@codacy/verity-cli 0.34.1-experimental.89100b5 → 0.34.1-experimental.c910405

package/bin/verity.js

@@ -13782,9 +13782,9 @@ ${JSON.stringify(symbolNames, null, 2)}`);
       PatternStructure: 5
     };
     var QueryError = class _QueryError extends Error {
-      constructor(kind, info2, index, length) {
-        super(_QueryError.formatMessage(kind, info2));
-        this.kind = kind;
+      constructor(kind2, info2, index, length) {
+        super(_QueryError.formatMessage(kind2, info2));
+        this.kind = kind2;
         this.info = info2;
         this.index = index;
         this.length = length;
@@ -13798,8 +13798,8 @@ ${JSON.stringify(symbolNames, null, 2)}`);
         __name(this, "QueryError");
       }
       /** Formats an error message based on the error kind and info */
-      static formatMessage(kind, info2) {
-        switch (kind) {
+      static formatMessage(kind2, info2) {
+        switch (kind2) {
           case QueryErrorKind.NodeName:
             return `Bad node name '${info2.word}'`;
           case QueryErrorKind.FieldName:
@@ -16278,8 +16278,8 @@ async function reportLoginOutcome(out2, opts = {}) {
       printWarn("  repository will report that account. Remove its line from ~/.verity/credentials");
       printWarn("  only if you want this repository on the login you just completed.");
     } else {
-      const kind = rec.userId != null ? "superseded per-repository" : "anonymous project-specific";
-      printWarn(`  Note: this repository has a ${kind} credential that takes`);
+      const kind2 = rec.userId != null ? "superseded per-repository" : "anonymous project-specific";
+      printWarn(`  Note: this repository has a ${kind2} credential that takes`);
       printWarn("  precedence here. Remove its line from ~/.verity/credentials to use your login.");
       printWarn('  Until then, "verity login" in this repository re-runs the full GitHub flow');
       printWarn("  every time.");
@@ -16851,6 +16851,7 @@ var VERITY_SESSION_END_HOOK = {
   command: "verity session end"
 };
 var GUARD_TIMEOUT = 300;
+var GUARD_TIMEOUT_MS = GUARD_TIMEOUT * 1e3;
 function buildGuardHook(on) {
   return {
     type: "command",
@@ -17606,9 +17607,9 @@ function pointsAtVerity(src) {
 }
 function describeSource(src) {
   if (!src || typeof src !== "object") return "an unrecognised source";
-  const kind = typeof src.source === "string" ? src.source : "unknown";
+  const kind2 = typeof src.source === "string" ? src.source : "unknown";
   const target = typeof src.repo === "string" && src.repo || typeof src.url === "string" && src.url || typeof src.path === "string" && src.path || "";
-  return target ? `${kind} \u2192 ${target}` : kind;
+  return target ? `${kind2} \u2192 ${target}` : kind2;
 }
 function legacyMarketplaceInstall() {
   const plugins = readJsonFile((0, import_node_path11.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
@@ -18532,8 +18533,8 @@ function slugify(s) {
   return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 60);
 }
 function orgNodePath(node) {
-  const kind = ORG_KINDS.includes(node.kind) ? node.kind : "domain";
-  return `${kind}/${slugify(node.title) || "claim"}-${node.tag_id.replace(/-/g, "").slice(0, 8)}.md`;
+  const kind2 = ORG_KINDS.includes(node.kind) ? node.kind : "domain";
+  return `${kind2}/${slugify(node.title) || "claim"}-${node.tag_id.replace(/-/g, "").slice(0, 8)}.md`;
 }
 function renderOrgNode(node, orgName) {
   const fm = [
@@ -18622,10 +18623,10 @@ function renderIndex(orgName, nodes) {
   ];
   const byKind = /* @__PURE__ */ new Map();
   for (const n of nodes) byKind.set(n.kind, [...byKind.get(n.kind) ?? [], n]);
-  for (const kind of ORG_KINDS) {
-    const list2 = byKind.get(kind);
+  for (const kind2 of ORG_KINDS) {
+    const list2 = byKind.get(kind2);
     if (!list2?.length) continue;
-    lines.push(`## ${kind}/ (${list2.length})`);
+    lines.push(`## ${kind2}/ (${list2.length})`);
     for (const n of list2) lines.push(`- [[${orgNodePath(n).split("/")[1].replace(/\.md$/, "")}]] \u2014 ${n.title} \xB7 ${n.origin}`);
     lines.push("");
   }
@@ -18684,8 +18685,8 @@ async function readOrgMirror(remote = requestRemote()) {
   const dir = orgMirrorDir(remote);
   if (!dir || !(0, import_node_fs14.existsSync)(dir)) return [];
   const out2 = [];
-  for (const kind of ORG_KINDS) {
-    const kindDir = (0, import_node_path14.join)(dir, kind);
+  for (const kind2 of ORG_KINDS) {
+    const kindDir = (0, import_node_path14.join)(dir, kind2);
     if (!(0, import_node_fs14.existsSync)(kindDir)) continue;
     let files;
     try {
@@ -18953,16 +18954,16 @@ function relevance(node, ctx) {
   return { score, via: { glob: globHit, tag: tagScore, text: textScore } };
 }
 var KIND_POOL_STRENGTH = 20;
-function priorFor(kind, pooled) {
-  const base = KIND_PRIOR_MEAN[kind] ?? DEFAULT_PRIOR_MEAN;
+function priorFor(kind2, pooled) {
+  const base = KIND_PRIOR_MEAN[kind2] ?? DEFAULT_PRIOR_MEAN;
   const a = pooled ? Math.max(0, pooled.alpha) : 0;
   const b = pooled ? Math.max(0, pooled.beta) : 0;
-  const mean = pooled && kind !== "integration" ? (KIND_POOL_STRENGTH * base + a) / (KIND_POOL_STRENGTH + a + b) : base;
+  const mean = pooled && kind2 !== "integration" ? (KIND_POOL_STRENGTH * base + a) / (KIND_POOL_STRENGTH + a + b) : base;
   return { alpha: mean * PRIOR_STRENGTH, beta: (1 - mean) * PRIOR_STRENGTH };
 }
-function posteriorFor(kind, own, pooled) {
-  const p = priorFor(kind, pooled);
-  if (!own || kind === "integration") return p;
+function posteriorFor(kind2, own, pooled) {
+  const p = priorFor(kind2, pooled);
+  if (!own || kind2 === "integration") return p;
   return { alpha: p.alpha + Math.max(0, own.alpha), beta: p.beta + Math.max(0, own.beta) };
 }
 function posteriorMean(p) {
@@ -20002,7 +20003,7 @@ async function regenerateIndex() {
         try {
           const content = await (0, import_promises9.readFile)((0, import_node_path19.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
-          const kind = pickFrontmatter(content, "kind") ?? "-";
+          const kind2 = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
           const globs = pickFrontmatterArray(content, "file_globs");
           const status = pickFrontmatter(content, "status") ?? "active";
@@ -20010,7 +20011,7 @@ async function regenerateIndex() {
           const globPart = globs.length > 0 ? ` \xB7 scope: \`${globs.slice(0, 3).join("`, `")}\`` : "";
           const statusPart = status !== "active" ? ` \xB7 *${status}*` : "";
           lines.push(`- [[${slug}]] \u2014 **${title}**`);
-          lines.push(`  *${kind}*${confPart}${globPart}${statusPart}`);
+          lines.push(`  *${kind2}*${confPart}${globPart}${statusPart}`);
         } catch {
           lines.push(`- [[${slug}]]`);
         }
@@ -22053,8 +22054,8 @@ function toRegister(severity) {
       return "NOTE";
   }
 }
-function recordMark(d, kind, from, to) {
-  appendEvent(d, { k: "mark", kind, from: from ?? null, to: to ?? null });
+function recordMark(d, kind2, from, to) {
+  appendEvent(d, { k: "mark", kind: kind2, from: from ?? null, to: to ?? null });
 }
 function recordCapabilities(d, c, known) {
   const put = (field, value, tier) => {
@@ -27257,7 +27258,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.34.1-experimental.89100b5" : "dev";
+    return true ? "0.34.1-experimental.c910405" : "dev";
   } catch {
     return "dev";
   }
@@ -27497,10 +27498,10 @@ var EMPTY_RESULT = {
   findings: [],
   summary: { total_findings: 0, by_severity: {}, tools_run: [] }
 };
-function withFailure(kind, detail) {
+function withFailure(kind2, detail) {
   return {
     ...EMPTY_RESULT,
-    summary: { ...EMPTY_RESULT.summary, failure: { kind, detail: detail.slice(0, 300) } }
+    summary: { ...EMPTY_RESULT.summary, failure: { kind: kind2, detail: detail.slice(0, 300) } }
   };
 }
 function runCodacyAnalysisIfAvailable(files) {
@@ -28259,11 +28260,11 @@ var rootCandidateCache = /* @__PURE__ */ new Map();
 function candidateRoots(repoRoot2) {
   const cached2 = rootCandidateCache.get(repoRoot2);
   if (cached2) return cached2;
-  const norm2 = repoRoot2.replace(/\\/g, "/").replace(/\/+$/, "");
-  const out2 = [norm2];
+  const norm3 = repoRoot2.replace(/\\/g, "/").replace(/\/+$/, "");
+  const out2 = [norm3];
   try {
-    const real = import_node_fs44.realpathSync.native(norm2).replace(/\\/g, "/").replace(/\/+$/, "");
-    if (real !== norm2) out2.push(real);
+    const real = import_node_fs44.realpathSync.native(norm3).replace(/\\/g, "/").replace(/\/+$/, "");
+    if (real !== norm3) out2.push(real);
   } catch {
   }
   for (const r of [...out2]) {
@@ -29114,39 +29115,39 @@ function extentOf(node) {
 }
 function definitionsIn(root, spec) {
   const out2 = [];
-  const add = (name2, kind, extent, fn, owner, last = extent) => {
+  const add = (name2, kind2, extent, fn, owner, last = extent) => {
     const q = qualifierOf(owner, spec);
-    out2.push({ name: name2, qualified: q ? `${q}.${name2}` : name2, kind, extent, last, fn });
+    out2.push({ name: name2, qualified: q ? `${q}.${name2}` : name2, kind: kind2, extent, last, fn });
   };
   const visit = (n) => {
-    const kind = spec.definitions[n.type];
-    if (kind && n.childForFieldName("body")) {
+    const kind2 = spec.definitions[n.type];
+    if (kind2 && n.childForFieldName("body")) {
       const nameNode = n.childForFieldName("name");
       if (nameNode && nameNode.type !== "computed_property_name") {
         const inClass = qualifierOf(n, spec) !== null;
-        const k = spec.id === "python" ? inClass ? "method" : "function" : kind;
+        const k = spec.id === "python" ? inClass ? "method" : "function" : kind2;
         add(nameNode.text, k, extentOf(n), n, n, n.parent?.type === "decorated_definition" ? n.parent : n);
       }
     } else if (spec.functionValues.has(n.type) && n.parent) {
       const p = n.parent;
-      const kind2 = n.type === "arrow_function" ? "arrow" : n.type === "lambda" || n.type === "lambda_expression" ? "lambda" : "function";
+      const kind3 = n.type === "arrow_function" ? "arrow" : n.type === "lambda" || n.type === "lambda_expression" ? "lambda" : "function";
       const bound = p.childForFieldName("value")?.id === n.id;
       if (bound && p.type === "variable_declarator" && p.childForFieldName("name")?.type === "identifier") {
         const decl = p.parent && p.parent.namedChildren.filter((c) => c.type === "variable_declarator").length === 1 ? p.parent : p;
-        add(p.childForFieldName("name").text, kind2, decl, n, p);
+        add(p.childForFieldName("name").text, kind3, decl, n, p);
       } else if (bound && (p.type === "public_field_definition" || p.type === "field_definition")) {
         const nameNode = p.childForFieldName("name") ?? p.childForFieldName("property");
-        if (nameNode && nameNode.type !== "computed_property_name") add(nameNode.text, kind2, extentOf(p), n, p, p);
+        if (nameNode && nameNode.type !== "computed_property_name") add(nameNode.text, kind3, extentOf(p), n, p, p);
       } else if (bound && p.type === "pair") {
         const key = p.childForFieldName("key");
-        if (key && (key.type === "property_identifier" || key.type === "identifier")) add(key.text, kind2, p, n, p);
+        if (key && (key.type === "property_identifier" || key.type === "identifier")) add(key.text, kind3, p, n, p);
       } else if (p.type === "arguments" && moduleCall(p.parent)) {
         const call = p.parent;
         const route = p.namedChildren[0];
         const quoted = route && route.id !== n.id && route.type === "string" ? unquote2(route.text) : null;
         const path = quoted && /^[\w/:.{}*-]{1,60}$/.test(quoted) ? quoted : null;
         const callee = call.childForFieldName("function").text;
-        add(path ? `${callee} ${path}` : callee, kind2, call.parent, n, call);
+        add(path ? `${callee} ${path}` : callee, kind3, call.parent, n, call);
       }
     }
     for (const c of n.namedChildren) visit(c);
@@ -29423,15 +29424,15 @@ var STABLE_EXPRESSION = (t) => {
   const root = t.split(".")[0];
   return root === "this" || root === "self" || /^[A-Z]/.test(root);
 };
-function argResource(kind, arg) {
-  if (!arg) return { kind, name: null, confidence: "unknown" };
+function argResource(kind2, arg) {
+  if (!arg) return { kind: kind2, name: null, confidence: "unknown" };
   if (arg.literal !== null) {
     const n = literalName(arg.literal);
-    return n ? { kind, name: n.name, confidence: n.confidence } : { kind, name: null, confidence: "unknown" };
+    return n ? { kind: kind2, name: n.name, confidence: n.confidence } : { kind: kind2, name: null, confidence: "unknown" };
   }
-  if (SIMPLE_EXPRESSION.test(arg.text) && STABLE_EXPRESSION(arg.text)) return { kind, name: arg.text, confidence: "expression" };
+  if (SIMPLE_EXPRESSION.test(arg.text) && STABLE_EXPRESSION(arg.text)) return { kind: kind2, name: arg.text, confidence: "expression" };
   const keyed = keyedCall(arg.text);
-  return keyed ? { kind, name: keyed, confidence: "expression" } : { kind, name: null, confidence: "unknown" };
+  return keyed ? { kind: kind2, name: keyed, confidence: "expression" } : { kind: kind2, name: null, confidence: "unknown" };
 }
 function keyedCall(text) {
   const t = text.trim();
@@ -30940,8 +30941,8 @@ ${m.accessors.map((x) => `  ${x.fn.path}:${x.fn.start.line} ${x.fn.qualified} \u
 var KINDS = ["table", "cache", "file", "http", "queue", "service", "memory"];
 function parseResource(text) {
   const colon = text.indexOf(":");
-  const kind = colon > 0 ? text.slice(0, colon) : "";
-  if (KINDS.includes(kind)) return { kinds: [kind], name: text.slice(colon + 1) };
+  const kind2 = colon > 0 ? text.slice(0, colon) : "";
+  if (KINDS.includes(kind2)) return { kinds: [kind2], name: text.slice(colon + 1) };
   return { kinds: KINDS, name: text };
 }
 var writersOfTool = async (ctx, args2) => {
@@ -33434,12 +33435,41 @@ async function runAnalyze(opts, globals) {
 }
 
