@codacy/verity-cli 0.30.1 → 0.31.0-experimental.6bc3b1b

package/bin/verity.js

@@ -10387,6 +10387,7 @@ var CLAUDE_SETTINGS_FILE = ".claude/settings.json";
 var STANDARD_FILE = `${VERITY_DIR}/standard.yaml`;
 var MEMORY_DIR = `${VERITY_DIR}/memory`;
 var CODACY_CONFIG_FILE = ".codacy/codacy.config.json";
+var VERITYIGNORE_FILE = ".verityignore";
 function projectPath(relativePath) {
   return (0, import_node_path.join)(repoRoot(), relativePath);
 }
@@ -10406,6 +10407,13 @@ var CONVERSATION_BUFFER_FILE = `${VERITY_DIR}/.conversation-buffer`;
 var CONVERSATION_MAX_ENTRIES = 10;
 var CONVERSATION_WINDOW_MINUTES = 15;
 var MAX_FINDINGS = 25;
+var GIT_MOMENT_BUDGET = {
+  maxFiles: 120,
+  maxFileBytes: 98304,
+  // 96KB, under the server's 100k chars
+  maxTotalBytes: 583680
+  // 570KB, under the server's 600k chars
+};
 var ANALYZABLE_EXTENSIONS = /* @__PURE__ */ new Set([
   "ts",
   "tsx",
@@ -10477,7 +10485,8 @@ var REVIEWABLE_FILENAMES = /* @__PURE__ */ new Set([
   "Makefile",
   "Dockerfile",
   "Jenkinsfile",
-  "Vagrantfile"
+  "Vagrantfile",
+  ".verityignore"
 ]);
 var REVIEWABLE_PATH_PATTERNS = [
   /\.circleci\//,
@@ -10497,7 +10506,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -10507,6 +10516,7 @@ function githubAppInstallUrl(accountId) {
   return accountId != null ? `https://github.com/apps/${GITHUB_APP_SLUG}/installations/new/permissions?target_id=${accountId}` : GITHUB_APP_INSTALL_URL;
 }
 var ADVISORY_EPISODE_FILE = `${VERITY_DIR}/.advisory-episode`;
+var IGNORE_DECLARATION_FILE = `${VERITY_DIR}/.ignore-declaration`;
 
 // src/lib/output.ts
 var RED = "\x1B[0;31m";
@@ -13530,6 +13540,90 @@ var LEGACY_MD_END = "<!-- gate-memory:end -->";
 var LEGACY_PRESERVE_START = "<!-- gate-memory:preserve -->";
 var LEGACY_PRESERVE_END = "<!-- /gate-memory:preserve -->";
 var CLAUDE_MD_PROSE = [
+  "## Project Memory",
+  "",
+  "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
+  "non-trivial work, scan `.verity/memory/index.md` for decisions, gotchas, and patterns",
+  "that may apply to the change you are about to make. Open specific node files via",
+  "the Read tool when the title or scope suggests relevance.",
+  "",
+  "The graph is auto-maintained by Verity. Files at `.verity/memory/_archive/` are",
+  "superseded \u2014 ignore them unless investigating history.",
+  "",
+  "## Quality gate: accepted risks",
+  "",
+  "When the Verity pre-commit/pre-push gate FAILs, fix the findings \u2014 that is the",
+  'default. Use `verity waive <pattern-id> --file <path> --reason "\u2026"` ONLY to relay',
+  "a risk a human has explicitly accepted: a named code-review finding, an ADR, or",
+  "the user saying so in this conversation. The --reason must cite that source.",
+  "",
+  "Never waive on your own judgment, to get past a block, or pre-emptively. A waive",
+  "binds to the file's current bytes and voids automatically when the file changes,",
+  "and every waive is recorded in the run ledger. For a pattern-level false positive",
+  "use `verity feedback finding <run-id> <pattern-id> false_positive` instead.",
+  "",
+  "> Durable, hand-curated guidance goes in the preserve region below (it survives",
+  "> regeneration) or anywhere OUTSIDE these markers. Everything else between the",
+  "> markers is tool-owned and overwritten on each run.",
+  "",
+  "## Housekeeping Turns",
+  "",
+  "When a turn will be pure housekeeping \u2014 pulling, installing dependencies,",
+  "rebasing, a formatting sweep you are not authoring \u2014 declare it BEFORE doing it:",
+  "",
+  "```bash",
+  'verity ignore --turn --agent --reason "pulling latest before starting"',
+  "```",
+  "",
+  "This skips the review for that turn, which saves the turn Verity would",
+  "otherwise spend saying it had nothing to say. Use `--for 30m` instead of",
+  "`--turn` when a single piece of housekeeping spans several turns.",
+  "",
+  "**It is a claim about the turn, not a way to silence review.** The declaration",
+  "is checked against what the turn actually did: if anything is authored \u2014 by you,",
+  "by a subagent, or by a shell command that can write files \u2014 it voids, the review",
+  "runs anyway, and the broken declaration is reported. So declare housekeeping you",
+  "are about to do, never work you have already done, and never as a way to get past",
+  "a finding. Declarations are budgeted per session and every one is recorded with",
+  "its reason."
+].join("\n");
+var CLAUDE_MD_PROSE_PRE_WAIVE = [
+  "## Project Memory",
+  "",
+  "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
+  "non-trivial work, scan `.verity/memory/index.md` for decisions, gotchas, and patterns",
+  "that may apply to the change you are about to make. Open specific node files via",
+  "the Read tool when the title or scope suggests relevance.",
+  "",
+  "The graph is auto-maintained by Verity. Files at `.verity/memory/_archive/` are",
+  "superseded \u2014 ignore them unless investigating history.",
+  "",
+  "> Durable, hand-curated guidance goes in the preserve region below (it survives",
+  "> regeneration) or anywhere OUTSIDE these markers. Everything else between the",
+  "> markers is tool-owned and overwritten on each run.",
+  "",
+  "## Housekeeping Turns",
+  "",
+  "When a turn will be pure housekeeping \u2014 pulling, installing dependencies,",
+  "rebasing, a formatting sweep you are not authoring \u2014 declare it BEFORE doing it:",
+  "",
+  "```bash",
+  'verity ignore --turn --agent --reason "pulling latest before starting"',
+  "```",
+  "",
+  "This skips the review for that turn, which saves the turn Verity would",
+  "otherwise spend saying it had nothing to say. Use `--for 30m` instead of",
+  "`--turn` when a single piece of housekeeping spans several turns.",
+  "",
+  "**It is a claim about the turn, not a way to silence review.** The declaration",
+  "is checked against what the turn actually did: if anything is authored \u2014 by you,",
+  "by a subagent, or by a shell command that can write files \u2014 it voids, the review",
+  "runs anyway, and the broken declaration is reported. So declare housekeeping you",
+  "are about to do, never work you have already done, and never as a way to get past",
+  "a finding. Declarations are budgeted per session and every one is recorded with",
+  "its reason."
+].join("\n");
+var CLAUDE_MD_PROSE_PRE_IGNORE = [
   "## Project Memory",
   "",
   "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
@@ -13654,7 +13748,12 @@ function extractPreserveContent(interior) {
 }
 function stripKnownProse(interior) {
   const trimmed = interior.replace(/^\n+/, "");
-  for (const prose of [CLAUDE_MD_PROSE, CLAUDE_MD_PROSE_LEGACY]) {
+  for (const prose of [
+    CLAUDE_MD_PROSE,
+    CLAUDE_MD_PROSE_PRE_WAIVE,
+    CLAUDE_MD_PROSE_PRE_IGNORE,
+    CLAUDE_MD_PROSE_LEGACY
+  ]) {
     if (trimmed.startsWith(prose)) return trimmed.slice(prose.length);
   }
   return trimmed;
@@ -16270,7 +16369,145 @@ async function readHookStdin() {
 
 // src/commands/standard.ts
 var import_promises9 = require("node:fs/promises");
+var import_node_fs20 = require("node:fs");
 var import_yaml = __toESM(require_dist());
+
+// src/lib/verityignore.ts
+var import_node_fs19 = require("node:fs");
+var EMPTY = { rules: [], securityOverlap: [], problems: [] };
+var SECURITY_PROBES = [
+  ".env",
+  ".env.local",
+  ".env.production",
+  "config/.env",
+  "services/api/.env",
+  "package-lock.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "Cargo.lock",
+  "go.sum",
+  "Gemfile.lock",
+  "Dockerfile",
+  "docker/Dockerfile"
+];
+function isSecuritySensitive(path) {
+  return SECURITY_PATTERNS.some((p) => p.test(path));
+}
+function compile(pattern) {
+  let p = pattern;
+  const dirOnly = p.endsWith("/");
+  if (dirOnly) p = p.slice(0, -1);
+  const anchored = p.includes("/");
+  if (p.startsWith("/")) p = p.slice(1);
+  const base = anchored ? p : `**/${p}`;
+  const forms = dirOnly ? [`${base}/**/*`] : [base, `${base}/**`];
+  const regexes = [];
+  for (const f of forms) {
+    try {
+      regexes.push(globToRegex(f));
+    } catch {
+    }
+  }
+  if (regexes.length === 0) return () => false;
+  return (path) => regexes.some((r) => r.test(path));
+}
+function parseVerityIgnore(content) {
+  const rules = [];
+  const problems = [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const lineNo = i + 1;
+    let raw = lines[i];
+    raw = raw.replace(/(?<!\\)\s+$/, "");
+    if (raw.length === 0) continue;
+    if (raw.startsWith("#")) continue;
+    let negated = false;
+    if (raw.startsWith("!")) {
+      negated = true;
+      raw = raw.slice(1);
+    } else if (raw.startsWith("\\!") || raw.startsWith("\\#")) {
+      raw = raw.slice(1);
+    }
+    if (raw.length === 0) {
+      problems.push(`line ${lineNo}: "!" with no pattern after it`);
+      continue;
+    }
+    if (raw === "**" || raw === "*" || raw === "/" || raw === "**/*") {
+      problems.push(
+        `line ${lineNo}: "${raw}" would exclude the whole repository from review \u2014 refused. List the directories you mean instead.`
+      );
+      continue;
+    }
+    rules.push({ raw, line: lineNo, negated, test: compile(raw) });
+  }
+  const byRule = /* @__PURE__ */ new Map();
+  for (const probe of SECURITY_PROBES) {
+    let responsible = null;
+    for (const rule of rules) {
+      if (rule.test(probe)) responsible = rule.negated ? null : rule;
+    }
+    if (!responsible) continue;
+    const entry = byRule.get(responsible.line) ?? { raw: responsible.raw, line: responsible.line, hides: [] };
+    entry.hides.push(probe);
+    byRule.set(responsible.line, entry);
+  }
+  const securityOverlap = [...byRule.values()].sort((a, b) => a.line - b.line);
+  return { rules, securityOverlap, problems };
+}
+function decide(rules, path) {
+  let excluded = false;
+  for (const rule of rules) {
+    if (rule.test(path)) excluded = !rule.negated;
+  }
+  return excluded;
+}
+function isIgnored(ig, path) {
+  return decide(ig.rules, path);
+}
+function loadVerityIgnore() {
+  const file = projectPath(VERITYIGNORE_FILE);
+  if (!(0, import_node_fs19.existsSync)(file)) return EMPTY;
+  try {
+    return parseVerityIgnore((0, import_node_fs19.readFileSync)(file, "utf-8"));
+  } catch {
+    return EMPTY;
+  }
+}
+function partitionIgnored(paths, ig) {
+  const suspended = paths.some((p) => p === VERITYIGNORE_FILE);
+  if (suspended || ig.rules.length === 0) {
+    return { rules: ig.rules.length, kept: [...paths], ignored: [], securityExcluded: [], suspended };
+  }
+  const kept = [];
+  const ignored = [];
+  for (const p of paths) {
+    if (p !== VERITYIGNORE_FILE && isIgnored(ig, p)) ignored.push(p);
+    else kept.push(p);
+  }
+  return {
+    rules: ig.rules.length,
+    kept,
+    ignored,
+    securityExcluded: ignored.filter(isSecuritySensitive),
+    suspended: false
+  };
+}
+function ignoreShare(kept, ignored) {
+  const total = kept + ignored;
+  if (total === 0) return 0;
+  return Math.round(ignored / total * 1e3) / 1e3;
+}
+function describeSecurityOverlap(ig) {
+  if (ig.securityOverlap.length === 0) return null;
+  const lines = ig.securityOverlap.map(
+    (o) => `  line ${o.line}: "${o.raw}" would hide ${o.hides.slice(0, 3).join(", ")}` + (o.hides.length > 3 ? ` (+${o.hides.length - 3} more)` : "")
+  );
+  return `.verityignore: ${ig.securityOverlap.length} pattern(s) can hide security-sensitive files from review:
+${lines.join("\n")}
+These are still excluded \u2014 this is a warning, not a refusal. Add a \`!\` rule to keep one in scope, e.g. \`!.env*\`.`;
+}
+
+// src/commands/standard.ts
 function registerStandardCommands(program2) {
   const standard = program2.command("standard").description("Manage the project Standard");
   standard.command("push").description("Upload the project Standard to the service").option("--file <path>", "Path to standard YAML file", STANDARD_FILE).option("--created-by <name>", "Who created this version", "claude-code").action(async (opts) => {
@@ -16299,12 +16536,25 @@ function registerStandardCommands(program2) {
       printError(`Invalid YAML in ${opts.file}: ${err.message}`);
       process.exit(1);
     }
+    let ignoreRaw = null;
+    const ignorePath = projectPath(VERITYIGNORE_FILE);
+    if ((0, import_node_fs20.existsSync)(ignorePath)) {
+      try {
+        ignoreRaw = (0, import_node_fs20.readFileSync)(ignorePath, "utf-8");
+        const overlap = describeSecurityOverlap(parseVerityIgnore(ignoreRaw));
+        if (overlap) printWarn(overlap);
+      } catch {
+      }
+    }
     const result = await apiRequest({
       method: "POST",
       path: "/standards",
       serviceUrl: urlResult.data,
       token: tokenResult.data.token,
-      body: { content, created_by: opts.createdBy },
+      body: {
+        content: ignoreRaw === null ? content : { ...content, verityignore: ignoreRaw },
+        created_by: opts.createdBy
+      },
       verbose: globals.verbose
     });
     if (!result.ok) {
@@ -16381,6 +16631,15 @@ function registerStandardCommands(program2) {
 var import_promises10 = require("node:fs/promises");
 function registerConfigCommands(program2) {
   const config = program2.command("config").description("Manage analysis configuration");
+  config.command("service-url").description("Print the resolved service URL (used by the shipped skills)").action(async () => {
+    const globals = program2.opts();
+    const urlResult = await resolveServiceUrl(globals.serviceUrl);
+    if (!urlResult.ok) {
+      printError(urlResult.error);
+      process.exit(1);
+    }
+    process.stdout.write(urlResult.data + "\n");
+  });
   config.command("push").description("Upload the analysis config to the service").option("--file <path>", "Path to config file", CODACY_CONFIG_FILE).action(async (opts) => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
@@ -16522,99 +16781,402 @@ function formatRunDetail(run) {
   return lines;
 }
 
