@codacy/verity-cli 0.31.4 → 0.32.0-experimental.68ae2ee

package/bin/verity.js

@@ -675,8 +675,8 @@ var require_option = __commonJS({
        * @param {(string | string[])} names
        * @return {Option}
        */
-      conflicts(names) {
-        this.conflictsWith = this.conflictsWith.concat(names);
+      conflicts(names2) {
+        this.conflictsWith = this.conflictsWith.concat(names2);
         return this;
       }
       /**
@@ -1249,8 +1249,8 @@ var require_command = __commonJS({
        * @param {string} names
        * @return {Command} `this` command for chaining
        */
-      arguments(names) {
-        names.trim().split(/ +/).forEach((detail) => {
+      arguments(names2) {
+        names2.trim().split(/ +/).forEach((detail) => {
           this.argument(detail);
         });
         return this;
@@ -10509,7 +10509,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -10955,8 +10955,8 @@ function filterReviewable(files) {
     const ext = (0, import_node_path3.extname)(f).slice(1);
     if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
     if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename3 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename3)) return true;
+    const basename4 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename4)) return true;
     if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
     return false;
   });
@@ -16758,12 +16758,862 @@ async function readHookStdin() {
 }
 
 // src/commands/standard.ts
+var import_promises12 = require("node:fs/promises");
+var import_node_fs28 = require("node:fs");
+var import_yaml3 = __toESM(require_dist());
+
+// src/lib/synthesize.ts
+var import_node_child_process8 = require("node:child_process");
+var import_node_fs24 = require("node:fs");
 var import_promises9 = require("node:fs/promises");
-var import_node_fs23 = require("node:fs");
+var import_node_path20 = require("node:path");
 var import_yaml = __toESM(require_dist());
 