 // src/commands/baseline.ts
-var import_node_fs55 = require("node:fs");
-var import_node_path42 = require("node:path");
+var import_node_fs56 = require("node:fs");
+var import_node_path43 = require("node:path");
 
-// src/lib/project-skills.ts
+// src/lib/skew-notice.ts
 var import_node_fs54 = require("node:fs");
 var import_node_path41 = require("node:path");
+var MARKER = ".skew-notice.json";
+function markerPath2() {
+  return (0, import_node_path41.join)(verityHome(), MARKER);
+}
+function today(now) {
+  const y = now.getFullYear();
+  const m = String(now.getMonth() + 1).padStart(2, "0");
+  const d = String(now.getDate()).padStart(2, "0");
+  return `${y}-${m}-${d}`;
+}
+function skewNoticeDue(skew, now = /* @__PURE__ */ new Date()) {
+  try {
+    const seen = JSON.parse((0, import_node_fs54.readFileSync)(markerPath2(), "utf-8"));
+    return !(seen.global === skew.global && seen.hooks === skew.hooks && seen.day === today(now));
+  } catch {
+    return true;
+  }
+}
+function recordSkewNotice(skew, now = /* @__PURE__ */ new Date()) {
+  try {
+    (0, import_node_fs54.mkdirSync)(verityHome(), { recursive: true, mode: 448 });
+    (0, import_node_fs54.writeFileSync)(markerPath2(), JSON.stringify({ global: skew.global, hooks: skew.hooks, day: today(now) }) + "\n");
+  } catch {
+  }
+}
+
+// src/lib/project-skills.ts
+var import_node_fs55 = require("node:fs");
+var import_node_path42 = require("node:path");
 var PROJECT_SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -33465,14 +33495,14 @@ var LEGACY_SKILL_NAMES = [
 var ALL = [...PROJECT_SKILL_NAMES, ...LEGACY_SKILL_NAMES];
 function staleProjectSkills() {
   const root = projectPath(".claude/skills");
-  if (!(0, import_node_fs54.existsSync)(root)) return [];
-  return ALL.filter((name2) => (0, import_node_fs54.existsSync)((0, import_node_path41.join)(root, name2)));
+  if (!(0, import_node_fs55.existsSync)(root)) return [];
+  return ALL.filter((name2) => (0, import_node_fs55.existsSync)((0, import_node_path42.join)(root, name2)));
 }
 function removeProjectSkills() {
   const root = projectPath(".claude/skills");
   const removed = [];
   for (const name2 of staleProjectSkills()) {
-    (0, import_node_fs54.rmSync)((0, import_node_path41.join)(root, name2), { recursive: true, force: true });
+    (0, import_node_fs55.rmSync)((0, import_node_path42.join)(root, name2), { recursive: true, force: true });
     removed.push(name2);
   }
   return removed;
@@ -33502,10 +33532,12 @@ function registerBaselineCommands(program2) {
       const skew = cliVersionSkew();
       const why = skew ? `the \`verity\` on PATH is ${skew.global} but the hooks run ${skew.hooks}, so it is not the CLI they use` : verityOnPath() ? "the `verity` on PATH is a separate install whose version could not be read" : "this machine has no `verity` on PATH \u2014 the plugin carries its own copy";
       const cliLine = cli ? `Verity CLI: ${why}. When a Verity skill tells you to run \`verity <args>\`, run \`${cli} <args>\` instead. Everything else about the command is identical.` : null;
-      const skewMsg = skew ? `Verity: your global \`verity\` CLI is ${skew.global} but the hooks run ${skew.hooks}. Fix it before using \`verity\` in a terminal: ${skew.remedy}` : null;
-      const skewNote = skew ? `Before anything else, including /verity:init's questions, tell the user their global \`verity\` is ${skew.global}, the hooks run ${skew.hooks}, and \`${skew.remedy}\` fixes it. Until they have, do not send them to run \`verity login\` in a terminal: that runs the global one, which can sign this machine in to a different server.` : null;
+      const skewLoud = !!skew && skewNoticeDue(skew);
+      const skewMsg = skew && skewLoud ? `Verity: your global \`verity\` CLI is ${skew.global} but the hooks run ${skew.hooks}. Fix it before using \`verity\` in a terminal: ${skew.remedy}` : null;
+      const loginWarning = "Until they have, do not send them to run `verity login` in a terminal: that runs the global one, which can sign this machine in to a different server.";
+      const skewNote = !skew ? null : skewLoud ? `Before anything else, including /verity:init's questions, tell the user their global \`verity\` is ${skew.global}, the hooks run ${skew.hooks}, and \`${skew.remedy}\` fixes it. ${loginWarning}` : `The user's global \`verity\` is ${skew.global} and the hooks run ${skew.hooks}; \`${skew.remedy}\` fixes it. They were already told today, so do not repeat it unprompted \u2014 mention it only where it matters, such as before suggesting a \`verity\` command for their terminal. ${loginWarning}`;
       if (!verityConfigured()) {
-        if (isMachineStore((0, import_node_path42.join)(repoRoot(), VERITY_DIR))) process.exit(0);
+        if (isMachineStore((0, import_node_path43.join)(repoRoot(), VERITY_DIR))) process.exit(0);
         const how = isPluginInvocation() ? "Tell the user to run /verity:init \u2014 they type it; you cannot invoke it." : "Tell the user to run `verity init` in their terminal.";
         const lines = [
           `Verity is installed but this project is not set up yet, so the quality gate will not review anything here. ${how}`
@@ -33532,19 +33564,20 @@ function registerBaselineCommands(program2) {
             }
           }) + "\n"
         );
+        if (skew && skewMsg) recordSkewNotice(skew);
         process.exit(0);
       }
       const realStart = source2 === void 0 || source2 === "startup" || source2 === "clear";
       let memoryMsg = null;
       let memoryAgentLine = null;
       const memoryNotice = projectPath(`${VERITY_DIR}/.memory-fence-notice`);
-      if (realStart && !(0, import_node_fs55.existsSync)(memoryNotice)) {
+      if (realStart && !(0, import_node_fs56.existsSync)(memoryNotice)) {
         const trackedGraph = memoryOptOut() ? 0 : committedMemoryFiles().length;
         if (trackedGraph > 0) {
           memoryMsg = `Verity: this project commits its knowledge base (${trackedGraph} files under .verity/memory/), so Verity's generated notes show up in every diff and pull request. Run \`verity memory untrack\` to keep them on disk but out of git, or \`verity memory track\` to keep committing them on purpose.`;
           memoryAgentLine = `This project has ${trackedGraph} knowledge-graph files tracked in git under .verity/memory/. As of Verity 0.32.6 the graph is machine-local by default \u2014 it is rebuilt from the service, and committing it puts generated notes in every pull request. If the user wants that stopped, run \`verity memory untrack\` for them: it keeps every file on disk and stages their removal from the index, so they only need to commit \u2014 and their teammates' working copies will vanish on the next pull and re-sync from the service, which is expected. If they would rather keep committing it, \`verity memory track\` records that and nothing will offer again.`;
           try {
-            (0, import_node_fs55.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
+            (0, import_node_fs56.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
           } catch {
           }
         }
@@ -33572,7 +33605,7 @@ function registerBaselineCommands(program2) {
           }
         }
         if (memoryAgentLine) notices.push(memoryAgentLine);
-        if (notices.length > 0) {
+        if (notices.length > 0 || skewMsg) {
           process.stdout.write(
             JSON.stringify({
               ...userMsg || skewMsg || memoryMsg ? { systemMessage: [skewMsg, userMsg, memoryMsg].filter(Boolean).join("\n") } : {},
@@ -33582,6 +33615,7 @@ function registerBaselineCommands(program2) {
               }
             }) + "\n"
           );
+          if (skew && skewMsg) recordSkewNotice(skew);
         }
       } else if (memoryMsg) {
         process.stdout.write(
@@ -33645,7 +33679,7 @@ function hookSource(value) {
 }
 
