "pipe" });
+    (0, import_node_child_process10.execSync)("git rev-parse --is-inside-work-tree", { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -21281,12 +22242,12 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path26.join)(root, ".gate");
-  const verityDir = (0, import_node_path26.join)(root, ".verity");
-  if ((0, import_node_fs35.existsSync)(gateDir) && !(0, import_node_fs35.existsSync)(verityDir)) {
+  const gateDir = (0, import_node_path28.join)(root, ".gate");
+  const verityDir = (0, import_node_path28.join)(root, ".verity");
+  if ((0, import_node_fs39.existsSync)(gateDir) && !(0, import_node_fs39.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if ((0, import_node_fs35.existsSync)(gateDir) && (0, import_node_fs35.existsSync)(verityDir)) {
+  if ((0, import_node_fs39.existsSync)(gateDir) && (0, import_node_fs39.existsSync)(verityDir)) {
     return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
   return false;
@@ -21300,20 +22261,20 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
       );
     }
     try {
-      (0, import_node_child_process9.execSync)("git mv .gate .verity", { cwd: root, stdio: "pipe" });
+      (0, import_node_child_process10.execSync)("git mv .gate .verity", { cwd: root, stdio: "pipe" });
       actions.push("Moved .gate/ \u2192 .verity/ (git mv, staged)");
       moved = true;
     } catch {
     }
   }
   if (moved) {
-    if ((0, import_node_fs35.existsSync)(gateDir)) {
+    if ((0, import_node_fs39.existsSync)(gateDir)) {
       const carried = carryLegacyContents(gateDir, verityDir);
       if (carried > 0) {
         actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
       }
       try {
-        (0, import_node_fs35.rmSync)(gateDir, { recursive: true, force: true });
+        (0, import_node_fs39.rmSync)(gateDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -21329,18 +22290,18 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
     actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
   try {
-    (0, import_node_fs35.rmSync)(gateDir, { recursive: true, force: true });
+    (0, import_node_fs39.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
   }
   return carried > 0;
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path26.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path26.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs35.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs35.existsSync)(verityCreds)) {
-    (0, import_node_fs35.mkdirSync)((0, import_node_path26.join)(home, ".verity"), { recursive: true });
+  const gateCreds = (0, import_node_path28.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path28.join)(home, ".verity", "credentials");
+  if (!(0, import_node_fs39.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs39.existsSync)(verityCreds)) {
+    (0, import_node_fs39.mkdirSync)((0, import_node_path28.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -21362,8 +22323,8 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path26.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs35.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  const claudeMd = (0, import_node_path28.join)(root, "CLAUDE.md");
+  const hadLegacyBlock = (0, import_node_fs39.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
     await ensureClaudeMdPointer(root);
@@ -21373,13 +22334,13 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path26.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path26.join)(root, "VERITY.md");
-  if (!(0, import_node_fs35.existsSync)(gateMd) || (0, import_node_fs35.existsSync)(verityMd)) return;
+  const gateMd = (0, import_node_path28.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path28.join)(root, "VERITY.md");
+  if (!(0, import_node_fs39.existsSync)(gateMd) || (0, import_node_fs39.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
-      (0, import_node_child_process9.execSync)("git mv GATE.md VERITY.md", { cwd: root, stdio: "pipe" });
+      (0, import_node_child_process10.execSync)("git mv GATE.md VERITY.md", { cwd: root, stdio: "pipe" });
       moved = true;
     } catch {
     }
@@ -21387,12 +22348,12 @@ function migrateStandardFile(root, actions) {
   if (!moved) moveFile(gateMd, verityMd);
   const content = readFileSyncSafe(verityMd);
   const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs35.writeFileSync)(verityMd, refreshed);
+  if (refreshed !== content) (0, import_node_fs39.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
-  const file = (0, import_node_path26.join)(root, ".claude", "settings.local.json");
-  if (!(0, import_node_fs35.existsSync)(file)) return;
+  const file = (0, import_node_path28.join)(root, ".claude", "settings.local.json");
+  if (!(0, import_node_fs39.existsSync)(file)) return;
   let settings;
   try {
     settings = JSON.parse(readFileSyncSafe(file) || "{}");
@@ -21440,21 +22401,21 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
   }
   if (toAppend.length > 0) {
     const sep2 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs35.writeFileSync)(verityCreds, verityContent + sep2 + toAppend.join("\n") + "\n");
+    (0, import_node_fs39.writeFileSync)(verityCreds, verityContent + sep2 + toAppend.join("\n") + "\n");
   }
-  (0, import_node_fs35.rmSync)(gateCreds, { force: true });