-// src/lib/verityignore.ts
+// src/lib/data-dir.ts
 var import_node_fs22 = require("node:fs");
+var import_node_path18 = require("node:path");
+function resolveDataDir() {
+  const candidates = [
+    (0, import_node_path18.join)(__dirname, "..", "data"),
+    // installed: node_modules/@codacy/verity-cli/data
+    (0, import_node_path18.join)(__dirname, "..", "..", "data"),
+    // edge case: nested resolution
+    // THE COMMITTED SOURCE, for a source checkout that has not been built.
+    // cli/data/skills/ is a BUILD ARTIFACT (scripts/build.js copies client/skills
+    // into it) and is gitignored, because skills have one committed source — so
+    // in a fresh clone the packaged candidates above do not exist at all, and
+    // without this the synthesizer throws "Could not find Verity skill data"
+    // for every test and every `verity` run from source. Resolved from this
+    // module's own location, never the cwd: see the warning below.
+    (0, import_node_path18.join)(__dirname, "..", "..", "client"),
+    // bundled: cli/bin/ → ../../client
+    (0, import_node_path18.join)(__dirname, "..", "..", "..", "client"),
+    // tsx: cli/src/lib/ → ../../../client
+    ...process.env.VERITY_DEV_DATA_DIR ? [process.env.VERITY_DEV_DATA_DIR] : []
+  ];
+  for (const candidate of candidates) {
+    if ((0, import_node_fs22.existsSync)((0, import_node_path18.join)(candidate, "skills"))) {
+      return candidate;
+    }
+  }
+  throw new Error(
+    "Could not find Verity skill data. Reinstall: npm install -g @codacy/verity-cli"
+  );
+}
+function setupDataPath(file) {
+  return (0, import_node_path18.join)(resolveDataDir(), "skills", "verity-setup", file);
+}
+
+// src/lib/detect.ts
+var import_node_child_process7 = require("node:child_process");
+var import_node_fs23 = require("node:fs");
+var import_node_path19 = require("node:path");
+var TOOLED_LANGUAGES = /* @__PURE__ */ new Set([
+  "typescript",
+  "javascript",
+  "python",
+  "go",
+  "java",
+  "kotlin",
+  "ruby",
+  "rust",
+  "c",
+  "cpp",
+  "shell",
+  "dockerfile"
+]);
+var MIN_FILES_FOR_LANGUAGE = 3;
+var IGNORED_SEGMENTS = [
+  "node_modules",
+  "dist",
+  "build",
+  "vendor",
+  "coverage",
+  ".git",
+  "__pycache__",
+  ".next",
+  ".venv",
+  "target",
+  ".verity",
+  ".codacy"
+];
+function isIgnored(path) {
+  const parts = path.split("/");
+  return parts.some((p) => IGNORED_SEGMENTS.includes(p));
+}
+function listProjectFiles(root) {
+  try {
+    const out = (0, import_node_child_process7.execSync)("git ls-files -z", {
+      cwd: root,
+      encoding: "utf-8",
+      maxBuffer: 32 * 1024 * 1024,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const tracked = out.split("\0").filter(Boolean).filter((p) => !isIgnored(p));
+    if (tracked.length > 0) return tracked;
+  } catch {
+  }
+  return walk(root);
+}
+var WALK_MAX_FILES = 2e4;
+var WALK_MAX_DEPTH = 8;
+function walk(root) {
+  const found = [];
+  const visit = (dir, depth) => {
+    if (depth > WALK_MAX_DEPTH || found.length >= WALK_MAX_FILES) return;
+    let entries;
+    try {
+      entries = (0, import_node_fs23.readdirSync)(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (found.length >= WALK_MAX_FILES) return;
+      if (IGNORED_SEGMENTS.includes(entry.name)) continue;
+      const full = (0, import_node_path19.join)(dir, entry.name);
+      if (entry.isDirectory()) visit(full, depth + 1);
+      else if (entry.isFile()) found.push((0, import_node_path19.relative)(root, full));
+    }
+  };
+  visit(root, 0);
+  return found;
+}
+function languageOf(path) {
+  const name = (0, import_node_path19.basename)(path);
+  if (/^Dockerfile(\..+)?$/i.test(name)) return "dockerfile";
+  if (!(0, import_node_path19.extname)(name)) return null;
+  const lang = detectLanguage(path);
+  return lang || null;
+}
+var FRAMEWORK_BY_DEPENDENCY = [
+  [/^react$/, "react"],
+  [/^react-native$/, "react-native"],
+  [/^next$/, "next.js"],
+  [/^vue$/, "vue"],
+  [/^@angular\/core$/, "angular"],
+  [/^svelte$/, "svelte"],
+  [/^express$/, "express"],
+  [/^fastify$/, "fastify"],
+  [/^@nestjs\/core$/, "nestjs"],
+  [/^koa$/, "koa"],
+  [/^hono$/, "hono"],
+  [/^@supabase\/supabase-js$/, "supabase"],
+  [/^prisma$|^@prisma\/client$/, "prisma"],
+  [/^drizzle-orm$/, "drizzle"],
+  [/^django$/i, "django"],
+  [/^flask$/i, "flask"],
+  [/^fastapi$/i, "fastapi"],
+  [/^sqlalchemy$/i, "sqlalchemy"],
+  [/^pydantic$/i, "pydantic"],
+  [/^celery$/i, "celery"],
+  [/^gin-gonic\/gin$/, "gin"],
+  [/^labstack\/echo/, "echo"],
+  [/^gofiber\/fiber/, "fiber"],
+  [/^spring-boot|springframework/, "spring"],
+  [/^rails$/, "rails"],
+  [/^sinatra$/, "sinatra"],
+  [/^actix-web$/, "actix"],
+  [/^axum$/, "axum"],
+  [/^rocket$/, "rocket"]
+];
+var TEST_FRAMEWORK_BY_DEPENDENCY = [
+  [/^vitest$/, "vitest"],
+  [/^jest$/, "jest"],
+  [/^mocha$/, "mocha"],
+  [/^@playwright\/test$/, "playwright"],
+  [/^cypress$/, "cypress"],
+  [/^pytest$/i, "pytest"],
+  [/^unittest2$/i, "unittest"],
+  [/^rspec$/, "rspec"],
+  [/^junit$|^junit-jupiter/, "junit"]
+];
+var TOOL_CONFIG_MARKERS = [
+  ["ESLint9", ["eslint.config.js", "eslint.config.mjs", "eslint.config.cjs", ".eslintrc", ".eslintrc.js", ".eslintrc.json", ".eslintrc.yml"]],
+  ["Semgrep", [".semgrep.yml", ".semgrep.yaml", "semgrep.yml", "semgrep.yaml"]],
+  ["Trivy", ["trivy.yaml", "trivy.yml"]],
+  ["Ruff", ["ruff.toml", ".ruff.toml"]],
+  ["PMD7", ["pmd.xml", "ruleset.xml"]],
+  ["detekt", ["detekt.yml", "detekt.yaml"]],
+  ["Hadolint", [".hadolint.yaml", ".hadolint.yml"]]
+];
+function readJson(path) {
+  try {
+    return JSON.parse((0, import_node_fs23.readFileSync)(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function matchAll(names2, table) {
+  const hits = /* @__PURE__ */ new Set();
+  for (const name of names2) {
+    for (const [pattern, label2] of table) {
+      if (pattern.test(name)) hits.add(label2);
+    }
+  }
+  return [...hits];
+}
+var NESTED_MANIFEST_LIMIT = 25;
+function declaredDependencies(root, files) {
+  const names2 = [];
+  const readPackageJson = (path) => {
+    const pkg = readJson(path);
+    if (!pkg) return;
+    for (const field of ["dependencies", "devDependencies", "peerDependencies"]) {
+      const deps = pkg[field];
+      if (deps && typeof deps === "object") names2.push(...Object.keys(deps));
+    }
+  };
+  readPackageJson((0, import_node_path19.join)(root, "package.json"));
+  const nested = files.filter((f) => f.includes("/") && (0, import_node_path19.basename)(f) === "package.json").slice(0, NESTED_MANIFEST_LIMIT);
+  for (const rel of nested) readPackageJson((0, import_node_path19.join)(root, rel));
+  const pythonManifests = [
+    ...["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].map((f) => (0, import_node_path19.join)(root, f)),
+    ...files.filter((f) => f.includes("/") && /(^|\/)(pyproject\.toml|requirements\.txt)$/.test(f)).slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path19.join)(root, f))
+  ];
+  for (const path of pythonManifests) {
+    if (!(0, import_node_fs23.existsSync)(path)) continue;
+    try {
+      const text = (0, import_node_fs23.readFileSync)(path, "utf-8");
+      for (const m of text.matchAll(/^\s*["']?([A-Za-z][A-Za-z0-9._-]+)/gm)) names2.push(m[1]);
+      for (const line of text.split("\n")) {
+        if (!/dependencies\s*=/.test(line)) continue;
+        for (const m of line.matchAll(/["']([A-Za-z][A-Za-z0-9._-]+)/g)) names2.push(m[1]);
+      }
+    } catch {
+    }
+  }
+  const goMods = [
+    (0, import_node_path19.join)(root, "go.mod"),
+    ...files.filter((f) => f.includes("/") && (0, import_node_path19.basename)(f) === "go.mod").slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path19.join)(root, f))
+  ];
+  for (const path of goMods) {
+    if (!(0, import_node_fs23.existsSync)(path)) continue;
+    try {
+      const text = (0, import_node_fs23.readFileSync)(path, "utf-8");
+      for (const m of text.matchAll(/^\s+([\w.-]+\/[\w./-]+)\s+v/gm)) {
+        names2.push(m[1].replace(/^github\.com\//, ""));
+      }
+    } catch {
+    }
+  }
+  for (const file of ["pom.xml", "build.gradle", "build.gradle.kts", "Gemfile", "Cargo.toml"]) {
+    const path = (0, import_node_path19.join)(root, file);
+    if (!(0, import_node_fs23.existsSync)(path)) continue;
+    try {
+      const text = (0, import_node_fs23.readFileSync)(path, "utf-8");
+      for (const m of text.matchAll(/["'<]([A-Za-z][A-Za-z0-9._-]{2,})["'>]/g)) names2.push(m[1]);
+    } catch {
+    }
+  }
+  return names2;
+}
+function detectBuildSystem(root, files) {
+  const has = (f) => (0, import_node_fs23.existsSync)((0, import_node_path19.join)(root, f)) || files.some((p) => (0, import_node_path19.basename)(p) === f);
+  if (has("pnpm-lock.yaml")) return "pnpm";
+  if (has("yarn.lock")) return "yarn";
+  if (has("bun.lock") || has("bun.lockb")) return "bun";
+  if (has("package-lock.json") || has("package.json")) return "npm";
+  if (has("poetry.lock")) return "poetry";
+  if (has("uv.lock")) return "uv";
+  if (has("pyproject.toml") || has("requirements.txt")) return "pip";
+  if (has("go.mod")) return "go";
+  if (has("pom.xml")) return "maven";
+  if (has("build.gradle") || has("build.gradle.kts")) return "gradle";
+  if (has("Cargo.toml")) return "cargo";
+  if (has("Gemfile")) return "bundler";
+  return null;
+}
+function detectArchitecture(root, files) {
+  const workspaceMarkers = ["lerna.json", "pnpm-workspace.yaml", "nx.json", "turbo.json", "rush.json"];
+  if (workspaceMarkers.some((m) => (0, import_node_fs23.existsSync)((0, import_node_path19.join)(root, m)))) return "monorepo";
+  const pkg = readJson((0, import_node_path19.join)(root, "package.json"));
+  if (pkg && "workspaces" in pkg) return "monorepo";
+  const manifests = files.filter((f) => /(^|\/)(package\.json|go\.mod|pyproject\.toml|Cargo\.toml|pom\.xml)$/.test(f));
+  const nested = manifests.filter((f) => f.includes("/"));
+  if (nested.length >= 2) {
+    const underServices = nested.filter((f) => /^(services|apps)\//.test(f));
+    return underServices.length >= 2 ? "microservices" : "monorepo";
+  }
+  return "monolith";
+}
+var SAMPLE_LIMIT = 300;
+function measureAvgFileLength(root, files, languages) {
+  const primary = new Set(languages.slice(0, 2));
+  const candidates = files.filter((f) => {
+    const lang = languageOf(f);
+    return lang !== null && primary.has(lang);
+  });
+  if (candidates.length === 0) return null;
+  const stride = Math.max(1, Math.floor(candidates.length / SAMPLE_LIMIT));
+  let total = 0;
+  let counted = 0;
+  for (let i = 0; i < candidates.length; i += stride) {
+    const path = (0, import_node_path19.join)(root, candidates[i]);
+    try {
+      if ((0, import_node_fs23.statSync)(path).size > 2 * 1024 * 1024) continue;
+      total += (0, import_node_fs23.readFileSync)(path, "utf-8").split("\n").length;
+      counted++;
+    } catch {
+    }
+  }
+  return counted > 0 ? Math.round(total / counted) : null;
+}
+function tunedFileLengthThreshold(avgFileLength, floor = 300) {
+  if (avgFileLength === null || avgFileLength <= 0) return floor;
+  const scaled = Math.round(avgFileLength * 0.8 / 50) * 50;
+  return Math.max(floor, scaled);
+}
+function detectProject(root = repoRoot()) {
+  const files = listProjectFiles(root);
+  const languageCounts = {};
+  for (const file of files) {
+    const lang = languageOf(file);
+    if (!lang) continue;
+    languageCounts[lang] = (languageCounts[lang] ?? 0) + 1;
+  }
+  const languages = Object.entries(languageCounts).filter(([lang, count]) => TOOLED_LANGUAGES.has(lang) && count >= MIN_FILES_FOR_LANGUAGE).sort((a, b) => b[1] - a[1]).map(([lang]) => lang);
+  const dependencies = declaredDependencies(root, files);
+  const existingToolConfigs = [];
+  for (const [tool, markers] of TOOL_CONFIG_MARKERS) {
+    for (const marker of markers) {
+      if ((0, import_node_fs23.existsSync)((0, import_node_path19.join)(root, marker))) {
+        existingToolConfigs.push({ tool, path: `./${marker}` });
+        break;
+      }
+    }
+  }
+  return {
+    projectName: (0, import_node_path19.basename)(root),
+    languages,
+    languageCounts,
+    frameworks: matchAll(dependencies, FRAMEWORK_BY_DEPENDENCY),
+    architecture: detectArchitecture(root, files),
+    buildSystem: detectBuildSystem(root, files),
+    testFramework: matchAll(dependencies, TEST_FRAMEWORK_BY_DEPENDENCY)[0] ?? null,
+    existingToolConfigs,
+    avgFileLength: measureAvgFileLength(root, files, languages),
+    filesScanned: files.length
+  };
+}
+function describeDetected(d) {
+  const langs = d.languages.length > 0 ? d.languages.map((l) => `${l} (${d.languageCounts[l]} files)`).join(", ") : "no code languages detected";
+  const parts = [langs];
+  if (d.frameworks.length > 0) parts.push(d.frameworks.join(", "));
+  parts.push(d.architecture);
+  if (d.buildSystem) parts.push(d.buildSystem);
+  if (d.testFramework) parts.push(d.testFramework);
+  return parts.join(" \xB7 ");
+}
+
+// src/lib/verity-md.ts
+function names(content, key) {
+  const raw = content[key];
+  if (!Array.isArray(raw)) return [];
+  return raw.map((entry) => {
+    if (typeof entry === "string") return entry;
+    if (entry && typeof entry === "object") {
+      const rec = entry;
+      const label2 = rec.name ?? rec.id ?? rec.dimension ?? rec.pattern;
+      return typeof label2 === "string" ? label2 : null;
+    }
+    return null;
+  }).filter((x) => !!x);
+}
+var DEFAULT_DIMENSIONS = ["comprehensibility", "modularity", "type_safety", "test_adequacy"];
+var DEFAULT_SECURITY = [
+  "No hardcoded secrets (CWE-798)",
+  "Input sanitization (CWE-20)",
+  "Parameterized queries (CWE-89)",
+  "Dependency verification (CWE-1395)",
+  "No unsafe deserialization (CWE-502)",
+  "Access control checks (CWE-639)",
+  "Config file integrity (CWE-15)"
+];
+function describeOrigin(origin) {
+  if (origin.kind === "adopted") {
+    return `adopted from the service${origin.createdBy ? `, created by ${origin.createdBy}` : ""}`;
+  }
+  return `derived from this codebase${origin.tools.length > 0 ? ` \xB7 ${origin.tools.join(", ")}` : ""}`;
+}
+function closingNote(origin) {
+  if (origin.kind === "adopted") {
+    return `_This Standard came from the service \u2014 the team's shared version. To change it,
+edit \`.verity/standard.yaml\` and run \`verity standard push\`, or re-synthesize
+from the codebase with \`verity standard synthesize --force\`._`;
+  }
+  return `_This Standard was derived from the codebase: languages, frameworks and
+architecture were detected, and the rules come from Verity's research-backed
+patterns reference. Project-specific patterns are not part of it yet \u2014 add them
+to \`custom_patterns\` in \`.verity/standard.yaml\` and run \`verity standard push\`._`;
+}
+function renderVerityMd(input) {
+  const dimensions = names(input.content, "quality_dimensions");
+  const patterns = names(input.content, "security_patterns");
+  const custom = names(input.content, "custom_patterns");
+  const list2 = (items, fallback) => (items.length > 0 ? items : fallback).map((i) => `- ${i}`).join("\n");
+  return `# VERITY.md \u2014 Quality Gate
+
+> This project uses [Verity](https://verity.md) to enforce quality and security standards on AI-generated code.
+
+**URL:** ${input.serviceUrl}
+**Project:** ${input.projectId ?? "this repository"}
+**Standard:** v${input.version} (${describeOrigin(input.origin)})
+
+## Quality Dimensions
+${list2(dimensions, DEFAULT_DIMENSIONS)}
+
+## Security Patterns
+${list2(patterns, DEFAULT_SECURITY)}
+${custom.length > 0 ? `
+## Project Patterns
+${list2(custom, [])}
+` : ""}
+## How It Works
+Every time the coding agent stops, the Verity hook:
+1. Runs static analysis via @codacy/analysis-cli
+2. Sends results + code to the Verity service
+3. An independent model reviews the code
+4. Returns PASS / WARN / FAIL with actionable findings
+
+${closingNote(input.origin)}
+`;
+}
+
+// src/lib/synthesize.ts
+function loadCatalog() {
+  const catalog = (0, import_yaml.parse)((0, import_node_fs24.readFileSync)(setupDataPath("patterns-reference.yaml"), "utf-8"));
+  const template = (0, import_yaml.parse)((0, import_node_fs24.readFileSync)(setupDataPath("standard-template.yaml"), "utf-8"));
+  return { catalog, template };
+}
+function selectTools(languages, intensity, catalog) {
+  const recommended = /* @__PURE__ */ new Set();
+  for (const language of languages) {
+    for (const tool of catalog.tool_recommendations?.[language]?.[intensity] ?? []) {
+      recommended.add(tool);
+    }
+  }
+  const tools = [];
+  const skipped = [];
+  for (const tool of recommended) {
+    if (tool === "Trivy") {
+      tools.push(tool);
+      continue;
+    }
+    const curated = catalog.curated_patterns?.[tool]?.patterns;
+    if (curated && curated.length > 0) tools.push(tool);
+    else skipped.push(tool);
+  }
+  return { tools: tools.sort(), skipped: skipped.sort() };
+}
+var TRIVY_BY_INTENSITY = {
+  lightweight: {
+    emit: "^Trivy_(secret|vulnerability_(critical|high))$",
+    fallback: ["Trivy_secret", "Trivy_vulnerability_critical", "Trivy_vulnerability_high"]
+  },
+  balanced: {
+    emit: "^Trivy_(secret|malicious_packages|vulnerability_(critical|high))$",
+    fallback: [
+      "Trivy_secret",
+      "Trivy_malicious_packages",
+      "Trivy_vulnerability_critical",
+      "Trivy_vulnerability_high"
+    ]
+  },
+  thorough: {
+    // `medium` is emitted when the adapter has it; the fallback stays at the
+    // four ids that are known to exist rather than guessing a fifth.
+    emit: "^Trivy_(secret|malicious_packages|vulnerability_(critical|high|medium))$",
+    fallback: [
+      "Trivy_secret",
+      "Trivy_malicious_packages",
+      "Trivy_vulnerability_critical",
+      "Trivy_vulnerability_high"
+    ]
+  }
+};
+function adapterPatternIds(toolId) {
+  try {
+    const out = (0, import_node_child_process8.execFileSync)(
+      process.execPath,
+      [setupDataPath("validate-patterns.mjs"), "--list", toolId],
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 3e4 }
+    );
+    const ids = out.split("\n").map((l) => l.trim()).filter(Boolean);
+    return ids.length > 0 ? new Set(ids) : null;
+  } catch {
+    return null;
+  }
+}
+function resolvePatternId(toolId, curatedId, adapterIds) {
+  if (adapterIds.has(curatedId)) return { id: curatedId, resolved: false };
+  const prefixed = `${toolId}_${curatedId}`;
+  if (adapterIds.has(prefixed)) return { id: prefixed, resolved: true };
+  for (const base of [curatedId, prefixed]) {
+    const matches = [...adapterIds].filter((id) => id.startsWith(`${base}_`));
+    if (matches.length === 1) return { id: matches[0], resolved: true };
+    if (matches.length > 1) return null;
+  }
+  const segments = curatedId.split("_");
+  if (segments.length >= 3) {
+    const head = segments.slice(0, 2).join("_");
+    const matches = [...adapterIds].filter((id) => id.startsWith(`${head}_`));
+    if (matches.length === 1) return { id: matches[0], resolved: true };
+  }
+  return null;
+}
+function trivyPatterns(intensity) {
+  try {
+    const out = (0, import_node_child_process8.execFileSync)(
+      process.execPath,
+      [setupDataPath("validate-patterns.mjs"), "--emit", "Trivy", TRIVY_BY_INTENSITY[intensity].emit],
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 3e4 }
+    );
+    const parsed = JSON.parse(out);
+    const patterns = parsed.map((p) => p.patternId).filter(Boolean);
+    if (patterns.length > 0) return { patterns, derived: true };
+  } catch {
+  }
+  return { patterns: [...TRIVY_BY_INTENSITY[intensity].fallback], derived: false };
+}
+function buildStandard(input, loaded) {
+  const { detected, intensity, tools } = input;
+  const { catalog, template } = loaded;
+  const standard = structuredClone(template);
+  const selected = new Set(tools);
+  standard.created_by = input.createdBy ?? "verity-cli";
+  standard.knowledge_spec = {
+    project_name: detected.projectName,
+    languages: detected.languages,
+    frameworks: detected.frameworks,
+    architecture: detected.architecture,
+    build_system: detected.buildSystem ?? "",
+    test_framework: detected.testFramework ?? ""
+  };
+  const dimensions = Array.isArray(standard.quality_dimensions) ? standard.quality_dimensions : [];
+  for (const dimension of dimensions) {
+    if (dimension.id === "comprehensibility") {
+      for (const signal of dimension.signals ?? []) {
+        if (signal.metric === "file_length") {
+          signal.threshold = tunedFileLengthThreshold(detected.avgFileLength);
+          if (detected.avgFileLength !== null) {
+            signal.measured_project_average = detected.avgFileLength;
+          }
+        }
+      }
+    }
+    if (dimension.id === "type_safety") {
+      dimension.signals = typeSafetySignals(detected.languages, catalog);
+    }
+  }
+  const patterns = Array.isArray(standard.security_patterns) ? standard.security_patterns : [];
+  const catalogById = new Map((catalog.security_patterns ?? []).map((p) => [p.id, p]));
+  for (const pattern of patterns) {
+    const fromCatalog = catalogById.get(String(pattern.id));
+    const enforcers = (fromCatalog?.enforced_by ?? []).filter((e) => e.tool && selected.has(e.tool)).map((e) => ({ tool: e.tool }));
+    pattern.enforced_by = enforcers;
+  }
+  standard.custom_patterns = [];
+  const constraints = standard.process_constraints ?? {};
+  constraints.analysis_mode = intensity;
+  standard.process_constraints = constraints;
+  standard.tool_configuration = Object.fromEntries(
+    tools.map((tool) => {
+      const existing = detected.existingToolConfigs.find((c) => c.tool === tool);
+      return [tool, existing ? { enabled: true, project_config_detected: existing.path } : { enabled: true }];
+    })
+  );
+  return standard;
+}
+function typeSafetySignals(languages, catalog) {
+  const template = (catalog.quality_dimensions ?? []).find((d) => d.id === "type_safety");
+  const signals = [];
+  for (const signal of template?.signals ?? []) {
+    const byLanguage = signal.rules_by_language;
+    if (!byLanguage) continue;
+    for (const language of languages) {
+      const entry = byLanguage[language];
+      if (!entry) continue;
+      signals.push({
+        metric: signal.metric,
+        language,
+        tool: entry.tool,
+        rules: entry.rules ?? [],
+        rationale: signal.rationale
+      });
+    }
+  }
+  return signals;
+}
+function standardToYaml(standard) {
+  return (0, import_yaml.stringify)(standard, { lineWidth: 100 });
+}
+var VERITY_ESLINT_CONFIG_PATH = "./.codacy/tools-configs/eslint.config.mjs";
+function resolveToolPatterns(toolId, curated) {
+  const real = adapterPatternIds(toolId);
+  if (!real) return { patterns: curated, notes: [] };
+  const notes = [];
+  const kept = [];
+  const lost = [];
+  let renamed = 0;
+  for (const { patternId } of curated) {
+    const match = resolvePatternId(toolId, patternId, real);
+    if (!match) {
+      lost.push(patternId);
+      continue;
+    }
+    if (match.resolved) renamed++;
+    kept.push({ patternId: match.id });
+  }
+  if (renamed > 0) {
+    notes.push(`${toolId}: ${renamed} of ${curated.length} pattern ids resolved to your adapter's spelling.`);
+  }
+  if (lost.length > 0) {
+    notes.push(
+      `${toolId}: ${lost.length} of ${curated.length} curated pattern ids match nothing in your installed adapter and were dropped${kept.length === 0 ? ` \u2014 ${toolId} is not configured at all` : ""} (${lost.slice(0, 3).join(", ")}${lost.length > 3 ? ", \u2026" : ""}). Re-derive them with: validate-patterns.mjs --list ${toolId}`
+    );
+  }
+  return { patterns: kept, notes };
+}
+function buildCodacyConfig(input, loaded, trivy, verifyAgainstAdapter = true) {
+  const tools = [];
+  const notes = [];
+  for (const toolId of input.tools) {
+    const curated = toolId === "Trivy" ? trivy.patterns.map((patternId) => ({ patternId })) : (loaded.catalog.curated_patterns?.[toolId]?.patterns ?? []).map((p) => ({ patternId: p.patternId }));
+    const resolved = verifyAgainstAdapter && toolId !== "Trivy" ? resolveToolPatterns(toolId, curated) : { patterns: curated, notes: [] };
+    const patterns = resolved.patterns;
+    notes.push(...resolved.notes);
+    if (patterns.length === 0) continue;
+    const tool = { toolId, patterns };
+    if (toolId === "ESLint9") {
+      tool.useLocalConfigurationFile = false;
+      tool.localConfigurationFile = VERITY_ESLINT_CONFIG_PATH;
+    }
+    tools.push(tool);
+  }
+  return {
+    config: {
+      version: 1,
+      metadata: {
+        source: "local",
+        languages: input.detected.languages.map(capitalizeLanguage)
+      },
+      tools
+    },
+    notes
+  };
+}
+function capitalizeLanguage(language) {
+  const special = {
+    typescript: "TypeScript",
+    javascript: "JavaScript",
+    cpp: "CPP",
+    c: "C",
+    csharp: "CSharp",
+    php: "PHP",
+    shell: "Shell",
+    dockerfile: "Dockerfile"
+  };
+  return special[language] ?? language.charAt(0).toUpperCase() + language.slice(1);
+}
+var VERITY_ESLINT_CONFIG = `// Verity-owned ESLint config for the quality gate. Generated by \`verity init\`.
+//
+// Deliberately SEPARATE from the project's ./eslint.config.js. Pointing the gate at
+// the project config makes Verity's pattern list a FILTER over rules the project
+// enabled, so any rule the project disables becomes unreachable (VRT-108).
+//
+// The enabled rules come from .codacy/codacy.config.json; this file supplies only
+// the parser, the globals and the ignores ESLint needs to run at all.
+import js from "@eslint/js";
+import globals from "globals";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  { ignores: ["dist/**", "build/**", "node_modules/**", "coverage/**", ".codacy/**"] },
+  {
+    extends: [js.configs.recommended, ...tseslint.configs.recommended],
+    files: ["**/*.{ts,tsx,js,jsx}"],
+    languageOptions: {
+      ecmaVersion: 2022,
+      sourceType: "module",
+      globals: { ...globals.browser, ...globals.node },
+    },
+  },
+);
+`;
+function validatePatternIds() {
+  const configPath = projectPath(CODACY_CONFIG_FILE);
+  try {
+    (0, import_node_child_process8.execFileSync)(process.execPath, [setupDataPath("validate-patterns.mjs"), configPath], {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 6e4
+    });
+    return { status: "valid" };
+  } catch (err) {
+    const e = err;
+    const raw = (e.stderr || e.stdout || e.message || "").trim();
+    const detail = raw.split("\n").slice(0, 6).join("\n");
+    if (/^\s*SKIP:/m.test(raw)) return { status: "unchecked", detail };
+    if (/^\s*FAIL:/m.test(raw)) return { status: "invalid", detail };
+    return { status: "unchecked", detail };
+  }
+}
+async function runSynthesis(opts) {
+  const standardPath = projectPath(STANDARD_FILE);
+  if ((0, import_node_fs24.existsSync)(standardPath) && !opts.force) {
+    return { refused: `${STANDARD_FILE} already exists \u2014 pass --force to replace it.` };
+  }
+  const detected = opts.detected ?? detectProject();
+  const loaded = loadCatalog();
+  const { tools, skipped } = selectTools(detected.languages, opts.intensity, loaded.catalog);
+  const trivy = trivyPatterns(opts.intensity);
+  const input = { detected, intensity: opts.intensity, tools };
+  const built = buildCodacyConfig(input, loaded, trivy);
+  const config = built.config;
+  const configuredTools = config.tools.map((t) => t.toolId);
+  const standard = buildStandard({ ...input, tools: configuredTools }, loaded);
+  const written = [];
+  const notes = [...built.notes];
+  await writeFileTo(STANDARD_FILE, standardToYaml(standard));
+  written.push(STANDARD_FILE);
+  if (config.tools.length > 0) {
+    await writeFileTo(CODACY_CONFIG_FILE, JSON.stringify(config, null, 2) + "\n");
+    written.push(CODACY_CONFIG_FILE);
+    if (config.tools.some((t) => t.toolId === "ESLint9")) {
+      await writeFileTo(VERITY_ESLINT_CONFIG_PATH.replace(/^\.\//, ""), VERITY_ESLINT_CONFIG);
+      written.push(VERITY_ESLINT_CONFIG_PATH.replace(/^\.\//, ""));
+    }
+  } else {
+    notes.push(
+      "No static-analysis tool matched this codebase, so the gate runs on AI review alone. Static findings would need a supported language (TypeScript, JavaScript, Python, Go, Java, Kotlin, Ruby, Rust, C/C++, shell, Dockerfile)."
+    );
+  }
+  await writeFileTo(VERITY_MD_FILE, renderVerityMd({
+    content: standard,
+    version: 1,
+    serviceUrl: opts.serviceUrl ?? "https://verity.md",
+    projectId: opts.projectId,
+    origin: { kind: "synthesized", tools }
+  }));
+  written.push(VERITY_MD_FILE);
+  if (skipped.length > 0) {
+    notes.push(
+      `Not configured: ${skipped.join(", ")} \u2014 the patterns reference has no derived rule ids for ${skipped.length === 1 ? "it" : "them"} yet, and a wrong id disables a tool silently.`
+    );
+  }
+  if (!trivy.derived && config.tools.some((t) => t.toolId === "Trivy")) {
+    notes.push(
+      "Trivy pattern ids came from the documented fallback, not from your installed adapter (@codacy/analysis-cli was not found). Re-run after installing it to derive them."
+    );
+  }
+  if (config.tools.length > 0) {
+    const validation = validatePatternIds();
+    if (validation.status === "invalid") {
+      notes.push(`\u26A0 Pattern-id validation FAILED \u2014 a tool may be silently disabled:
+${validation.detail}`);
+    } else if (validation.status === "unchecked") {
+      notes.push("Pattern ids could not be validated (no analysis adapter installed on this machine).");
+    }
+  }
+  return { written, notes, standard, tools, intensity: opts.intensity, detected };
+}
+async function correctVerityMdVersion(opts) {
+  if (opts.version === 1) return;
+  await writeFileTo(VERITY_MD_FILE, renderVerityMd({
+    content: opts.standard,
+    version: opts.version,
+    serviceUrl: opts.serviceUrl ?? "https://verity.md",
+    projectId: opts.projectId,
+    origin: { kind: "synthesized", tools: opts.tools }
+  }));
+}
+async function writeFileTo(relative2, body) {
+  const target = projectPath(relative2);
+  await (0, import_promises9.mkdir)((0, import_node_path20.dirname)(target), { recursive: true });
+  await (0, import_promises9.writeFile)(target, body);
+}
+async function deriveConfigForStandard(standard) {
+  const spec = standard.knowledge_spec ?? {};
+  const constraints = standard.process_constraints ?? {};
+  const languages = Array.isArray(spec.languages) ? spec.languages.filter((l) => typeof l === "string").map((l) => l.toLowerCase()) : [];
+  const mode2 = constraints.analysis_mode;
+  const intensity = mode2 === "lightweight" || mode2 === "thorough" ? mode2 : "balanced";
+  const written = [];
+  const notes = [];
+  if (languages.length === 0) {
+    notes.push(
+      "The adopted Standard names no languages, so no analysis config could be derived from it. Static analysis will run nothing until one exists."
+    );
+    return { written, notes, tools: [] };
+  }
+  const loaded = loadCatalog();
+  const { tools, skipped } = selectTools(languages, intensity, loaded.catalog);
+  const trivy = trivyPatterns(intensity);
+  const stub = {
+    projectName: "",
+    languages,
+    languageCounts: {},
+    frameworks: [],
+    architecture: "monolith",
+    buildSystem: null,
+    testFramework: null,
+    existingToolConfigs: [],
+    avgFileLength: null,
+    filesScanned: 0
+  };
+  const built = buildCodacyConfig({ detected: stub, intensity, tools }, loaded, trivy);
+  const config = built.config;
+  notes.push(...built.notes);
+  if (config.tools.length === 0) {
+    notes.push("No static-analysis tool matches the adopted Standard's languages \u2014 the gate runs on AI review alone.");
+    return { written, notes, tools: [] };
+  }
+  await writeFileTo(CODACY_CONFIG_FILE, JSON.stringify(config, null, 2) + "\n");
+  written.push(CODACY_CONFIG_FILE);
+  if (config.tools.some((t) => t.toolId === "ESLint9")) {
+    const path = VERITY_ESLINT_CONFIG_PATH.replace(/^\.\//, "");
+    await writeFileTo(path, VERITY_ESLINT_CONFIG);
+    written.push(path);
+  }
+  if (skipped.length > 0) {
+    notes.push(`Not configured: ${skipped.join(", ")} \u2014 no derived rule ids for ${skipped.length === 1 ? "it" : "them"} yet.`);
+  }
+  const validation = validatePatternIds();
+  if (validation.status === "invalid") {
+    notes.push(`\u26A0 Pattern-id validation FAILED \u2014 a tool may be silently disabled:
+${validation.detail}`);
+  }
+  return { written, notes, tools };
+}
+
+// src/lib/setup-state.ts
+var import_promises10 = require("node:fs/promises");
+var import_node_fs25 = require("node:fs");
+var SETUP_STATE_FILE = `${VERITY_DIR}/setup.json`;
+async function readSetupState() {
+  const path = projectPath(SETUP_STATE_FILE);
+  if (!(0, import_node_fs25.existsSync)(path)) return null;
+  try {
+    const parsed = JSON.parse(await (0, import_promises10.readFile)(path, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function writeSetupState(patch) {
+  const current = await readSetupState() ?? { version: 1 };
+  const next = { ...current, ...patch, version: 1 };
+  await writeJsonFilePreservingStyle(projectPath(SETUP_STATE_FILE), next);
+  return next;
+}
+
+// src/lib/push-setup.ts
+var import_node_fs27 = require("node:fs");
+var import_promises11 = require("node:fs/promises");
+var import_yaml2 = __toESM(require_dist());
+
+// src/lib/verityignore.ts
+var import_node_fs26 = require("node:fs");
 var EMPTY = { rules: [], securityOverlap: [], problems: [] };
 var SECURITY_PROBES = [
   ".env",
@@ -16851,14 +17701,14 @@ function decide(rules, path) {
   }
   return excluded;
 }
-function isIgnored(ig, path) {
+function isIgnored2(ig, path) {
   return decide(ig.rules, path);
 }
 function loadVerityIgnore() {
   const file = projectPath(VERITYIGNORE_FILE);
-  if (!(0, import_node_fs22.existsSync)(file)) return EMPTY;
+  if (!(0, import_node_fs26.existsSync)(file)) return EMPTY;
   try {
-    return parseVerityIgnore((0, import_node_fs22.readFileSync)(file, "utf-8"));
+    return parseVerityIgnore((0, import_node_fs26.readFileSync)(file, "utf-8"));
   } catch {
     return EMPTY;
   }
@@ -16871,7 +17721,7 @@ function partitionIgnored(paths, ig) {
   const kept = [];
   const ignored = [];
   for (const p of paths) {
-    if (p !== VERITYIGNORE_FILE && isIgnored(ig, p)) ignored.push(p);
+    if (p !== VERITYIGNORE_FILE && isIgnored2(ig, p)) ignored.push(p);
     else kept.push(p);
   }
   return {
@@ -16887,6 +17737,22 @@ function ignoreShare(kept, ignored) {
   if (total === 0) return 0;
   return Math.round(ignored / total * 1e3) / 1e3;
 }
+function buildStandardUpload(standard, ignoreRaw) {
+  if (ignoreRaw === null) return { content: standard, warning: null };
+  return {
+    content: { ...standard, verityignore: ignoreRaw },
+    warning: describeSecurityOverlap(parseVerityIgnore(ignoreRaw))
+  };
+}
+function readVerityIgnoreRaw() {
+  const file = projectPath(VERITYIGNORE_FILE);
+  if (!(0, import_node_fs26.existsSync)(file)) return null;
+  try {
+    return (0, import_node_fs26.readFileSync)(file, "utf-8");
+  } catch {
+    return null;
+  }
+}
 function describeSecurityOverlap(ig) {
   if (ig.securityOverlap.length === 0) return null;
   const lines = ig.securityOverlap.map(
@@ -16897,9 +17763,122 @@ ${lines.join("\n")}
 These are still excluded \u2014 this is a warning, not a refusal. Add a \`!\` rule to keep one in scope, e.g. \`!.env*\`.`;
 }
 