 // src/commands/review.ts
-var import_node_fs56 = require("node:fs");
+var import_node_fs57 = require("node:fs");
 function registerReviewCommand(program2) {
   program2.command("review").description("Run on-demand Verity analysis (advisory, never blocks)").requiredOption("--files <paths>", "Comma-separated file list").option("--changed <paths>", "Subset of --files that were modified").option("--intent <text>", "User intent description (max 2000 chars); - reads it from stdin, so the words never pass through shell quoting").option("--specs <paths>", "Comma-separated spec file paths").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -33668,7 +33702,7 @@ async function runReview(opts, globals) {
   const changedFiles = opts.changed ? opts.changed.split(",").map((f) => f.trim()).filter(Boolean) : allFiles;
   const analyzable = filterAnalyzable(allFiles);
   const securityFiles = filterSecurity(allFiles);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs56.existsSync)(f) || resolveFile(f) !== null);
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs57.existsSync)(f) || resolveFile(f) !== null);
   const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
@@ -33734,12 +33768,12 @@ async function runReview(opts, globals) {
 }
 
 // src/commands/guard.ts
-var import_node_fs61 = require("node:fs");
-var import_node_path48 = require("node:path");
+var import_node_fs62 = require("node:fs");
+var import_node_path49 = require("node:path");
 
 // src/lib/vendored.ts
-var import_node_fs57 = require("node:fs");
-var import_node_path43 = require("node:path");
+var import_node_fs58 = require("node:fs");
+var import_node_path44 = require("node:path");
 var INSTALLED_SKILL = /^\.claude\/skills\/(verity-[a-z0-9-]+)\/(.+)$/;
 function dataDirOrNull() {
   try {
@@ -33754,7 +33788,7 @@ function shippedSkillFile(path, dataDir = dataDirOrNull()) {
   const [, skill, rel] = m;
   if (rel.split("/").some((seg) => seg === ".." || seg === ".")) return null;
   try {
-    return (0, import_node_fs57.readFileSync)((0, import_node_path43.join)(dataDir, "skills", skill, rel), "utf8");
+    return (0, import_node_fs58.readFileSync)((0, import_node_path44.join)(dataDir, "skills", skill, rel), "utf8");
   } catch {
     return null;
   }
@@ -33864,7 +33898,7 @@ async function runAgentReview(options) {
 }
 
 // src/lib/prove/auto.ts
-var import_node_path47 = require("node:path");
+var import_node_path48 = require("node:path");
 var import_node_crypto19 = require("node:crypto");
 
 // src/lib/prove/signals.ts
@@ -34906,9 +34940,9 @@ function effectSites(numbered2) {
     const t = r.text.trim();
     if (!t || t.startsWith("//") || t.startsWith("#") || t.startsWith("*")) continue;
     const onParam = [...params].some((p) => callsOn(t, p) || callsDirect(t, p));
-    const kind = EFFECT_LINE2.test(t) || onParam ? "effect" : CONTROL_LINE.test(t) ? "control" : null;
-    if (!kind) continue;
-    out2.push(`L${r.n} [${kind}] ${t.length > 160 ? t.slice(0, 157) + "\u2026" : t}`);
+    const kind2 = EFFECT_LINE2.test(t) || onParam ? "effect" : CONTROL_LINE.test(t) ? "control" : null;
+    if (!kind2) continue;
+    out2.push(`L${r.n} [${kind2}] ${t.length > 160 ? t.slice(0, 157) + "\u2026" : t}`);
     if (out2.length >= MAX_EFFECT_SITES) break;
   }
   return out2;
@@ -35591,18 +35625,18 @@ function renderReplay(model, property, r) {
 // src/lib/prove/runner.ts
 var import_node_child_process15 = require("node:child_process");
 var import_node_os8 = require("node:os");
-var import_node_fs60 = require("node:fs");
+var import_node_fs61 = require("node:fs");
 var import_node_os9 = require("node:os");
-var import_node_path46 = require("node:path");
+var import_node_path47 = require("node:path");
 
 // src/lib/prove/scaffold.ts
-var import_node_fs59 = require("node:fs");
-var import_node_path45 = require("node:path");
+var import_node_fs60 = require("node:fs");
+var import_node_path46 = require("node:path");
 