-// src/commands/status.ts
-function timeAgo(isoDate) {
-  const ms = Date.now() - new Date(isoDate).getTime();
-  const mins = Math.floor(ms / 6e4);
-  if (mins < 1) return "just now";
-  if (mins < 60) return `${mins}m ago`;
-  const hrs = Math.floor(mins / 60);
-  if (hrs < 24) return `${hrs}h ago`;
-  const days = Math.floor(hrs / 24);
-  return `${days}d ago`;
+// src/lib/ignore-declaration.ts
+var import_node_fs22 = require("node:fs");
+
+// src/lib/debounce.ts
+var import_node_fs21 = require("node:fs");
+var import_node_crypto10 = require("node:crypto");
+function scopedFile(base, sessionId) {
+  if (!sessionId) return base;
+  return `${base}.${(0, import_node_crypto10.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
 }
-function registerStatusCommand(program2) {
-  program2.command("status").description("Show project quality status").option("--history", "Include recent run history").option("--limit <n>", "Number of history entries", "5").option("--json", "Output raw JSON").action(async (opts) => {
-    const globals = program2.opts();
-    const tokenResult = await resolveToken(globals.token);
-    if (!tokenResult.ok) {
-      printError(tokenResult.error);
-      process.exit(1);
-    }
-    const urlResult = await resolveServiceUrl(globals.serviceUrl);
-    if (!urlResult.ok) {
-      printError(urlResult.error);
-      process.exit(1);
-    }
-    const token = tokenResult.data.token;
-    const serviceUrl = urlResult.data;
-    const who = await whoami(token, serviceUrl, globals.verbose);
-    const memResult = await apiRequest({
-      method: "GET",
-      path: "/memory",
-      serviceUrl,
-      token,
-      verbose: globals.verbose
-    });
-    const denial = memResult.ok ? null : authDenialRemedy(memResult.error);
-    if (!memResult.ok && !denial) {
-      printError(memResult.error);
-      process.exit(1);
+function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
+  const file = scopedFile(DEBOUNCE_FILE, sessionId);
+  if (!(0, import_node_fs21.existsSync)(file)) return null;
+  try {
+    const lastTs = parseInt((0, import_node_fs21.readFileSync)(file, "utf-8").trim(), 10);
+    const nowTs = Math.floor(Date.now() / 1e3);
+    const elapsed = nowTs - lastTs;
+    if (elapsed < debounceSeconds) {
+      return `Debounced \u2014 last analysis was ${elapsed}s ago`;
     }
-    const mem = memResult.ok ? memResult.data : null;
-    if (opts.json) {
-      const output = {
-        auth: who.ok ? who.data : { error: who.error },
-        memory: mem
-      };
-      if (denial && !memResult.ok) {
-        output.error = { code: denial.code, message: memResult.error, remedy: denial.remedy };
-      }
-      if (opts.history && !denial) {
-        const runsResult = await apiRequest({
-          method: "GET",
-          path: `/runs?limit=${opts.limit}`,
-          serviceUrl,
-          token,
-          verbose: globals.verbose
-        });
-        if (runsResult.ok) {
-          output.runs = runsResult.data.runs;
-        }
+  } catch {
+  }
+  return null;
+}
+function checkMtime(files, bypassForRecentCommits, sessionId) {
+  if (bypassForRecentCommits) return null;
+  const file = scopedFile(DEBOUNCE_FILE, sessionId);
+  if (!(0, import_node_fs21.existsSync)(file)) return null;
+  let debounceTime;
+  try {
+    debounceTime = (0, import_node_fs21.statSync)(file).mtimeMs;
+  } catch {
+    return null;
+  }
+  for (const f of files) {
+    const resolved = resolveFile(f);
+    if (!resolved) continue;
+    try {
+      const stat3 = (0, import_node_fs21.statSync)(resolved);
+      if (stat3.mtimeMs > debounceTime) {
+        return null;
       }
-      printJson(output);
-      return;
-    }
-    if (mem?.configured === false) {
-      printInfo("Verity is not configured for this project. Run /verity-setup.");
-      return;
-    }
-    printInfo("=== Verity Status ===");
-    if (who.ok && who.data.logged_in) {
-      printInfo(`Account:     Logged in as ${who.data.email ?? `user #${who.data.user_id}`} \u2713`);
-    } else if (who.ok && who.data.anonymous) {
-      printInfo('Account:     Anonymous \u2014 runs not saved, no cloud memory. Run "verity login".');
-    } else if (tokenResult.data.userId != null) {
-      printInfo(`Account:     Logged in as ${tokenResult.data.email ?? `user #${tokenResult.data.userId}`} (cached \u2014 could not reach the Verity service) \u2713`);
-    } else if (!who.ok) {
-      printInfo(`Account:     Unknown \u2014 could not reach the Verity service (${who.error})`);
+    } catch {
+      continue;
     }
-    if (who.ok) {
-      const nudge = reverifyNudge(who.data);
-      if (nudge) printWarn(`             ${nudge}`);
+  }
+  return "No files modified since last analysis";
+}
+function computeContentHash(files) {
+  const hash = (0, import_node_crypto10.createHash)("sha1");
+  const sorted = [...files].sort();
+  for (const f of sorted) {
+    const resolved = resolveFile(f) ?? f;
+    try {
+      if ((0, import_node_fs21.existsSync)(resolved)) {
+        hash.update((0, import_node_fs21.readFileSync)(resolved));
+      }
+    } catch {
     }
-    if (denial) {
-      printWarn(`Access:      ${denial.remedy}`);
-      printInfo("             Project status, history, and cloud memory stay unavailable until then.");
+  }
+  return hash.digest("hex");
+}
+function checkContentHash(files, sessionId) {
+  const hash = computeContentHash(files);
+  const file = scopedFile(HASH_FILE, sessionId);
+  if ((0, import_node_fs21.existsSync)(file)) {
+    try {
+      const storedHash = (0, import_node_fs21.readFileSync)(file, "utf-8").trim();
+      if (hash === storedHash) {
+        return { skip: "No source changes since last analysis", hash };
+      }
+    } catch {
     }
-    if (mem?.project_name) printInfo(`Project:     ${mem.project_name}`);
-    if (mem?.standard) {
-      const s = mem.standard;
-      printInfo(`Standard:    v${s.version} (${s.quality_dimensions} quality, ${s.security_patterns} security, ${s.custom_patterns} custom)`);
-      printInfo(`Languages:   ${s.languages.join(", ")}`);
+  }
+  return { skip: null, hash };
+}
+function recordAnalysisStart(sessionId) {
+  (0, import_node_fs21.mkdirSync)(VERITY_DIR, { recursive: true });
+  (0, import_node_fs21.writeFileSync)(scopedFile(DEBOUNCE_FILE, sessionId), String(Math.floor(Date.now() / 1e3)));
+}
+function recordPassHash(hash, sessionId) {
+  (0, import_node_fs21.writeFileSync)(scopedFile(HASH_FILE, sessionId), hash);
+}
+function narrowToRecent(files, sessionId) {
+  const file = scopedFile(DEBOUNCE_FILE, sessionId);
+  if (!(0, import_node_fs21.existsSync)(file)) return files;
+  let debounceTime;
+  try {
+    debounceTime = (0, import_node_fs21.statSync)(file).mtimeMs;
+  } catch {
+    return files;
+  }
+  const recent = files.filter((f) => {
+    try {
+      return (0, import_node_fs21.existsSync)(f) && (0, import_node_fs21.statSync)(f).mtimeMs > debounceTime;
+    } catch {
+      return false;
     }
-    const hookStatus = await checkAllVerityHooks();
-    const moments = [];
+  });
+  return recent.length > 0 ? recent : files;
+}
+function readIteration(currentCommit, _contentHash) {
+  return Math.max(1, readBlockState(currentCommit).attempts);
+}
+var NO_BLOCKS = { attempts: 0, blocks: 0, fingerprint: null };
+function readBlockState(currentCommit, opts) {
+  if (opts?.newUserPrompt) return NO_BLOCKS;
+  if (!(0, import_node_fs21.existsSync)(ITERATION_FILE)) return NO_BLOCKS;
+  try {
+    const stored = (0, import_node_fs21.readFileSync)(ITERATION_FILE, "utf-8").trim();
+    const parsed = stored.startsWith("{") ? parseJsonState(stored) : parseLegacyState(stored);
+    if (!parsed) return NO_BLOCKS;
+    if (parsed.commit !== currentCommit) return NO_BLOCKS;
+    if (parsed.ts > 0 && Math.floor(Date.now() / 1e3) - parsed.ts > 600) return NO_BLOCKS;
+    return { attempts: parsed.attempts, blocks: parsed.blocks, fingerprint: parsed.fingerprint };
+  } catch {
+    return NO_BLOCKS;
+  }
+}
+function parseJsonState(raw) {
+  const o = JSON.parse(raw);
+  const attempts = typeof o.attempts === "number" ? o.attempts : NaN;
+  if (isNaN(attempts)) return null;
+  return {
+    attempts,
+    blocks: typeof o.blocks === "number" ? o.blocks : attempts,
+    fingerprint: typeof o.fingerprint === "string" && o.fingerprint ? o.fingerprint : null,
+    commit: typeof o.commit === "string" ? o.commit : "",
+    ts: typeof o.ts === "number" ? o.ts : 0
+  };
+}
+function parseLegacyState(raw) {
+  const parts = raw.split(":");
+  const n = parseInt(parts[0], 10);
+  if (isNaN(n)) return null;
+  return {
+    attempts: n,
+    // The old file has no separate block count; the old counter is the closest
+    // honest answer, and it errs toward releasing sooner rather than later.
+    blocks: n,
+    fingerprint: parts.slice(3).join(":") || null,
+    commit: parts[1] ?? "",
+    ts: parseInt(parts[2] ?? "0", 10)
+  };
+}
+function findingsFingerprint(findings) {
+  const keys = findings.map((f) => `${String(f.pattern_id ?? "?")}|${String(f.file ?? "?")}`).filter((k) => k !== "?|?");
+  return [...new Set(keys)].sort().join(",");
+}
+function isSameProblem(previous, current) {
+  if (!previous || !current) return false;
+  const prev = new Set(previous.split(","));
+  return current.split(",").some((k) => prev.has(k));
+}
+function writeBlockState(commit, state) {
+  (0, import_node_fs21.mkdirSync)(VERITY_DIR, { recursive: true });
+  (0, import_node_fs21.writeFileSync)(
+    ITERATION_FILE,
+    JSON.stringify({
+      v: 2,
+      attempts: state.attempts,
+      blocks: state.blocks,
+      commit,
+      ts: Math.floor(Date.now() / 1e3),
+      fingerprint: state.fingerprint ?? void 0
+    })
+  );
+}
+function resetBlockState(commit) {
+  writeBlockState(commit, { attempts: 0, blocks: 0, fingerprint: null });
+}
+
+// src/lib/ignore-declaration.ts
+var IGNORE_BUDGET = 3;
+var MAX_WINDOW_SECONDS = 60 * 60;
+var TURN_FUSE_SECONDS = 10 * 60;
+function parseDuration(input) {
+  const trimmed = input.trim().toLowerCase();
+  const m = /^(\d+)(s|m|h)?$/.exec(trimmed);
+  if (!m) {
+    return { ok: false, error: `Could not read "${input}" as a duration. Use 30m, 45s, or 1h.` };
+  }
+  const n = parseInt(m[1], 10);
+  if (!Number.isFinite(n) || n <= 0) {
+    return { ok: false, error: `A duration must be a positive number of seconds, minutes or hours \u2014 got "${input}".` };
+  }
+  const unit = m[2] ?? "m";
+  const seconds = unit === "s" ? n : unit === "h" ? n * 3600 : n * 60;
+  if (seconds > MAX_WINDOW_SECONDS) {
+    return {
+      ok: false,
+      error: `${input} is longer than the ${MAX_WINDOW_SECONDS / 60}-minute maximum. An ignore is meant to cover one piece of housekeeping, not a sitting \u2014 declare it again when you need it.`
+    };
+  }
+  return { ok: true, seconds };
+}
+function resolveActive(state, now) {
+  if (!state?.active) return null;
+  if (state.active.expires <= now) return null;
+  return state.active;
+}
+function verifyDeclaration(input) {
+  const d = input.declaration;
+  if (!d) return { honoured: false, void: false };
+  if (!input.authorshipIsObservable) {
+    return {
+      honoured: false,
+      void: true,
+      why: "the transcript window could not show what this turn did, so the declaration could not be checked"
+    };
+  }
+  if (input.commandRecordTruncated) {
+    return {
+      honoured: false,
+      void: true,
+      why: "the record of commands run this turn was incomplete, so the declaration could not be checked"
+    };
+  }
+  if (input.agentAuthoredFiles > 0) {
+    return {
+      honoured: false,
+      void: true,
+      why: `${input.agentAuthoredFiles} file${input.agentAuthoredFiles === 1 ? " was" : "s were"} authored during it`
+    };
+  }
+  if (input.subagents > 0) {
+    return {
+      honoured: false,
+      void: true,
+      why: "work was delegated to a subagent during it, whose authorship this turn cannot account for"
+    };
+  }
+  const authoring = [...input.agentCommands ?? [], ...input.userCommands ?? []].filter(
+    (c) => !isNonAuthoringCommand(c)
+  );
+  if (authoring.length > 0) {
+    return {
+      honoured: false,
+      void: true,
+      why: `a command that can write files ran during it (${authoring[0]})`
+    };
+  }
+  return { honoured: true };
+}
+function stateFile(sessionId) {
+  return projectPath(scopedFile(IGNORE_DECLARATION_FILE, sessionId));
+}
+function ignoreStateKeys(token, sessionId) {
+  const scoped = sessionScopeKey(token, sessionId);
+  const userOnly = sessionScopeKey(token, void 0);
+  return scoped === userOnly ? [scoped] : [scoped, userOnly];
+}
+function resolveIgnoreState(keys) {
+  for (const key of keys) {
+    const state = readIgnoreState(key);
+    if (state) return { state, key };
+  }
+  return null;
+}
+function readIgnoreState(sessionId) {
+  const file = stateFile(sessionId);
+  if (!(0, import_node_fs22.existsSync)(file)) return null;
+  try {
+    const o = JSON.parse((0, import_node_fs22.readFileSync)(file, "utf-8")) ?? {};
+    const spent = typeof o.spent === "number" ? o.spent : 0;
+    const raw = o.active;
+    let active = null;
+    if (raw && typeof raw === "object") {
+      const scope2 = raw.scope === "window" ? "window" : raw.scope === "turn" ? "turn" : null;
+      const expires = typeof raw.expires === "number" ? raw.expires : null;
+      if (scope2 && expires != null) {
+        active = {
+          scope: scope2,
+          origin: raw.origin === "agent" ? "agent" : "user",
+          reason: typeof raw.reason === "string" ? raw.reason : "",
+          at: typeof raw.at === "number" ? raw.at : 0,
+          expires
+        };
+      }
+    }
+    return { v: 1, active, spent };
+  } catch {
+    return null;
+  }
+}
+function writeIgnoreState(state, sessionId) {
+  try {
+    (0, import_node_fs22.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
+    (0, import_node_fs22.writeFileSync)(stateFile(sessionId), JSON.stringify({ v: 1, active: state.active, spent: state.spent }));
+  } catch {
+  }
+}
+function clearActiveDeclaration(sessionId) {
+  const prev = readIgnoreState(sessionId);
+  if (!prev) return;
+  writeIgnoreState({ v: 1, active: null, spent: prev.spent }, sessionId);
+}
+function describeRemaining(d, now) {
+  const left = Math.max(0, d.expires - now);
+  if (left >= 90) return `${Math.round(left / 60)}m left`;
+  return `${left}s left`;
+}
+
+// src/commands/status.ts
+function timeAgo(isoDate) {
+  const ms = Date.now() - new Date(isoDate).getTime();
+  const mins = Math.floor(ms / 6e4);
+  if (mins < 1) return "just now";
+  if (mins < 60) return `${mins}m ago`;
+  const hrs = Math.floor(mins / 60);
+  if (hrs < 24) return `${hrs}h ago`;
+  const days = Math.floor(hrs / 24);
+  return `${days}d ago`;
+}
+function registerStatusCommand(program2) {
+  program2.command("status").description("Show project quality status").option("--history", "Include recent run history").option("--limit <n>", "Number of history entries", "5").option("--json", "Output raw JSON").action(async (opts) => {
+    const globals = program2.opts();
+    const tokenResult = await resolveToken(globals.token);
+    if (!tokenResult.ok) {
+      printError(tokenResult.error);
+      process.exit(1);
+    }
+    const urlResult = await resolveServiceUrl(globals.serviceUrl);
+    if (!urlResult.ok) {
+      printError(urlResult.error);
+      process.exit(1);
+    }
+    const token = tokenResult.data.token;
+    const serviceUrl = urlResult.data;
+    const who = await whoami(token, serviceUrl, globals.verbose);
+    const memResult = await apiRequest({
+      method: "GET",
+      path: "/memory",
+      serviceUrl,
+      token,
+      verbose: globals.verbose
+    });
+    const denial = memResult.ok ? null : authDenialRemedy(memResult.error);
+    if (!memResult.ok && !denial) {
+      printError(memResult.error);
+      process.exit(1);
+    }
+    const mem = memResult.ok ? memResult.data : null;
+    if (opts.json) {
+      const output = {
+        auth: who.ok ? who.data : { error: who.error },
+        memory: mem
+      };
+      if (denial && !memResult.ok) {
+        output.error = { code: denial.code, message: memResult.error, remedy: denial.remedy };
+      }
+      if (opts.history && !denial) {
+        const runsResult = await apiRequest({
+          method: "GET",
+          path: `/runs?limit=${opts.limit}`,
+          serviceUrl,
+          token,
+          verbose: globals.verbose
+        });
+        if (runsResult.ok) {
+          output.runs = runsResult.data.runs;
+        }
+      }
+      printJson(output);
+      return;
+    }
+    if (mem?.configured === false) {
+      printInfo("Verity is not configured for this project. Run /verity-setup.");
+      return;
+    }
+    printInfo("=== Verity Status ===");
+    if (who.ok && who.data.logged_in) {
+      printInfo(`Account:     Logged in as ${who.data.email ?? `user #${who.data.user_id}`} \u2713`);
+    } else if (who.ok && who.data.anonymous) {
+      printInfo('Account:     Anonymous \u2014 runs not saved, no cloud memory. Run "verity login".');
+    } else if (tokenResult.data.userId != null) {
+      printInfo(`Account:     Logged in as ${tokenResult.data.email ?? `user #${tokenResult.data.userId}`} (cached \u2014 could not reach the Verity service) \u2713`);
+    } else if (!who.ok) {
+      printInfo(`Account:     Unknown \u2014 could not reach the Verity service (${who.error})`);
+    }
+    if (who.ok) {
+      const nudge = reverifyNudge(who.data);
+      if (nudge) printWarn(`             ${nudge}`);
+    }
+    if (denial) {
+      printWarn(`Access:      ${denial.remedy}`);
+      printInfo("             Project status, history, and cloud memory stay unavailable until then.");
+    }
+    if (mem?.project_name) printInfo(`Project:     ${mem.project_name}`);
+    if (mem?.standard) {
+      const s = mem.standard;
+      printInfo(`Standard:    v${s.version} (${s.quality_dimensions} quality, ${s.security_patterns} security, ${s.custom_patterns} custom)`);
+      printInfo(`Languages:   ${s.languages.join(", ")}`);
+    }
+    const hookStatus = await checkAllVerityHooks();
+    const moments = [];
     if (hookStatus.stop) moments.push("stop");
     if (hookStatus.guardOn.includes("commit")) moments.push("pre-commit");
     if (hookStatus.guardOn.includes("push")) moments.push("pre-push/PR");
@@ -16630,6 +17192,39 @@ function registerStatusCommand(program2) {
       printInfo(`Trend:       ${r.trend}`);
       printInfo(`Runs:        ${r.count} recorded`);
     }
+    {
+      const tokenForScope = tokenResult.data.token;
+      const found = resolveIgnoreState(
+        ignoreStateKeys(tokenForScope, process.env.CLAUDE_SESSION_ID || void 0)
+      );
+      const now = Math.floor(Date.now() / 1e3);
+      const active = resolveActive(found?.state ?? null, now);
+      const spent = found?.state.spent ?? 0;
+      if (active) {
+        printInfo("");
+        printInfo("--- Ignore Declared ---");
+        printInfo(`Scope:       ${active.scope === "turn" ? "the next turn" : `a window, ${describeRemaining(active, now)}`}`);
+        printInfo(`Reason:      ${active.reason}`);
+        printInfo(`Declared by: ${active.origin === "agent" ? "the agent" : "you"}`);
+        printInfo(`Budget:      ${spent}/${IGNORE_BUDGET} declarations this session`);
+        printInfo('Turns that author anything are still reviewed \u2014 the declaration voids. "verity ignore clear" cancels it.');
+      } else if (spent > 0) {
+        printInfo("");
+        printInfo(`Ignore budget: ${spent}/${IGNORE_BUDGET} declarations used this session.`);
+      }
+    }
+    {
+      const ig = loadVerityIgnore();
+      if (ig.rules.length > 0 || ig.problems.length > 0) {
+        printInfo("");
+        printInfo("--- .verityignore ---");
+        printInfo(`Rules:       ${ig.rules.length}`);
+        for (const problem of ig.problems) printWarn(`  ${problem}`);
+        const overlap = describeSecurityOverlap(ig);
+        if (overlap) printWarn(overlap);
+        printInfo("An edit to .verityignore suspends every rule for that turn \u2014 the edit is always reviewed.");
+      }
+    }
     if (mem.pending_items && mem.pending_items.length > 0) {
       printInfo("");
       printInfo("--- Pending Items ---");
@@ -16793,6 +17388,7 @@ function createRun(opts, globals) {
     allChanged: [],
     hasRecentCommitFiles: false,
     changedUniverse: [],
+    verityIgnored: { rules: 0, kept: [], ignored: [], securityExcluded: [], suspended: false },
     analyzable: [],
     reviewable: [],
     securityFiles: [],
@@ -16826,6 +17422,7 @@ function createRun(opts, globals) {
     deletedNodePaths: [],
     editedUploads: [],
     autoSeedNotice: null,
+    voidedIgnoreNotice: null,
     foldResult: null,
     foldConservation: null,
     memorySession: null,
@@ -16846,7 +17443,7 @@ function createRun(opts, globals) {
 }
 