+// src/lib/push-setup.ts
+async function pushStandardAndConfig(globals, what = {}) {
+  const pushStandard = what.standard ?? true;
+  const pushConfig = what.config ?? true;
+  const lines = [];
+  const token = await resolveToken(globals.token);
+  const url = await resolveServiceUrl(globals.serviceUrl);
+  if (!token.ok || !url.ok) {
+    lines.push('Not signed in \u2014 the Standard stays local until you run "verity login" and "verity standard push".');
+    return { lines, standardVersion: null, configPushed: false };
+  }
+  let standardVersion = null;
+  const standardPath = projectPath(STANDARD_FILE);
+  if (pushStandard && (0, import_node_fs27.existsSync)(standardPath)) {
+    try {
+      const content = (0, import_yaml2.parse)(await (0, import_promises11.readFile)(standardPath, "utf-8"));
+      const upload = buildStandardUpload(content, readVerityIgnoreRaw());
+      if (upload.warning) lines.push(upload.warning);
+      const result = await apiRequest({
+        method: "POST",
+        path: "/standards",
+        serviceUrl: url.data,
+        token: token.data.token,
+        body: { content: upload.content, created_by: "verity-cli" },
+        verbose: globals.verbose
+      });
+      if (result.ok) {
+        standardVersion = result.data.version;
+        lines.push(`Standard pushed to Verity (v${result.data.version}) \u2713`);
+      } else {
+        lines.push(`Could not push the Standard: ${result.error} \u2014 run "verity standard push" later.`);
+      }
+    } catch (err) {
+      lines.push(`Could not read ${STANDARD_FILE}: ${err.message}`);
+    }
+  }
+  let configPushed = false;
+  const configPath = projectPath(CODACY_CONFIG_FILE);
+  if (pushConfig && (0, import_node_fs27.existsSync)(configPath)) {
+    try {
+      const content = JSON.parse(await (0, import_promises11.readFile)(configPath, "utf-8"));
+      const result = await apiRequest({
+        method: "POST",
+        path: "/analysis-configs",
+        serviceUrl: url.data,
+        token: token.data.token,
+        body: { content },
+        verbose: globals.verbose
+      });
+      if (result.ok) {
+        configPushed = true;
+        lines.push("Analysis config pushed \u2713");
+      } else {
+        lines.push(`Could not push the analysis config: ${result.error} \u2014 run "verity config push" later.`);
+      }
+    } catch (err) {
+      lines.push(`Could not read ${CODACY_CONFIG_FILE}: ${err.message}`);
+    }
+  }
+  return { lines, standardVersion, configPushed };
+}
+
 // src/commands/standard.ts
 function registerStandardCommands(program2) {
   const standard = program2.command("standard").description("Manage the project Standard");
+  standard.command("synthesize").description("Derive the Standard and analysis config from this codebase (no model required)").option("--intensity <mode>", "lightweight | balanced | thorough (default: your recorded answer)").option("--force", "Replace an existing .verity/standard.yaml").option("--config-only", "Rewrite only the analysis config, from the Standard already here").option("--push", "Upload the Standard and config after writing them").action(async (opts) => {
+    const globals = program2.opts();
+    const state = await readSetupState();
+    if (opts.configOnly) {
+      const standardPath = projectPath(STANDARD_FILE);
+      if (!(0, import_node_fs28.existsSync)(standardPath)) {
+        printError(`No ${STANDARD_FILE} here \u2014 run "verity standard synthesize" to create one.`);
+        process.exit(1);
+      }
+      const content = (0, import_yaml3.parse)(await (0, import_promises12.readFile)(standardPath, "utf-8"));
+      const derived = await deriveConfigForStandard(content);
+      for (const path of derived.written) printInfo(`  ${path} \u2713`);
+      for (const note of derived.notes) printWarn(`  ${note}`);
+      if (derived.written.length === 0) printWarn("  Nothing written.");
+      if (opts.push) {
+        const pushed = await pushStandardAndConfig(globals, { standard: false });
+        for (const line of pushed.lines) printInfo(`  ${line}`);
+      }
+      return;
+    }
+    if (opts.intensity && !parseIntensity(opts.intensity)) {
+      printError(`Unknown intensity "${opts.intensity}" \u2014 use lightweight, balanced or thorough.`);
+      process.exit(1);
+    }
+    const intensity = parseIntensity(opts.intensity) ?? state?.intensity ?? "balanced";
+    const urlResult = await resolveServiceUrl(globals.serviceUrl);
+    const result = await runSynthesis({
+      intensity,
+      force: opts.force ?? false,
+      serviceUrl: urlResult.ok ? urlResult.data : void 0
+    });
+    if ("refused" in result) {
+      printWarn(result.refused);
+      process.exit(1);
+    }
+    printInfo(`  ${describeDetected(result.detected)}`);
+    for (const path of result.written) printInfo(`  ${path} \u2713`);
+    for (const note of result.notes) printWarn(`  ${note}`);
+    if (opts.push) {
+      const pushed = await pushStandardAndConfig(globals);
+      for (const line of pushed.lines) printInfo(`  ${line}`);
+      if (pushed.standardVersion !== null) {
+        await correctVerityMdVersion({
+          standard: result.standard,
+          version: pushed.standardVersion,
+          tools: result.tools,
+          serviceUrl: urlResult.ok ? urlResult.data : void 0
+        });
+      }
+    }
+  });
   standard.command("push").description("Upload the project Standard to the service").option("--file <path>", "Path to standard YAML file", STANDARD_FILE).option("--created-by <name>", "Who created this version", "claude-code").action(async (opts) => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
@@ -16914,37 +17893,26 @@ function registerStandardCommands(program2) {
     }
     let yamlContent;
     try {
-      yamlContent = await (0, import_promises9.readFile)(opts.file, "utf-8");
+      yamlContent = await (0, import_promises12.readFile)(opts.file, "utf-8");
     } catch {
       printError(`Cannot read ${opts.file}`);
       process.exit(1);
     }
     let content;
     try {
-      content = (0, import_yaml.parse)(yamlContent);
+      content = (0, import_yaml3.parse)(yamlContent);
     } catch (err) {
       printError(`Invalid YAML in ${opts.file}: ${err.message}`);
       process.exit(1);
     }
-    let ignoreRaw = null;
-    const ignorePath = projectPath(VERITYIGNORE_FILE);
-    if ((0, import_node_fs23.existsSync)(ignorePath)) {
-      try {
-        ignoreRaw = (0, import_node_fs23.readFileSync)(ignorePath, "utf-8");
-        const overlap = describeSecurityOverlap(parseVerityIgnore(ignoreRaw));
-        if (overlap) printWarn(overlap);
-      } catch {
-      }
-    }
+    const upload = buildStandardUpload(content, readVerityIgnoreRaw());
+    if (upload.warning) printWarn(upload.warning);
     const result = await apiRequest({
       method: "POST",
       path: "/standards",
       serviceUrl: urlResult.data,
       token: tokenResult.data.token,
-      body: {
-        content: ignoreRaw === null ? content : { ...content, verityignore: ignoreRaw },
-        created_by: opts.createdBy
-      },
+      body: { content: upload.content, created_by: opts.createdBy },
       verbose: globals.verbose
     });
     if (!result.ok) {
@@ -17016,9 +17984,13 @@ function registerStandardCommands(program2) {
     }
   });
 }
+function parseIntensity(value) {
+  if (value === "lightweight" || value === "balanced" || value === "thorough") return value;
+  return null;
+}
 
 // src/commands/config.ts
-var import_promises10 = require("node:fs/promises");
+var import_promises13 = require("node:fs/promises");
 function registerConfigCommands(program2) {
   const config = program2.command("config").description("Manage analysis configuration");
   config.command("service-url").description("Print the resolved service URL (used by the shipped skills)").action(async () => {
@@ -17060,7 +18032,7 @@ function registerConfigCommands(program2) {
     }
     let content;
     try {
-      const raw = await (0, import_promises10.readFile)(opts.file, "utf-8");
+      const raw = await (0, import_promises13.readFile)(opts.file, "utf-8");
       content = JSON.parse(raw);
     } catch {
       printError(`Cannot read or parse ${opts.file}`);
@@ -17188,10 +18160,10 @@ function formatRunDetail(run2) {
 }
 
 // src/lib/ignore-declaration.ts
-var import_node_fs25 = require("node:fs");
+var import_node_fs30 = require("node:fs");
 
 // src/lib/debounce.ts
-var import_node_fs24 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 var import_node_crypto10 = require("node:crypto");
 function scopedFile(base, sessionId) {
   if (!sessionId) return base;
@@ -17199,9 +18171,9 @@ function scopedFile(base, sessionId) {
 }
 function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs24.existsSync)(file)) return null;
+  if (!(0, import_node_fs29.existsSync)(file)) return null;
   try {
-    const lastTs = parseInt((0, import_node_fs24.readFileSync)(file, "utf-8").trim(), 10);
+    const lastTs = parseInt((0, import_node_fs29.readFileSync)(file, "utf-8").trim(), 10);
     const nowTs = Math.floor(Date.now() / 1e3);
     const elapsed = nowTs - lastTs;
     if (elapsed < debounceSeconds) {
@@ -17214,10 +18186,10 @@ function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
 function checkMtime(files, bypassForRecentCommits, sessionId) {
   if (bypassForRecentCommits) return null;
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs24.existsSync)(file)) return null;
+  if (!(0, import_node_fs29.existsSync)(file)) return null;
   let debounceTime;
   try {
-    debounceTime = (0, import_node_fs24.statSync)(file).mtimeMs;
+    debounceTime = (0, import_node_fs29.statSync)(file).mtimeMs;
   } catch {
     return null;
   }
@@ -17225,7 +18197,7 @@ function checkMtime(files, bypassForRecentCommits, sessionId) {
     const resolved = resolveFile(f);
     if (!resolved) continue;
     try {
-      const stat3 = (0, import_node_fs24.statSync)(resolved);
+      const stat3 = (0, import_node_fs29.statSync)(resolved);
       if (stat3.mtimeMs > debounceTime) {
         return null;
       }
@@ -17241,8 +18213,8 @@ function computeContentHash(files) {
   for (const f of sorted) {
     const resolved = resolveFile(f) ?? f;
     try {
-      if ((0, import_node_fs24.existsSync)(resolved)) {
-        hash.update((0, import_node_fs24.readFileSync)(resolved));
+      if ((0, import_node_fs29.existsSync)(resolved)) {
+        hash.update((0, import_node_fs29.readFileSync)(resolved));
       }
     } catch {
     }
@@ -17252,9 +18224,9 @@ function computeContentHash(files) {
 function checkContentHash(files, sessionId) {
   const hash = computeContentHash(files);
   const file = scopedFile(HASH_FILE, sessionId);
-  if ((0, import_node_fs24.existsSync)(file)) {
+  if ((0, import_node_fs29.existsSync)(file)) {
     try {
-      const storedHash = (0, import_node_fs24.readFileSync)(file, "utf-8").trim();
+      const storedHash = (0, import_node_fs29.readFileSync)(file, "utf-8").trim();
       if (hash === storedHash) {
         return { skip: "No source changes since last analysis", hash };
       }
@@ -17264,24 +18236,24 @@ function checkContentHash(files, sessionId) {
   return { skip: null, hash };
 }
 function recordAnalysisStart(sessionId) {
-  (0, import_node_fs24.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs24.writeFileSync)(scopedFile(DEBOUNCE_FILE, sessionId), String(Math.floor(Date.now() / 1e3)));
+  (0, import_node_fs29.mkdirSync)(VERITY_DIR, { recursive: true });
+  (0, import_node_fs29.writeFileSync)(scopedFile(DEBOUNCE_FILE, sessionId), String(Math.floor(Date.now() / 1e3)));
 }
 function recordPassHash(hash, sessionId) {
-  (0, import_node_fs24.writeFileSync)(scopedFile(HASH_FILE, sessionId), hash);
+  (0, import_node_fs29.writeFileSync)(scopedFile(HASH_FILE, sessionId), hash);
 }
 function narrowToRecent(files, sessionId) {
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs24.existsSync)(file)) return files;
+  if (!(0, import_node_fs29.existsSync)(file)) return files;
   let debounceTime;
   try {
-    debounceTime = (0, import_node_fs24.statSync)(file).mtimeMs;
+    debounceTime = (0, import_node_fs29.statSync)(file).mtimeMs;
   } catch {
     return files;
   }
   const recent = files.filter((f) => {
     try {
-      return (0, import_node_fs24.existsSync)(f) && (0, import_node_fs24.statSync)(f).mtimeMs > debounceTime;
+      return (0, import_node_fs29.existsSync)(f) && (0, import_node_fs29.statSync)(f).mtimeMs > debounceTime;
     } catch {
       return false;
     }
@@ -17294,9 +18266,9 @@ function readIteration(currentCommit, _contentHash) {
 var NO_BLOCKS = { attempts: 0, blocks: 0, fingerprint: null };
 function readBlockState(currentCommit, opts) {
   if (opts?.newUserPrompt) return NO_BLOCKS;
-  if (!(0, import_node_fs24.existsSync)(ITERATION_FILE)) return NO_BLOCKS;
+  if (!(0, import_node_fs29.existsSync)(ITERATION_FILE)) return NO_BLOCKS;
   try {
-    const stored = (0, import_node_fs24.readFileSync)(ITERATION_FILE, "utf-8").trim();
+    const stored = (0, import_node_fs29.readFileSync)(ITERATION_FILE, "utf-8").trim();
     const parsed = stored.startsWith("{") ? parseJsonState(stored) : parseLegacyState(stored);
     if (!parsed) return NO_BLOCKS;
     if (parsed.commit !== currentCommit) return NO_BLOCKS;
@@ -17342,8 +18314,8 @@ function isSameProblem(previous, current) {
   return current.split(",").some((k) => prev.has(k));
 }
 function writeBlockState(commit, state) {
-  (0, import_node_fs24.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs24.writeFileSync)(
+  (0, import_node_fs29.mkdirSync)(VERITY_DIR, { recursive: true });
+  (0, import_node_fs29.writeFileSync)(
     ITERATION_FILE,
     JSON.stringify({
       v: 2,
@@ -17448,9 +18420,9 @@ function resolveIgnoreState(keys) {
 }
 function readIgnoreState(sessionId) {
   const file = stateFile(sessionId);
-  if (!(0, import_node_fs25.existsSync)(file)) return null;
+  if (!(0, import_node_fs30.existsSync)(file)) return null;
   try {
-    const o = JSON.parse((0, import_node_fs25.readFileSync)(file, "utf-8")) ?? {};
+    const o = JSON.parse((0, import_node_fs30.readFileSync)(file, "utf-8")) ?? {};
     const spent = typeof o.spent === "number" ? o.spent : 0;
     const raw = o.active;
     let active = null;
@@ -17474,8 +18446,8 @@ function readIgnoreState(sessionId) {
 }
 function writeIgnoreState(state, sessionId) {
   try {
-    (0, import_node_fs25.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
-    (0, import_node_fs25.writeFileSync)(stateFile(sessionId), JSON.stringify({ v: 1, active: state.active, spent: state.spent }));
+    (0, import_node_fs30.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
+    (0, import_node_fs30.writeFileSync)(stateFile(sessionId), JSON.stringify({ v: 1, active: state.active, spent: state.spent }));
   } catch {
   }
 }
@@ -17850,10 +18822,10 @@ function createRun(opts, globals) {
 }
 
 // src/commands/analyze/index.ts
-var import_node_fs38 = require("node:fs");
+var import_node_fs43 = require("node:fs");
 