 // src/lib/prove/safe-write.ts
-var import_node_fs58 = require("node:fs");
+var import_node_fs59 = require("node:fs");
 var import_node_crypto15 = require("node:crypto");
-var import_node_path44 = require("node:path");
+var import_node_path45 = require("node:path");
 var SafeWriteError = class extends Error {
   constructor(reason, path) {
     super(`refusing to write ${path}: ${reason}`);
@@ -35611,10 +35645,10 @@ var SafeWriteError = class extends Error {
     this.name = "SafeWriteError";
   }
 };
-var FLAGS3 = import_node_fs58.constants;
+var FLAGS3 = import_node_fs59.constants;
 var NOFOLLOW2 = FLAGS3.O_NOFOLLOW ?? 0;
 function assertPlainRelative(rel) {
-  if (!rel || (0, import_node_path44.isAbsolute)(rel)) throw new SafeWriteError("bad-path", rel);
+  if (!rel || (0, import_node_path45.isAbsolute)(rel)) throw new SafeWriteError("bad-path", rel);
   for (const part of rel.split(/[\\/]/)) {
     if (part === ".." || part === "" || part === ".") throw new SafeWriteError("bad-path", rel);
   }
@@ -35623,34 +35657,34 @@ function ensureDirsNoFollow(root, rel) {
   const parts2 = rel.split(/[\\/]/);
   let cur = root;
   for (const part of parts2.slice(0, -1)) {
-    cur = (0, import_node_path44.join)(cur, part);
+    cur = (0, import_node_path45.join)(cur, part);
     let st;
     try {
-      st = (0, import_node_fs58.lstatSync)(cur);
+      st = (0, import_node_fs59.lstatSync)(cur);
     } catch {
-      (0, import_node_fs58.mkdirSync)(cur);
+      (0, import_node_fs59.mkdirSync)(cur);
       continue;
     }
     if (st.isSymbolicLink()) throw new SafeWriteError("symlink", cur);
     if (!st.isDirectory()) throw new SafeWriteError("not-regular", cur);
   }
-  return (0, import_node_path44.join)(root, rel);
+  return (0, import_node_path45.join)(root, rel);
 }
 function insideRoot(realRoot, realPath) {
-  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path44.sep) ? realRoot : realRoot + import_node_path44.sep);
+  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path45.sep) ? realRoot : realRoot + import_node_path45.sep);
 }
 function removeQuietly(path) {
   try {
-    (0, import_node_fs58.unlinkSync)(path);
+    (0, import_node_fs59.unlinkSync)(path);
   } catch {
   }
 }
 function writeFileInRootNoFollow(root, rel, content) {
   assertPlainRelative(rel);
   const dest = ensureDirsNoFollow(root, rel);
-  const dir = (0, import_node_path44.dirname)(dest);
+  const dir = (0, import_node_path45.dirname)(dest);
   try {
-    const st = (0, import_node_fs58.lstatSync)(dest);
+    const st = (0, import_node_fs59.lstatSync)(dest);
     if (st.isSymbolicLink()) throw new SafeWriteError("symlink", dest);
     if (!st.isFile()) throw new SafeWriteError("not-regular", dest);
   } catch (err2) {
@@ -35658,41 +35692,41 @@ function writeFileInRootNoFollow(root, rel, content) {
   }
   let realRoot;
   try {
-    realRoot = (0, import_node_fs58.realpathSync)(root);
+    realRoot = (0, import_node_fs59.realpathSync)(root);
   } catch {
     throw new SafeWriteError("unwritable", root);
   }
-  const tmp = (0, import_node_path44.join)(dir, `.${(0, import_node_path44.basename)(dest)}.${(0, import_node_crypto15.randomBytes)(6).toString("hex")}.tmp`);
+  const tmp = (0, import_node_path45.join)(dir, `.${(0, import_node_path45.basename)(dest)}.${(0, import_node_crypto15.randomBytes)(6).toString("hex")}.tmp`);
   let fd;
   try {
-    fd = (0, import_node_fs58.openSync)(tmp, import_node_fs58.constants.O_WRONLY | import_node_fs58.constants.O_CREAT | import_node_fs58.constants.O_EXCL | NOFOLLOW2, 420);
+    fd = (0, import_node_fs59.openSync)(tmp, import_node_fs59.constants.O_WRONLY | import_node_fs59.constants.O_CREAT | import_node_fs59.constants.O_EXCL | NOFOLLOW2, 420);
   } catch {
     throw new SafeWriteError("unwritable", tmp);
   }
   try {
-    const opened = (0, import_node_fs58.fstatSync)(fd, { bigint: true });
+    const opened = (0, import_node_fs59.fstatSync)(fd, { bigint: true });
     let realTmp;
     try {
-      realTmp = (0, import_node_fs58.realpathSync)(tmp);
+      realTmp = (0, import_node_fs59.realpathSync)(tmp);
     } catch {
       throw new SafeWriteError("escaped", tmp);
     }
-    const there = (0, import_node_fs58.lstatSync)(realTmp, { bigint: true });
+    const there = (0, import_node_fs59.lstatSync)(realTmp, { bigint: true });
     if (!opened.isFile() || there.ino !== opened.ino || there.dev !== opened.dev || !insideRoot(realRoot, realTmp)) {
       throw new SafeWriteError("escaped", tmp);
     }
     const buf = Buffer.from(content, "utf-8");
     let off = 0;
-    while (off < buf.length) off += (0, import_node_fs58.writeSync)(fd, buf, off, buf.length - off);
+    while (off < buf.length) off += (0, import_node_fs59.writeSync)(fd, buf, off, buf.length - off);
   } catch (err2) {
-    (0, import_node_fs58.closeSync)(fd);
+    (0, import_node_fs59.closeSync)(fd);
     removeQuietly(tmp);
     throw err2 instanceof SafeWriteError ? err2 : new SafeWriteError("unwritable", tmp);
   }
-  (0, import_node_fs58.closeSync)(fd);
+  (0, import_node_fs59.closeSync)(fd);
   try {
-    if (!insideRoot(realRoot, (0, import_node_fs58.realpathSync)(dir)) || (0, import_node_fs58.lstatSync)(dir).isSymbolicLink()) throw new SafeWriteError("escaped", dir);
-    (0, import_node_fs58.renameSync)(tmp, dest);
+    if (!insideRoot(realRoot, (0, import_node_fs59.realpathSync)(dir)) || (0, import_node_fs59.lstatSync)(dir).isSymbolicLink()) throw new SafeWriteError("escaped", dir);
+    (0, import_node_fs59.renameSync)(tmp, dest);
   } catch (err2) {
     removeQuietly(tmp);
     throw err2 instanceof SafeWriteError ? err2 : new SafeWriteError("unwritable", dest);
@@ -35706,9 +35740,9 @@ function pathHasNoLink(root, rel) {
   }
   let cur = root;
   for (const part of rel.split(/[\\/]/)) {
-    cur = cur + import_node_path44.sep + part;
+    cur = cur + import_node_path45.sep + part;
     try {
-      if ((0, import_node_fs58.lstatSync)(cur).isSymbolicLink()) return false;
+      if ((0, import_node_fs59.lstatSync)(cur).isSymbolicLink()) return false;
     } catch {
       return true;
     }
@@ -36018,20 +36052,20 @@ This directory is machine-local and gitignored (see ../.gitignore). Models are
 never committed; what reaches the team is the bug report and the fix.
 `;
 function scaffoldProofs(root) {
-  const proofsDir = (0, import_node_path45.join)(root, PROOFS_DIR);
+  const proofsDir = (0, import_node_path46.join)(root, PROOFS_DIR);
   const written = [];
   const kept = [];
   for (const stray of ["lakefile.lean"]) {
     const rel = `${PROOFS_DIR}/${stray}`;
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path45.join)(root, rel));
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path46.join)(root, rel));
     try {
-      (0, import_node_fs59.rmSync)((0, import_node_path45.join)(root, rel), { force: true });
+      (0, import_node_fs60.rmSync)((0, import_node_path46.join)(root, rel), { force: true });
     } catch {
     }
   }
   for (const f of PROOFS_TEMPLATE_FILES) {
     const rel = `${PROOFS_DIR}/${f.path}`;
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path45.join)(root, rel));
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path46.join)(root, rel));
     const current = readRegularFileInRoot(root, rel, 4 * 1024 * 1024);
     if (current.ok && current.content === f.content) {
       kept.push(rel);
@@ -36044,8 +36078,8 @@ function scaffoldProofs(root) {
     [`${PROOFS_DIR}/.gitignore`, LOCAL_GITIGNORE],
     [`${MODELS_DIR}/README.md`, MODELS_README]
   ]) {
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path45.join)(root, rel));
-    if (existsNoFollow((0, import_node_path45.join)(root, rel))) {
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path46.join)(root, rel));
+    if (existsNoFollow((0, import_node_path46.join)(root, rel))) {
       kept.push(rel);
       continue;
     }
@@ -36056,7 +36090,7 @@ function scaffoldProofs(root) {
 }
 function existsNoFollow(abs) {
   try {
-    (0, import_node_fs59.lstatSync)(abs);
+    (0, import_node_fs60.lstatSync)(abs);
     return true;
   } catch {
     return false;
@@ -36135,12 +36169,12 @@ function parseHeader(obj) {
 function parseProperty(obj) {
   const model = ident(obj.model);
   const id = ident(obj.id);
-  const kind = typeof obj.kind === "string" && KINDS2.has(obj.kind) ? obj.kind : null;
+  const kind2 = typeof obj.kind === "string" && KINDS2.has(obj.kind) ? obj.kind : null;
   const result = typeof obj.result === "string" && RESULTS.has(obj.result) ? obj.result : null;
   const source2 = obj.source === void 0 ? "" : str2(obj.source, LIMITS.text);
   const desc = obj.desc === void 0 ? "" : str2(obj.desc, LIMITS.text);
-  if (!model || !id || !kind || !result || source2 === null || desc === null) return null;
-  const p = { model, id, kind, source: source2, desc, result };
+  if (!model || !id || !kind2 || !result || source2 === null || desc === null) return null;
+  const p = { model, id, kind: kind2, source: source2, desc, result };
   if (obj.bound !== void 0) {
     const n = nat(obj.bound);
     if (n === null) return null;
@@ -36314,17 +36348,17 @@ function renderReport(r) {
 