 // src/lib/stderr-log.ts
-var import_node_fs19 = require("node:fs");
+var import_node_fs23 = require("node:fs");
 var TOKEN_RE2 = /verity_[0-9a-f]{16,}/g;
 var ANSI_RE = /\u001b\[[0-?]*[ -/]*[@-~]/g;
 function scrub(s) {
@@ -16859,9 +17456,9 @@ function append(text) {
   try {
     const dir = projectPath(DEBUG_LOG_DIR);
     const file = projectPath(STDERR_LOG_FILE);
-    (0, import_node_fs19.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs23.mkdirSync)(dir, { recursive: true });
     rotateIfNeeded(file);
-    (0, import_node_fs19.appendFileSync)(file, text);
+    (0, import_node_fs23.appendFileSync)(file, text);
   } catch {
   }
 }
@@ -17019,7 +17616,7 @@ function installRunEvidence(run) {
 
 // src/lib/git-frame.ts
 var import_node_child_process7 = require("node:child_process");
-var import_node_fs20 = require("node:fs");
+var import_node_fs24 = require("node:fs");
 var import_node_os3 = require("node:os");
 var import_node_path18 = require("node:path");
 var import_node_path19 = require("node:path");
@@ -17158,14 +17755,14 @@ function gitAt(dir, args) {
 }
 function realpathOr(p) {
   try {
-    return import_node_fs20.realpathSync.native(p);
+    return import_node_fs24.realpathSync.native(p);
   } catch {
     return (0, import_node_path18.resolve)(p);
   }
 }
 function resolveFrame(input) {
   const found = findMomentSegment(input.command, input.on);
-  const hookDirUsable = !!input.hookCwd && (0, import_node_fs20.existsSync)(input.hookCwd);
+  const hookDirUsable = !!input.hookCwd && (0, import_node_fs24.existsSync)(input.hookCwd);
   const baseDir = hookDirUsable ? input.hookCwd : process.cwd();
   let anchor = hookDirUsable ? "hook-cwd" : "process-cwd";
   const refuse = (refusal) => ({
@@ -17188,7 +17785,7 @@ function resolveFrame(input) {
     if (dirs.size > 1) return refuse(`target:multiple ${found.moment} targets in one command`);
     const targetDir = dirs.size === 1 ? [...dirs][0] : baseDir;
     if (targetDir !== baseDir) {
-      if (!(0, import_node_fs20.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
+      if (!(0, import_node_fs24.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
       dir = targetDir;
     }
   }
@@ -17227,7 +17824,7 @@ var SHA_RE2 = /^[0-9a-f]{40}$/;
 function baselineShaAt(frame) {
   if (!frame.worktreeRoot) return null;
   try {
-    const sha = (0, import_node_fs20.readFileSync)((0, import_node_path19.join)(frame.worktreeRoot, BASELINE_SHA_FILE), "utf-8").trim();
+    const sha = (0, import_node_fs24.readFileSync)((0, import_node_path19.join)(frame.worktreeRoot, BASELINE_SHA_FILE), "utf-8").trim();
     if (!SHA_RE2.test(sha)) return null;
     return refResolves(frame, sha) ? sha : null;
   } catch {
@@ -17340,7 +17937,7 @@ function truthy(v) {
 }
 