 // src/lib/repo-context.ts
-var import_node_child_process7 = require("node:child_process");
+var import_node_child_process9 = require("node:child_process");
 var import_node_os3 = require("node:os");
 function rgInvocations(env = process.env) {
   const out = [{ cmd: "rg" }];
@@ -18429,7 +19401,7 @@ function buildRepoContext(input) {
   ];
   let res = null;
   for (const inv of rgInvocations()) {
-    res = (0, import_node_child_process7.spawnSync)(inv.cmd, args, {
+    res = (0, import_node_child_process9.spawnSync)(inv.cmd, args, {
       ...inv.argv0 ? { argv0: inv.argv0 } : {},
       cwd: input.cwd ?? process.cwd(),
       timeout: input.timeoutMs ?? RG_TIMEOUT_MS,
@@ -18670,11 +19642,11 @@ function installRunEvidence(run2) {
 }
 
 // src/lib/git-frame.ts
-var import_node_child_process8 = require("node:child_process");
-var import_node_fs26 = require("node:fs");
+var import_node_child_process10 = require("node:child_process");
+var import_node_fs31 = require("node:fs");
 var import_node_os4 = require("node:os");
-var import_node_path18 = require("node:path");
-var import_node_path19 = require("node:path");
+var import_node_path21 = require("node:path");
+var import_node_path22 = require("node:path");
 var VALUE_TOKEN = `(?:'[^']*'|"[^"]*"|\\S+)`;
 var GIT_GLOBAL_OPTS = `(?:\\s+(?:-[Cc]\\s+${VALUE_TOKEN}|--?[\\w-]+(?:=\\S+)?))*`;
 var COMMIT_HEAD = `git${GIT_GLOBAL_OPTS}\\s+commit(?![\\w-])`;
@@ -18727,8 +19699,8 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
     if (SHELL_DYNAMIC.test(raw) || raw === "-") {
       return { dir: null, named: true, unresolvable: `cd target not statically resolvable: ${raw}` };
     }
-    const expanded = raw === "~" ? (0, import_node_os4.homedir)() : raw.startsWith("~/") ? (0, import_node_path19.join)((0, import_node_os4.homedir)(), raw.slice(2)) : raw;
-    dir = (0, import_node_path18.isAbsolute)(expanded) ? expanded : (0, import_node_path18.resolve)(dir, expanded);
+    const expanded = raw === "~" ? (0, import_node_os4.homedir)() : raw.startsWith("~/") ? (0, import_node_path22.join)((0, import_node_os4.homedir)(), raw.slice(2)) : raw;
+    dir = (0, import_node_path21.isAbsolute)(expanded) ? expanded : (0, import_node_path21.resolve)(dir, expanded);
   }
   const seg = segments[segmentIndex];
   const overrideMatch = /--(?:git-dir|work-tree)(?:=|\s)|\bGIT_(?:DIR|WORK_TREE|INDEX_FILE)=/.exec(seg);
@@ -18746,8 +19718,8 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
       if (SHELL_DYNAMIC.test(raw)) {
         return { dir: null, named: true, unresolvable: `-C target not statically resolvable: ${raw}` };
       }
-      const expanded = raw === "~" ? (0, import_node_os4.homedir)() : raw.startsWith("~/") ? (0, import_node_path19.join)((0, import_node_os4.homedir)(), raw.slice(2)) : raw;
-      dir = (0, import_node_path18.isAbsolute)(expanded) ? expanded : (0, import_node_path18.resolve)(dir, expanded);
+      const expanded = raw === "~" ? (0, import_node_os4.homedir)() : raw.startsWith("~/") ? (0, import_node_path22.join)((0, import_node_os4.homedir)(), raw.slice(2)) : raw;
+      dir = (0, import_node_path21.isAbsolute)(expanded) ? expanded : (0, import_node_path21.resolve)(dir, expanded);
     }
   }
   return { dir, named, unresolvable: null };
@@ -18803,21 +19775,21 @@ function parsePushTarget(segment) {
 }
 function gitAt(dir, args) {
   try {
-    return (0, import_node_child_process8.execFileSync)("git", args, { cwd: dir, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    return (0, import_node_child_process10.execFileSync)("git", args, { cwd: dir, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
     return "";
   }
 }
 function realpathOr(p) {
   try {
-    return import_node_fs26.realpathSync.native(p);
+    return import_node_fs31.realpathSync.native(p);
   } catch {
-    return (0, import_node_path18.resolve)(p);
+    return (0, import_node_path21.resolve)(p);
   }
 }
 function resolveFrame(input) {
   const found = findMomentSegment(input.command, input.on);
-  const hookDirUsable = !!input.hookCwd && (0, import_node_fs26.existsSync)(input.hookCwd);
+  const hookDirUsable = !!input.hookCwd && (0, import_node_fs31.existsSync)(input.hookCwd);
   const baseDir = hookDirUsable ? input.hookCwd : process.cwd();
   let anchor = hookDirUsable ? "hook-cwd" : "process-cwd";
   const refuse = (refusal) => ({
@@ -18840,7 +19812,7 @@ function resolveFrame(input) {
     if (dirs.size > 1) return refuse(`target:multiple ${found.moment} targets in one command`);
     const targetDir = dirs.size === 1 ? [...dirs][0] : baseDir;
     if (targetDir !== baseDir) {
-      if (!(0, import_node_fs26.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
+      if (!(0, import_node_fs31.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
       dir = targetDir;
     }
   }
@@ -18851,7 +19823,7 @@ function resolveFrame(input) {
   const gitDirRaw = gitAt(dir, ["rev-parse", "--absolute-git-dir"]);
   const commonRaw = gitAt(dir, ["rev-parse", "--git-common-dir"]);
   const gitDir = gitDirRaw ? realpathOr(gitDirRaw) : null;
-  const commonDir = commonRaw ? realpathOr((0, import_node_path18.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path18.resolve)(dir, commonRaw)) : null;
+  const commonDir = commonRaw ? realpathOr((0, import_node_path21.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path21.resolve)(dir, commonRaw)) : null;
   const branchRaw = gitAt(dir, ["rev-parse", "--abbrev-ref", "HEAD"]);
   return {
     moment: found?.moment ?? null,
@@ -18878,8 +19850,8 @@ function refResolves(frame, ref) {
 var SHA_RE2 = /^[0-9a-f]{40}$/;
 function stagedRange(frame) {
   if (!frame.worktreeRoot) return { kind: "nothing", base: null, head: "INDEX", via: "refused" };
-  const mergeHead = frame.gitDir ? (0, import_node_path19.join)(frame.gitDir, "MERGE_HEAD") : null;
-  if (mergeHead && (0, import_node_fs26.existsSync)(mergeHead)) {
+  const mergeHead = frame.gitDir ? (0, import_node_path22.join)(frame.gitDir, "MERGE_HEAD") : null;
+  if (mergeHead && (0, import_node_fs31.existsSync)(mergeHead)) {
     const vsHead = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "HEAD"]).split("\n").filter(Boolean));
     const vsMerge = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "MERGE_HEAD"]).split("\n").filter(Boolean));
     const resolutions = [...vsHead].filter((f) => vsMerge.has(f) && !isVerityOwnedPath(f));
@@ -19003,7 +19975,7 @@ function truthy(v) {
 }
 
 // src/lib/transcript.ts
-var import_node_fs27 = require("node:fs");
+var import_node_fs32 = require("node:fs");
 var MAX_READ_BYTES = 256 * 1024;
 var SMALL_FILE_BYTES = 64 * 1024;
 var MAX_FILES_LIST = 20;
@@ -19030,7 +20002,7 @@ async function extractActionSummary(transcriptPath) {
 function readTurnLines(transcriptPath) {
   let size;
   try {
-    size = (0, import_node_fs27.statSync)(transcriptPath).size;
+    size = (0, import_node_fs32.statSync)(transcriptPath).size;
   } catch {
     return null;
   }
@@ -19038,7 +20010,7 @@ function readTurnLines(transcriptPath) {
   let raw;
   let windowed = false;
   if (size <= SMALL_FILE_BYTES) {
-    raw = (0, import_node_fs27.readFileSync)(transcriptPath, "utf-8");
+    raw = (0, import_node_fs32.readFileSync)(transcriptPath, "utf-8");
   } else {
     windowed = true;
     const buf = Buffer.alloc(Math.min(MAX_READ_BYTES, size));
@@ -19537,7 +20509,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.31.4" : "dev";
+    return true ? "0.32.0-experimental.68ae2ee" : "dev";
   } catch {
     return "dev";
   }
@@ -19577,8 +20549,8 @@ async function sendSkipBeacon(ctx, reason) {
 }
 
 // src/lib/static-analysis.ts
-var import_node_child_process9 = require("node:child_process");
-var import_node_fs28 = require("node:fs");
+var import_node_child_process11 = require("node:child_process");
+var import_node_fs33 = require("node:fs");
 var SEVERITY_ORDER = {
   Error: 0,
   Critical: 0,
@@ -19590,7 +20562,7 @@ var SEVERITY_ORDER = {
 };
 function isCodacyAvailable() {
   try {
-    (0, import_node_child_process9.execSync)("which codacy-analysis", { stdio: "pipe" });
+    (0, import_node_child_process11.execSync)("which codacy-analysis", { stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -19626,13 +20598,13 @@ function runCodacyAnalysis(files) {
   if (files.length === 0) return empty;
   const existingFiles = files.filter((f) => {
     try {
-      return (0, import_node_fs28.existsSync)(f);
+      return (0, import_node_fs33.existsSync)(f);
     } catch {
       return false;
     }
   });
   if (existingFiles.length === 0) return empty;
-  const proc = (0, import_node_child_process9.spawnSync)("codacy-analysis", buildAnalyzerArgv(existingFiles), {
+  const proc = (0, import_node_child_process11.spawnSync)("codacy-analysis", buildAnalyzerArgv(existingFiles), {
     encoding: "utf-8",
     maxBuffer: 10 * 1024 * 1024
   });
@@ -19895,8 +20867,8 @@ async function scope(run2) {
 }
 
 // src/lib/specs.ts
-var import_node_fs29 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_fs34 = require("node:fs");
+var import_node_path23 = require("node:path");
 var SPEC_CANDIDATES = [
   "CLAUDE.md",
   "AGENTS.md",
@@ -19927,16 +20899,16 @@ function discoverSpecs(consulted = []) {
     const totalCap = relevant ? MAX_TOTAL_SPEC_BYTES : UNCONSULTED_TOTAL_BYTES;
     if (totalBytes >= totalCap) return false;
     if (seen.has(specPath)) return true;
-    if (!(0, import_node_fs29.existsSync)(specPath)) return true;
+    if (!(0, import_node_fs34.existsSync)(specPath)) return true;
     seen.add(specPath);
     const remaining = totalCap - totalBytes;
     const fileCap = relevant ? MAX_SPEC_FILE_BYTES : UNCONSULTED_FILE_BYTES;
     const readBytes = Math.min(fileCap, remaining);
     try {
       const buf = Buffer.alloc(readBytes);
-      const fd = (0, import_node_fs29.openSync)(specPath, "r");
-      const bytesRead = (0, import_node_fs29.readSync)(fd, buf, 0, readBytes, 0);
-      (0, import_node_fs29.closeSync)(fd);
+      const fd = (0, import_node_fs34.openSync)(specPath, "r");
+      const bytesRead = (0, import_node_fs34.readSync)(fd, buf, 0, readBytes, 0);
+      (0, import_node_fs34.closeSync)(fd);
       const content = buf.slice(0, bytesRead).toString("utf-8");
       if (!content) return true;
       result.push({ path: specPath, content });
@@ -19952,7 +20924,7 @@ function discoverSpecs(consulted = []) {
     if (!addSpec(candidate)) break;
   }
   for (const dir of ["spec", "docs"]) {
-    if (!(0, import_node_fs29.existsSync)(dir)) continue;
+    if (!(0, import_node_fs34.existsSync)(dir)) continue;
     try {
       const mdFiles = findMdFiles(dir, 2).sort();
       for (const mdFile of mdFiles) {
@@ -19967,9 +20939,9 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   if (depth >= maxDepth) return [];
   const result = [];
   try {
-    const entries = (0, import_node_fs29.readdirSync)(dir, { withFileTypes: true });
+    const entries = (0, import_node_fs34.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = (0, import_node_path20.join)(dir, entry.name);
+      const fullPath = (0, import_node_path23.join)(dir, entry.name);
       if (entry.isFile() && entry.name.endsWith(".md")) {
         result.push(fullPath);
       } else if (entry.isDirectory() && depth < maxDepth - 1) {
@@ -19981,19 +20953,19 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   return result;
 }
 function discoverPlans() {
-  const homePlansDir = (0, import_node_path20.join)(process.env.HOME ?? "", ".claude", "plans");
+  const homePlansDir = (0, import_node_path23.join)(process.env.HOME ?? "", ".claude", "plans");
   const localPlansDir = ".claude/plans";
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
   for (const plansDir of [localPlansDir, homePlansDir]) {
-    if (!(0, import_node_fs29.existsSync)(plansDir)) continue;
+    if (!(0, import_node_fs34.existsSync)(plansDir)) continue;
     try {
-      for (const f of (0, import_node_fs29.readdirSync)(plansDir)) {
+      for (const f of (0, import_node_fs34.readdirSync)(plansDir)) {
         if (!f.endsWith(".md") || seen.has(f)) continue;
         seen.add(f);
-        const fullPath = (0, import_node_path20.join)(plansDir, f);
+        const fullPath = (0, import_node_path23.join)(plansDir, f);
         try {
-          const stat3 = (0, import_node_fs29.statSync)(fullPath);
+          const stat3 = (0, import_node_fs34.statSync)(fullPath);
           candidates.push({ name: f, path: fullPath, mtime: stat3.mtimeMs, size: stat3.size });
         } catch {
         }
@@ -20006,7 +20978,7 @@ function discoverPlans() {
   for (const entry of candidates.slice(0, MAX_PLAN_FILES)) {
     if (entry.size > MAX_PLAN_FILE_BYTES) continue;
     try {
-      const content = (0, import_node_fs29.readFileSync)(entry.path, "utf-8");
+      const content = (0, import_node_fs34.readFileSync)(entry.path, "utf-8");
       result.push({ name: entry.name, content });
     } catch {
     }
@@ -20021,12 +20993,12 @@ function discoverGuardDocs(rangeFiles2) {
     if (result.length >= MAX_SPEC_FILES) break;
     if (!GUARD_DOC_EXT.test(path)) continue;
     if (path.startsWith("/") || path.includes("..")) continue;
-    if (!(0, import_node_fs29.existsSync)(path)) continue;
+    if (!(0, import_node_fs34.existsSync)(path)) continue;
     try {
-      const stat3 = (0, import_node_fs29.statSync)(path);
+      const stat3 = (0, import_node_fs34.statSync)(path);
       if (stat3.size > MAX_PLAN_FILE_BYTES) continue;
       if (totalBytes + stat3.size > MAX_TOTAL_SPEC_BYTES) continue;
-      const content = (0, import_node_fs29.readFileSync)(path, "utf-8");
+      const content = (0, import_node_fs34.readFileSync)(path, "utf-8");
       if (!content) continue;
       result.push({ name: path, content });
       totalBytes += content.length;
@@ -20202,8 +21174,8 @@ async function mode(run2) {
 }
 
 // src/lib/fold.ts
-var import_node_fs30 = require("node:fs");
-var import_node_path21 = require("node:path");
+var import_node_fs35 = require("node:fs");
+var import_node_path24 = require("node:path");
 var KNOWN_RECORD_TYPES = /* @__PURE__ */ new Set([
   "user",
   "assistant",
@@ -20340,7 +21312,7 @@ function candidateRoots(repoRoot2) {
   const norm = repoRoot2.replace(/\\/g, "/").replace(/\/+$/, "");
   const out = [norm];
   try {
-    const real = import_node_fs30.realpathSync.native(norm).replace(/\\/g, "/").replace(/\/+$/, "");
+    const real = import_node_fs35.realpathSync.native(norm).replace(/\\/g, "/").replace(/\/+$/, "");
     if (real !== norm) out.push(real);
   } catch {
   }
@@ -20428,31 +21400,31 @@ function fold(transcriptPath, opts = {}) {
     }
   };
   try {
-    if (!(0, import_node_fs30.existsSync)(transcriptPath)) return result;
-    ingest((0, import_node_fs30.readFileSync)(transcriptPath, "utf8"), "agent");
+    if (!(0, import_node_fs35.existsSync)(transcriptPath)) return result;
+    ingest((0, import_node_fs35.readFileSync)(transcriptPath, "utf8"), "agent");
     result.coverage.complete = true;
   } catch {
     return result;
   }
   try {
-    const sidecarDir = (0, import_node_path21.join)(
-      (0, import_node_path21.dirname)(transcriptPath),
-      (0, import_node_path21.basename)(transcriptPath).replace(/\.jsonl$/, ""),
+    const sidecarDir = (0, import_node_path24.join)(
+      (0, import_node_path24.dirname)(transcriptPath),
+      (0, import_node_path24.basename)(transcriptPath).replace(/\.jsonl$/, ""),
       "subagents"
     );
-    if ((0, import_node_fs30.existsSync)(sidecarDir)) {
+    if ((0, import_node_fs35.existsSync)(sidecarDir)) {
       const maxFiles = opts.maxSidecars ?? 200;
       const maxBytes = opts.maxSidecarBytes ?? 16 * 1024 * 1024;
       const found = [];
-      const walk = (d, depth) => {
+      const walk2 = (d, depth) => {
         if (depth > 4) return;
-        for (const e of (0, import_node_fs30.readdirSync)(d, { withFileTypes: true })) {
-          const p = (0, import_node_path21.join)(d, e.name);
+        for (const e of (0, import_node_fs35.readdirSync)(d, { withFileTypes: true })) {
+          const p = (0, import_node_path24.join)(d, e.name);
           if (e.isDirectory()) {
-            walk(p, depth + 1);
+            walk2(p, depth + 1);
           } else if (e.name.startsWith("agent-") && e.name.endsWith(".jsonl")) {
             try {
-              const st = (0, import_node_fs30.statSync)(p);
+              const st = (0, import_node_fs35.statSync)(p);
               found.push({ path: p, size: st.size, mtimeMs: st.mtimeMs });
             } catch {
               result.coverage.malformed++;
@@ -20460,7 +21432,7 @@ function fold(transcriptPath, opts = {}) {
           }
         }
       };
-      walk(sidecarDir, 0);
+      walk2(sidecarDir, 0);
       found.sort((a, b) => b.mtimeMs - a.mtimeMs);
       let bytes = 0;
       for (const f of found) {
@@ -20469,7 +21441,7 @@ function fold(transcriptPath, opts = {}) {
           continue;
         }
         try {
-          ingest((0, import_node_fs30.readFileSync)(f.path, "utf8"), "subagent");
+          ingest((0, import_node_fs35.readFileSync)(f.path, "utf8"), "subagent");
           bytes += f.size;
           result.coverage.subagentFiles++;
         } catch {
@@ -20504,7 +21476,7 @@ function fold(transcriptPath, opts = {}) {
 }
 function classifyUnobserved(path) {
   try {
-    const st = (0, import_node_fs30.statSync)(path);
+    const st = (0, import_node_fs35.statSync)(path);
     if (!st.isFile()) return "unreadable";
   } catch {
     return "unreadable";
@@ -20821,20 +21793,20 @@ async function evidence(run2) {
 }
 