+  (0, import_node_fs39.rmSync)(gateCreds, { force: true });
   return toAppend.length;
 }
 function readFileSyncSafe(path) {
   try {
-    return (0, import_node_fs35.readFileSync)(path, "utf-8");
+    return (0, import_node_fs39.readFileSync)(path, "utf-8");
   } catch {
     return "";
   }
 }
 function hasStagedChanges(root) {
   try {
-    (0, import_node_child_process9.execSync)("git diff --cached --quiet", { cwd: root, stdio: "pipe" });
+    (0, import_node_child_process10.execSync)("git diff --cached --quiet", { cwd: root, stdio: "pipe" });
     return false;
   } catch {
     return true;
@@ -21462,35 +22423,35 @@ function hasStagedChanges(root) {
 }
 function moveDir(from, to) {
   try {
-    (0, import_node_fs35.renameSync)(from, to);
+    (0, import_node_fs39.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs35.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs35.rmSync)(from, { recursive: true, force: true });
+    (0, import_node_fs39.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs39.rmSync)(from, { recursive: true, force: true });
   }
 }
 function moveFile(from, to) {
   try {
-    (0, import_node_fs35.renameSync)(from, to);
+    (0, import_node_fs39.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs35.cpSync)(from, to);
-    (0, import_node_fs35.rmSync)(from, { force: true });
+    (0, import_node_fs39.cpSync)(from, to);
+    (0, import_node_fs39.rmSync)(from, { force: true });
   }
 }
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk = (relDir) => {
-    const srcDir = (0, import_node_path26.join)(gateDir, relDir);
-    for (const entry of (0, import_node_fs35.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path26.join)(relDir, entry) : entry;
-      const src = (0, import_node_path26.join)(gateDir, rel);
-      const dest = (0, import_node_path26.join)(verityDir, rel);
-      if ((0, import_node_fs35.statSync)(src).isDirectory()) {
+    const srcDir = (0, import_node_path28.join)(gateDir, relDir);
+    for (const entry of (0, import_node_fs39.readdirSync)(srcDir)) {
+      const rel = relDir ? (0, import_node_path28.join)(relDir, entry) : entry;
+      const src = (0, import_node_path28.join)(gateDir, rel);
+      const dest = (0, import_node_path28.join)(verityDir, rel);
+      if ((0, import_node_fs39.statSync)(src).isDirectory()) {
         walk(rel);
-      } else if (!(0, import_node_fs35.existsSync)(dest)) {
-        (0, import_node_fs35.mkdirSync)((0, import_node_path26.dirname)(dest), { recursive: true });
-        (0, import_node_fs35.cpSync)(src, dest);
+      } else if (!(0, import_node_fs39.existsSync)(dest)) {
+        (0, import_node_fs39.mkdirSync)((0, import_node_path28.dirname)(dest), { recursive: true });
+        (0, import_node_fs39.cpSync)(src, dest);
         copied++;
       }
     }
@@ -21499,22 +22460,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path26.join)(root, ".gate");
-  const verityDir = (0, import_node_path26.join)(root, ".verity");
-  if ((0, import_node_fs35.existsSync)(gateDir) && !(0, import_node_fs35.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs35.existsSync)(gateDir) && (0, import_node_fs35.existsSync)(verityDir)) {
-    if ((0, import_node_fs35.existsSync)((0, import_node_path26.join)(gateDir, "credentials")) && !(0, import_node_fs35.existsSync)((0, import_node_path26.join)(verityDir, "credentials"))) {
+  const gateDir = (0, import_node_path28.join)(root, ".gate");
+  const verityDir = (0, import_node_path28.join)(root, ".verity");
+  if ((0, import_node_fs39.existsSync)(gateDir) && !(0, import_node_fs39.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs39.existsSync)(gateDir) && (0, import_node_fs39.existsSync)(verityDir)) {
+    if ((0, import_node_fs39.existsSync)((0, import_node_path28.join)(gateDir, "credentials")) && !(0, import_node_fs39.existsSync)((0, import_node_path28.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs35.existsSync)((0, import_node_path26.join)(gateDir, "memory")) && !(0, import_node_fs35.existsSync)((0, import_node_path26.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs39.existsSync)((0, import_node_path28.join)(gateDir, "memory")) && !(0, import_node_fs39.existsSync)((0, import_node_path28.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path26.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs35.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+  const claudeMd = (0, import_node_path28.join)(root, "CLAUDE.md");
+  if ((0, import_node_fs39.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs35.existsSync)((0, import_node_path26.join)(root, "GATE.md")) && !(0, import_node_fs35.existsSync)((0, import_node_path26.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs39.existsSync)((0, import_node_path28.join)(root, "GATE.md")) && !(0, import_node_fs39.existsSync)((0, import_node_path28.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -21607,7 +22568,7 @@ async function runOptionalAuth(resolution, opts = {}) {
   }
   let remote = "";
   try {
-    remote = (0, import_node_child_process10.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    remote = (0, import_node_child_process11.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
   }
   if (!healed) {