 // src/lib/transcript.ts
-var import_node_fs21 = require("node:fs");
+var import_node_fs25 = require("node:fs");
 var MAX_READ_BYTES = 256 * 1024;
 var SMALL_FILE_BYTES = 64 * 1024;
 var MAX_FILES_LIST = 20;
@@ -17366,7 +17963,7 @@ async function extractActionSummary(transcriptPath) {
 function readTurnLines(transcriptPath) {
   let size;
   try {
-    size = (0, import_node_fs21.statSync)(transcriptPath).size;
+    size = (0, import_node_fs25.statSync)(transcriptPath).size;
   } catch {
     return null;
   }
@@ -17374,7 +17971,7 @@ function readTurnLines(transcriptPath) {
   let raw;
   let windowed = false;
   if (size <= SMALL_FILE_BYTES) {
-    raw = (0, import_node_fs21.readFileSync)(transcriptPath, "utf-8");
+    raw = (0, import_node_fs25.readFileSync)(transcriptPath, "utf-8");
   } else {
     windowed = true;
     const buf = Buffer.alloc(Math.min(MAX_READ_BYTES, size));
@@ -17432,6 +18029,7 @@ function buildSummary(lines) {
   const commands = [];
   const userCommands = [];
   let userCommandsTruncated = false;
+  let commandsTruncated = false;
   let searches = 0;
   let subagents = 0;
   let webFetches = 0;
@@ -17472,7 +18070,10 @@ function buildSummary(lines) {
       totalToolCalls++;
       const toolName = block.name ?? "unknown";
       toolCounts[toolName] = (toolCounts[toolName] ?? 0) + 1;
-      if (totalToolCalls > MAX_TOOL_BLOCKS) continue;
+      if (totalToolCalls > MAX_TOOL_BLOCKS) {
+        if (toolName === "Bash") commandsTruncated = true;
+        continue;
+      }
       const input = block.input ?? {};
       switch (toolName) {
         case "Read":
@@ -17492,9 +18093,11 @@ function buildSummary(lines) {
           addPath(filesEdited, input.file_path);
           break;
         case "Bash": {
-          const cmd = sanitizeCommand(input.command);
-          if (cmd && commands.length < MAX_COMMANDS) {
-            commands.push(cmd);
+          const { cmd, lost } = sanitizeCommandWithLoss(input.command);
+          if (lost) commandsTruncated = true;
+          if (cmd) {
+            if (commands.length < MAX_COMMANDS) commands.push(cmd);
+            else commandsTruncated = true;
           }
           break;
         }
@@ -17537,6 +18140,7 @@ function buildSummary(lines) {
     ],
     searches,
     commands,
+    ...commandsTruncated ? { commands_truncated: true } : {},
     user_commands: userCommands,
     ...userCommandsTruncated ? { user_commands_truncated: true } : {},
     subagents,
@@ -17547,6 +18151,7 @@ function buildSummary(lines) {
   };
   if (JSON.stringify(summary).length > MAX_SUMMARY_BYTES) {
     summary.commands = [];
+    summary.commands_truncated = true;
     summary.user_commands = [];
     summary.user_commands_truncated = true;
     if (JSON.stringify(summary).length > MAX_SUMMARY_BYTES) {
@@ -17582,12 +18187,22 @@ function userTypedCommands(entry) {
   }
   return { commands, truncated };
 }
+function sanitizeCommandWithLoss(rawCmd) {
+  if (typeof rawCmd !== "string" || !rawCmd) return { cmd: null, lost: false };
+  const lines = rawCmd.split("\n");
+  const lost = lines.slice(1).some((l) => l.trim().length > 0);
+  const first = lines[0];
+  const cmd = sanitizeCommand(first);
+  const hadSeparator = SEPARATORS.some((sep2) => first.indexOf(sep2) > 0);
+  return { cmd, lost: lost || !hadSeparator && first.length > MAX_COMMAND_CHARS };
+}
+var SEPARATORS = [" | ", " > ", " >> ", " 2>", " && ", " ; "];
 function sanitizeCommand(rawCmd) {
   if (typeof rawCmd !== "string" || !rawCmd) return null;
   let cmd = rawCmd.split("\n")[0];
   let cut = -1;
   let marker = "";
-  for (const sep2 of [" | ", " > ", " >> ", " 2>", " && ", " ; "]) {
+  for (const sep2 of SEPARATORS) {
     const idx = cmd.indexOf(sep2);
     if (idx > 0 && (cut === -1 || idx < cut)) {
       cut = idx;
@@ -17837,7 +18452,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.30.1" : "dev";
+    return true ? "0.31.0-experimental.6bc3b1b" : "dev";
   } catch {
     return "dev";
   }
@@ -17878,7 +18493,7 @@ async function sendSkipBeacon(ctx, reason) {
 
 // src/lib/static-analysis.ts
 var import_node_child_process8 = require("node:child_process");
-var import_node_fs22 = require("node:fs");
+var import_node_fs26 = require("node:fs");
 var SEVERITY_ORDER = {
   Error: 0,
   Critical: 0,
@@ -17926,7 +18541,7 @@ function runCodacyAnalysis(files) {
   if (files.length === 0) return empty;
   const existingFiles = files.filter((f) => {
     try {
-      return (0, import_node_fs22.existsSync)(f);
+      return (0, import_node_fs26.existsSync)(f);
     } catch {
       return false;
     }
@@ -18124,6 +18739,7 @@ async function passAndExit(run, reason, skip, kindOverride) {
     "bare-acknowledgment",
     "reflection-prompt",
     "command-only-turn",
+    "declared-ignore",
     "skip-mode",
     "zero-increment",
     "debounce",
@@ -18163,19 +18779,37 @@ async function scope(run) {
   const { files: allChanged, hasRecentCommitFiles } = getChangedFiles();
   run.changedUniverse = allChanged;
   const { kept: external } = partitionVerityOwned(allChanged);
-  const analyzable = filterAnalyzable(external);
-  const reviewable = filterReviewable(external);
-  const securityFiles = filterSecurity(external);
+  const verityIgnore = loadVerityIgnore();
+  const ignored = partitionIgnored(external, verityIgnore);
+  for (const problem of verityIgnore.problems) {
+    process.stderr.write(`Verity: .verityignore ${problem}
+`);
+  }
+  if (ignored.securityExcluded.length > 0) {
+    process.stderr.write(
+      `Verity: .verityignore excluded ${ignored.securityExcluded.length} security-sensitive file(s) from review this run: ${ignored.securityExcluded.slice(0, 5).join(", ")}. Add a \`!\` rule to keep them in scope.
+`
+    );
+  }
+  if (ignored.suspended) {
+    process.stderr.write(
+      "Verity: .verityignore changed this turn \u2014 its rules are suspended for this run, so nothing is excluded by them. They take effect once this turn has been reviewed.\n"
+    );
+  }
+  const inScope = ignored.kept;
+  const analyzable = filterAnalyzable(inScope);
+  const reviewable = filterReviewable(inScope);
+  const securityFiles = filterSecurity(inScope);
   const noFilesChanged = analyzable.length === 0 && reviewable.length === 0 && securityFiles.length === 0;
   if (noFilesChanged && !assistantResponse) {
     await passAndExit(run, "No analyzable files changed", "no-analyzable-files");
   }
   const allForReview = Array.from(/* @__PURE__ */ new Set([...analyzable, ...reviewable]));
-  Object.assign(run, { allChanged, allForReview, analyzable, hasRecentCommitFiles, noFilesChanged, reviewable, securityFiles });
+  Object.assign(run, { allChanged, allForReview, analyzable, hasRecentCommitFiles, noFilesChanged, reviewable, securityFiles, verityIgnored: ignored });
 }
 
 // src/lib/specs.ts
-var import_node_fs23 = require("node:fs");
+var import_node_fs27 = require("node:fs");
 var import_node_path20 = require("node:path");
 var SPEC_CANDIDATES = [
   "CLAUDE.md",
@@ -18207,16 +18841,16 @@ function discoverSpecs(consulted = []) {
     const totalCap = relevant ? MAX_TOTAL_SPEC_BYTES : UNCONSULTED_TOTAL_BYTES;
     if (totalBytes >= totalCap) return false;
     if (seen.has(specPath)) return true;
-    if (!(0, import_node_fs23.existsSync)(specPath)) return true;
+    if (!(0, import_node_fs27.existsSync)(specPath)) return true;
     seen.add(specPath);
     const remaining = totalCap - totalBytes;
     const fileCap = relevant ? MAX_SPEC_FILE_BYTES : UNCONSULTED_FILE_BYTES;
     const readBytes = Math.min(fileCap, remaining);
     try {
       const buf = Buffer.alloc(readBytes);
-      const fd = (0, import_node_fs23.openSync)(specPath, "r");
-      const bytesRead = (0, import_node_fs23.readSync)(fd, buf, 0, readBytes, 0);
-      (0, import_node_fs23.closeSync)(fd);
+      const fd = (0, import_node_fs27.openSync)(specPath, "r");
+      const bytesRead = (0, import_node_fs27.readSync)(fd, buf, 0, readBytes, 0);
+      (0, import_node_fs27.closeSync)(fd);
       const content = buf.slice(0, bytesRead).toString("utf-8");
       if (!content) return true;
       result.push({ path: specPath, content });
@@ -18232,7 +18866,7 @@ function discoverSpecs(consulted = []) {
     if (!addSpec(candidate)) break;
   }
   for (const dir of ["spec", "docs"]) {
-    if (!(0, import_node_fs23.existsSync)(dir)) continue;
+    if (!(0, import_node_fs27.existsSync)(dir)) continue;
     try {
       const mdFiles = findMdFiles(dir, 2).sort();
       for (const mdFile of mdFiles) {
@@ -18247,7 +18881,7 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   if (depth >= maxDepth) return [];
   const result = [];
   try {
-    const entries = (0, import_node_fs23.readdirSync)(dir, { withFileTypes: true });
+    const entries = (0, import_node_fs27.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
       const fullPath = (0, import_node_path20.join)(dir, entry.name);
       if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -18266,14 +18900,14 @@ function discoverPlans() {
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
   for (const plansDir of [localPlansDir, homePlansDir]) {
-    if (!(0, import_node_fs23.existsSync)(plansDir)) continue;
+    if (!(0, import_node_fs27.existsSync)(plansDir)) continue;
     try {
-      for (const f of (0, import_node_fs23.readdirSync)(plansDir)) {
+      for (const f of (0, import_node_fs27.readdirSync)(plansDir)) {
         if (!f.endsWith(".md") || seen.has(f)) continue;
         seen.add(f);
         const fullPath = (0, import_node_path20.join)(plansDir, f);
         try {
-          const stat3 = (0, import_node_fs23.statSync)(fullPath);
+          const stat3 = (0, import_node_fs27.statSync)(fullPath);
           candidates.push({ name: f, path: fullPath, mtime: stat3.mtimeMs, size: stat3.size });
         } catch {
         }
@@ -18286,13 +18920,35 @@ function discoverPlans() {
   for (const entry of candidates.slice(0, MAX_PLAN_FILES)) {
     if (entry.size > MAX_PLAN_FILE_BYTES) continue;
     try {
-      const content = (0, import_node_fs23.readFileSync)(entry.path, "utf-8");
+      const content = (0, import_node_fs27.readFileSync)(entry.path, "utf-8");
       result.push({ name: entry.name, content });
     } catch {
     }
   }
   return result;
 }
+var GUARD_DOC_EXT = /\.(md|mdx|txt|rst|adoc)$/i;
+function discoverGuardDocs(rangeFiles2) {
+  const result = [];
+  let totalBytes = 0;
+  for (const path of rangeFiles2) {
+    if (result.length >= MAX_SPEC_FILES) break;
+    if (!GUARD_DOC_EXT.test(path)) continue;
+    if (path.startsWith("/") || path.includes("..")) continue;
+    if (!(0, import_node_fs27.existsSync)(path)) continue;
+    try {
+      const stat3 = (0, import_node_fs27.statSync)(path);
+      if (stat3.size > MAX_PLAN_FILE_BYTES) continue;
+      if (totalBytes + stat3.size > MAX_TOTAL_SPEC_BYTES) continue;
+      const content = (0, import_node_fs27.readFileSync)(path, "utf-8");
+      if (!content) continue;
+      result.push({ name: path, content });
+      totalBytes += content.length;
+    } catch {
+    }
+  }
+  return result;
+}
 
 // src/commands/analyze/phases/03-intent-inputs.ts
 async function intentInputs(run) {
@@ -18306,6 +18962,50 @@ async function intentInputs(run) {
   })) {
     await passAndExit(run, "User command only \u2014 skipping analysis", "command-only-turn");
   }
+  {
+    const ignoreKeys = ignoreStateKeys(
+      run.tokenResult.ok ? run.tokenResult.data.token : void 0,
+      null
+    );
+    const found = resolveIgnoreState([baselineSessionId, ...ignoreKeys]);
+    const declaration = resolveActive(found?.state ?? null, Math.floor(Date.now() / 1e3));
+    if (declaration) {
+      const commandRecordTruncated = actionSummary?.commands_truncated === true || actionSummary?.user_commands_truncated === true || // The derived signal, and the only one an older client's summary can
+      // give: `tool_counts` keeps counting Bash calls past every cap that
+      // stops the list growing, so a mismatch IS a loss. See
+      // `ActionSummary.commands_truncated`.
+      (actionSummary?.tool_counts?.Bash ?? 0) > (actionSummary?.commands?.length ?? 0);
+      const outcome = verifyDeclaration({
+        declaration,
+        agentAuthoredFiles: (actionSummary?.files_edited.length ?? 0) + (actionSummary?.files_created.length ?? 0),
+        subagents: actionSummary?.subagents ?? 0,
+        agentCommands: actionSummary?.commands,
+        userCommands: actionSummary?.user_commands,
+        commandRecordTruncated,
+        authorshipIsObservable: !!actionSummary && actionSummary.transcript_windowed !== "orphaned"
+      });
+      if (outcome.honoured) {
+        if (declaration.scope === "turn" && found) clearActiveDeclaration(found.key);
+        logEvent("ignore_honoured", { scope: declaration.scope, origin: declaration.origin });
+        await passAndExit(
+          run,
+          `skipping this turn \u2014 declared housekeeping ("${declaration.reason}")`,
+          "declared-ignore"
+        );
+      } else if (outcome.void) {
+        if (found) clearActiveDeclaration(found.key);
+        logEvent("ignore_voided", {
+          scope: declaration.scope,
+          origin: declaration.origin,
+          why: outcome.why
+        });
+        const notice = `Verity: the ignore declared for this window ("${declaration.reason}") was voided \u2014 ${outcome.why}. Reviewing normally.`;
+        process.stderr.write(`${notice}
+`);
+        run.voidedIgnoreNotice = notice;
+      }
+    }
+  }
   const conversation = await readAndClearConversationBuffer(baselineSessionId);
   const specs = discoverSpecs(actionSummary?.files_read ?? []);
   const plans = discoverPlans();
@@ -18419,177 +19119,8 @@ async function mode(run) {
   Object.assign(run, { analysisMode, contextFilePaths, sessionAuthoredCode, sessionIdForMemory });
 }
 