 // src/lib/cache-cleanup.ts
-var import_node_fs31 = require("node:fs");
-var import_node_path22 = require("node:path");
+var import_node_fs36 = require("node:fs");
+var import_node_path25 = require("node:path");
 var CACHE_TTL_DAYS = 7;
 function pruneStaleCache() {
   try {
     const dir = projectPath(CACHE_DIR);
     const cutoff = Date.now() - CACHE_TTL_DAYS * 24 * 3600 * 1e3;
-    for (const entry of (0, import_node_fs31.readdirSync)(dir)) {
+    for (const entry of (0, import_node_fs36.readdirSync)(dir)) {
       if (!entry.startsWith("pending-")) continue;
-      const path = (0, import_node_path22.join)(dir, entry);
+      const path = (0, import_node_path25.join)(dir, entry);
       try {
-        const stat3 = (0, import_node_fs31.statSync)(path);
+        const stat3 = (0, import_node_fs36.statSync)(path);
         if (stat3.mtimeMs < cutoff) {
-          (0, import_node_fs31.unlinkSync)(path);
+          (0, import_node_fs36.unlinkSync)(path);
           logEvent("cache_entry_pruned", {
             path: entry,
             age_days: Math.round((Date.now() - stat3.mtimeMs) / 864e5)
@@ -20848,7 +21820,7 @@ function pruneStaleCache() {
 }
 
 // src/lib/context-files.ts
-var import_node_fs32 = require("node:fs");
+var import_node_fs37 = require("node:fs");
 var import_node_os5 = require("node:os");
 var MAX_CONTEXT_FILES = 10;
 var MAX_CONTEXT_FILE_BYTES = 10240;
@@ -20906,7 +21878,7 @@ function gatherContextFiles(contextPaths, deltaFiles, opts) {
       continue;
     }
     try {
-      const content = (0, import_node_fs32.readFileSync)(safePath, "utf8");
+      const content = (0, import_node_fs37.readFileSync)(safePath, "utf8");
       const bytes = Buffer.byteLength(content);
       if (bytes > MAX_CONTEXT_FILE_BYTES) {
         logEvent("context_file_skipped", { path: filePath, reason: "too_large", bytes });
@@ -20956,7 +21928,7 @@ async function contextFiles(run2) {
   const readSet = readSetContextPaths(run2.actionSummary, codeDelta.files);
   const { kept: externalContext } = partitionVerityOwned(readSet);
   const ig = loadVerityIgnore();
-  const unfenced = run2.verityIgnored.suspended ? externalContext : externalContext.filter((p) => !isIgnored(ig, p));
+  const unfenced = run2.verityIgnored.suspended ? externalContext : externalContext.filter((p) => !isIgnored2(ig, p));
   const contextFiles2 = gatherContextFiles(unfenced, codeDelta.files, {
     maxFiles: MAX_FILES - codeDelta.files.length
   });
@@ -20977,7 +21949,7 @@ async function repoContext(run2) {
   const deltaFiles = codeDelta.files.filter((f) => f.role !== "context");
   const sentPaths = new Set(codeDelta.files.map((f) => f.path));
   const ig = loadVerityIgnore();
-  const isExcluded = (p) => isVerityOwnedPath(p) || !run2.verityIgnored.suspended && isIgnored(ig, p);
+  const isExcluded = (p) => isVerityOwnedPath(p) || !run2.verityIgnored.suspended && isIgnored2(ig, p);
   run2.repoContext = buildRepoContext({
     deltaFiles,
     diffs: snapshotResult.diffs,
@@ -20996,10 +21968,10 @@ async function repoContext(run2) {
 }
 
 // src/lib/seed-runner.ts
-var import_promises11 = require("node:fs/promises");
-var import_node_fs33 = require("node:fs");
-var import_node_path23 = require("node:path");
-var import_yaml2 = __toESM(require_dist());
+var import_promises14 = require("node:fs/promises");
+var import_node_fs38 = require("node:fs");
+var import_node_path26 = require("node:path");
+var import_yaml4 = __toESM(require_dist());
 
 // src/lib/seed.ts
 function extractReadmeIntro(content) {
@@ -21237,29 +22209,29 @@ function renderNodeMarkdown(candidate, nodeId, createdAt) {
   return fm;
 }
 async function runSeed(opts) {
-  if (!(0, import_node_fs33.existsSync)(STANDARD_FILE)) {
+  if (!(0, import_node_fs38.existsSync)(STANDARD_FILE)) {
     return { created: 0, failed: 0, skipped: "no_standard", candidates: [] };
   }
   let standardDoc;
   try {
-    const raw = await (0, import_promises11.readFile)(STANDARD_FILE, "utf-8");
-    standardDoc = (0, import_yaml2.parse)(raw);
+    const raw = await (0, import_promises14.readFile)(STANDARD_FILE, "utf-8");
+    standardDoc = (0, import_yaml4.parse)(raw);
   } catch {
     return { created: 0, failed: 0, skipped: "no_standard", candidates: [] };
   }
   const knowledgeSpec = standardDoc.knowledge_spec ?? {};
   let readmeContent;
-  if ((0, import_node_fs33.existsSync)("README.md")) {
+  if ((0, import_node_fs38.existsSync)("README.md")) {
     try {
-      readmeContent = await (0, import_promises11.readFile)("README.md", "utf-8");
+      readmeContent = await (0, import_promises14.readFile)("README.md", "utf-8");
     } catch {
     }
   }
   let claudeMdContent;
   for (const p of ["CLAUDE.md", ".claude/CLAUDE.md"]) {
-    if ((0, import_node_fs33.existsSync)(p)) {
+    if ((0, import_node_fs38.existsSync)(p)) {
       try {
-        claudeMdContent = await (0, import_promises11.readFile)(p, "utf-8");
+        claudeMdContent = await (0, import_promises14.readFile)(p, "utf-8");
         break;
       } catch {
       }
@@ -21280,8 +22252,8 @@ async function runSeed(opts) {
   if (candidates.length === 0) {
     return { created: 0, failed: 0, skipped: "no_candidates", candidates: [] };
   }
-  const overviewPath = (0, import_node_path23.join)(MEMORY_DIR, "domain", "project-overview.md");
-  if ((0, import_node_fs33.existsSync)(overviewPath) && !opts.force) {
+  const overviewPath = (0, import_node_path26.join)(MEMORY_DIR, "domain", "project-overview.md");
+  if ((0, import_node_fs38.existsSync)(overviewPath) && !opts.force) {
     return { created: 0, failed: 0, skipped: "already_seeded", candidates };
   }
   if (opts.dryRun) {
@@ -21323,8 +22295,8 @@ async function runSeed(opts) {
       continue;
     }
     try {
-      await (0, import_promises11.mkdir)((0, import_node_path23.dirname)(targetPath), { recursive: true });
-      await (0, import_promises11.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
+      await (0, import_promises14.mkdir)((0, import_node_path26.dirname)(targetPath), { recursive: true });
+      await (0, import_promises14.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
       created++;
       opts.onCreated?.(nodeId, filePathRel, c);
     } catch (err) {
@@ -21336,8 +22308,8 @@ async function runSeed(opts) {
 }
 
 // src/commands/analyze/phases/08-memory-manifest.ts
-var import_node_fs34 = require("node:fs");
-var import_node_path24 = require("node:path");
+var import_node_fs39 = require("node:fs");
+var import_node_path27 = require("node:path");
 async function memoryManifest(run2) {
   const { globals } = run2;
   const { serviceUrl, token } = run2;
@@ -21347,9 +22319,9 @@ async function memoryManifest(run2) {
   let autoSeedNotice = null;
   try {
     await ensureMemoryDir();
-    const seedMarker = (0, import_node_path24.join)(VERITY_DIR, ".seeded");
-    const hasStandard = (0, import_node_fs34.existsSync)(STANDARD_FILE);
-    const alreadyTried = (0, import_node_fs34.existsSync)(seedMarker);
+    const seedMarker = (0, import_node_path27.join)(VERITY_DIR, ".seeded");
+    const hasStandard = (0, import_node_fs39.existsSync)(STANDARD_FILE);
+    const alreadyTried = (0, import_node_fs39.existsSync)(seedMarker);
     if (hasStandard && !alreadyTried) {
       const preManifest = await buildManifest();
       if (preManifest.nodes.length === 0) {
@@ -21362,7 +22334,7 @@ async function memoryManifest(run2) {
             dryRun: false
           });
           if (seedResult.created > 0) {
-            (0, import_node_fs34.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created}
+            (0, import_node_fs39.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created}
 `);
             autoSeedNotice = `Seeded ${seedResult.created} knowledge node(s) from your existing Standard (one-time).`;
             logEvent("auto_seed_ran", {
@@ -21370,7 +22342,7 @@ async function memoryManifest(run2) {
               failed: seedResult.failed
             });
           } else if (seedResult.skipped === "already_seeded") {
-            (0, import_node_fs34.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
+            (0, import_node_fs39.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
 `);
           } else {
             logEvent("auto_seed_noop", {
@@ -21465,7 +22437,7 @@ function computeIncrement(reviewedPaths, hashOf, priorAuthored) {
 }
 
 // src/commands/analyze/phases/10-working-memory.ts
-var import_node_path25 = require("node:path");
+var import_node_path28 = require("node:path");
 async function workingMemory(run2) {
   const { opts } = run2;
   const { allForReview, baseline, conversation, foldResult, sessionId, token, transcriptPath } = run2;
@@ -21477,7 +22449,7 @@ async function workingMemory(run2) {
     const priorState = foldForMarks(memorySession.d);
     incrementReport = computeIncrement(
       allForReview,
-      (p) => fileHash((0, import_node_path25.join)(repoRoot(), p)),
+      (p) => fileHash((0, import_node_path28.join)(repoRoot(), p)),
       priorState.authored_all.map((a) => ({
         path: a.path,
         hash_at_last_verdict: a.hash_at_last_verdict
@@ -21559,7 +22531,7 @@ async function workingMemory(run2) {
 }
 
 // src/lib/note-budget.ts
-var import_node_fs35 = require("node:fs");
+var import_node_fs40 = require("node:fs");
 var ADVISORY_BUDGET = { PASS: 1, WARN: 2 };
 var EPISODE_STALE_SECONDS = 30 * 60;
 var FRESH = { delivered: 0, tasksCompleted: 0, ts: 0 };
@@ -21581,9 +22553,9 @@ function advisoryBudgetSpent(episode, rawDecision) {
 }
 function readAdvisoryEpisode(sessionId) {
   const file = scopedFile(ADVISORY_EPISODE_FILE, sessionId);
-  if (!(0, import_node_fs35.existsSync)(file)) return null;
+  if (!(0, import_node_fs40.existsSync)(file)) return null;
   try {
-    const o = JSON.parse((0, import_node_fs35.readFileSync)(file, "utf-8")) ?? {};
+    const o = JSON.parse((0, import_node_fs40.readFileSync)(file, "utf-8")) ?? {};
     const delivered = typeof o.delivered === "number" ? o.delivered : NaN;
     if (isNaN(delivered)) return null;
     return {
@@ -21597,8 +22569,8 @@ function readAdvisoryEpisode(sessionId) {
 }
 function writeAdvisoryEpisode(episode, sessionId) {
   try {
-    (0, import_node_fs35.mkdirSync)(VERITY_DIR, { recursive: true });
-    (0, import_node_fs35.writeFileSync)(
+    (0, import_node_fs40.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs40.writeFileSync)(
       scopedFile(ADVISORY_EPISODE_FILE, sessionId),
       JSON.stringify({ v: 1, ...episode })
     );
@@ -21628,7 +22600,7 @@ function isExplicitlyAutonomous(env = process.env) {
 }
 
 // src/lib/task-context.ts
-var import_node_child_process10 = require("node:child_process");
+var import_node_child_process12 = require("node:child_process");
 var CLOSING_RE = /\b(close[sd]?|fix(?:e[sd])?|resolve[sd]?)\b[\s:]*#(\d+)/i;
 var BRANCH_RE = /(?:^|[/_-])(?:issue|gh|fix)[-_/]?(\d+)\b/i;
 function parseLinkedIssue(sources) {
@@ -21644,7 +22616,7 @@ function parseLinkedIssue(sources) {
 }
 function safeExec(cmd, timeout) {
   try {
-    return (0, import_node_child_process10.execSync)(cmd, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout }).trim();
+    return (0, import_node_child_process12.execSync)(cmd, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout }).trim();
   } catch {
     return "";
   }
@@ -21915,14 +22887,14 @@ async function buildRequest(run2) {
 }
 
 // src/lib/offline.ts
-var import_node_fs36 = require("node:fs");
+var import_node_fs41 = require("node:fs");
 var import_node_crypto11 = require("node:crypto");
 function cacheRequest(body) {
   try {
-    (0, import_node_fs36.mkdirSync)(CACHE_DIR, { recursive: true });
+    (0, import_node_fs41.mkdirSync)(CACHE_DIR, { recursive: true });
     const suffix = (0, import_node_crypto11.randomBytes)(4).toString("hex");
     const filename = `pending-${Math.floor(Date.now() / 1e3)}-${suffix}.json`;
-    (0, import_node_fs36.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body)));
+    (0, import_node_fs41.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body)));
   } catch {
   }
 }
@@ -22041,8 +23013,8 @@ async function transmit(run2) {
 }
 
 // src/commands/analyze/phases/13-reconcile.ts
-var import_node_fs37 = require("node:fs");
-var import_node_path26 = require("node:path");
+var import_node_fs42 = require("node:fs");
+var import_node_path29 = require("node:path");
 async function reconcile(run2) {
   const { actionSummary, allChanged, analyzable, baseline, baselineSessionId, codeDelta, contentHash, conversation, decision, foldResult, memory, memorySession, response, reviewable, securityFiles, turnId } = run2;
   const sentPaths = codeDelta.files.map((f) => f.path);
@@ -22071,7 +23043,7 @@ async function reconcile(run2) {
       const st = foldDossier(memorySession.d);
       openElsewhere = openBlockingElsewhere(st.statements, sentPaths, (file, line) => {
         try {
-          const src = (0, import_node_fs37.readFileSync)((0, import_node_path26.join)(repoRoot(), file), "utf8").split("\n");
+          const src = (0, import_node_fs42.readFileSync)((0, import_node_path29.join)(repoRoot(), file), "utf8").split("\n");
           const at = src[line - 1];
           return at === void 0 ? null : lineSha(at);
         } catch {
@@ -22736,7 +23708,7 @@ function registerAnalyzeCommand(program2) {
 var tracing = () => process.env.VERITY_TRACE_PHASES === "1";
 async function runAnalyze(opts, globals) {
   if (!verityConfigured()) {
-    (0, import_node_fs38.writeSync)(2, '[verity] not set up in this project \u2014 run "verity init" first.\n');
+    (0, import_node_fs43.writeSync)(2, '[verity] not set up in this project \u2014 run "verity init" first.\n');
     process.exit(0);
   }
   const run2 = createRun(opts, globals);
@@ -22817,7 +23789,7 @@ async function readStdin() {
 }
 
 // src/commands/review.ts
-var import_node_fs39 = require("node:fs");
+var import_node_fs44 = require("node:fs");
 function registerReviewCommand(program2) {
   program2.command("review").description("Run on-demand Verity analysis (advisory, never blocks)").requiredOption("--files <paths>", "Comma-separated file list").option("--changed <paths>", "Subset of --files that were modified").option("--intent <text>", "User intent description (max 2000 chars)").option("--specs <paths>", "Comma-separated spec file paths").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -22836,7 +23808,7 @@ async function runReview(opts, globals) {
   const securityFiles = filterSecurity(allFiles);
   let staticResults;
   if (isCodacyAvailable()) {
-    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs39.existsSync)(f) || resolveFile(f) !== null);
+    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs44.existsSync)(f) || resolveFile(f) !== null);
     staticResults = runCodacyAnalysis(scannable);
   } else {
     staticResults = {
@@ -22862,10 +23834,10 @@ async function runReview(opts, globals) {
     const specPaths = opts.specs.split(",").map((f) => f.trim()).filter(Boolean);
     specs = [];
     for (const p of specPaths) {
-      if (!(0, import_node_fs39.existsSync)(p)) continue;
+      if (!(0, import_node_fs44.existsSync)(p)) continue;
       try {
-        const { readFileSync: readFileSync26 } = await import("node:fs");
-        const content = readFileSync26(p, "utf-8");
+        const { readFileSync: readFileSync27 } = await import("node:fs");
+        const content = readFileSync27(p, "utf-8");
         specs.push({ path: p, content: content.slice(0, 10240) });
       } catch {
       }
@@ -22922,10 +23894,10 @@ async function runReview(opts, globals) {
 }
 
 // src/commands/guard.ts
-var import_node_fs40 = require("node:fs");
-var import_node_path27 = require("node:path");
+var import_node_fs45 = require("node:fs");
+var import_node_path30 = require("node:path");
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path27.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path30.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
   return new Promise((resolve4) => {
@@ -22970,7 +23942,7 @@ function readPreToolUseStdin() {
 }
 function readIterMap() {
   try {
-    const raw = JSON.parse((0, import_node_fs40.readFileSync)(GUARD_ITER_FILE, "utf-8"));
+    const raw = JSON.parse((0, import_node_fs45.readFileSync)(GUARD_ITER_FILE, "utf-8"));
     if (raw && typeof raw === "object") {
       if (typeof raw.moment === "string" && typeof raw.count === "number") {
         return { [raw.moment]: raw.count };
@@ -22990,10 +23962,10 @@ function readIter(moment) {
 }
 function writeIter(moment, count) {
   try {
-    (0, import_node_fs40.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs45.mkdirSync)(VERITY_DIR, { recursive: true });
     const map = readIterMap();
     map[moment] = count;
-    (0, import_node_fs40.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+    (0, import_node_fs45.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
   } catch {
   }
 }
@@ -23003,10 +23975,10 @@ function resetIter(moment) {
     if (!(moment in map)) return;
     delete map[moment];
     if (Object.keys(map).length === 0) {
-      if ((0, import_node_fs40.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs40.unlinkSync)(GUARD_ITER_FILE);
+      if ((0, import_node_fs45.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs45.unlinkSync)(GUARD_ITER_FILE);
     } else {
-      (0, import_node_fs40.mkdirSync)(VERITY_DIR, { recursive: true });
-      (0, import_node_fs40.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+      (0, import_node_fs45.mkdirSync)(VERITY_DIR, { recursive: true });
+      (0, import_node_fs45.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
     }
   } catch {
   }
@@ -23078,7 +24050,7 @@ function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedInte
   const securityFiles = filterSecurity(files);
   let staticResults;
   if (isCodacyAvailable()) {
-    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs40.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs45.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
     staticResults = runCodacyAnalysis(scannable);
   } else {
     staticResults = { tool: "@codacy/analysis-cli", findings: [], summary: { total_findings: 0, by_severity: {}, tools_run: [] } };
@@ -23211,13 +24183,13 @@ async function runGuard(opts, globals) {
       diffs: [],
       signalsByPath: rangeChangeSignals(frame, range, codeDelta.files.map((f) => f.path)),
       sentPaths: new Set(codeDelta.files.map((f) => f.path)),
-      isExcluded: (p) => isVerityOwnedPath(p) || isIgnored(ig, p),
+      isExcluded: (p) => isVerityOwnedPath(p) || isIgnored2(ig, p),
       cwd: frame.worktreeRoot ?? process.cwd()
     });
     upgradeToExcerpts(repoContext2, {
       readFile: (rel) => {
         try {
-          return (0, import_node_fs40.readFileSync)((0, import_node_path27.join)(frame.worktreeRoot ?? process.cwd(), rel), "utf8");
+          return (0, import_node_fs45.readFileSync)((0, import_node_path30.join)(frame.worktreeRoot ?? process.cwd(), rel), "utf8");
         } catch {
           return null;
         }
@@ -23438,7 +24410,7 @@ function registerIgnoreCommand(program2) {
 