 // src/lib/prove/runner.ts
 function verityLeanHome(env = process.env) {
-  return env.VERITY_LEAN_HOME ?? (0, import_node_path46.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".verity", "lean");
+  return env.VERITY_LEAN_HOME ?? (0, import_node_path47.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".verity", "lean");
 }
 function findToolchain(env = process.env) {
-  const managedBin = (0, import_node_path46.join)(verityLeanHome(env), LEAN_TOOLCHAIN.replace(/^leanprover\/lean4:/, ""), "bin");
-  const elanBin = (0, import_node_path46.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "bin");
-  const elanHas = (0, import_node_fs60.existsSync)((0, import_node_path46.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "toolchains", LEAN_TOOLCHAIN.replace("/", "--").replace(":", "---")));
-  const userPath = (env.PATH ?? "").split(import_node_path46.delimiter).filter((d) => d && (elanHas || (0, import_node_path46.resolve)(d) !== (0, import_node_path46.resolve)(elanBin)));
-  const path = [managedBin, ...elanHas ? [elanBin] : [], ...userPath].join(import_node_path46.delimiter);
+  const managedBin = (0, import_node_path47.join)(verityLeanHome(env), LEAN_TOOLCHAIN.replace(/^leanprover\/lean4:/, ""), "bin");
+  const elanBin = (0, import_node_path47.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "bin");
+  const elanHas = (0, import_node_fs61.existsSync)((0, import_node_path47.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "toolchains", LEAN_TOOLCHAIN.replace("/", "--").replace(":", "---")));
+  const userPath = (env.PATH ?? "").split(import_node_path47.delimiter).filter((d) => d && (elanHas || (0, import_node_path47.resolve)(d) !== (0, import_node_path47.resolve)(elanBin)));
+  const path = [managedBin, ...elanHas ? [elanBin] : [], ...userPath].join(import_node_path47.delimiter);
   const merged = { ...env, PATH: path, ELAN_TOOLCHAIN: env.ELAN_TOOLCHAIN ?? LEAN_TOOLCHAIN };
   const exe = process.platform === "win32" ? "lake.exe" : "lake";
-  const candidates2 = [(0, import_node_path46.join)(managedBin, exe), ...elanHas ? [(0, import_node_path46.join)(elanBin, exe)] : [], exe];
+  const candidates2 = [(0, import_node_path47.join)(managedBin, exe), ...elanHas ? [(0, import_node_path47.join)(elanBin, exe)] : [], exe];
   for (const candidate of candidates2) {
     try {
       (0, import_node_child_process15.execFileSync)(candidate, ["--version"], { env: merged, stdio: ["ignore", "pipe", "pipe"], timeout: 1e4 });
@@ -36403,7 +36437,7 @@ function proofsWorkspaceProblem(root) {
   for (const rel of [".verity", PROOFS_DIR, `${PROOFS_DIR}/.lake`]) {
     let st;
     try {
-      st = (0, import_node_fs60.lstatSync)((0, import_node_path46.join)(root, rel));
+      st = (0, import_node_fs61.lstatSync)((0, import_node_path47.join)(root, rel));
     } catch {
       break;
     }
@@ -36423,44 +36457,44 @@ function refused(problem) {
 function buildLibrary(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
   const problem = proofsWorkspaceProblem(root);
   if (problem) return refused(problem);
-  return run2(tc, (0, import_node_path46.join)(root, PROOFS_DIR), ["build"], timeoutMs);
+  return run2(tc, (0, import_node_path47.join)(root, PROOFS_DIR), ["build"], timeoutMs);
 }
 async function buildLibraryAsync(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
   const problem = proofsWorkspaceProblem(root);
   if (problem) return refused(problem);
-  return runAsync(tc, (0, import_node_path46.join)(root, PROOFS_DIR), ["build"], timeoutMs);
+  return runAsync(tc, (0, import_node_path47.join)(root, PROOFS_DIR), ["build"], timeoutMs);
 }
 function isModelInRoot(modelsAbs, rel) {
-  if (!rel.endsWith(".lean") || (0, import_node_path46.isAbsolute)(rel) || rel.startsWith("..")) return false;
+  if (!rel.endsWith(".lean") || (0, import_node_path47.isAbsolute)(rel) || rel.startsWith("..")) return false;
   return statRegularInRoot(modelsAbs, rel).ok;
 }
 function resolveModelFile(root, arg) {
-  const modelsAbs = (0, import_node_path46.join)(root, MODELS_DIR);
-  const asPath = (0, import_node_path46.relative)(modelsAbs, (0, import_node_path46.isAbsolute)(arg) ? arg : (0, import_node_path46.resolve)(root, arg));
+  const modelsAbs = (0, import_node_path47.join)(root, MODELS_DIR);
+  const asPath = (0, import_node_path47.relative)(modelsAbs, (0, import_node_path47.isAbsolute)(arg) ? arg : (0, import_node_path47.resolve)(root, arg));
   const candidates2 = arg.includes("/") || arg.includes("\\") ? [asPath] : [arg, `${arg}.lean`];
   for (const rel of candidates2) {
-    if (isModelInRoot(modelsAbs, rel)) return (0, import_node_path46.join)(modelsAbs, rel);
+    if (isModelInRoot(modelsAbs, rel)) return (0, import_node_path47.join)(modelsAbs, rel);
   }
   return null;
 }
 function listModelFiles(root) {
-  const modelsAbs = (0, import_node_path46.join)(root, MODELS_DIR);
-  if (!(0, import_node_fs60.existsSync)(modelsAbs)) return [];
-  return (0, import_node_fs60.readdirSync)(modelsAbs).filter((f) => isModelInRoot(modelsAbs, f)).sort().map((f) => (0, import_node_path46.join)(modelsAbs, f));
+  const modelsAbs = (0, import_node_path47.join)(root, MODELS_DIR);
+  if (!(0, import_node_fs61.existsSync)(modelsAbs)) return [];
+  return (0, import_node_fs61.readdirSync)(modelsAbs).filter((f) => isModelInRoot(modelsAbs, f)).sort().map((f) => (0, import_node_path47.join)(modelsAbs, f));
 }
 function trimDiagnostics(text) {
   return text.split("\n").filter((l) => !l.startsWith("trace:")).join("\n").trim().slice(0, 4e3);
 }
 function checkModel(tc, root, modelFile, opts = {}) {
-  const proofsAbs = (0, import_node_path46.join)(root, PROOFS_DIR);
-  const rel = (0, import_node_path46.relative)(proofsAbs, modelFile);
+  const proofsAbs = (0, import_node_path47.join)(root, PROOFS_DIR);
+  const rel = (0, import_node_path47.relative)(proofsAbs, modelFile);
   const problem = proofsWorkspaceProblem(root);
   const res = problem ? refused(problem) : run2(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
 }
 async function checkModelAsync(tc, root, modelFile, opts = {}) {
-  const proofsAbs = (0, import_node_path46.join)(root, PROOFS_DIR);
-  const rel = (0, import_node_path46.relative)(proofsAbs, modelFile);
+  const proofsAbs = (0, import_node_path47.join)(root, PROOFS_DIR);
+  const rel = (0, import_node_path47.relative)(proofsAbs, modelFile);
   const problem = proofsWorkspaceProblem(root);
   const res = problem ? refused(problem) : await runAsync(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
@@ -36469,10 +36503,10 @@ function toReport(res, root, modelFile, timeoutMs) {
   const parsed = parseVerityLines(res.stdout);
   const combined = `${res.stdout}
 ${res.stderr}`;
-  const name2 = parsed.header?.model ?? (0, import_node_path46.basename)(modelFile, ".lean");
+  const name2 = parsed.header?.model ?? (0, import_node_path47.basename)(modelFile, ".lean");
   const report = {
     model: name2,
-    file: (0, import_node_path46.relative)(root, modelFile),
+    file: (0, import_node_path47.relative)(root, modelFile),
     ok: res.ok,
     header: parsed.header,
     properties: parsed.properties,
@@ -36519,9 +36553,9 @@ function isCrashTrace(trace) {
 }
 function mergeFormalFindings(response, outcome, pushedFiles) {
   if (!outcome) return { blocking: 0 };
-  const norm2 = (p) => p.replace(/\\/g, "/");
-  const pushed = new Set(pushedFiles.map(norm2));
-  const blocking = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm2(f.file)));
+  const norm3 = (p) => p.replace(/\\/g, "/");
+  const pushed = new Set(pushedFiles.map(norm3));
+  const blocking = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm3(f.file)));
   if (blocking.length === 0) return { blocking: 0 };
   const existing = Array.isArray(response.findings) ? response.findings : [];
   response.findings = [
@@ -36717,15 +36751,15 @@ function nonNegative(v) {
   return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : 0;
 }
 function readLedger(root) {
-  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const empty = { day: today, models: 0, costUsd: 0 };
+  const today2 = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const empty = { day: today2, models: 0, costUsd: 0 };
   if (!isLocalState(root, AUTO_LEDGER)) return empty;
   const read2 = readRegularFileInRoot(root, AUTO_LEDGER, 4096);
   if (!read2.ok) return empty;
   try {
     const o = JSON.parse(read2.content);
-    if (o.day !== today || typeof o.models !== "number") return empty;
-    return { day: today, models: nonNegative(o.models), costUsd: nonNegative(o.costUsd) };
+    if (o.day !== today2 || typeof o.models !== "number") return empty;
+    return { day: today2, models: nonNegative(o.models), costUsd: nonNegative(o.costUsd) };
   } catch {
     return empty;
   }
@@ -36903,7 +36937,7 @@ async function runFormalPhase(input) {
   const ranked = await deps.rank(eligible, root, input.changedLines);
   if (!ranked.ok && ranked.disabled) return done({ status: "skipped", skip: "disabled-by-server", detail: ranked.error });
   if (ranked.ok) spend(ranked);
-  candidates2 = ranked.ranked.slice(0, 5).map((c) => ({ file: c.file, symbol: c.ai?.symbol ?? null, score: c.ai?.score ?? null, criteria: c.ai?.criteria ?? null, reasked: !!c.ai?.reasked, reasons: (c.ai?.reasons ?? []).map((r) => r.slice(0, 200)) }));
+  candidates2 = ranked.ranked.slice(0, 5).map((c) => ({ file: c.file, symbol: c.ai?.symbol ?? null, score: c.ai?.score ?? null, criteria: c.ai?.criteria ?? null, reasked: !!c.ai?.reasked, reasons: (c.ai?.reasons ?? []).map((r) => r.slice(0, 200)), commits: c.commits, fixCommits: c.fixCommits, risk: c.risk }));
   if (cancelled()) return done({ status: "skipped", skip: "deadline", detail: "cut off after ranking" });
   const minScore = input.minScore ?? DEFAULT_MIN_SCORE;
   let qualified = ranked.ranked.filter((c) => c.ai && c.ai.score >= minScore);
@@ -37012,7 +37046,7 @@ async function runFormalPhase(input) {
   const sha2562 = sha256Of(chosen.content);
   const chosenContent = chosen.content;
   const { lines, numbered: numbered2 } = chosen;
-  const target = { file: top.file, symbol: top.ai.symbol, lines, score: top.ai.score, reasons: [...top.reasons, ...top.ai.reasons], extent: chosen.extent, ...chosen.context ? { context: chosen.context.stats } : {}, ...floor ? { floor: true } : {} };
+  const target = { file: top.file, symbol: top.ai.symbol, lines, score: top.ai.score, reasons: [...top.reasons, ...top.ai.reasons], extent: chosen.extent, ...chosen.context ? { context: chosen.context.stats } : {}, ...floor ? { floor: true } : {}, signals: { commits: top.commits, fixCommits: top.fixCommits, risk: top.risk } };
   progress.target = target;
   if (!REPLAYABLE.test(top.file)) return done({ status: "skipped", skip: "replay-unsupported", detail: `${top.file}: replay supports TS/JS and Python`, target });
   if (timeLeft() < GENERATE_RESERVE_MS) return done({ status: "skipped", skip: "not-enough-time", detail: `${Math.round(timeLeft() / 1e3)} s left before generation`, target });
@@ -37042,7 +37076,7 @@ async function runFormalPhase(input) {
     modelName = gen.name;
     const rel = `${AUTO_MODELS_DIR}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path47.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path48.join)(root, rel);
     progress.model = { name: gen.name, file: rel, rounds: round };
     progress.step = "check";
     report = await deps.check(root, abs);
@@ -37164,7 +37198,7 @@ async function runFormalPhase(input) {
   return done({
     status: "checked",
     target,
-    model: { name: modelName, file: (0, import_node_path47.relative)(root, (0, import_node_path47.join)(root, modelFile)), rounds },
+    model: { name: modelName, file: (0, import_node_path48.relative)(root, (0, import_node_path48.join)(root, modelFile)), rounds },
     properties: report.properties,
     findings
   });
@@ -37241,7 +37275,7 @@ async function generateAndCheck(root, req, opts) {
     }
     const rel = `${dir}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path47.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path48.join)(root, rel);
     const report = await opts.deps.check(root, abs);
     const abstracts = report.header?.abstracts ?? [];
     const stray = abstracts.find((a) => !headerFiles.has(a.file)) ?? (abstracts[0] && abstracts[0].file !== req.file ? abstracts[0] : void 0);
@@ -37372,13 +37406,138 @@ function describeFormalOutcome(o) {
   return `formal: ${o.model?.name ?? "?"} on ${o.target?.file ?? "?"}#${o.target?.symbol ?? "?"} (${o.model?.rounds ?? 1} round${o.model?.rounds === 1 ? "" : "s"}) \xB7 ${parts2.join(" \xB7 ")} \xB7 ${Math.round(o.durationMs / 1e3)} s${cost}${cut}`;
 }
 