-// src/lib/debounce.ts
-var import_node_fs24 = require("node:fs");
-var import_node_crypto10 = require("node:crypto");
-function scopedFile(base, sessionId) {
-  if (!sessionId) return base;
-  return `${base}.${(0, import_node_crypto10.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
-}
-function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
-  const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs24.existsSync)(file)) return null;
-  try {
-    const lastTs = parseInt((0, import_node_fs24.readFileSync)(file, "utf-8").trim(), 10);
-    const nowTs = Math.floor(Date.now() / 1e3);
-    const elapsed = nowTs - lastTs;
-    if (elapsed < debounceSeconds) {
-      return `Debounced \u2014 last analysis was ${elapsed}s ago`;
-    }
-  } catch {
-  }
-  return null;
-}
-function checkMtime(files, bypassForRecentCommits, sessionId) {
-  if (bypassForRecentCommits) return null;
-  const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs24.existsSync)(file)) return null;
-  let debounceTime;
-  try {
-    debounceTime = (0, import_node_fs24.statSync)(file).mtimeMs;
-  } catch {
-    return null;
-  }
-  for (const f of files) {
-    const resolved = resolveFile(f);
-    if (!resolved) continue;
-    try {
-      const stat3 = (0, import_node_fs24.statSync)(resolved);
-      if (stat3.mtimeMs > debounceTime) {
-        return null;
-      }
-    } catch {
-      continue;
-    }
-  }
-  return "No files modified since last analysis";
-}
-function computeContentHash(files) {
-  const hash = (0, import_node_crypto10.createHash)("sha1");
-  const sorted = [...files].sort();
-  for (const f of sorted) {
-    const resolved = resolveFile(f) ?? f;
-    try {
-      if ((0, import_node_fs24.existsSync)(resolved)) {
-        hash.update((0, import_node_fs24.readFileSync)(resolved));
-      }
-    } catch {
-    }
-  }
-  return hash.digest("hex");
-}
-function checkContentHash(files, sessionId) {
-  const hash = computeContentHash(files);
-  const file = scopedFile(HASH_FILE, sessionId);
-  if ((0, import_node_fs24.existsSync)(file)) {
-    try {
-      const storedHash = (0, import_node_fs24.readFileSync)(file, "utf-8").trim();
-      if (hash === storedHash) {
-        return { skip: "No source changes since last analysis", hash };
-      }
-    } catch {
-    }
-  }
-  return { skip: null, hash };
-}
-function recordAnalysisStart(sessionId) {
-  (0, import_node_fs24.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs24.writeFileSync)(scopedFile(DEBOUNCE_FILE, sessionId), String(Math.floor(Date.now() / 1e3)));
-}
-function recordPassHash(hash, sessionId) {
-  (0, import_node_fs24.writeFileSync)(scopedFile(HASH_FILE, sessionId), hash);
-}
-function narrowToRecent(files, sessionId) {
-  const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs24.existsSync)(file)) return files;
-  let debounceTime;
-  try {
-    debounceTime = (0, import_node_fs24.statSync)(file).mtimeMs;
-  } catch {
-    return files;
-  }
-  const recent = files.filter((f) => {
-    try {
-      return (0, import_node_fs24.existsSync)(f) && (0, import_node_fs24.statSync)(f).mtimeMs > debounceTime;
-    } catch {
-      return false;
-    }
-  });
-  return recent.length > 0 ? recent : files;
-}
-function readIteration(currentCommit, _contentHash) {
-  return Math.max(1, readBlockState(currentCommit).attempts);
-}
-var NO_BLOCKS = { attempts: 0, blocks: 0, fingerprint: null };
-function readBlockState(currentCommit, opts) {
-  if (opts?.newUserPrompt) return NO_BLOCKS;
-  if (!(0, import_node_fs24.existsSync)(ITERATION_FILE)) return NO_BLOCKS;
-  try {
-    const stored = (0, import_node_fs24.readFileSync)(ITERATION_FILE, "utf-8").trim();
-    const parsed = stored.startsWith("{") ? parseJsonState(stored) : parseLegacyState(stored);
-    if (!parsed) return NO_BLOCKS;
-    if (parsed.commit !== currentCommit) return NO_BLOCKS;
-    if (parsed.ts > 0 && Math.floor(Date.now() / 1e3) - parsed.ts > 600) return NO_BLOCKS;
-    return { attempts: parsed.attempts, blocks: parsed.blocks, fingerprint: parsed.fingerprint };
-  } catch {
-    return NO_BLOCKS;
-  }
-}
-function parseJsonState(raw) {
-  const o = JSON.parse(raw);
-  const attempts = typeof o.attempts === "number" ? o.attempts : NaN;
-  if (isNaN(attempts)) return null;
-  return {
-    attempts,
-    blocks: typeof o.blocks === "number" ? o.blocks : attempts,
-    fingerprint: typeof o.fingerprint === "string" && o.fingerprint ? o.fingerprint : null,
-    commit: typeof o.commit === "string" ? o.commit : "",
-    ts: typeof o.ts === "number" ? o.ts : 0
-  };
-}
-function parseLegacyState(raw) {
-  const parts = raw.split(":");
-  const n = parseInt(parts[0], 10);
-  if (isNaN(n)) return null;
-  return {
-    attempts: n,
-    // The old file has no separate block count; the old counter is the closest
-    // honest answer, and it errs toward releasing sooner rather than later.
-    blocks: n,
-    fingerprint: parts.slice(3).join(":") || null,
-    commit: parts[1] ?? "",
-    ts: parseInt(parts[2] ?? "0", 10)
-  };
-}
-function findingsFingerprint(findings) {
-  const keys = findings.map((f) => `${String(f.pattern_id ?? "?")}|${String(f.file ?? "?")}`).filter((k) => k !== "?|?");
-  return [...new Set(keys)].sort().join(",");
-}
-function isSameProblem(previous, current) {
-  if (!previous || !current) return false;
-  const prev = new Set(previous.split(","));
-  return current.split(",").some((k) => prev.has(k));
-}
-function writeBlockState(commit, state) {
-  (0, import_node_fs24.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs24.writeFileSync)(
-    ITERATION_FILE,
-    JSON.stringify({
-      v: 2,
-      attempts: state.attempts,
-      blocks: state.blocks,
-      commit,
-      ts: Math.floor(Date.now() / 1e3),
-      fingerprint: state.fingerprint ?? void 0
-    })
-  );
-}
-function resetBlockState(commit) {
-  writeBlockState(commit, { attempts: 0, blocks: 0, fingerprint: null });
-}
-
 // src/lib/fold.ts
-var import_node_fs25 = require("node:fs");
+var import_node_fs28 = require("node:fs");
 var import_node_path21 = require("node:path");
 var KNOWN_RECORD_TYPES = /* @__PURE__ */ new Set([
   "user",
@@ -18727,7 +19258,7 @@ function candidateRoots(repoRoot2) {
   const norm = repoRoot2.replace(/\\/g, "/").replace(/\/+$/, "");
   const out = [norm];
   try {
-    const real = import_node_fs25.realpathSync.native(norm).replace(/\\/g, "/").replace(/\/+$/, "");
+    const real = import_node_fs28.realpathSync.native(norm).replace(/\\/g, "/").replace(/\/+$/, "");
     if (real !== norm) out.push(real);
   } catch {
   }
@@ -18815,8 +19346,8 @@ function fold(transcriptPath, opts = {}) {
     }
   };
   try {
-    if (!(0, import_node_fs25.existsSync)(transcriptPath)) return result;
-    ingest((0, import_node_fs25.readFileSync)(transcriptPath, "utf8"), "agent");
+    if (!(0, import_node_fs28.existsSync)(transcriptPath)) return result;
+    ingest((0, import_node_fs28.readFileSync)(transcriptPath, "utf8"), "agent");
     result.coverage.complete = true;
   } catch {
     return result;
@@ -18827,19 +19358,19 @@ function fold(transcriptPath, opts = {}) {
       (0, import_node_path21.basename)(transcriptPath).replace(/\.jsonl$/, ""),
       "subagents"
     );
-    if ((0, import_node_fs25.existsSync)(sidecarDir)) {
+    if ((0, import_node_fs28.existsSync)(sidecarDir)) {
       const maxFiles = opts.maxSidecars ?? 200;
       const maxBytes = opts.maxSidecarBytes ?? 16 * 1024 * 1024;
       const found = [];
       const walk = (d, depth) => {
         if (depth > 4) return;
-        for (const e of (0, import_node_fs25.readdirSync)(d, { withFileTypes: true })) {
+        for (const e of (0, import_node_fs28.readdirSync)(d, { withFileTypes: true })) {
           const p = (0, import_node_path21.join)(d, e.name);
           if (e.isDirectory()) {
             walk(p, depth + 1);
           } else if (e.name.startsWith("agent-") && e.name.endsWith(".jsonl")) {
             try {
-              const st = (0, import_node_fs25.statSync)(p);
+              const st = (0, import_node_fs28.statSync)(p);
               found.push({ path: p, size: st.size, mtimeMs: st.mtimeMs });
             } catch {
               result.coverage.malformed++;
@@ -18856,7 +19387,7 @@ function fold(transcriptPath, opts = {}) {
           continue;
         }
         try {
-          ingest((0, import_node_fs25.readFileSync)(f.path, "utf8"), "subagent");
+          ingest((0, import_node_fs28.readFileSync)(f.path, "utf8"), "subagent");
           bytes += f.size;
           result.coverage.subagentFiles++;
         } catch {
@@ -18891,7 +19422,7 @@ function fold(transcriptPath, opts = {}) {
 }
 function classifyUnobserved(path) {
   try {
-    const st = (0, import_node_fs25.statSync)(path);
+    const st = (0, import_node_fs28.statSync)(path);
     if (!st.isFile()) return "unreadable";
   } catch {
     return "unreadable";
@@ -19195,20 +19726,20 @@ async function evidence(run) {
 }
 
 // src/lib/cache-cleanup.ts
-var import_node_fs26 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 var import_node_path22 = require("node:path");
 var CACHE_TTL_DAYS = 7;
 function pruneStaleCache() {
   try {
     const dir = projectPath(CACHE_DIR);
     const cutoff = Date.now() - CACHE_TTL_DAYS * 24 * 3600 * 1e3;
-    for (const entry of (0, import_node_fs26.readdirSync)(dir)) {
+    for (const entry of (0, import_node_fs29.readdirSync)(dir)) {
       if (!entry.startsWith("pending-")) continue;
       const path = (0, import_node_path22.join)(dir, entry);
       try {
-        const stat3 = (0, import_node_fs26.statSync)(path);
+        const stat3 = (0, import_node_fs29.statSync)(path);
         if (stat3.mtimeMs < cutoff) {
-          (0, import_node_fs26.unlinkSync)(path);
+          (0, import_node_fs29.unlinkSync)(path);
           logEvent("cache_entry_pruned", {
             path: entry,
             age_days: Math.round((Date.now() - stat3.mtimeMs) / 864e5)
@@ -19222,7 +19753,7 @@ function pruneStaleCache() {
 }
 
 // src/lib/context-files.ts
-var import_node_fs27 = require("node:fs");
+var import_node_fs30 = require("node:fs");
 var MAX_CONTEXT_FILES = 10;
 var MAX_CONTEXT_FILE_BYTES = 10240;
 var MAX_CONTEXT_TOTAL_BYTES = 51200;
@@ -19243,7 +19774,7 @@ function gatherContextFiles(contextPaths, deltaFiles) {
       continue;
     }
     try {
-      const content = (0, import_node_fs27.readFileSync)(safePath, "utf8");
+      const content = (0, import_node_fs30.readFileSync)(safePath, "utf8");
       const bytes = Buffer.byteLength(content);
       if (bytes > MAX_CONTEXT_FILE_BYTES) {
         logEvent("context_file_skipped", { path: filePath, reason: "too_large", bytes });
@@ -19305,7 +19836,7 @@ async function contextFiles(run) {
 
 // src/lib/seed-runner.ts
 var import_promises11 = require("node:fs/promises");
-var import_node_fs28 = require("node:fs");
+var import_node_fs31 = require("node:fs");
 var import_node_path23 = require("node:path");
 var import_yaml2 = __toESM(require_dist());
 
@@ -19545,7 +20076,7 @@ function renderNodeMarkdown(candidate, nodeId, createdAt) {
   return fm;
 }
 async function runSeed(opts) {
-  if (!(0, import_node_fs28.existsSync)(STANDARD_FILE)) {
+  if (!(0, import_node_fs31.existsSync)(STANDARD_FILE)) {
     return { created: 0, failed: 0, skipped: "no_standard", candidates: [] };
   }
   let standardDoc;
@@ -19557,7 +20088,7 @@ async function runSeed(opts) {
   }
   const knowledgeSpec = standardDoc.knowledge_spec ?? {};
   let readmeContent;
-  if ((0, import_node_fs28.existsSync)("README.md")) {
+  if ((0, import_node_fs31.existsSync)("README.md")) {
     try {
       readmeContent = await (0, import_promises11.readFile)("README.md", "utf-8");
     } catch {
@@ -19565,7 +20096,7 @@ async function runSeed(opts) {
   }
   let claudeMdContent;
   for (const p of ["CLAUDE.md", ".claude/CLAUDE.md"]) {
-    if ((0, import_node_fs28.existsSync)(p)) {
+    if ((0, import_node_fs31.existsSync)(p)) {
       try {
         claudeMdContent = await (0, import_promises11.readFile)(p, "utf-8");
         break;
@@ -19589,7 +20120,7 @@ async function runSeed(opts) {
     return { created: 0, failed: 0, skipped: "no_candidates", candidates: [] };
   }
   const overviewPath = (0, import_node_path23.join)(MEMORY_DIR, "domain", "project-overview.md");
-  if ((0, import_node_fs28.existsSync)(overviewPath) && !opts.force) {
+  if ((0, import_node_fs31.existsSync)(overviewPath) && !opts.force) {
     return { created: 0, failed: 0, skipped: "already_seeded", candidates };
   }
   if (opts.dryRun) {
@@ -19644,7 +20175,7 @@ async function runSeed(opts) {
 }
 