@@ -21650,15 +22611,15 @@ async function runOptionalAuth(resolution, opts = {}) {
 }
 function resolveDataDir() {
   const candidates = [
-    (0, import_node_path27.join)(__dirname, "..", "data"),
+    (0, import_node_path29.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path27.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path29.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path27.join)(process.cwd(), "cli", "data")
+    (0, import_node_path29.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates) {
-    if ((0, import_node_fs36.existsSync)((0, import_node_path27.join)(candidate, "skills"))) {
+    if ((0, import_node_fs40.existsSync)((0, import_node_path29.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -21674,7 +22635,7 @@ function registerInitCommand(program2) {
   program2.command("init").description("Initialize Verity in the current project").option("--force", "Overwrite existing skills and hooks").action(async (opts) => {
     const force = opts.force ?? false;
     const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-    const isProject = projectMarkers.some((m) => (0, import_node_fs36.existsSync)(m));
+    const isProject = projectMarkers.some((m) => (0, import_node_fs40.existsSync)(m));
     if (!isProject) {
       printError("No project detected in the current directory.");
       printInfo('Run "verity init" from your project root.');
@@ -21702,30 +22663,30 @@ function registerInitCommand(program2) {
     }
     printInfo(`  Node.js ${nodeVersion} \u2713`);
     try {
-      const gitVersion = (0, import_node_child_process10.execSync)("git --version", { encoding: "utf-8" }).trim();
+      const gitVersion = (0, import_node_child_process11.execSync)("git --version", { encoding: "utf-8" }).trim();
       printInfo(`  ${gitVersion} \u2713`);
     } catch {
       printError("git is required but not installed. Install from https://git-scm.com");
       process.exit(1);
     }
     try {
-      (0, import_node_child_process10.execSync)("which claude", { encoding: "utf-8" });
+      (0, import_node_child_process11.execSync)("which claude", { encoding: "utf-8" });
       printInfo("  Claude Code \u2713");
     } catch {
       printWarn("  Claude Code not found \u2014 hooks will be configured but need Claude Code to run.");
     }
     try {
-      (0, import_node_child_process10.execSync)("which codacy-analysis", { encoding: "utf-8", stdio: "pipe" });
+      (0, import_node_child_process11.execSync)("which codacy-analysis", { encoding: "utf-8", stdio: "pipe" });
       printInfo("  @codacy/analysis-cli \u2713");
     } catch {
       printInfo("  Installing @codacy/analysis-cli...");
       try {
-        (0, import_node_child_process10.execSync)("npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "pipe", timeout: 12e4 });
+        (0, import_node_child_process11.execSync)("npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "pipe", timeout: 12e4 });
         printInfo("  @codacy/analysis-cli installed \u2713");
       } catch {
         try {
           printWarn("  Retrying with sudo...");
-          (0, import_node_child_process10.execSync)("sudo npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
+          (0, import_node_child_process11.execSync)("sudo npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
           printInfo("  @codacy/analysis-cli installed \u2713");
         } catch {
           printWarn("  Could not install @codacy/analysis-cli automatically.");
@@ -21737,21 +22698,21 @@ function registerInitCommand(program2) {
     console.log("");
     printInfo("Installing skills...");
     const dataDir = resolveDataDir();
-    const skillsSource = (0, import_node_path27.join)(dataDir, "skills");
+    const skillsSource = (0, import_node_path29.join)(dataDir, "skills");
     const skillsDest = ".claude/skills";
     const skills = ["verity-setup", "verity-analyze", "verity-status", "verity-feedback", "verity-learn", "verity-memory", "verity-insights", "verity-reflect"];
     let skillsInstalled = 0;
     for (const skill of skills) {
-      const src = (0, import_node_path27.join)(skillsSource, skill);
-      const dest = (0, import_node_path27.join)(skillsDest, skill);
-      if (!(0, import_node_fs36.existsSync)(src)) {
+      const src = (0, import_node_path29.join)(skillsSource, skill);
+      const dest = (0, import_node_path29.join)(skillsDest, skill);
+      if (!(0, import_node_fs40.existsSync)(src)) {
         printWarn(`  Skill data not found: ${skill}`);
         continue;
       }
-      if ((0, import_node_fs36.existsSync)(dest) && !force) {
-        const srcSkill = (0, import_node_path27.join)(src, "SKILL.md");
-        const destSkill = (0, import_node_path27.join)(dest, "SKILL.md");
-        if ((0, import_node_fs36.existsSync)(destSkill)) {
+      if ((0, import_node_fs40.existsSync)(dest) && !force) {
+        const srcSkill = (0, import_node_path29.join)(src, "SKILL.md");
+        const destSkill = (0, import_node_path29.join)(dest, "SKILL.md");
+        if ((0, import_node_fs40.existsSync)(destSkill)) {
           try {
             const srcContent = await (0, import_promises13.readFile)(srcSkill, "utf-8");
             const destContent = await (0, import_promises13.readFile)(destSkill, "utf-8");