+// src/lib/prove/record.ts
+var RECORD_TIMEOUT_MS = 8e3;
+var HOOK_EXIT_MARGIN_MS = 5e3;
+var MIN_RECORD_POST_MS = 1e3;
+function guardRecordDeadline(hookStartedAt) {
+  return hookStartedAt + GUARD_TIMEOUT_MS - HOOK_EXIT_MARGIN_MS;
+}
+function recordPostTimeout(now, deadlineAt, timeoutMs = RECORD_TIMEOUT_MS) {
+  if (deadlineAt === void 0) return timeoutMs;
+  const left = deadlineAt - now;
+  return left < MIN_RECORD_POST_MS ? null : Math.min(timeoutMs, left);
+}
+var norm2 = (p) => p.replace(/\\/g, "/");
+var SAFE_SEGMENT = /^[A-Za-z0-9._@+~$()[\]-]{1,255}$/;
+function safeRepoPath(p) {
+  const n = norm2(p);
+  if (!n || n.length > 512 || n.startsWith("/") || /^[A-Za-z]:\//.test(n)) return null;
+  return n.split("/").every((s) => s !== "." && s !== ".." && SAFE_SEGMENT.test(s)) ? n : null;
+}
+var SYMBOL = /^[A-Za-z_$][\w$]*(?:[.#:][A-Za-z_$][\w$]*)*$/;
+var IDENT3 = /^[A-Za-z][\w]*$/;
+var TRACE_STEP = /^[A-Za-z_]\w{0,63}$/;
+var ELIDED_STEP = "\u2026";
+function recordBasis(source2) {
+  if (typeof source2 !== "string") return "";
+  if (/^rule:[a-z-]+$/.test(source2)) return source2;
+  const m = /^(?:([^:\s]+):)?L(\d+)(?::|$)/.exec(source2);
+  return m ? m[1] ? `${norm2(m[1])}:L${m[2]}` : `L${m[2]}` : "";
+}
+function recordTrace(trace) {
+  return trace.slice(0, 16).map((s) => {
+    const name2 = (s.trim().split(/[\s(]/, 1)[0] ?? "").split(".").pop() ?? "";
+    return TRACE_STEP.test(name2) ? name2 : ELIDED_STEP;
+  });
+}
+var ident2 = (s, re, max) => typeof s === "string" && s.length <= max && re.test(s) ? s : null;
+var kind = (k) => k === "intent" ? "intent" : "structural";
+var signalsOf = (c) => c && typeof c.commits === "number" && typeof c.fixCommits === "number" ? { commits: c.commits, fix_commits: c.fixCommits, risk: Object.fromEntries(Object.entries(c.risk ?? {}).filter(([, n]) => typeof n === "number" && n > 0).slice(0, 16)) } : null;
+function buildPhaseRecord(outcome, ctx) {
+  const pushed = new Set(ctx.pushedFiles.map(norm2));
+  const blocks = (f) => ctx.moment === "push" && f.verdict === "reproduced" && !f.waived && pushed.has(norm2(f.file));
+  const symbol = (s) => ident2(s, SYMBOL, 200);
+  return {
+    moment: ctx.moment,
+    status: outcome.status,
+    skip: outcome.skip ?? null,
+    parent_run_id: ctx.parentRunId,
+    target: outcome.target && symbol(outcome.target.symbol) && safeRepoPath(outcome.target.file) ? {
+      file: safeRepoPath(outcome.target.file),
+      symbol: symbol(outcome.target.symbol),
+      lines: outcome.target.lines ?? null,
+      score: Math.max(0, Math.min(1, outcome.target.score)),
+      extent: ident2(outcome.target.extent, /^[a-z-]+(?::[a-z-]+)?$/, 60),
+      signals: signalsOf(outcome.target.signals)
+    } : null,
+    candidates: (outcome.candidates ?? []).filter((c) => safeRepoPath(c.file)).slice(0, 12).map((c) => ({
+      file: safeRepoPath(c.file),
+      symbol: c.symbol === null ? null : symbol(c.symbol),
+      score: c.score === null ? null : Math.max(0, Math.min(1, c.score)),
+      criteria: c.criteria,
+      reasked: c.reasked,
+      signals: signalsOf(c)
+    })),
+    model: outcome.model && ident2(outcome.model.name, /^[A-Za-z][\w]*(?:\.[A-Za-z][\w]*)*$/, 120) ? { name: outcome.model.name, rounds: Math.max(0, Math.min(20, outcome.model.rounds)) } : null,
+    properties: (outcome.properties ?? []).filter((p) => ident2(p.id, IDENT3, 120)).slice(0, 16).map((p) => ({
+      id: p.id,
+      kind: kind(p.kind),
+      basis: recordBasis(p.source),
+      result: p.result,
+      bound: p.bound ?? null,
+      states: p.states ?? null
+    })),
+    findings: outcome.findings.filter((f) => ident2(f.property, IDENT3, 120) && symbol(f.symbol) && safeRepoPath(f.file)).slice(0, 8).map((f) => ({
+      property: f.property,
+      kind: kind(f.kind),
+      trace: recordTrace(f.trace),
+      file: safeRepoPath(f.file),
+      symbol: f.symbol,
+      verdict: f.verdict,
+      waived: f.waived === true,
+      blocked: blocks(f)
+    })),
+    grounding: outcome.grounding ? {
+      sent_back: outcome.grounding.sentBack,
+      dropped: outcome.grounding.dropped.filter((id) => ident2(id, IDENT3, 120)).slice(0, 16),
+      trigger_missing: (outcome.grounding.triggerMissing ?? []).filter((id) => ident2(id, IDENT3, 120)).slice(0, 16)
+    } : null,
+    usage: {
+      input_tokens: outcome.usage.inputTokens,
+      output_tokens: outcome.usage.outputTokens,
+      cost_usd: outcome.usage.costUsd,
+      unpriced: outcome.usage.unpriced
+    },
+    duration_ms: Math.round(outcome.durationMs)
+  };
+}
+async function postPhaseRecord(outcome, ctx, post) {
+  try {
+    const timeout = recordPostTimeout((post.now ?? Date.now)(), post.deadlineAt, post.timeoutMs ?? RECORD_TIMEOUT_MS);
+    if (timeout === null) {
+      logEvent("formal_record_skipped", { moment: ctx.moment, reason: "hook-deadline" });
+      return null;
+    }
+    const res = await apiRequest({
+      method: "POST",
+      path: "/prove/record",
+      serviceUrl: post.serviceUrl,
+      token: post.token,
+      body: buildPhaseRecord(outcome, ctx),
+      timeout,
+      cmd: "prove-record"
+    });
+    if (!res.ok) {
+      logEvent("formal_record_failed", { moment: ctx.moment, category: res.category ?? "unknown", http_status: res.http_status ?? null });
+      return null;
+    }
+    const runId = typeof res.data?.run_id === "string" ? res.data.run_id : null;
+    logEvent("formal_record", { moment: ctx.moment, run_id: runId });
+    return runId;
+  } catch (err2) {
+    logEvent("formal_record_failed", { moment: ctx.moment, category: "exception", name: err2?.constructor?.name ?? "Error" });
+    return null;
+  }
+}
+
 // src/commands/guard.ts
 var EXCERPT_SOURCE_MAX_BYTES = 2 * 1024 * 1024;
 var WRITERS_BUDGET_MS = 1500;
 var EXCERPT_MAX_LINES2 = 30;
 var VENDORED_READ_MAX_BYTES = 256 * 1024;
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path48.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path49.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
   return new Promise((resolve9) => {
@@ -37423,7 +37582,7 @@ function readPreToolUseStdin() {
 }
 function readIterMap() {
   try {
-    const raw = JSON.parse((0, import_node_fs61.readFileSync)(GUARD_ITER_FILE, "utf-8"));
+    const raw = JSON.parse((0, import_node_fs62.readFileSync)(GUARD_ITER_FILE, "utf-8"));
     if (raw && typeof raw === "object") {
       if (typeof raw.moment === "string" && typeof raw.count === "number") {
         return { [raw.moment]: raw.count };
@@ -37443,10 +37602,10 @@ function readIter(moment) {
 }
 function writeIter(moment, count) {
   try {
-    (0, import_node_fs61.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs62.mkdirSync)(VERITY_DIR, { recursive: true });
     const map = readIterMap();
     map[moment] = count;
-    (0, import_node_fs61.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+    (0, import_node_fs62.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
   } catch {
   }
 }
@@ -37456,10 +37615,10 @@ function resetIter(moment) {
     if (!(moment in map)) return;
     delete map[moment];
     if (Object.keys(map).length === 0) {
-      if ((0, import_node_fs61.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs61.unlinkSync)(GUARD_ITER_FILE);
+      if ((0, import_node_fs62.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs62.unlinkSync)(GUARD_ITER_FILE);
     } else {
-      (0, import_node_fs61.mkdirSync)(VERITY_DIR, { recursive: true });
-      (0, import_node_fs61.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+      (0, import_node_fs62.mkdirSync)(VERITY_DIR, { recursive: true });
+      (0, import_node_fs62.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
     }
   } catch {
   }
@@ -37529,7 +37688,7 @@ function hasBlockingFinding(response, sentFiles) {
 function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedIntent, coverageTelemetry) {
   const analyzable = filterAnalyzable(files);
   const securityFiles = filterSecurity(files);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs61.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs62.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
   const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const trigger = moment === "pre-commit" ? "hook:pre-commit" : "hook:pre-push";
   const requestBody = {
@@ -37946,6 +38105,13 @@ async function runGuard(opts, globals) {
   const witnessed = [...codeDelta.files.map((f) => f.path), ...agentVerdict?.witnessed_files ?? []];
   mergeFormalFindings(response, formalOutcome, files);
   decision = response.gate_decision ?? "(unrecognised)";
+  if (formalOutcome) {
+    await postPhaseRecord(formalOutcome, {
+      moment: "push",
+      parentRunId: typeof response.run_id === "string" ? response.run_id : null,
+      pushedFiles: files
+    }, { serviceUrl: urlResult.data, token: tokenResult.data.token, deadlineAt: guardRecordDeadline(hookStartedAt) });
+  }
   if (!result.ok) {
     const authRemedy = result.error.startsWith("STALE_VERIFICATION") ? " Your GitHub verification expired \u2014 run `verity login` to re-verify." : result.error.startsWith("FORBIDDEN") ? " No access grant for this repository \u2014 run `verity login` to refresh your grants." : result.error.startsWith("INVALID_TOKEN") ? " Your Verity login expired or was revoked \u2014 run `verity login` to sign in again." : "";
     if (oneShotLostOutcome({ agentGate: decision, agentBlocking: hasBlockingFinding(response, witnessed) }) === "block") {
@@ -38155,7 +38321,7 @@ function registerIgnoreCommand(program2) {
 