 // src/commands/analyze/phases/08-memory-manifest.ts
-var import_node_fs29 = require("node:fs");
+var import_node_fs32 = require("node:fs");
 var import_node_path24 = require("node:path");
 async function memoryManifest(run) {
   const { globals } = run;
@@ -19656,8 +20187,8 @@ async function memoryManifest(run) {
   try {
     await ensureMemoryDir();
     const seedMarker = (0, import_node_path24.join)(VERITY_DIR, ".seeded");
-    const hasStandard = (0, import_node_fs29.existsSync)(STANDARD_FILE);
-    const alreadyTried = (0, import_node_fs29.existsSync)(seedMarker);
+    const hasStandard = (0, import_node_fs32.existsSync)(STANDARD_FILE);
+    const alreadyTried = (0, import_node_fs32.existsSync)(seedMarker);
     if (hasStandard && !alreadyTried) {
       const preManifest = await buildManifest();
       if (preManifest.nodes.length === 0) {
@@ -19670,7 +20201,7 @@ async function memoryManifest(run) {
             dryRun: false
           });
           if (seedResult.created > 0) {
-            (0, import_node_fs29.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created}
+            (0, import_node_fs32.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created}
 `);
             autoSeedNotice = `Seeded ${seedResult.created} knowledge node(s) from your existing Standard (one-time).`;
             logEvent("auto_seed_ran", {
@@ -19678,7 +20209,7 @@ async function memoryManifest(run) {
               failed: seedResult.failed
             });
           } else if (seedResult.skipped === "already_seeded") {
-            (0, import_node_fs29.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
+            (0, import_node_fs32.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
 `);
           } else {
             logEvent("auto_seed_noop", {
@@ -19867,7 +20398,7 @@ async function workingMemory(run) {
 }
 
 // src/lib/note-budget.ts
-var import_node_fs30 = require("node:fs");
+var import_node_fs33 = require("node:fs");
 var ADVISORY_BUDGET = { PASS: 1, WARN: 2 };
 var EPISODE_STALE_SECONDS = 30 * 60;
 var FRESH = { delivered: 0, tasksCompleted: 0, ts: 0 };
@@ -19889,9 +20420,9 @@ function advisoryBudgetSpent(episode, rawDecision) {
 }
 function readAdvisoryEpisode(sessionId) {
   const file = scopedFile(ADVISORY_EPISODE_FILE, sessionId);
-  if (!(0, import_node_fs30.existsSync)(file)) return null;
+  if (!(0, import_node_fs33.existsSync)(file)) return null;
   try {
-    const o = JSON.parse((0, import_node_fs30.readFileSync)(file, "utf-8")) ?? {};
+    const o = JSON.parse((0, import_node_fs33.readFileSync)(file, "utf-8")) ?? {};
     const delivered = typeof o.delivered === "number" ? o.delivered : NaN;
     if (isNaN(delivered)) return null;
     return {
@@ -19905,8 +20436,8 @@ function readAdvisoryEpisode(sessionId) {
 }
 function writeAdvisoryEpisode(episode, sessionId) {
   try {
-    (0, import_node_fs30.mkdirSync)(VERITY_DIR, { recursive: true });
-    (0, import_node_fs30.writeFileSync)(
+    (0, import_node_fs33.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs33.writeFileSync)(
       scopedFile(ADVISORY_EPISODE_FILE, sessionId),
       JSON.stringify({ v: 1, ...episode })
     );
@@ -20013,7 +20544,16 @@ async function buildRequest(run) {
     // the state, so the number is one turn lagged by construction. The
     // degenerate win for the budget is a dead channel that looks like clean
     // code; this is what makes "did delivery rate collapse" a query.
-    advisory_delivered_prior: readAdvisoryEpisode(run.baselineSessionId)?.delivered ?? 0
+    advisory_delivered_prior: readAdvisoryEpisode(run.baselineSessionId)?.delivered ?? 0,
+    // `.verityignore` — see CoverageTelemetry.verityignore for why the SHARE is
+    // the number that matters and why no paths travel with it.
+    verityignore: {
+      rules: run.verityIgnored.rules,
+      excluded: run.verityIgnored.ignored.length,
+      share: ignoreShare(run.verityIgnored.kept.length, run.verityIgnored.ignored.length),
+      security_excluded: run.verityIgnored.securityExcluded.length,
+      suspended: run.verityIgnored.suspended
+    }
   };
   const requestBody = {
     coverage_telemetry: coverageTelemetry,
@@ -20211,14 +20751,14 @@ async function buildRequest(run) {
 }
 
 // src/lib/offline.ts
-var import_node_fs31 = require("node:fs");
+var import_node_fs34 = require("node:fs");
 var import_node_crypto11 = require("node:crypto");
 function cacheRequest(body) {
   try {
-    (0, import_node_fs31.mkdirSync)(CACHE_DIR, { recursive: true });
+    (0, import_node_fs34.mkdirSync)(CACHE_DIR, { recursive: true });
     const suffix = (0, import_node_crypto11.randomBytes)(4).toString("hex");
     const filename = `pending-${Math.floor(Date.now() / 1e3)}-${suffix}.json`;
-    (0, import_node_fs31.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body)));
+    (0, import_node_fs34.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body)));
   } catch {
   }
 }
@@ -20337,7 +20877,7 @@ async function transmit(run) {
 }
 
 // src/commands/analyze/phases/13-reconcile.ts
-var import_node_fs32 = require("node:fs");
+var import_node_fs35 = require("node:fs");
 var import_node_path26 = require("node:path");
 async function reconcile(run) {
   const { actionSummary, allChanged, analyzable, baseline, baselineSessionId, codeDelta, contentHash, conversation, decision, foldResult, memory, memorySession, response, reviewable, securityFiles, turnId } = run;
@@ -20348,7 +20888,7 @@ async function reconcile(run) {
       const st = foldDossier(memorySession.d);
       openElsewhere = openBlockingElsewhere(st.statements, sentPaths, (file, line) => {
         try {
-          const src = (0, import_node_fs32.readFileSync)((0, import_node_path26.join)(repoRoot(), file), "utf8").split("\n");
+          const src = (0, import_node_fs35.readFileSync)((0, import_node_path26.join)(repoRoot(), file), "utf8").split("\n");
           const at = src[line - 1];
           return at === void 0 ? null : lineSha(at);
         } catch {
@@ -20409,6 +20949,25 @@ async function reconcile(run) {
         stage: "self-scope",
         kind: "policy"
       })),
+      // ⚠ WHAT THE TEAM'S OWN `.verityignore` REMOVED — every path, named
+      // (VRT-135 · 3/3). The 0.30 principle: an exclusion the ledger cannot see
+      // is a scoping decision nobody can audit, and this is the one exclusion
+      // stage a user can edit, so it is the one that most needs to be visible.
+      //
+      // `policy`, by D2's bar — no version of this product would have reviewed a
+      // file the project declared out of scope, so it must not downgrade PASS to
+      // WARN. That is also why it is not narrated per-turn by `describeCoverage`
+      // (policy exclusions are recorded, not announced): repeating "your dist/
+      // went unreviewed" on every turn is how a channel gets muted. The SHARE
+      // below is the signal that replaces the noise.
+      //
+      // Taken from the run, not recomputed — see context.ts `verityIgnored`.
+      ...run.verityIgnored.ignored.map((path) => ({
+        path,
+        reason: "verityignore",
+        stage: "verityignore",
+        kind: "policy"
+      })),
       // The extension allowlist. POLICY: a changed README was never going to be
       // reviewed, and calling that a coverage gap would downgrade nearly every
       // PASS to WARN until WARN meant nothing. Recorded so the ledger balances and
@@ -20638,7 +21197,7 @@ function agentContextFor(response, intentRepeat = 0, priorPendingFingerprints =
 }
 async function render(run) {
   const { opts, globals } = run;
-  const { actionSummary, assistantResponse, autoSeedNotice, baselineSessionId, codeDelta, contentHash, conversation, currentCommit, decision, intentRepeatCount, memory, openElsewhere, priorPendingFingerprints, response, reviewCoverage, serviceUrl, sessionIdForMemory, silenced, token, watermarkHash, watermarkIsPartial } = run;
+  const { actionSummary, assistantResponse, autoSeedNotice, voidedIgnoreNotice, baselineSessionId, codeDelta, contentHash, conversation, currentCommit, decision, intentRepeatCount, memory, openElsewhere, priorPendingFingerprints, response, reviewCoverage, serviceUrl, sessionIdForMemory, silenced, token, watermarkHash, watermarkIsPartial } = run;
   let { iteration } = run;
   const metadata = response.metadata ?? {};
   const intentAmbiguity = metadata.intent_ambiguity;
@@ -20890,6 +21449,7 @@ ${YELLOW}${grantNudge.trim()}${NC}
       const viewUrl = response.view_url ?? "";
       if (viewUrl) userSummary += ` Report: ${viewUrl}`;
       if (autoSeedNotice) userSummary = `${autoSeedNotice} ${userSummary}`;
+      if (voidedIgnoreNotice) userSummary = `${voidedIgnoreNotice} ${userSummary}`;
       userSummary += loginNudge + grantNudge;
       emitVerdict({
         proposed: "PASS",
@@ -20911,6 +21471,7 @@ ${YELLOW}${grantNudge.trim()}${NC}
       const viewUrl = response.view_url ?? "";
       if (viewUrl) userSummary += ` Report: ${viewUrl}`;
       if (autoSeedNotice) userSummary = `${autoSeedNotice} ${userSummary}`;
+      if (voidedIgnoreNotice) userSummary = `${voidedIgnoreNotice} ${userSummary}`;
       userSummary += loginNudge + grantNudge;
       emitVerdict({
         proposed: "WARN",
@@ -20926,7 +21487,11 @@ ${YELLOW}${grantNudge.trim()}${NC}
     }
     default: {
       const raw = String(decision ?? "(missing)");
-      const msg = (autoSeedNotice ? `${autoSeedNotice} Verity: unrecognised verdict \u2014 treating as WARN` : "Verity: unrecognised verdict \u2014 treating as WARN") + loginNudge + grantNudge;
+      const msg = [
+        voidedIgnoreNotice,
+        autoSeedNotice,
+        "Verity: unrecognised verdict \u2014 treating as WARN"
+      ].filter(Boolean).join(" ") + loginNudge + grantNudge;
       process.stderr.write(
         `Verity: server returned an unrecognised gate_decision (${raw}). Rendering WARN rather than PASS. Update the CLI: npm i -g @codacy/verity-cli
 `
@@ -21003,7 +21568,7 @@ async function runAnalyze(opts, globals) {
 }
 
 // src/commands/baseline.ts
-var import_node_fs33 = require("node:fs");
+var import_node_fs36 = require("node:fs");
 function registerBaselineCommands(program2) {
   const baseline = program2.command("baseline").description("Manage the task-start working-tree baseline");
   baseline.command("capture").description("Snapshot the working tree at task start (used by SessionStart hook)").option("--session-id <id>", "Session id (overrides any value from stdin)").option("--source <source>", "Lifecycle hint: startup|resume|clear|compact").action(async (opts) => {
@@ -21012,7 +21577,7 @@ function registerBaselineCommands(program2) {
         process.chdir(repoRoot());
       } catch {
       }
-      if (!(0, import_node_fs33.existsSync)(VERITY_DIR)) {
+      if (!(0, import_node_fs36.existsSync)(VERITY_DIR)) {
         process.exit(0);
       }
       let sessionId = opts.sessionId;
@@ -21052,7 +21617,7 @@ async function readStdin() {
 }
 
 // src/commands/review.ts
-var import_node_fs34 = require("node:fs");
+var import_node_fs37 = require("node:fs");
 function registerReviewCommand(program2) {
   program2.command("review").description("Run on-demand Verity analysis (advisory, never blocks)").requiredOption("--files <paths>", "Comma-separated file list").option("--changed <paths>", "Subset of --files that were modified").option("--intent <text>", "User intent description (max 2000 chars)").option("--specs <paths>", "Comma-separated spec file paths").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -21071,7 +21636,7 @@ async function runReview(opts, globals) {
   const securityFiles = filterSecurity(allFiles);
   let staticResults;
   if (isCodacyAvailable()) {
-    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs34.existsSync)(f) || resolveFile(f) !== null);
+    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs37.existsSync)(f) || resolveFile(f) !== null);
     staticResults = runCodacyAnalysis(scannable);
   } else {
     staticResults = {
@@ -21097,10 +21662,10 @@ async function runReview(opts, globals) {
     const specPaths = opts.specs.split(",").map((f) => f.trim()).filter(Boolean);
     specs = [];
     for (const p of specPaths) {
-      if (!(0, import_node_fs34.existsSync)(p)) continue;
+      if (!(0, import_node_fs37.existsSync)(p)) continue;
       try {
-        const { readFileSync: readFileSync20 } = await import("node:fs");
-        const content = readFileSync20(p, "utf-8");
+        const { readFileSync: readFileSync24 } = await import("node:fs");
+        const content = readFileSync24(p, "utf-8");
         specs.push({ path: p, content: content.slice(0, 10240) });
       } catch {
       }
@@ -21157,7 +21722,7 @@ async function runReview(opts, globals) {
 }
 