 // src/commands/waive.ts
 var import_node_crypto12 = require("node:crypto");
-var import_node_fs41 = require("node:fs");
+var import_node_fs46 = require("node:fs");
 function registerWaiveCommand(program2) {
   program2.command("waive <pattern-id>").description("Record an accepted-risk disposition for an open finding (voids when the file changes)").option("--file <path>", "File the finding is anchored to, REPO-RELATIVE (recommended \u2014 narrows the waive)").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action(async (patternId, opts) => {
     const globals = program2.opts();
@@ -23467,7 +24439,7 @@ function registerWaiveCommand(program2) {
     if (opts.file) {
       body.file = opts.file;
       try {
-        body.file_sha256 = (0, import_node_crypto12.createHash)("sha256").update((0, import_node_fs41.readFileSync)(opts.file)).digest("hex");
+        body.file_sha256 = (0, import_node_crypto12.createHash)("sha256").update((0, import_node_fs46.readFileSync)(opts.file)).digest("hex");
       } catch {
         printError(`Cannot read ${opts.file} \u2014 run from the repo root, or omit --file to waive by pattern.`);
         process.exit(1);
@@ -23492,10 +24464,11 @@ function registerWaiveCommand(program2) {
 }
 
 // src/commands/init.ts
-var import_node_fs46 = require("node:fs");
-var import_promises14 = require("node:fs/promises");
-var import_node_path29 = require("node:path");
-var import_node_child_process14 = require("node:child_process");
+var import_node_fs51 = require("node:fs");
+var import_promises17 = require("node:fs/promises");
+var import_yaml6 = __toESM(require_dist());
+var import_node_path33 = require("node:path");
+var import_node_child_process16 = require("node:child_process");
 
 // src/lib/banner.ts
 var WORDMARK = [
@@ -23573,14 +24546,14 @@ function printPhase(n, of, title, subtitle) {
 }
 
 // src/commands/doctor.ts
-var import_node_fs44 = require("node:fs");
+var import_node_fs48 = require("node:fs");
 
 // src/lib/prereqs.ts
-var import_node_child_process11 = require("node:child_process");
+var import_node_child_process13 = require("node:child_process");
 var MIN_NODE_MAJOR = 20;
 function which(bin) {
   try {
-    const out = (0, import_node_child_process11.execSync)(`command -v ${bin}`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    const out = (0, import_node_child_process13.execSync)(`command -v ${bin}`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
     return out || null;
   } catch {
     return null;
@@ -23602,7 +24575,7 @@ function checkNode() {
 function checkGit() {
   let detail = "";
   try {
-    detail = (0, import_node_child_process11.execSync)("git --version", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    detail = (0, import_node_child_process13.execSync)("git --version", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
     return {
       id: "git",
@@ -23640,7 +24613,7 @@ function checkAnalysisCli() {
 var INSTALL_TIMEOUT_MS = 12e4;
 function run(command, args, opts = {}) {
   return new Promise((resolve4) => {
-    const child = (0, import_node_child_process11.spawn)(command, args, {
+    const child = (0, import_node_child_process13.spawn)(command, args, {
       stdio: opts.inherit ? "inherit" : "pipe",
       timeout: INSTALL_TIMEOUT_MS
     });
@@ -23689,11 +24662,11 @@ async function checkPrereqs(opts = {}) {
 }
 
 // src/lib/telemetry.ts
-var import_promises12 = require("node:fs/promises");
+var import_promises15 = require("node:fs/promises");
 
 // src/lib/gitignore.ts
-var import_node_child_process12 = require("node:child_process");
-var import_node_fs42 = require("node:fs");
+var import_node_child_process14 = require("node:child_process");
+var import_node_fs47 = require("node:fs");
 var VERITY_GITIGNORE_MARKER = "# Verity \u2014 machine-local state.";
 var SETTINGS_LOCAL_IGNORE_ENTRY = ".claude/settings.local.json";
 var VERITY_GITIGNORE_BLOCK = [
@@ -23707,26 +24680,26 @@ var VERITY_GITIGNORE_BLOCK = [
   ""
 ].join("\n");
 var BREAKING_ENTRIES = /* @__PURE__ */ new Set([".verity/", ".verity"]);
-function isIgnored2(path) {
+function isIgnored3(path) {
   try {
-    (0, import_node_child_process12.execSync)(`git check-ignore -q -- "${path}"`, { stdio: "pipe" });
+    (0, import_node_child_process14.execSync)(`git check-ignore -q -- "${path}"`, { stdio: "pipe" });
     return true;
   } catch (err) {
     return err.status === 1 ? false : null;
   }
 }
 function semanticsHold() {
-  const snapshot = isIgnored2(".verity/.snapshot/__probe__");
-  const standard = isIgnored2(".verity/standard.yaml");
-  const node = isIgnored2(".verity/memory/domain/__probe__.md");
-  const futureState = isIgnored2(".verity/.__probe-future-state__");
+  const snapshot = isIgnored3(".verity/.snapshot/__probe__");
+  const standard = isIgnored3(".verity/standard.yaml");
+  const node = isIgnored3(".verity/memory/domain/__probe__.md");
+  const futureState = isIgnored3(".verity/.__probe-future-state__");
   if (snapshot === null || standard === null || node === null || futureState === null) return null;
   return snapshot === true && futureState === true && standard === false && node === false;
 }
 function ensureVerityGitignore() {
   let content = "";
   try {
-    content = (0, import_node_fs42.readFileSync)(".gitignore", "utf-8");
+    content = (0, import_node_fs47.readFileSync)(".gitignore", "utf-8");
   } catch {
   }
   const hasMarker = content.includes(VERITY_GITIGNORE_MARKER);
@@ -23747,7 +24720,7 @@ function ensureVerityGitignore() {
       const sep2 = next === "" ? "" : next.endsWith("\n") ? "\n" : "\n\n";
       next = next + sep2 + VERITY_GITIGNORE_BLOCK;
     }
-    (0, import_node_fs42.writeFileSync)(".gitignore", next);
+    (0, import_node_fs47.writeFileSync)(".gitignore", next);
     return verified(needsRepair ? "repaired" : "added");
   } catch {
     return "failed";
@@ -23756,7 +24729,7 @@ function ensureVerityGitignore() {
 function committedVerityState() {
   let out = "";
   try {
-    out = (0, import_node_child_process12.execSync)("git ls-files -z -- .verity", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+    out = (0, import_node_child_process14.execSync)("git ls-files -z -- .verity", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
   } catch {
     return [];
   }
@@ -23766,10 +24739,10 @@ function untrackVerityState() {
   const tracked = committedVerityState();
   if (tracked.length === 0) return "none";
   try {
-    (0, import_node_child_process12.execSync)("git rm -r --cached --quiet -- .verity", { stdio: "pipe" });
+    (0, import_node_child_process14.execSync)("git rm -r --cached --quiet -- .verity", { stdio: "pipe" });
     for (const keep of [".verity/standard.yaml", ".verity/memory"]) {
       try {
-        (0, import_node_child_process12.execSync)(`git add -- "${keep}"`, { stdio: "pipe" });
+        (0, import_node_child_process14.execSync)(`git add -- "${keep}"`, { stdio: "pipe" });
       } catch {
       }
     }
@@ -23809,7 +24782,7 @@ function buildTelemetryEnv(serviceUrl) {
 var VERITY_TELEMETRY_KEYS = Object.keys(buildTelemetryEnv(""));
 async function readSettingsLocal() {
   try {
-    return JSON.parse(await (0, import_promises12.readFile)(projectPath(SETTINGS_LOCAL_FILE2), "utf-8"));
+    return JSON.parse(await (0, import_promises15.readFile)(projectPath(SETTINGS_LOCAL_FILE2), "utf-8"));
   } catch {
     return {};
   }
@@ -23821,7 +24794,7 @@ async function ensureGitignore() {
   const file = projectPath(GITIGNORE_FILE);
   let content = "";
   try {
-    content = await (0, import_promises12.readFile)(file, "utf-8");
+    content = await (0, import_promises15.readFile)(file, "utf-8");
   } catch {
   }
   const lines = content.split("\n").map((l) => l.trim());
@@ -23830,7 +24803,7 @@ async function ensureGitignore() {
   }
   const block = "# Verity telemetry \u2014 machine-local Claude Code settings\n" + GITIGNORE_ENTRY + "\n";
   const next = content ? content + (content.endsWith("\n") ? "" : "\n") + "\n" + block : block;
-  await (0, import_promises12.writeFile)(file, next);
+  await (0, import_promises15.writeFile)(file, next);
 }
 async function installTelemetry(serviceUrl) {
   const env = buildTelemetryEnv(serviceUrl);
@@ -23868,50 +24841,49 @@ async function uninstallTelemetry() {
   return { ok: true, data: { removed } };
 }
 
-// src/lib/setup-state.ts
-var import_promises13 = require("node:fs/promises");
-var import_node_fs43 = require("node:fs");
-var SETUP_STATE_FILE = `${VERITY_DIR}/setup.json`;
-async function readSetupState() {
-  const path = projectPath(SETUP_STATE_FILE);
-  if (!(0, import_node_fs43.existsSync)(path)) return null;
-  try {
-    const parsed = JSON.parse(await (0, import_promises13.readFile)(path, "utf-8"));
-    return parsed && typeof parsed === "object" ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-async function writeSetupState(patch) {
-  const current = await readSetupState() ?? { version: 1 };
-  const next = { ...current, ...patch, version: 1 };
-  await writeJsonFilePreservingStyle(projectPath(SETUP_STATE_FILE), next);
-  return next;
-}
-
 // src/commands/doctor.ts
 async function buildReport() {
   const prereqs = await checkPrereqs({ install: false });
   const state = await readSetupState();
   const hooks = await checkAllVerityHooks();
   const telemetry = await checkTelemetry();
+  const hasConfig = (0, import_node_fs48.existsSync)(projectPath(CODACY_CONFIG_FILE));
   const artifacts = {
-    standard: (0, import_node_fs44.existsSync)(projectPath(STANDARD_FILE)),
-    analysisConfig: (0, import_node_fs44.existsSync)(projectPath(CODACY_CONFIG_FILE)),
-    verityMd: (0, import_node_fs44.existsSync)(projectPath(VERITY_MD_FILE))
+    standard: (0, import_node_fs48.existsSync)(projectPath(STANDARD_FILE)),
+    analysisConfig: hasConfig,
+    verityMd: (0, import_node_fs48.existsSync)(projectPath(VERITY_MD_FILE)),
+    analysisConfigIds: hasConfig ? validatePatternIds().status : "absent"
   };
   const next = [];
   for (const c of prereqs.checks) {
     if (c.status !== "ok" && c.remedy) next.push(c.remedy);
   }
   if (!state?.init) next.push('Run "verity init" \u2014 the deterministic setup phase has not completed here.');
-  if (!artifacts.standard || !artifacts.analysisConfig || !artifacts.verityMd) {
-    next.push("Run /verity-setup in Claude Code \u2014 the Standard, analysis config, and VERITY.md are synthesized there.");
+  const missing = [
+    !artifacts.standard && ".verity/standard.yaml",
+    !artifacts.analysisConfig && ".codacy/codacy.config.json",
+    !artifacts.verityMd && "VERITY.md"
+  ].filter((x) => !!x);
+  if (missing.length === 3) {
+    next.push('Run "verity standard synthesize --push" \u2014 it derives the Standard, the analysis config and VERITY.md from this codebase.');
+  } else if (missing.length === 1 && !artifacts.analysisConfig) {
+    next.push(
+      'No analysis config, so static analysis runs nothing. Run "verity standard synthesize --config-only" to derive one from the Standard you already have (--force would REPLACE that Standard), or have a teammate run "verity config push".'
+    );
+  } else if (missing.length > 0) {
+    next.push(
+      `Missing ${missing.join(" and ")}. Run "verity standard synthesize --force" to regenerate \u2014 note that replaces the Standard; use --config-only if only the analysis config is missing.`
+    );
   }
   const noAnalysisMoment = !hooks.stop && hooks.guardOn.length === 0;
   if (noAnalysisMoment) {
     next.push('No analysis moment is active \u2014 run "verity hooks install --moments stop" or re-run "verity init".');
   }
+  if (artifacts.analysisConfigIds === "invalid") {
+    next.push(
+      'Your analysis config names pattern ids that no longer resolve, so those tools run with nothing enabled and report zero issues. Fix: "verity standard synthesize --config-only" (or re-run "verity init").'
+    );
+  }
   if (state?.telemetry === "deferred") {
     next.push('Telemetry was requested but needs a token \u2014 run "verity login", then "verity telemetry install".');
   }
@@ -23957,7 +24929,9 @@ function registerDoctorCommand(program2) {
     printInfo(`Telemetry: ${report.telemetry.enabled ? `enabled \u2192 ${report.telemetry.endpoint}` : "disabled"}`);
     printInfo("Artifacts:");
     printInfo(`  .verity/standard.yaml: ${report.artifacts.standard ? "\u2713" : "missing"}`);
-    printInfo(`  .codacy/codacy.config.json: ${report.artifacts.analysisConfig ? "\u2713" : "missing"}`);
+    const idState = report.artifacts.analysisConfigIds;
+    const idNote = idState === "valid" ? "\u2713" : idState === "invalid" ? "\u26A0 ids do not resolve" : idState === "unchecked" ? "\u2713 (ids unverified \u2014 no adapter)" : "";
+    printInfo(`  .codacy/codacy.config.json: ${report.artifacts.analysisConfig ? idNote : "missing"}`);
     printInfo(`  VERITY.md: ${report.artifacts.verityMd ? "\u2713" : "missing"}`);
     if (report.next.length > 0) {
       console.log("");
@@ -23971,16 +24945,16 @@ function registerDoctorCommand(program2) {
 }
 