 // src/commands/waive.ts
 var import_node_crypto20 = require("node:crypto");
-var import_node_fs62 = require("node:fs");
+var import_node_fs63 = require("node:fs");
 function registerWaiveCommand(program2) {
   program2.command("waive <pattern-id>").description("Record an accepted-risk disposition for an open finding (voids when the file changes)").option("--file <path>", "File the finding is anchored to, REPO-RELATIVE (recommended \u2014 narrows the waive)").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action(async (patternId, opts) => {
     const globals = program2.opts();
@@ -38184,7 +38350,7 @@ function registerWaiveCommand(program2) {
     if (opts.file) {
       body2.file = opts.file;
       try {
-        body2.file_sha256 = (0, import_node_crypto20.createHash)("sha256").update((0, import_node_fs62.readFileSync)(opts.file)).digest("hex");
+        body2.file_sha256 = (0, import_node_crypto20.createHash)("sha256").update((0, import_node_fs63.readFileSync)(opts.file)).digest("hex");
       } catch {
         printError(`Cannot read ${opts.file} \u2014 run from the repo root, or omit --file to waive by pattern.`);
         process.exit(1);
@@ -38209,10 +38375,10 @@ function registerWaiveCommand(program2) {
 }
 
 // src/commands/init.ts
-var import_node_fs67 = require("node:fs");
+var import_node_fs68 = require("node:fs");
 var import_promises20 = require("node:fs/promises");
 var import_yaml6 = __toESM2(require_dist());
-var import_node_path52 = require("node:path");
+var import_node_path53 = require("node:path");
 var import_node_os11 = require("node:os");
 var import_node_child_process19 = require("node:child_process");
 
@@ -38292,7 +38458,7 @@ function printPhase(n, of, title, subtitle) {
 }
 
 // src/commands/doctor.ts
-var import_node_fs63 = require("node:fs");
+var import_node_fs64 = require("node:fs");
 
 // src/lib/prereqs.ts
 var import_node_child_process16 = require("node:child_process");
@@ -38500,11 +38666,11 @@ async function buildReport() {
   const hooks = wiring.status;
   const provenance = cliProvenance();
   const telemetry = await checkTelemetry();
-  const hasConfig = (0, import_node_fs63.existsSync)(projectPath(CODACY_CONFIG_FILE));
+  const hasConfig = (0, import_node_fs64.existsSync)(projectPath(CODACY_CONFIG_FILE));
   const artifacts = {
-    standard: (0, import_node_fs63.existsSync)(projectPath(STANDARD_FILE)),
+    standard: (0, import_node_fs64.existsSync)(projectPath(STANDARD_FILE)),
     analysisConfig: hasConfig,
-    verityMd: (0, import_node_fs63.existsSync)(projectPath(VERITY_MD_FILE)),
+    verityMd: (0, import_node_fs64.existsSync)(projectPath(VERITY_MD_FILE)),
     analysisConfigIds: hasConfig ? validatePatternIds().status : "absent"
   };
   const next = [];
@@ -38663,8 +38829,8 @@ function registerDoctorCommand(program2) {
 }
 