 // src/commands/guard.ts
-var import_node_fs35 = require("node:fs");
+var import_node_fs38 = require("node:fs");
 var import_node_path27 = require("node:path");
 var GUARD_BLOCK_CAP = 2;
 var GUARD_ITER_FILE = (0, import_node_path27.join)(VERITY_DIR, ".guard-iteration");
@@ -21205,7 +21770,7 @@ function readPreToolUseStdin() {
 }
 function readIterMap() {
   try {
-    const raw = JSON.parse((0, import_node_fs35.readFileSync)(GUARD_ITER_FILE, "utf-8"));
+    const raw = JSON.parse((0, import_node_fs38.readFileSync)(GUARD_ITER_FILE, "utf-8"));
     if (raw && typeof raw === "object") {
       if (typeof raw.moment === "string" && typeof raw.count === "number") {
         return { [raw.moment]: raw.count };
@@ -21225,10 +21790,10 @@ function readIter(moment) {
 }
 function writeIter(moment, count) {
   try {
-    (0, import_node_fs35.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs38.mkdirSync)(VERITY_DIR, { recursive: true });
     const map = readIterMap();
     map[moment] = count;
-    (0, import_node_fs35.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+    (0, import_node_fs38.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
   } catch {
   }
 }
@@ -21238,10 +21803,10 @@ function resetIter(moment) {
     if (!(moment in map)) return;
     delete map[moment];
     if (Object.keys(map).length === 0) {
-      if ((0, import_node_fs35.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs35.unlinkSync)(GUARD_ITER_FILE);
+      if ((0, import_node_fs38.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs38.unlinkSync)(GUARD_ITER_FILE);
     } else {
-      (0, import_node_fs35.mkdirSync)(VERITY_DIR, { recursive: true });
-      (0, import_node_fs35.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+      (0, import_node_fs38.mkdirSync)(VERITY_DIR, { recursive: true });
+      (0, import_node_fs38.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
     }
   } catch {
   }
@@ -21302,16 +21867,17 @@ function extractStatedIntent(moment, command, pushedMessages = null) {
   const text = moment === "pre-commit" ? parseCommitMessage(command) : parsePrIntent(command) ?? pushedMessages;
   return isSubstantiveIntent(text) ? text : null;
 }
-function hasBlockingFinding(response) {
+function hasBlockingFinding(response, sentFiles) {
   const findings = response.findings ?? [];
-  return findings.some((f) => f.scope !== "pre-existing" && ["critical", "high"].includes((f.severity ?? "").toLowerCase()));
+  const sent = sentFiles ? new Set(sentFiles.map((p) => p.replace(/\\/g, "/"))) : null;
+  return findings.some((f) => f.scope !== "pre-existing" && ["critical", "high"].includes((f.severity ?? "").toLowerCase()) && (sent === null || typeof f.file === "string" && sent.has(f.file.replace(/\\/g, "/"))));
 }
 function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedIntent, coverageTelemetry) {
   const analyzable = filterAnalyzable(files);
   const securityFiles = filterSecurity(files);
   let staticResults;
   if (isCodacyAvailable()) {
-    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs35.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs38.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
     staticResults = runCodacyAnalysis(scannable);
   } else {
     staticResults = { tool: "@codacy/analysis-cli", findings: [], summary: { total_findings: 0, by_severity: {}, tools_run: [] } };
@@ -21333,13 +21899,11 @@ function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedInte
     }
   };
   if (coverageTelemetry) requestBody.coverage_telemetry = coverageTelemetry;
-  const specs = discoverSpecs();
-  const plans = discoverPlans();
-  if (specs.length > 0 || plans.length > 0 || statedIntent) {
+  const docs = discoverGuardDocs(files);
+  if (docs.length > 0 || statedIntent) {
     const intentContext = {};
     if (statedIntent) intentContext.user_prompt = statedIntent;
-    if (specs.length > 0) intentContext.specs = specs;
-    if (plans.length > 0) intentContext.plans = plans;
+    if (docs.length > 0) intentContext.plans = docs;
     requestBody.intent_context = intentContext;
   }
   return requestBody;
@@ -21420,7 +21984,7 @@ async function runGuard(opts, globals) {
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
   if (!tokenResult.ok || !urlResult.ok) process.exit(0);
   logEvent("guard_frame", { moment, ...frameTelemetry(frame, range) });
-  const codeDelta = collectCodeDelta(files);
+  const codeDelta = collectCodeDelta(files, GIT_MOMENT_BUDGET);
   if (codeDelta.total_files === 0) process.exit(0);
   const statedIntent = extractStatedIntent(
     moment,
@@ -21446,6 +22010,7 @@ async function runGuard(opts, globals) {
     excluded: codeDelta.excluded.map((e) => ({ path: e.path, reason: e.reason }))
   };
   logToFileOnly(coverageBlock(coverage));
+  const reviewStart = Date.now();
   const result = await analyzeRequest({
     serviceUrl: urlResult.data,
     token: tokenResult.data.token,
@@ -21454,6 +22019,7 @@ async function runGuard(opts, globals) {
     timeout: 29e4,
     cmd: "guard"
   });
+  const reviewSecs = Math.max(1, Math.round((Date.now() - reviewStart) / 1e3));
   if (!result.ok) {
     const authRemedy = result.error.startsWith("STALE_VERIFICATION") ? " Your GitHub verification expired \u2014 run `verity login` to re-verify." : result.error.startsWith("FORBIDDEN") ? " No access grant for this repository \u2014 run `verity login` to refresh your grants." : result.error.startsWith("INVALID_TOKEN") ? " Your Verity login expired or was revoked \u2014 run `verity login` to sign in again." : "";
     emitAllowNotice(
@@ -21466,9 +22032,9 @@ async function runGuard(opts, globals) {
   const decision = response.gate_decision ?? "(unrecognised)";
   const viewUrl = response.view_url ?? "";
   const link = viewUrl ? ` \u2014 ${viewUrl}` : "";
-  const covLine = coverageSummary(coverage);
+  const covLine = `${coverageSummary(coverage)} in ${reviewSecs}s`;
   const covDetail = coverageBlock(coverage);
-  if (decision === "FAIL" && hasBlockingFinding(response)) {
+  if (decision === "FAIL" && hasBlockingFinding(response, codeDelta.files.map((f) => f.path))) {
     writeIter(moment, iter + 1);
     writeBlockMessage(moment, response, covDetail);
     process.exit(2);
@@ -21536,17 +22102,166 @@ function writeBlockMessage(moment, response, covDetail) {
 `);
   process.stderr.write(`${BOLD}Fix these, then re-run the ${verb}.${NC}
 `);
+  process.stderr.write(`${DIM}Accepted risk? Record it: verity waive <pattern-id> --file <path> --reason "\u2026" (voids automatically when the file changes).${NC}
+`);
+}
+
+// src/commands/ignore.ts
+function registerIgnoreCommand(program2) {
+  const ignore = program2.command("ignore").description("Declare the next turn (or a short window) as housekeeping \u2014 no review needed").option("--turn", "Cover the next turn only (the default)").option("--for <duration>", "Cover a window: 30m, 45s, 1h (max 60m)").option("--reason <reason>", "Why this window needs no review \u2014 required, and recorded").option("--agent", "Mark the declaration as agent-invoked (a ledger label, not a permission)").option("--session-id <id>", "Session id (defaults to $CLAUDE_SESSION_ID)").option("--json", "Output raw JSON").action(async (opts) => {
+    const globals = program2.opts();
+    const now = Math.floor(Date.now() / 1e3);
+    const reason = opts.reason?.trim();
+    if (!reason) {
+      printError(
+        'A reason is required: verity ignore --turn --reason "pulling latest before starting".\nIt is recorded with the declaration and is the only trace a skipped turn leaves.'
+      );
+      process.exit(1);
+    }
+    if (opts.for && opts.turn) {
+      printError("Use either --turn or --for, not both \u2014 they are two different windows.");
+      process.exit(1);
+    }
+    let scope2 = "turn";
+    let ttl = TURN_FUSE_SECONDS;
+    if (opts.for) {
+      const parsed = parseDuration(opts.for);
+      if (!parsed.ok) {
+        printError(parsed.error);
+        process.exit(1);
+      }
+      scope2 = "window";
+      ttl = parsed.seconds;
+    }
+    const tokenResult = await resolveToken(globals.token);
+    const token = tokenResult.ok ? tokenResult.data.token : void 0;
+    const sessionId = opts.sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+    const keys = ignoreStateKeys(token, sessionId);
+    const existing = resolveIgnoreState(keys);
+    const spent = existing?.state.spent ?? 0;
+    const writeKey = existing?.key ?? keys[0];
+    if (spent >= IGNORE_BUDGET) {
+      const msg = `Ignore budget spent for this session (${spent}/${IGNORE_BUDGET} declarations). The next turn will be reviewed normally. The budget is per session \u2014 it is what stops an ignore from becoming a standing mute.`;
+      if (opts.json) {
+        printJson({ declared: false, reason_refused: "budget-spent", spent, budget: IGNORE_BUDGET });
+      } else {
+        printWarn(msg);
+      }
+      logEvent("ignore_refused", { why: "budget-spent", spent, budget: IGNORE_BUDGET });
+      process.exit(0);
+    }
+    const declaration = {
+      scope: scope2,
+      origin: opts.agent ? "agent" : "user",
+      reason,
+      at: now,
+      expires: now + ttl
+    };
+    writeIgnoreState({ v: 1, active: declaration, spent: spent + 1 }, writeKey);
+    logEvent("ignore_declared", {
+      scope: scope2,
+      origin: declaration.origin,
+      ttl_seconds: ttl,
+      spent: spent + 1,
+      budget: IGNORE_BUDGET
+    });
+    if (opts.json) {
+      printJson({
+        declared: true,
+        scope: scope2,
+        origin: declaration.origin,
+        reason,
+        expires_at: new Date(declaration.expires * 1e3).toISOString(),
+        spent: spent + 1,
+        budget: IGNORE_BUDGET
+      });
+      return;
+    }
+    const window = scope2 === "turn" ? "the next turn" : `the next ${describeRemaining(declaration, now).replace(" left", "")}`;
+    printInfo(`Verity will skip ${window} \u2014 "${reason}" (${spent + 1}/${IGNORE_BUDGET} this session).`);
+    printInfo("It covers turns that author nothing. If anything is written, the declaration voids and the review runs.");
+  });
+  ignore.command("clear").description("Cancel the active declaration (the spent budget is not refunded)").option("--session-id <id>", "Session id (defaults to $CLAUDE_SESSION_ID)").action(async (opts) => {
+    const globals = program2.opts();
+    const tokenResult = await resolveToken(globals.token);
+    const token = tokenResult.ok ? tokenResult.data.token : void 0;
+    const sessionId = opts.sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+    const found = resolveIgnoreState(ignoreStateKeys(token, sessionId));
+    const active = resolveActive(found?.state ?? null, Math.floor(Date.now() / 1e3));
+    if (!found || !active) {
+      printInfo("No active ignore declaration.");
+      return;
+    }
+    clearActiveDeclaration(found.key);
+    logEvent("ignore_cleared", { scope: active.scope, origin: active.origin });
+    printInfo(`Cleared: "${active.reason}". The next turn will be reviewed normally.`);
+  });
+}
+
+// src/commands/waive.ts
+var import_node_crypto12 = require("node:crypto");
+var import_node_fs39 = require("node:fs");
+function registerWaiveCommand(program2) {
+  program2.command("waive <pattern-id>").description("Record an accepted-risk disposition for an open finding (voids when the file changes)").option("--file <path>", "File the finding is anchored to, REPO-RELATIVE (recommended \u2014 narrows the waive)").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action(async (patternId, opts) => {
+    const globals = program2.opts();
+    try {
+      process.chdir(repoRoot());
+    } catch {
+    }
+    if (opts.reason.trim().length < 20) {
+      printError("A waive needs a real reason (>= 20 chars) \u2014 name the human disposition it records.");
+      process.exit(1);
+    }
+    const tokenResult = await resolveToken(globals.token);
+    if (!tokenResult.ok) {
+      printError(tokenResult.error);
+      process.exit(1);
+    }
+    const urlResult = await resolveServiceUrl(globals.serviceUrl);
+    if (!urlResult.ok) {
+      printError(urlResult.error);
+      process.exit(1);
+    }
+    const body = {
+      pattern_id: patternId,
+      reason: opts.reason.trim()
+    };
+    if (opts.file) {
+      body.file = opts.file;
+      try {
+        body.file_sha256 = (0, import_node_crypto12.createHash)("sha256").update((0, import_node_fs39.readFileSync)(opts.file)).digest("hex");
+      } catch {
+        printError(`Cannot read ${opts.file} \u2014 run from the repo root, or omit --file to waive by pattern.`);
+        process.exit(1);
+      }
+    }
+    const result = await apiRequest({
+      method: "POST",
+      path: "/feedback/waive",
+      serviceUrl: urlResult.data,
+      token: tokenResult.data.token,
+      body,
+      verbose: globals.verbose
+    });
+    if (!result.ok) {
+      printError(`Couldn't record the waive: ${result.error}`);
+      process.exit(1);
+    }
+    logEvent("waive_recorded", { pattern: patternId, file: opts.file ?? null, waived: result.data.waived });
+    printInfo(`Waived ${result.data.waived} open statement(s) for '${patternId}'${opts.file ? ` on ${opts.file}` : ""}.`);
+    printInfo(result.data.note);
+  });
 }
 
 // src/commands/init.ts
-var import_node_fs37 = require("node:fs");
+var import_node_fs41 = require("node:fs");
 var import_promises13 = require("node:fs/promises");
 var import_node_path29 = require("node:path");
 var import_node_child_process11 = require("node:child_process");
 var readline2 = __toESM(require("node:readline/promises"));
 
 // src/commands/migrate.ts
-var import_node_fs36 = require("node:fs");
+var import_node_fs40 = require("node:fs");
 var import_node_path28 = require("node:path");
 var import_node_child_process10 = require("node:child_process");
 