@@ -21794,7 +22755,7 @@ function registerInitCommand(program2) {
     } catch (err) {
       printWarn(`  Could not update CLAUDE.md: ${err.message}`);
     }
-    const globalVerityDir = (0, import_node_path27.join)(process.env.HOME ?? "", ".verity");
+    const globalVerityDir = (0, import_node_path29.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises13.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     try {
@@ -21829,8 +22790,8 @@ function registerInitCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-var import_node_fs37 = require("node:fs");
-var import_node_path28 = require("node:path");
+var import_node_fs41 = require("node:fs");
+var import_node_path30 = require("node:path");
 var SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -21849,11 +22810,11 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name of SKILL_NAMES) {
-      const dir = (0, import_node_path28.join)(skillsRoot, name);
-      if ((0, import_node_fs37.existsSync)(dir)) {
+      const dir = (0, import_node_path30.join)(skillsRoot, name);
+      if ((0, import_node_fs41.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name}/`,
-          apply: () => (0, import_node_fs37.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs41.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -21867,24 +22828,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs37.existsSync)(verityDir)) {
+    if ((0, import_node_fs41.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs37.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs41.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs37.existsSync)(verityMd)) {
+      if ((0, import_node_fs41.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs37.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs41.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs37.existsSync)(path) && (0, import_node_fs37.statSync)(path).isDirectory() && (0, import_node_fs37.readdirSync)(path).length === 0) {
-        (0, import_node_fs37.rmdirSync)(path);
+      if ((0, import_node_fs41.existsSync)(path) && (0, import_node_fs41.statSync)(path).isDirectory() && (0, import_node_fs41.readdirSync)(path).length === 0) {
+        (0, import_node_fs41.rmdirSync)(path);
       }
     };
     actions.push({
@@ -21895,11 +22856,11 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path28.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs37.existsSync)(globalVerityDir)) {
+    const globalVerityDir = (0, import_node_path30.join)(home, ".verity");
+    if (purgeGlobal && (0, import_node_fs41.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs37.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs41.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -22093,8 +23054,8 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs38 = require("node:fs");
-var import_node_path29 = require("node:path");
+var import_node_fs42 = require("node:fs");
+var import_node_path31 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -22131,11 +23092,11 @@ function registerResetCommand(program2) {
     }
     const cacheDir = projectPath(CACHE_DIR);
     let purged = 0;
-    if ((0, import_node_fs38.existsSync)(cacheDir)) {
-      for (const entry of (0, import_node_fs38.readdirSync)(cacheDir)) {
+    if ((0, import_node_fs42.existsSync)(cacheDir)) {
+      for (const entry of (0, import_node_fs42.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs38.unlinkSync)((0, import_node_path29.join)(cacheDir, entry));
+            (0, import_node_fs42.unlinkSync)((0, import_node_path31.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -22150,19 +23111,19 @@ function registerResetCommand(program2) {
       projectPath(`${VERITY_DIR}/.last-analysis`)
     ];
     for (const file of filesToClear) {
-      if ((0, import_node_fs38.existsSync)(file)) {
+      if ((0, import_node_fs42.existsSync)(file)) {
         try {
-          (0, import_node_fs38.writeFileSync)(file, "");
+          (0, import_node_fs42.writeFileSync)(file, "");
         } catch {
         }
       }
     }
     if (opts.all) {
       const logsDir = projectPath(`${VERITY_DIR}/.logs`);
-      if ((0, import_node_fs38.existsSync)(logsDir)) {
-        for (const entry of (0, import_node_fs38.readdirSync)(logsDir)) {
+      if ((0, import_node_fs42.existsSync)(logsDir)) {
+        for (const entry of (0, import_node_fs42.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs38.unlinkSync)((0, import_node_path29.join)(logsDir, entry));
+            (0, import_node_fs42.unlinkSync)((0, import_node_path31.join)(logsDir, entry));
           } catch {
           }
         }
@@ -22470,8 +23431,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.30.0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.30.0");
+program.name("verity").description("CLI for Verity quality gate service").version("0.30.1-experimental.67b8921").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.30.1-experimental.67b8921");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();
@@ -22494,6 +23455,7 @@ registerAnalyzeCommand(program);
 registerBaselineCommands(program);
 registerReviewCommand(program);
 registerGuardCommand(program);
+registerIgnoreCommand(program);
 registerInitCommand(program);
 registerUninstallCommand(program);
 registerTaskCommands(program);