 // src/commands/migrate.ts
-var import_node_fs45 = require("node:fs");
-var import_node_path28 = require("node:path");
-var import_node_child_process13 = require("node:child_process");
+var import_node_fs49 = require("node:fs");
+var import_node_path31 = require("node:path");
+var import_node_child_process15 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
-  (0, import_node_child_process13.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
+  (0, import_node_child_process15.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
 }
 function isGitTracked(cwd, relPath) {
   try {
-    (0, import_node_child_process13.execSync)(`git ls-files --error-unmatch ${relPath}`, { cwd, stdio: "pipe" });
+    (0, import_node_child_process15.execSync)(`git ls-files --error-unmatch ${relPath}`, { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -23988,7 +24962,7 @@ function isGitTracked(cwd, relPath) {
 }
 function isGitRepo(cwd) {
   try {
-    (0, import_node_child_process13.execSync)("git rev-parse --is-inside-work-tree", { cwd, stdio: "pipe" });
+    (0, import_node_child_process15.execSync)("git rev-parse --is-inside-work-tree", { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -24009,12 +24983,12 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path28.join)(root, ".gate");
-  const verityDir = (0, import_node_path28.join)(root, ".verity");
-  if ((0, import_node_fs45.existsSync)(gateDir) && !(0, import_node_fs45.existsSync)(verityDir)) {
+  const gateDir = (0, import_node_path31.join)(root, ".gate");
+  const verityDir = (0, import_node_path31.join)(root, ".verity");
+  if ((0, import_node_fs49.existsSync)(gateDir) && !(0, import_node_fs49.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if ((0, import_node_fs45.existsSync)(gateDir) && (0, import_node_fs45.existsSync)(verityDir)) {
+  if ((0, import_node_fs49.existsSync)(gateDir) && (0, import_node_fs49.existsSync)(verityDir)) {
     return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
   return false;
@@ -24028,20 +25002,20 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
       );
     }
     try {
-      (0, import_node_child_process13.execSync)("git mv .gate .verity", { cwd: root, stdio: "pipe" });
+      (0, import_node_child_process15.execSync)("git mv .gate .verity", { cwd: root, stdio: "pipe" });
       actions.push("Moved .gate/ \u2192 .verity/ (git mv, staged)");
       moved = true;
     } catch {
     }
   }
   if (moved) {
-    if ((0, import_node_fs45.existsSync)(gateDir)) {
+    if ((0, import_node_fs49.existsSync)(gateDir)) {
       const carried = carryLegacyContents(gateDir, verityDir);
       if (carried > 0) {
         actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
       }
       try {
-        (0, import_node_fs45.rmSync)(gateDir, { recursive: true, force: true });
+        (0, import_node_fs49.rmSync)(gateDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -24057,18 +25031,18 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
     actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
   try {
-    (0, import_node_fs45.rmSync)(gateDir, { recursive: true, force: true });
+    (0, import_node_fs49.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
   }
   return carried > 0;
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path28.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path28.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs45.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs45.existsSync)(verityCreds)) {
-    (0, import_node_fs45.mkdirSync)((0, import_node_path28.join)(home, ".verity"), { recursive: true });
+  const gateCreds = (0, import_node_path31.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path31.join)(home, ".verity", "credentials");
+  if (!(0, import_node_fs49.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs49.existsSync)(verityCreds)) {
+    (0, import_node_fs49.mkdirSync)((0, import_node_path31.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -24090,8 +25064,8 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path28.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs45.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  const claudeMd = (0, import_node_path31.join)(root, "CLAUDE.md");
+  const hadLegacyBlock = (0, import_node_fs49.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
     await ensureClaudeMdPointer(root);
@@ -24101,13 +25075,13 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path28.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path28.join)(root, "VERITY.md");
-  if (!(0, import_node_fs45.existsSync)(gateMd) || (0, import_node_fs45.existsSync)(verityMd)) return;
+  const gateMd = (0, import_node_path31.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path31.join)(root, "VERITY.md");
+  if (!(0, import_node_fs49.existsSync)(gateMd) || (0, import_node_fs49.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
-      (0, import_node_child_process13.execSync)("git mv GATE.md VERITY.md", { cwd: root, stdio: "pipe" });
+      (0, import_node_child_process15.execSync)("git mv GATE.md VERITY.md", { cwd: root, stdio: "pipe" });
       moved = true;
     } catch {
     }
@@ -24115,12 +25089,12 @@ function migrateStandardFile(root, actions) {
   if (!moved) moveFile(gateMd, verityMd);
   const content = readFileSyncSafe(verityMd);
   const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs45.writeFileSync)(verityMd, refreshed);
+  if (refreshed !== content) (0, import_node_fs49.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
-  const file = (0, import_node_path28.join)(root, ".claude", "settings.local.json");
-  if (!(0, import_node_fs45.existsSync)(file)) return;
+  const file = (0, import_node_path31.join)(root, ".claude", "settings.local.json");
+  if (!(0, import_node_fs49.existsSync)(file)) return;
   let settings;
   try {
     settings = JSON.parse(readFileSyncSafe(file) || "{}");
@@ -24168,21 +25142,21 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
   }
   if (toAppend.length > 0) {
     const sep2 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs45.writeFileSync)(verityCreds, verityContent + sep2 + toAppend.join("\n") + "\n");
+    (0, import_node_fs49.writeFileSync)(verityCreds, verityContent + sep2 + toAppend.join("\n") + "\n");
   }
-  (0, import_node_fs45.rmSync)(gateCreds, { force: true });
+  (0, import_node_fs49.rmSync)(gateCreds, { force: true });
   return toAppend.length;
 }
 function readFileSyncSafe(path) {
   try {
-    return (0, import_node_fs45.readFileSync)(path, "utf-8");
+    return (0, import_node_fs49.readFileSync)(path, "utf-8");
   } catch {
     return "";
   }
 }
 function hasStagedChanges(root) {
   try {
-    (0, import_node_child_process13.execSync)("git diff --cached --quiet", { cwd: root, stdio: "pipe" });
+    (0, import_node_child_process15.execSync)("git diff --cached --quiet", { cwd: root, stdio: "pipe" });
     return false;
   } catch {
     return true;
@@ -24190,59 +25164,59 @@ function hasStagedChanges(root) {
 }
 function moveDir(from, to) {
   try {
-    (0, import_node_fs45.renameSync)(from, to);
+    (0, import_node_fs49.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs45.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs45.rmSync)(from, { recursive: true, force: true });
+    (0, import_node_fs49.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs49.rmSync)(from, { recursive: true, force: true });
   }
 }
 function moveFile(from, to) {
   try {
-    (0, import_node_fs45.renameSync)(from, to);
+    (0, import_node_fs49.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs45.cpSync)(from, to);
-    (0, import_node_fs45.rmSync)(from, { force: true });
+    (0, import_node_fs49.cpSync)(from, to);
+    (0, import_node_fs49.rmSync)(from, { force: true });
   }
 }
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
-  const walk = (relDir) => {
-    const srcDir = (0, import_node_path28.join)(gateDir, relDir);
-    for (const entry of (0, import_node_fs45.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path28.join)(relDir, entry) : entry;
-      const src = (0, import_node_path28.join)(gateDir, rel);
-      const dest = (0, import_node_path28.join)(verityDir, rel);
-      if ((0, import_node_fs45.statSync)(src).isDirectory()) {
-        walk(rel);
-      } else if (!(0, import_node_fs45.existsSync)(dest)) {
-        (0, import_node_fs45.mkdirSync)((0, import_node_path28.dirname)(dest), { recursive: true });
-        (0, import_node_fs45.cpSync)(src, dest);
+  const walk2 = (relDir) => {
+    const srcDir = (0, import_node_path31.join)(gateDir, relDir);
+    for (const entry of (0, import_node_fs49.readdirSync)(srcDir)) {
+      const rel = relDir ? (0, import_node_path31.join)(relDir, entry) : entry;
+      const src = (0, import_node_path31.join)(gateDir, rel);
+      const dest = (0, import_node_path31.join)(verityDir, rel);
+      if ((0, import_node_fs49.statSync)(src).isDirectory()) {
+        walk2(rel);
+      } else if (!(0, import_node_fs49.existsSync)(dest)) {
+        (0, import_node_fs49.mkdirSync)((0, import_node_path31.dirname)(dest), { recursive: true });
+        (0, import_node_fs49.cpSync)(src, dest);
         copied++;
       }
     }
   };
-  walk("");
+  walk2("");
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path28.join)(root, ".gate");
-  const verityDir = (0, import_node_path28.join)(root, ".verity");
-  if ((0, import_node_fs45.existsSync)(gateDir) && !(0, import_node_fs45.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs45.existsSync)(gateDir) && (0, import_node_fs45.existsSync)(verityDir)) {
-    if ((0, import_node_fs45.existsSync)((0, import_node_path28.join)(gateDir, "credentials")) && !(0, import_node_fs45.existsSync)((0, import_node_path28.join)(verityDir, "credentials"))) {
+  const gateDir = (0, import_node_path31.join)(root, ".gate");
+  const verityDir = (0, import_node_path31.join)(root, ".verity");
+  if ((0, import_node_fs49.existsSync)(gateDir) && !(0, import_node_fs49.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs49.existsSync)(gateDir) && (0, import_node_fs49.existsSync)(verityDir)) {
+    if ((0, import_node_fs49.existsSync)((0, import_node_path31.join)(gateDir, "credentials")) && !(0, import_node_fs49.existsSync)((0, import_node_path31.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs45.existsSync)((0, import_node_path28.join)(gateDir, "memory")) && !(0, import_node_fs45.existsSync)((0, import_node_path28.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs49.existsSync)((0, import_node_path31.join)(gateDir, "memory")) && !(0, import_node_fs49.existsSync)((0, import_node_path31.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path28.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs45.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+  const claudeMd = (0, import_node_path31.join)(root, "CLAUDE.md");
+  if ((0, import_node_fs49.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs45.existsSync)((0, import_node_path28.join)(root, "GATE.md")) && !(0, import_node_fs45.existsSync)((0, import_node_path28.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs49.existsSync)((0, import_node_path31.join)(root, "GATE.md")) && !(0, import_node_fs49.existsSync)((0, import_node_path31.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -24268,12 +25242,168 @@ function registerMigrateCommand(program2) {
 }
 
 // src/lib/prompt.ts
-var readline2 = __toESM(require("node:readline/promises"));
+var readline3 = __toESM(require("node:readline/promises"));
+
+// src/lib/select.ts
+var readline2 = __toESM(require("node:readline"));
+function keyToAction(str, key) {
+  const name = key?.name;
+  if (key?.ctrl && (name === "c" || str === "")) return { type: "interrupt" };
+  if (key?.ctrl && (name === "d" || str === "")) return { type: "eof" };
+  switch (name) {
+    case "up":
+      return { type: "move", delta: -1 };
+    case "down":
+      return { type: "move", delta: 1 };
+    case "k":
+      return key?.ctrl ? null : { type: "move", delta: -1 };
+    case "j":
+      return key?.ctrl ? null : { type: "move", delta: 1 };
+    case "space":
+      return { type: "toggle" };
+    case "return":
+    case "enter":
+      return { type: "confirm" };
+    default:
+      break;
+  }
+  if (str === " ") return { type: "toggle" };
+  if (str === "\r" || str === "\n") return { type: "confirm" };
+  if (str && /^[1-9]$/.test(str)) return { type: "jump", index: Number(str) - 1 };
+  return null;
+}
+function applyKey(state, action, count, mode2) {
+  switch (action.type) {
+    case "move": {
+      const cursor = (state.cursor + action.delta + count) % count;
+      return { status: "open", state: { cursor, chosen: state.chosen } };
+    }
+    case "jump": {
+      if (action.index >= count) return { status: "open", state };
+      return { status: "open", state: { cursor: action.index, chosen: state.chosen } };
+    }
+    case "toggle": {
+      if (mode2 === "single") {
+        return { status: "open", state: { cursor: state.cursor, chosen: /* @__PURE__ */ new Set([state.cursor]) } };
+      }
+      const chosen = new Set(state.chosen);
+      if (chosen.has(state.cursor)) chosen.delete(state.cursor);
+      else chosen.add(state.cursor);
+      return { status: "open", state: { cursor: state.cursor, chosen } };
+    }
+    case "confirm": {
+      if (mode2 === "single") return { status: "confirmed", indices: [state.cursor] };
+      if (state.chosen.size === 0) {
+        return {
+          status: "open",
+          state: { ...state, hint: "Select at least one \u2014 space toggles the option under the cursor." }
+        };
+      }
+      return { status: "confirmed", indices: [...state.chosen].sort((a, b) => a - b) };
+    }
+    case "interrupt":
+      return { status: "interrupt" };
+    case "eof":
+      return { status: "eof" };
+  }
+}
+var GREEN3 = "\x1B[0;32m";
+var DIM4 = "\x1B[2m";
+var BOLD2 = "\x1B[1m";
+var RESET3 = "\x1B[0m";
+function renderSelect(question, choices, state, mode2, color = colorEnabled()) {
+  const paint = (text, code) => color ? `${code}${text}${RESET3}` : text;
+  const lines = ["", `  ${question}`];
+  const labelOf = (c) => `${c.label}${c.recommended ? " (recommended)" : ""}`;
+  const gutter = Math.max(...choices.map((c) => labelOf(c).length));
+  choices.forEach((choice, i) => {
+    const here = i === state.cursor;
+    const marker = state.chosen.has(i) ? "\u25C9" : "\u25CB";
+    const cursor = here ? "\u276F" : " ";
+    const label2 = labelOf(choice);
+    const pad = choice.hint ? " ".repeat(gutter - label2.length) : "";
+    const hint = choice.hint ? `${pad}   ${paint(choice.hint, DIM4)}` : "";
+    lines.push(`  ${cursor} ${marker} ${here ? paint(label2, BOLD2) : label2}${hint}`);
+  });
+  const keys = mode2 === "multi" ? "\u2191\u2193 move \xB7 space toggle \xB7 enter confirm" : "\u2191\u2193 move \xB7 enter confirm";
+  lines.push(`  ${paint(state.hint ?? keys, state.hint ? GREEN3 : DIM4)}`);
+  return lines;
+}
+function runSelect(opts) {
+  const input = opts.input ?? process.stdin;
+  const output = opts.output ?? process.stdout;
+  const { choices, mode: mode2 } = opts;
+  if (typeof input.setRawMode !== "function" || !input.isTTY) return Promise.resolve(null);
+  const initialIdx = choices.map((c, i) => opts.initial.includes(c.id) ? i : -1).filter((i) => i >= 0);
+  let state = {
+    cursor: initialIdx[0] ?? 0,
+    chosen: new Set(mode2 === "single" ? [initialIdx[0] ?? 0] : initialIdx)
+  };
+  return new Promise((resolve4) => {
+    let painted = 0;
+    let settled = false;
+    const draw = () => {
+      if (painted > 0) {
+        readline2.moveCursor(output, 0, -painted);
+        readline2.cursorTo(output, 0);
+        readline2.clearScreenDown(output);
+      }
+      const lines = renderSelect(opts.question, choices, state, mode2);
+      output.write(lines.join("\n") + "\n");
+      painted = lines.length;
+    };
+    const onKey = (str, key) => {
+      const action = keyToAction(str, key);
+      if (!action) return;
+      const outcome = applyKey(state, action, choices.length, mode2);
+      if (outcome.status === "open") {
+        state = outcome.state;
+        draw();
+        return;
+      }
+      if (outcome.status === "confirmed") {
+        state = { ...state, hint: void 0 };
+        draw();
+        finish(outcome.indices.map((i) => choices[i].id));
+        return;
+      }
+      if (outcome.status === "eof") {
+        finish(null);
+        return;
+      }
+      restore();
+      output.write("\n");
+      process.exit(130);
+    };
+    const restore = () => {
+      input.removeListener("keypress", onKey);
+      try {
+        input.setRawMode(false);
+      } catch {
+      }
+      input.pause();
+    };
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      restore();
+      resolve4(value);
+    };
+    readline2.emitKeypressEvents(input);
+    input.setRawMode(true);
+    input.resume();
+    input.on("keypress", onKey);
+    input.once("end", () => finish(null));
+    draw();
+  });
+}
+
+// src/lib/prompt.ts
 function interactive() {
   return !!process.stdin.isTTY && !!process.stdout.isTTY;
 }
 async function askLine(question, io = {}) {
-  const rl = readline2.createInterface({
+  const rl = readline3.createInterface({
     input: io.input ?? process.stdin,
     output: io.output ?? process.stdout
   });
@@ -24331,6 +25461,8 @@ function printOptions(question, choices) {
 }
 async function promptChoice(question, choices, fallback) {
   if (!interactive()) return fallback;
+  const picked = await runSelect({ question, choices, initial: [fallback], mode: "single" });
+  if (picked !== null) return picked[0] ?? fallback;
   printOptions(question, choices);
   const defaultIdx = choices.findIndex((c) => c.id === fallback);
   const answer = await ask(`  Choose [${defaultIdx + 1}]: `);
@@ -24344,6 +25476,8 @@ async function promptChoice(question, choices, fallback) {
 }
 async function promptMultiSelect(question, choices, fallback) {
   if (!interactive()) return [...fallback];
+  const picked = await runSelect({ question, choices, initial: fallback, mode: "multi" });
+  if (picked !== null) return picked.length > 0 ? picked : [...fallback];
   printOptions(question, choices);
   const defaultLabel = choices.map((c, i) => fallback.includes(c.id) ? String(i + 1) : null).filter(Boolean).join(",");
   const answer = await ask(`  Choose one or more, comma-separated [${defaultLabel}]: `);
@@ -24356,6 +25490,100 @@ async function promptMultiSelect(question, choices, fallback) {
   return parsed.ids;
 }
 