@@ -21678,10 +22393,10 @@ async function runMigration(opts = {}) {
 function migrateProjectDir(root, actions) {
   const gateDir = (0, import_node_path28.join)(root, ".gate");
   const verityDir = (0, import_node_path28.join)(root, ".verity");
-  if ((0, import_node_fs36.existsSync)(gateDir) && !(0, import_node_fs36.existsSync)(verityDir)) {
+  if ((0, import_node_fs40.existsSync)(gateDir) && !(0, import_node_fs40.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if ((0, import_node_fs36.existsSync)(gateDir) && (0, import_node_fs36.existsSync)(verityDir)) {
+  if ((0, import_node_fs40.existsSync)(gateDir) && (0, import_node_fs40.existsSync)(verityDir)) {
     return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
   return false;
@@ -21702,13 +22417,13 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
     }
   }
   if (moved) {
-    if ((0, import_node_fs36.existsSync)(gateDir)) {
+    if ((0, import_node_fs40.existsSync)(gateDir)) {
       const carried = carryLegacyContents(gateDir, verityDir);
       if (carried > 0) {
         actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
       }
       try {
-        (0, import_node_fs36.rmSync)(gateDir, { recursive: true, force: true });
+        (0, import_node_fs40.rmSync)(gateDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -21724,7 +22439,7 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
     actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
   try {
-    (0, import_node_fs36.rmSync)(gateDir, { recursive: true, force: true });
+    (0, import_node_fs40.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
   }
   return carried > 0;
@@ -21733,9 +22448,9 @@ function migrateGlobalCredentials(home, actions) {
   if (!home) return;
   const gateCreds = (0, import_node_path28.join)(home, ".gate", "credentials");
   const verityCreds = (0, import_node_path28.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs36.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs36.existsSync)(verityCreds)) {
-    (0, import_node_fs36.mkdirSync)((0, import_node_path28.join)(home, ".verity"), { recursive: true });
+  if (!(0, import_node_fs40.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs40.existsSync)(verityCreds)) {
+    (0, import_node_fs40.mkdirSync)((0, import_node_path28.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -21758,7 +22473,7 @@ async function migrateLegacyHooks(root, actions) {
 }
 async function migrateClaudeMd(root, actions) {
   const claudeMd = (0, import_node_path28.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs36.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  const hadLegacyBlock = (0, import_node_fs40.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
     await ensureClaudeMdPointer(root);
@@ -21770,7 +22485,7 @@ async function migrateClaudeMd(root, actions) {
 function migrateStandardFile(root, actions) {
   const gateMd = (0, import_node_path28.join)(root, "GATE.md");
   const verityMd = (0, import_node_path28.join)(root, "VERITY.md");
-  if (!(0, import_node_fs36.existsSync)(gateMd) || (0, import_node_fs36.existsSync)(verityMd)) return;
+  if (!(0, import_node_fs40.existsSync)(gateMd) || (0, import_node_fs40.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
@@ -21782,12 +22497,12 @@ function migrateStandardFile(root, actions) {
   if (!moved) moveFile(gateMd, verityMd);
   const content = readFileSyncSafe(verityMd);
   const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs36.writeFileSync)(verityMd, refreshed);
+  if (refreshed !== content) (0, import_node_fs40.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
   const file = (0, import_node_path28.join)(root, ".claude", "settings.local.json");
-  if (!(0, import_node_fs36.existsSync)(file)) return;
+  if (!(0, import_node_fs40.existsSync)(file)) return;
   let settings;
   try {
     settings = JSON.parse(readFileSyncSafe(file) || "{}");
@@ -21835,14 +22550,14 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
   }
   if (toAppend.length > 0) {
     const sep2 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs36.writeFileSync)(verityCreds, verityContent + sep2 + toAppend.join("\n") + "\n");
+    (0, import_node_fs40.writeFileSync)(verityCreds, verityContent + sep2 + toAppend.join("\n") + "\n");
   }
-  (0, import_node_fs36.rmSync)(gateCreds, { force: true });
+  (0, import_node_fs40.rmSync)(gateCreds, { force: true });
   return toAppend.length;
 }
 function readFileSyncSafe(path) {
   try {
-    return (0, import_node_fs36.readFileSync)(path, "utf-8");
+    return (0, import_node_fs40.readFileSync)(path, "utf-8");
   } catch {
     return "";
   }
@@ -21857,35 +22572,35 @@ function hasStagedChanges(root) {
 }
 function moveDir(from, to) {
   try {
-    (0, import_node_fs36.renameSync)(from, to);
+    (0, import_node_fs40.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs36.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs36.rmSync)(from, { recursive: true, force: true });
+    (0, import_node_fs40.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs40.rmSync)(from, { recursive: true, force: true });
   }
 }
 function moveFile(from, to) {
   try {
-    (0, import_node_fs36.renameSync)(from, to);
+    (0, import_node_fs40.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs36.cpSync)(from, to);
-    (0, import_node_fs36.rmSync)(from, { force: true });
+    (0, import_node_fs40.cpSync)(from, to);
+    (0, import_node_fs40.rmSync)(from, { force: true });
   }
 }
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk = (relDir) => {
     const srcDir = (0, import_node_path28.join)(gateDir, relDir);
-    for (const entry of (0, import_node_fs36.readdirSync)(srcDir)) {
+    for (const entry of (0, import_node_fs40.readdirSync)(srcDir)) {
       const rel = relDir ? (0, import_node_path28.join)(relDir, entry) : entry;
       const src = (0, import_node_path28.join)(gateDir, rel);
       const dest = (0, import_node_path28.join)(verityDir, rel);
-      if ((0, import_node_fs36.statSync)(src).isDirectory()) {
+      if ((0, import_node_fs40.statSync)(src).isDirectory()) {
         walk(rel);
-      } else if (!(0, import_node_fs36.existsSync)(dest)) {
-        (0, import_node_fs36.mkdirSync)((0, import_node_path28.dirname)(dest), { recursive: true });
-        (0, import_node_fs36.cpSync)(src, dest);
+      } else if (!(0, import_node_fs40.existsSync)(dest)) {
+        (0, import_node_fs40.mkdirSync)((0, import_node_path28.dirname)(dest), { recursive: true });
+        (0, import_node_fs40.cpSync)(src, dest);
         copied++;
       }
     }
@@ -21896,20 +22611,20 @@ function carryLegacyContents(gateDir, verityDir) {
 async function needsMigration(root = repoRoot()) {
   const gateDir = (0, import_node_path28.join)(root, ".gate");
   const verityDir = (0, import_node_path28.join)(root, ".verity");
-  if ((0, import_node_fs36.existsSync)(gateDir) && !(0, import_node_fs36.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs36.existsSync)(gateDir) && (0, import_node_fs36.existsSync)(verityDir)) {
-    if ((0, import_node_fs36.existsSync)((0, import_node_path28.join)(gateDir, "credentials")) && !(0, import_node_fs36.existsSync)((0, import_node_path28.join)(verityDir, "credentials"))) {
+  if ((0, import_node_fs40.existsSync)(gateDir) && !(0, import_node_fs40.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs40.existsSync)(gateDir) && (0, import_node_fs40.existsSync)(verityDir)) {
+    if ((0, import_node_fs40.existsSync)((0, import_node_path28.join)(gateDir, "credentials")) && !(0, import_node_fs40.existsSync)((0, import_node_path28.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs36.existsSync)((0, import_node_path28.join)(gateDir, "memory")) && !(0, import_node_fs36.existsSync)((0, import_node_path28.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs40.existsSync)((0, import_node_path28.join)(gateDir, "memory")) && !(0, import_node_fs40.existsSync)((0, import_node_path28.join)(verityDir, "memory"))) {
       return true;
     }
   }
   const claudeMd = (0, import_node_path28.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs36.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+  if ((0, import_node_fs40.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs36.existsSync)((0, import_node_path28.join)(root, "GATE.md")) && !(0, import_node_fs36.existsSync)((0, import_node_path28.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs40.existsSync)((0, import_node_path28.join)(root, "GATE.md")) && !(0, import_node_fs40.existsSync)((0, import_node_path28.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -22053,7 +22768,7 @@ function resolveDataDir() {
     // local dev: running from repo root
   ];
   for (const candidate of candidates) {
-    if ((0, import_node_fs37.existsSync)((0, import_node_path29.join)(candidate, "skills"))) {
+    if ((0, import_node_fs41.existsSync)((0, import_node_path29.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -22069,7 +22784,7 @@ function registerInitCommand(program2) {
   program2.command("init").description("Initialize Verity in the current project").option("--force", "Overwrite existing skills and hooks").action(async (opts) => {
     const force = opts.force ?? false;
     const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-    const isProject = projectMarkers.some((m) => (0, import_node_fs37.existsSync)(m));
+    const isProject = projectMarkers.some((m) => (0, import_node_fs41.existsSync)(m));
     if (!isProject) {
       printError("No project detected in the current directory.");
       printInfo('Run "verity init" from your project root.');
@@ -22139,14 +22854,14 @@ function registerInitCommand(program2) {
     for (const skill of skills) {
       const src = (0, import_node_path29.join)(skillsSource, skill);
       const dest = (0, import_node_path29.join)(skillsDest, skill);
-      if (!(0, import_node_fs37.existsSync)(src)) {
+      if (!(0, import_node_fs41.existsSync)(src)) {
         printWarn(`  Skill data not found: ${skill}`);
         continue;
       }
-      if ((0, import_node_fs37.existsSync)(dest) && !force) {
+      if ((0, import_node_fs41.existsSync)(dest) && !force) {
         const srcSkill = (0, import_node_path29.join)(src, "SKILL.md");
         const destSkill = (0, import_node_path29.join)(dest, "SKILL.md");
-        if ((0, import_node_fs37.existsSync)(destSkill)) {
+        if ((0, import_node_fs41.existsSync)(destSkill)) {
           try {
             const srcContent = await (0, import_promises13.readFile)(srcSkill, "utf-8");
             const destContent = await (0, import_promises13.readFile)(destSkill, "utf-8");
@@ -22224,7 +22939,7 @@ function registerInitCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-var import_node_fs38 = require("node:fs");
+var import_node_fs42 = require("node:fs");
 var import_node_path30 = require("node:path");
 var SKILL_NAMES = [
   "verity-setup",
@@ -22245,10 +22960,10 @@ function registerUninstallCommand(program2) {
     const skillsRoot = projectPath(".claude/skills");
     for (const name of SKILL_NAMES) {
       const dir = (0, import_node_path30.join)(skillsRoot, name);
-      if ((0, import_node_fs38.existsSync)(dir)) {
+      if ((0, import_node_fs42.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name}/`,
-          apply: () => (0, import_node_fs38.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs42.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -22262,24 +22977,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs38.existsSync)(verityDir)) {
+    if ((0, import_node_fs42.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs38.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs42.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs38.existsSync)(verityMd)) {
+      if ((0, import_node_fs42.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs38.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs42.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs38.existsSync)(path) && (0, import_node_fs38.statSync)(path).isDirectory() && (0, import_node_fs38.readdirSync)(path).length === 0) {
-        (0, import_node_fs38.rmdirSync)(path);
+      if ((0, import_node_fs42.existsSync)(path) && (0, import_node_fs42.statSync)(path).isDirectory() && (0, import_node_fs42.readdirSync)(path).length === 0) {
+        (0, import_node_fs42.rmdirSync)(path);
       }
     };
     actions.push({
@@ -22291,10 +23006,10 @@ function registerUninstallCommand(program2) {
     });
     const home = process.env.HOME ?? "";
     const globalVerityDir = (0, import_node_path30.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs38.existsSync)(globalVerityDir)) {
+    if (purgeGlobal && (0, import_node_fs42.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs38.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs42.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -22488,7 +23203,7 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs39 = require("node:fs");
+var import_node_fs43 = require("node:fs");
 var import_node_path31 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
@@ -22526,11 +23241,11 @@ function registerResetCommand(program2) {
     }
     const cacheDir = projectPath(CACHE_DIR);
     let purged = 0;
-    if ((0, import_node_fs39.existsSync)(cacheDir)) {
-      for (const entry of (0, import_node_fs39.readdirSync)(cacheDir)) {
+    if ((0, import_node_fs43.existsSync)(cacheDir)) {
+      for (const entry of (0, import_node_fs43.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs39.unlinkSync)((0, import_node_path31.join)(cacheDir, entry));
+            (0, import_node_fs43.unlinkSync)((0, import_node_path31.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -22545,19 +23260,19 @@ function registerResetCommand(program2) {
       projectPath(`${VERITY_DIR}/.last-analysis`)
     ];
     for (const file of filesToClear) {
-      if ((0, import_node_fs39.existsSync)(file)) {
+      if ((0, import_node_fs43.existsSync)(file)) {
         try {
-          (0, import_node_fs39.writeFileSync)(file, "");
+          (0, import_node_fs43.writeFileSync)(file, "");
         } catch {
         }
       }
     }
     if (opts.all) {
       const logsDir = projectPath(`${VERITY_DIR}/.logs`);
-      if ((0, import_node_fs39.existsSync)(logsDir)) {
-        for (const entry of (0, import_node_fs39.readdirSync)(logsDir)) {
+      if ((0, import_node_fs43.existsSync)(logsDir)) {
+        for (const entry of (0, import_node_fs43.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs39.unlinkSync)((0, import_node_path31.join)(logsDir, entry));
+            (0, import_node_fs43.unlinkSync)((0, import_node_path31.join)(logsDir, entry));
           } catch {
           }
         }
@@ -22865,8 +23580,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.30.1").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.30.1");
+program.name("verity").description("CLI for Verity quality gate service").version("0.31.0-experimental.6bc3b1b").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.31.0-experimental.6bc3b1b");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();
@@ -22889,6 +23604,8 @@ registerAnalyzeCommand(program);
 registerBaselineCommands(program);
 registerReviewCommand(program);
 registerGuardCommand(program);
+registerIgnoreCommand(program);
+registerWaiveCommand(program);
 registerInitCommand(program);
 registerUninstallCommand(program);
 registerTaskCommands(program);