+// src/lib/remote-config.ts
+var import_node_fs50 = require("node:fs");
+var import_promises16 = require("node:fs/promises");
+var import_node_path32 = require("node:path");
+var import_yaml5 = __toESM(require_dist());
+var IGNORE_RIDER = "verityignore";
+async function fetchRemoteSetup(opts) {
+  const standard = await apiRequest({
+    method: "GET",
+    path: "/standards/latest",
+    serviceUrl: opts.serviceUrl,
+    token: opts.token,
+    verbose: opts.verbose
+  });
+  if (!standard.ok) {
+    const missing = /STANDARD_NOT_FOUND|not found|404/i.test(standard.error);
+    return missing ? { status: "none" } : { status: "unavailable", reason: standard.error };
+  }
+  const config = await apiRequest({
+    method: "GET",
+    path: "/analysis-configs",
+    serviceUrl: opts.serviceUrl,
+    token: opts.token,
+    verbose: opts.verbose
+  });
+  return {
+    status: "found",
+    standard: {
+      version: standard.data.version,
+      content: standard.data.content ?? {},
+      createdBy: standard.data.created_by,
+      createdAt: standard.data.created_at
+    },
+    // Absent is normal and not an error: the two are stored independently, and a
+    // project can have a Standard with no analysis config.
+    analysisConfig: config.ok ? config.data.content ?? null : null
+  };
+}
+async function adoptRemoteSetup(found, opts) {
+  const written = [];
+  const notes = [];
+  const content = { ...found.standard.content };
+  const rider = typeof content[IGNORE_RIDER] === "string" ? content[IGNORE_RIDER] : null;
+  delete content[IGNORE_RIDER];
+  await writeOut(STANDARD_FILE, (0, import_yaml5.stringify)(content));
+  written.push(STANDARD_FILE);
+  if (rider !== null) {
+    const localIgnore = projectPath(VERITYIGNORE_FILE);
+    if (!(0, import_node_fs50.existsSync)(localIgnore)) {
+      await writeOut(VERITYIGNORE_FILE, rider);
+      written.push(VERITYIGNORE_FILE);
+    } else {
+      const local = await (0, import_promises16.readFile)(localIgnore, "utf-8").catch(() => null);
+      if (local !== null && local !== rider) {
+        notes.push(`${VERITYIGNORE_FILE} already exists here and differs from the pushed copy \u2014 kept yours.`);
+      }
+    }
+  }
+  if (found.analysisConfig) {
+    await writeOut(CODACY_CONFIG_FILE, JSON.stringify(found.analysisConfig, null, 2) + "\n");
+    written.push(CODACY_CONFIG_FILE);
+  } else {
+    const derived = await deriveConfigForStandard(content);
+    written.push(...derived.written);
+    notes.push(...derived.notes);
+    if (derived.written.length > 0) {
+      notes.push("No analysis config was stored for this repository \u2014 derived one from the adopted Standard.");
+    }
+  }
+  await writeOut(VERITY_MD_FILE, renderVerityMd({
+    content,
+    version: found.standard.version,
+    serviceUrl: opts.serviceUrl,
+    projectId: opts.projectId,
+    origin: { kind: "adopted", createdBy: found.standard.createdBy }
+  }));
+  written.push(VERITY_MD_FILE);
+  return { written, notes };
+}
+async function writeOut(relative2, body) {
+  const target = projectPath(relative2);
+  await (0, import_promises16.mkdir)((0, import_node_path32.dirname)(target), { recursive: true });
+  await (0, import_promises16.writeFile)(target, body);
+}
+function describeRemote(found) {
+  const when = found.standard.createdAt.slice(0, 10);
+  const who = found.standard.createdBy ? ` by ${found.standard.createdBy}` : "";
+  const extras = [];
+  if (found.analysisConfig) extras.push("analysis config");
+  if (typeof found.standard.content[IGNORE_RIDER] === "string") extras.push(".verityignore");
+  const also = extras.length > 0 ? ` \xB7 with ${extras.join(" and ")}` : "";
+  return `version ${found.standard.version}, pushed${who} on ${when}${also}`;
+}
+
 // src/commands/init.ts
 async function confirmExistingLogin(serviceUrl, remote, opts) {
   const existing = await resolveToken(opts.token);
@@ -24414,7 +25642,7 @@ async function runOptionalAuth(resolution, opts = {}) {
   }
   let remote = "";
   try {
-    remote = (0, import_node_child_process14.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    remote = (0, import_node_child_process16.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
   }
   if (!healed) {
@@ -24458,17 +25686,17 @@ async function runOptionalAuth(resolution, opts = {}) {
     localOnlyNote();
   }
 }
-function resolveDataDir() {
+function resolveDataDir2() {
   const candidates = [
-    (0, import_node_path29.join)(__dirname, "..", "data"),
+    (0, import_node_path33.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path29.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path33.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path29.join)(process.cwd(), "cli", "data")
+    (0, import_node_path33.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates) {
-    if ((0, import_node_fs46.existsSync)((0, import_node_path29.join)(candidate, "skills"))) {
+    if ((0, import_node_fs51.existsSync)((0, import_node_path33.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -24477,28 +25705,28 @@ function resolveDataDir() {
   );
 }
 async function copyDir(src, dest) {
-  await (0, import_promises14.mkdir)(dest, { recursive: true });
-  await (0, import_promises14.cp)(src, dest, { recursive: true, force: true });
+  await (0, import_promises17.mkdir)(dest, { recursive: true });
+  await (0, import_promises17.cp)(src, dest, { recursive: true, force: true });
 }
 async function skillIsCurrent(src, dest) {
   const list2 = (dir) => {
     const out = [];
-    const walk = (d, prefix) => {
-      for (const e of (0, import_node_fs46.readdirSync)(d, { withFileTypes: true })) {
+    const walk2 = (d, prefix) => {
+      for (const e of (0, import_node_fs51.readdirSync)(d, { withFileTypes: true })) {
         const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk((0, import_node_path29.join)(d, e.name), rel);
+        if (e.isDirectory()) walk2((0, import_node_path33.join)(d, e.name), rel);
         else if (e.isFile()) out.push(rel);
       }
     };
-    walk(dir, "");
+    walk2(dir, "");
     return out.sort();
   };
   try {
     const shipped = list2(src);
     if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
     for (const rel of shipped) {
-      const a = await (0, import_promises14.readFile)((0, import_node_path29.join)(src, rel), "utf-8");
-      const b = await (0, import_promises14.readFile)((0, import_node_path29.join)(dest, rel), "utf-8");
+      const a = await (0, import_promises17.readFile)((0, import_node_path33.join)(src, rel), "utf-8");
+      const b = await (0, import_promises17.readFile)((0, import_node_path33.join)(dest, rel), "utf-8");
       if (a !== b) return false;
     }
     return true;
@@ -24527,9 +25755,17 @@ var MOMENT_CHOICES = [
   { id: "pre-push", label: "Before push / PR", hint: "reviews the to-be-pushed commits, blocks on FAIL" }
 ];
 var DEFAULT_MOMENTS = ["stop"];
+async function momentsFromInstalledHooks() {
+  const status = await checkAllVerityHooks();
+  const wired = [];
+  if (status.stop) wired.push("stop");
+  if (status.guardOn.includes("commit")) wired.push("pre-commit");
+  if (status.guardOn.includes("push")) wired.push("pre-push");
+  return wired.length > 0 ? wired : DEFAULT_MOMENTS;
+}
 async function askSetupQuestions(defaultsOnly, previous) {
   const intensityDefault = previous?.intensity ?? "balanced";
-  const momentsDefault = previous?.moments?.length ? previous.moments : DEFAULT_MOMENTS;
+  const momentsDefault = previous?.moments?.length ? previous.moments : await momentsFromInstalledHooks();
   if (defaultsOnly) {
     return { intensity: intensityDefault, moments: momentsDefault, telemetry: "not-asked" };
   }
@@ -24566,6 +25802,127 @@ function insideClaudeCode() {
 function resumeDeferredPending(previous) {
   return previous?.telemetry === "deferred";
 }
+async function maybeAdoptRemoteSetup(opts) {
+  if (!opts.adopt) {
+    printInfo("  Skipped (--no-adopt) \u2014 the setup below runs from this codebase.");
+    return false;
+  }
+  const token = await resolveToken(opts.globals.token);
+  const url = await resolveServiceUrl(opts.globals.serviceUrl);
+  if (!token.ok || !url.ok) {
+    printInfo("  Not signed in, so there is nothing to fetch \u2014 the setup below runs from your codebase.");
+    return false;
+  }
+  const found = await fetchRemoteSetup({
+    token: token.data.token,
+    serviceUrl: url.data,
+    verbose: opts.globals.verbose
+  });
+  if (found.status === "unavailable") {
+    printWarn(`  Could not ask the service (${found.reason}) \u2014 continuing with the regular setup.`);
+    return false;
+  }
+  if (found.status === "none") {
+    printInfo("  No Standard stored for this repository yet \u2014 this setup will create the first one.");
+    return false;
+  }
+  if (opts.previous?.declinedStandardVersion === found.standard.version) {
+    printInfo(`  Standard v${found.standard.version} is available; you declined this version before \u2014 not asking again.`);
+    printInfo("    A newer version will be offered. To take it now: verity standard get, or /verity-setup.");
+    return false;
+  }
+  console.log("");
+  console.log(`  This repository already has a Standard on Verity: ${describeRemote(found)}`);
+  console.log("    Using it keeps you consistent with everyone else on the project.");
+  console.log("    Synthesizing a new one from this codebase would push a competing version.");
+  console.log("");
+  const use = opts.defaultsOnly ? true : await promptYes("  Use the existing Standard? [Y/n] ", { nonInteractive: true });
+  if (!use) {
+    printInfo("  Keeping the existing version untouched; /verity-setup will synthesize a new one.");
+    await writeSetupState({ declinedStandardVersion: found.standard.version }).catch(() => {
+    });
+    return false;
+  }
+  try {
+    const outcome = await adoptRemoteSetup(found, {
+      serviceUrl: url.data,
+      projectId: await projectLabel(token.data.token, url.data, opts.globals.verbose)
+    });
+    for (const path of outcome.written) printInfo(`  ${path} \u2713`);
+    for (const note of outcome.notes) printWarn(`  ${note}`);
+    if (opts.previous?.declinedStandardVersion != null) {
+      await writeSetupState({ declinedStandardVersion: void 0 }).catch(() => {
+      });
+    }
+    return true;
+  } catch (err) {
+    printWarn(`  Could not write the fetched configuration: ${err.message}`);
+    printInfo("  Falling back to the regular setup.");
+    return false;
+  }
+}
+async function projectLabel(token, serviceUrl, verbose) {
+  try {
+    const who = await whoami(token, serviceUrl, verbose);
+    return who.ok ? who.data.project_id : null;
+  } catch {
+    return null;
+  }
+}
+async function synthesizeLocally(opts) {
+  printInfo("  Building a Standard from your codebase\u2026");
+  try {
+    const url = await resolveServiceUrl(opts.globals.serviceUrl);
+    const result = await runSynthesis({
+      intensity: opts.intensity,
+      serviceUrl: url.ok ? url.data : void 0
+    });
+    if ("refused" in result) {
+      printWarn(`  ${result.refused}`);
+      return false;
+    }
+    printInfo(`  ${describeDetected(result.detected)}`);
+    for (const path of result.written) printInfo(`  ${path} \u2713`);
+    for (const note of result.notes) printWarn(`  ${note}`);
+    const pushed = await pushStandardAndConfig(opts.globals);
+    for (const line of pushed.lines) printInfo(`  ${line}`);
+    if (pushed.standardVersion !== null) {
+      await correctVerityMdVersion({
+        standard: result.standard,
+        version: pushed.standardVersion,
+        tools: result.tools,
+        serviceUrl: url.ok ? url.data : void 0
+      });
+    }
+    return true;
+  } catch (err) {
+    printWarn(`  Could not derive a Standard: ${err.message}`);
+    printInfo("  Run /verity-setup in Claude Code to synthesize one instead.");
+    return false;
+  }
+}
+async function healStaleAnalysisConfig(globals) {
+  const configPath = projectPath(CODACY_CONFIG_FILE);
+  const standardPath = projectPath(STANDARD_FILE);
+  if (!(0, import_node_fs51.existsSync)(configPath) || !(0, import_node_fs51.existsSync)(standardPath)) return;
+  const validation = validatePatternIds();
+  if (validation.status !== "invalid") return;
+  printWarn("  Your analysis config names pattern ids that no longer resolve \u2014 those tools were");
+  printWarn("  running silently with nothing enabled. Re-deriving it from your Standard\u2026");
+  try {
+    const content = (0, import_yaml6.parse)(await (0, import_promises17.readFile)(standardPath, "utf-8"));
+    const derived = await deriveConfigForStandard(content);
+    for (const path of derived.written) printInfo(`  ${path} \u2713 (re-derived)`);
+    for (const note of derived.notes) printWarn(`  ${note}`);
+    if (derived.written.length > 0) {
+      const pushed = await pushStandardAndConfig(globals, { standard: false });
+      for (const line of pushed.lines) printInfo(`  ${line}`);
+    }
+  } catch (err) {
+    printWarn(`  Could not re-derive it: ${err.message}`);
+    printInfo("  Fix it with: verity standard synthesize --config-only");
+  }
+}
 var PHASE_TWO_ARTIFACTS = [
   {
     path: ".verity/standard.yaml",
@@ -24634,7 +25991,7 @@ async function handoffToSetup(enabled, claudeInstalled) {
   console.log("  Usually a minute or two. Quit any time \u2014 re-running /verity-setup resumes.");
   console.log("");
   const startedAt = Date.now();
-  const run2 = (0, import_node_child_process14.spawnSync)("claude", ["/verity-setup"], { stdio: "inherit" });
+  const run2 = (0, import_node_child_process16.spawnSync)("claude", ["/verity-setup"], { stdio: "inherit" });
   if (run2.error) {
     printWarn(`Could not start Claude Code: ${run2.error.message}`);
     return instruct("start it yourself and run the skill there");
@@ -24643,18 +26000,18 @@ async function handoffToSetup(enabled, claudeInstalled) {
 }
 async function installSkills(force, step) {
   step("Installing skills");
-  const dataDir = resolveDataDir();
-  const skillsSource = (0, import_node_path29.join)(dataDir, "skills");
+  const dataDir = resolveDataDir2();
+  const skillsSource = (0, import_node_path33.join)(dataDir, "skills");
   const skillsDest = ".claude/skills";
   let skillsInstalled = 0;
   for (const skill of SKILLS) {
-    const src = (0, import_node_path29.join)(skillsSource, skill);
-    const dest = (0, import_node_path29.join)(skillsDest, skill);
-    if (!(0, import_node_fs46.existsSync)(src)) {
+    const src = (0, import_node_path33.join)(skillsSource, skill);
+    const dest = (0, import_node_path33.join)(skillsDest, skill);
+    if (!(0, import_node_fs51.existsSync)(src)) {
       printWarn(`  Skill data not found: ${skill}`);
       continue;
     }
-    if ((0, import_node_fs46.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) {
+    if ((0, import_node_fs51.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) {
       skillsInstalled++;
       continue;
     }
@@ -24713,7 +26070,7 @@ async function checkPrerequisites(step) {
 }
 async function scaffoldProject(step, defaultsOnly) {
   step("Knowledge base, .gitignore and CLAUDE.md");
-  await (0, import_promises14.mkdir)(VERITY_DIR, { recursive: true });
+  await (0, import_promises17.mkdir)(VERITY_DIR, { recursive: true });
   await ensureMemoryDir();
   const ignoreResult = ensureVerityGitignore();
   if (ignoreResult === "failed") {
@@ -24752,13 +26109,14 @@ function registerInitCommand(program2) {
   program2.command("init").alias("setup").description("Set up Verity in the current project (asks the setup questions, then hands off to /verity-setup)").option("--force", "Reinstall the skills even when they are already up to date (hooks are always reconciled)").option("-y, --yes", "Take the recommended answer for every question (no prompts)").option("--no-setup", "Skip the /verity-setup handoff at the end").option(
     "--plugin-mode",
     "The Claude Code plugin owns the skills and hooks: install neither, and remove any this project already has"
-  ).action(async (opts) => {
+  ).option("--no-adopt", "Don't offer this repository's existing Standard from the service; synthesize a new one").action(async (opts) => {
     const force = opts.force ?? false;
     const wantsHandoff = opts.setup !== false;
+    const wantsAdopt = opts.adopt !== false;
     const defaultsOnly = (opts.yes ?? false) || !interactive();
     const pluginMode = opts.pluginMode ?? pluginActiveHere();
     const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-    const isProject = projectMarkers.some((m) => (0, import_node_fs46.existsSync)(m));
+    const isProject = projectMarkers.some((m) => (0, import_node_fs51.existsSync)(m));
     if (!isProject) {
       printError("No project detected in the current directory.");
       printInfo('Run "verity init" from your project root.');
@@ -24773,7 +26131,7 @@ function registerInitCommand(program2) {
     } else {
       printPhase(1, 2, "this machine", "prerequisites \xB7 skills \xB7 hooks \xB7 sign-in");
     }
-    const TOTAL_STEPS = 8;
+    const TOTAL_STEPS = 9;
     let stepNo = 0;
     const step = (label2) => {
       stepNo++;
@@ -24804,8 +26162,8 @@ function registerInitCommand(program2) {
       printInfo(`  intensity: ${intensity} \xB7 moments: ${moments.join(", ") || "none"} (no questions asked)`);
     }
     await scaffoldProject(step, defaultsOnly);
-    const globalVerityDir = (0, import_node_path29.join)(process.env.HOME ?? "", ".verity");
-    await (0, import_promises14.mkdir)(globalVerityDir, { recursive: true });
+    const globalVerityDir = (0, import_node_path33.join)(process.env.HOME ?? "", ".verity");
+    await (0, import_promises17.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     step("Wiring Claude Code hooks");
     const gitMoments = [
@@ -24857,6 +26215,27 @@ function registerInitCommand(program2) {
         printWarn('Telemetry needs a Verity token \u2014 run "verity login", then "verity telemetry install".');
       }
     }
+    step("Your project's Standard");
+    let haveStandard = false;
+    if ((0, import_node_fs51.existsSync)(projectPath(STANDARD_FILE))) {
+      printInfo("  This project already has .verity/standard.yaml \u2014 keeping it.");
+      haveStandard = true;
+    } else {
+      haveStandard = await maybeAdoptRemoteSetup({
+        globals: program2.opts(),
+        defaultsOnly,
+        previous,
+        adopt: wantsAdopt
+      });
+    }
+    if (!haveStandard) {
+      haveStandard = await synthesizeLocally({
+        globals: program2.opts(),
+        intensity
+      });
+    } else {
+      await healStaleAnalysisConfig(program2.opts());
+    }
     step("Recording your answers");
     try {
       await writeSetupState({
@@ -24865,7 +26244,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.31.4" : "dev"
+          cli_version: true ? "0.32.0-experimental.68ae2ee" : "dev"
         }
       });
     } catch (err) {
@@ -24882,19 +26261,30 @@ function registerInitCommand(program2) {
       console.log("    .claude/settings.json          hooks, reconciled to your chosen moments");
     }
     console.log("    .verity/memory/                knowledge base (commit to git)");
+    console.log("    .verity/standard.yaml          the Standard the gate enforces");
+    console.log("    .codacy/codacy.config.json     static-analysis patterns (validated)");
+    console.log("    VERITY.md                      project quality overview");
     console.log("    .verity/setup.json             your answers, read by /verity-setup");
     console.log("    .gitignore                     Verity block (whitelist form)");
     console.log("    CLAUDE.md                      memory pointer, waive policy, reflection");
     console.log("");
     console.log(`  Intensity: ${intensity}    Moments: ${moments.join(", ") || "none"}`);
-    await handoffToSetup(wantsHandoff, claudeInstalled);
+    console.log("");
+    if (haveStandard) {
+      printInfo("Setup complete \u2014 the gate is live on your next Claude Code session.");
+      printInfo('  Add project-specific rules any time: edit .verity/standard.yaml, then "verity standard push".');
+      printInfo("  Or have a model propose them: /verity-setup --force in Claude Code.");
+    } else {
+      printWarn("No Standard for this project yet \u2014 the gate cannot review until there is one.");
+      await handoffToSetup(wantsHandoff, claudeInstalled);
+    }
     console.log("");
   });
 }
 
 // src/commands/uninstall.ts
-var import_node_fs47 = require("node:fs");
-var import_node_path30 = require("node:path");
+var import_node_fs52 = require("node:fs");
+var import_node_path34 = require("node:path");
 var SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -24913,11 +26303,11 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name of SKILL_NAMES) {
-      const dir = (0, import_node_path30.join)(skillsRoot, name);
-      if ((0, import_node_fs47.existsSync)(dir)) {
+      const dir = (0, import_node_path34.join)(skillsRoot, name);
+      if ((0, import_node_fs52.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name}/`,
-          apply: () => (0, import_node_fs47.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs52.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -24931,24 +26321,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs47.existsSync)(verityDir)) {
+    if ((0, import_node_fs52.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs47.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs52.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs47.existsSync)(verityMd)) {
+      if ((0, import_node_fs52.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs47.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs52.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs47.existsSync)(path) && (0, import_node_fs47.statSync)(path).isDirectory() && (0, import_node_fs47.readdirSync)(path).length === 0) {
-        (0, import_node_fs47.rmdirSync)(path);
+      if ((0, import_node_fs52.existsSync)(path) && (0, import_node_fs52.statSync)(path).isDirectory() && (0, import_node_fs52.readdirSync)(path).length === 0) {
+        (0, import_node_fs52.rmdirSync)(path);
       }
     };
     actions.push({
@@ -24959,11 +26349,11 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path30.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs47.existsSync)(globalVerityDir)) {
+    const globalVerityDir = (0, import_node_path34.join)(home, ".verity");
+    if (purgeGlobal && (0, import_node_fs52.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs47.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs52.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -25157,8 +26547,8 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs48 = require("node:fs");
-var import_node_path31 = require("node:path");
+var import_node_fs53 = require("node:fs");
+var import_node_path35 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -25195,11 +26585,11 @@ function registerResetCommand(program2) {
     }
     const cacheDir = projectPath(CACHE_DIR);
     let purged = 0;
-    if ((0, import_node_fs48.existsSync)(cacheDir)) {
-      for (const entry of (0, import_node_fs48.readdirSync)(cacheDir)) {
+    if ((0, import_node_fs53.existsSync)(cacheDir)) {
+      for (const entry of (0, import_node_fs53.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs48.unlinkSync)((0, import_node_path31.join)(cacheDir, entry));
+            (0, import_node_fs53.unlinkSync)((0, import_node_path35.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -25214,19 +26604,19 @@ function registerResetCommand(program2) {
       projectPath(`${VERITY_DIR}/.last-analysis`)
     ];
     for (const file of filesToClear) {
-      if ((0, import_node_fs48.existsSync)(file)) {
+      if ((0, import_node_fs53.existsSync)(file)) {
         try {
-          (0, import_node_fs48.writeFileSync)(file, "");
+          (0, import_node_fs53.writeFileSync)(file, "");
         } catch {
         }
       }
     }
     if (opts.all) {
       const logsDir = projectPath(`${VERITY_DIR}/.logs`);
-      if ((0, import_node_fs48.existsSync)(logsDir)) {
-        for (const entry of (0, import_node_fs48.readdirSync)(logsDir)) {
+      if ((0, import_node_fs53.existsSync)(logsDir)) {
+        for (const entry of (0, import_node_fs53.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs48.unlinkSync)((0, import_node_path31.join)(logsDir, entry));
+            (0, import_node_fs53.unlinkSync)((0, import_node_path35.join)(logsDir, entry));
           } catch {
           }
         }
@@ -25534,8 +26924,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.31.4").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.31.4");
+program.name("verity").description("CLI for Verity quality gate service").version("0.32.0-experimental.68ae2ee").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.32.0-experimental.68ae2ee");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();