 // src/commands/migrate.ts
-var import_node_fs64 = require("node:fs");
-var import_node_path49 = require("node:path");
+var import_node_fs65 = require("node:fs");
+var import_node_path50 = require("node:path");
 var import_node_child_process17 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
@@ -38701,12 +38867,12 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path49.join)(root, ".gate");
-  const verityDir = (0, import_node_path49.join)(root, ".verity");
-  if ((0, import_node_fs64.existsSync)(gateDir) && !(0, import_node_fs64.existsSync)(verityDir)) {
+  const gateDir = (0, import_node_path50.join)(root, ".gate");
+  const verityDir = (0, import_node_path50.join)(root, ".verity");
+  if ((0, import_node_fs65.existsSync)(gateDir) && !(0, import_node_fs65.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if ((0, import_node_fs64.existsSync)(gateDir) && (0, import_node_fs64.existsSync)(verityDir)) {
+  if ((0, import_node_fs65.existsSync)(gateDir) && (0, import_node_fs65.existsSync)(verityDir)) {
     return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
   return false;
@@ -38727,13 +38893,13 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
     }
   }
   if (moved) {
-    if ((0, import_node_fs64.existsSync)(gateDir)) {
+    if ((0, import_node_fs65.existsSync)(gateDir)) {
       const carried = carryLegacyContents(gateDir, verityDir);
       if (carried > 0) {
         actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
       }
       try {
-        (0, import_node_fs64.rmSync)(gateDir, { recursive: true, force: true });
+        (0, import_node_fs65.rmSync)(gateDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -38749,18 +38915,18 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
     actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
   try {
-    (0, import_node_fs64.rmSync)(gateDir, { recursive: true, force: true });
+    (0, import_node_fs65.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
   }
   return carried > 0;
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path49.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path49.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs64.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs64.existsSync)(verityCreds)) {
-    (0, import_node_fs64.mkdirSync)((0, import_node_path49.join)(home, ".verity"), { recursive: true });
+  const gateCreds = (0, import_node_path50.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path50.join)(home, ".verity", "credentials");
+  if (!(0, import_node_fs65.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs65.existsSync)(verityCreds)) {
+    (0, import_node_fs65.mkdirSync)((0, import_node_path50.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -38782,8 +38948,8 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path49.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs64.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  const claudeMd = (0, import_node_path50.join)(root, "CLAUDE.md");
+  const hadLegacyBlock = (0, import_node_fs65.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
     await ensureClaudeMdPointer(root);
@@ -38793,9 +38959,9 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path49.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path49.join)(root, "VERITY.md");
-  if (!(0, import_node_fs64.existsSync)(gateMd) || (0, import_node_fs64.existsSync)(verityMd)) return;
+  const gateMd = (0, import_node_path50.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path50.join)(root, "VERITY.md");
+  if (!(0, import_node_fs65.existsSync)(gateMd) || (0, import_node_fs65.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
@@ -38807,12 +38973,12 @@ function migrateStandardFile(root, actions) {
   if (!moved) moveFile(gateMd, verityMd);
   const content = readFileSyncSafe(verityMd);
   const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs64.writeFileSync)(verityMd, refreshed);
+  if (refreshed !== content) (0, import_node_fs65.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
-  const file = (0, import_node_path49.join)(root, ".claude", "settings.local.json");
-  if (!(0, import_node_fs64.existsSync)(file)) return;
+  const file = (0, import_node_path50.join)(root, ".claude", "settings.local.json");
+  if (!(0, import_node_fs65.existsSync)(file)) return;
   let settings;
   try {
     settings = JSON.parse(readFileSyncSafe(file) || "{}");
@@ -38860,14 +39026,14 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
   }
   if (toAppend.length > 0) {
     const sep6 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs64.writeFileSync)(verityCreds, verityContent + sep6 + toAppend.join("\n") + "\n");
+    (0, import_node_fs65.writeFileSync)(verityCreds, verityContent + sep6 + toAppend.join("\n") + "\n");
   }
-  (0, import_node_fs64.rmSync)(gateCreds, { force: true });
+  (0, import_node_fs65.rmSync)(gateCreds, { force: true });
   return toAppend.length;
 }
 function readFileSyncSafe(path) {
   try {
-    return (0, import_node_fs64.readFileSync)(path, "utf-8");
+    return (0, import_node_fs65.readFileSync)(path, "utf-8");
   } catch {
     return "";
   }
@@ -38882,35 +39048,35 @@ function hasStagedChanges(root) {
 }
 function moveDir(from, to) {
   try {
-    (0, import_node_fs64.renameSync)(from, to);
+    (0, import_node_fs65.renameSync)(from, to);
   } catch (err2) {
     if (err2.code !== "EXDEV") throw err2;
-    (0, import_node_fs64.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs64.rmSync)(from, { recursive: true, force: true });
+    (0, import_node_fs65.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs65.rmSync)(from, { recursive: true, force: true });
   }
 }
 function moveFile(from, to) {
   try {
-    (0, import_node_fs64.renameSync)(from, to);
+    (0, import_node_fs65.renameSync)(from, to);
   } catch (err2) {
     if (err2.code !== "EXDEV") throw err2;
-    (0, import_node_fs64.cpSync)(from, to);
-    (0, import_node_fs64.rmSync)(from, { force: true });
+    (0, import_node_fs65.cpSync)(from, to);
+    (0, import_node_fs65.rmSync)(from, { force: true });
   }
 }
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk2 = (relDir) => {
-    const srcDir = (0, import_node_path49.join)(gateDir, relDir);
-    for (const entry of (0, import_node_fs64.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path49.join)(relDir, entry) : entry;
-      const src = (0, import_node_path49.join)(gateDir, rel);
-      const dest = (0, import_node_path49.join)(verityDir, rel);
-      if ((0, import_node_fs64.statSync)(src).isDirectory()) {
+    const srcDir = (0, import_node_path50.join)(gateDir, relDir);
+    for (const entry of (0, import_node_fs65.readdirSync)(srcDir)) {
+      const rel = relDir ? (0, import_node_path50.join)(relDir, entry) : entry;
+      const src = (0, import_node_path50.join)(gateDir, rel);
+      const dest = (0, import_node_path50.join)(verityDir, rel);
+      if ((0, import_node_fs65.statSync)(src).isDirectory()) {
         walk2(rel);
-      } else if (!(0, import_node_fs64.existsSync)(dest)) {
-        (0, import_node_fs64.mkdirSync)((0, import_node_path49.dirname)(dest), { recursive: true });
-        (0, import_node_fs64.cpSync)(src, dest);
+      } else if (!(0, import_node_fs65.existsSync)(dest)) {
+        (0, import_node_fs65.mkdirSync)((0, import_node_path50.dirname)(dest), { recursive: true });
+        (0, import_node_fs65.cpSync)(src, dest);
         copied++;
       }
     }
@@ -38919,22 +39085,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path49.join)(root, ".gate");
-  const verityDir = (0, import_node_path49.join)(root, ".verity");
-  if ((0, import_node_fs64.existsSync)(gateDir) && !(0, import_node_fs64.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs64.existsSync)(gateDir) && (0, import_node_fs64.existsSync)(verityDir)) {
-    if ((0, import_node_fs64.existsSync)((0, import_node_path49.join)(gateDir, "credentials")) && !(0, import_node_fs64.existsSync)((0, import_node_path49.join)(verityDir, "credentials"))) {
+  const gateDir = (0, import_node_path50.join)(root, ".gate");
+  const verityDir = (0, import_node_path50.join)(root, ".verity");
+  if ((0, import_node_fs65.existsSync)(gateDir) && !(0, import_node_fs65.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs65.existsSync)(gateDir) && (0, import_node_fs65.existsSync)(verityDir)) {
+    if ((0, import_node_fs65.existsSync)((0, import_node_path50.join)(gateDir, "credentials")) && !(0, import_node_fs65.existsSync)((0, import_node_path50.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs64.existsSync)((0, import_node_path49.join)(gateDir, "memory")) && !(0, import_node_fs64.existsSync)((0, import_node_path49.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs65.existsSync)((0, import_node_path50.join)(gateDir, "memory")) && !(0, import_node_fs65.existsSync)((0, import_node_path50.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path49.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs64.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+  const claudeMd = (0, import_node_path50.join)(root, "CLAUDE.md");
+  if ((0, import_node_fs65.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs64.existsSync)((0, import_node_path49.join)(root, "GATE.md")) && !(0, import_node_fs64.existsSync)((0, import_node_path49.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs65.existsSync)((0, import_node_path50.join)(root, "GATE.md")) && !(0, import_node_fs65.existsSync)((0, import_node_path50.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -39215,11 +39381,11 @@ async function promptMultiSelect(question, choices, fallback) {
 }
 
 // src/lib/prove/lean-install.ts
-var import_node_fs65 = require("node:fs");
+var import_node_fs66 = require("node:fs");
 var import_node_crypto21 = require("node:crypto");
 var import_node_child_process18 = require("node:child_process");
 var import_node_os10 = require("node:os");
-var import_node_path50 = require("node:path");
+var import_node_path51 = require("node:path");
 var import_promises18 = require("node:stream/promises");
 var import_node_stream = require("node:stream");
 var RELEASES = "https://releases.lean-lang.org/lean4";
@@ -39230,10 +39396,10 @@ function freeBytes(dir) {
   let d = dir;
   for (let i2 = 0; i2 < 64; i2++) {
     try {
-      const st = (0, import_node_fs65.statfsSync)(d);
+      const st = (0, import_node_fs66.statfsSync)(d);
       return Number(st.bavail) * Number(st.bsize);
     } catch {
-      const up = (0, import_node_path50.join)(d, "..");
+      const up = (0, import_node_path51.join)(d, "..");
       if (up === d) return null;
       d = up;
     }
@@ -39255,7 +39421,7 @@ function expectedSha256(asset, version = pinnedVersion()) {
 function sha256File(path) {
   return new Promise((resolve9, reject) => {
     const hash = (0, import_node_crypto21.createHash)("sha256");
-    (0, import_node_fs65.createReadStream)(path).on("data", (chunk) => hash.update(chunk)).on("end", () => resolve9(hash.digest("hex"))).on("error", reject);
+    (0, import_node_fs66.createReadStream)(path).on("data", (chunk) => hash.update(chunk)).on("end", () => resolve9(hash.digest("hex"))).on("error", reject);
   });
 }
 async function verifyDownload(zip, asset, version = pinnedVersion()) {
@@ -39275,7 +39441,7 @@ function leanAssetName(version = pinnedVersion()) {
   return suffix ? `lean-${v}-${suffix}.zip` : null;
 }
 function pinnedVersionDir(env = process.env) {
-  return (0, import_node_path50.join)(verityLeanHome(env), pinnedVersion());
+  return (0, import_node_path51.join)(verityLeanHome(env), pinnedVersion());
 }
 function lakeBinary() {
   return (0, import_node_os10.platform)() === "win32" ? "lake.exe" : "lake";
@@ -39286,12 +39452,12 @@ function unzip(zip, dest) {
   for (const [cmd, args2] of attempts) {
     try {
       (0, import_node_child_process18.execFileSync)(cmd, args2, { stdio: ["ignore", "ignore", "pipe"], timeout: 15 * 6e4 });
-      if ((0, import_node_fs65.readdirSync)(dest).length > 0) return { ok: true, via: cmd };
+      if ((0, import_node_fs66.readdirSync)(dest).length > 0) return { ok: true, via: cmd };
       errors.push(`${cmd}: produced nothing`);
     } catch (err2) {
       errors.push(`${cmd}: ${String(err2.message).split("\n")[0].slice(0, 120)}`);
       try {
-        for (const e of (0, import_node_fs65.readdirSync)(dest)) (0, import_node_fs65.rmSync)((0, import_node_path50.join)(dest, e), { recursive: true, force: true });
+        for (const e of (0, import_node_fs66.readdirSync)(dest)) (0, import_node_fs66.rmSync)((0, import_node_path51.join)(dest, e), { recursive: true, force: true });
       } catch {
       }
     }
@@ -39317,7 +39483,7 @@ async function download(url, dest, onProgress, stallMs = DOWNLOAD_STALL_MS) {
       seen += chunk.length;
       onProgress(seen, total);
     });
-    await (0, import_promises18.pipeline)(stream, (0, import_node_fs65.createWriteStream)(dest), { signal: ctrl.signal });
+    await (0, import_promises18.pipeline)(stream, (0, import_node_fs66.createWriteStream)(dest), { signal: ctrl.signal });
   } catch (err2) {
     if (ctrl.signal.aborted) throw new Error(`download stalled: nothing received for ${Math.round(stallMs / 1e3)} s`);
     throw err2;
@@ -39367,10 +39533,10 @@ async function installLean(opts = {}) {
     const gb = (n) => (n / 1024 ** 3).toFixed(1);
     return { ok: false, error: `not enough disk space for Lean: ${gb(free)} GB free where ${home} lives, needs about ${gb(needed)} GB` };
   }
-  const tmp = (0, import_node_path50.join)(home, ".tmp");
-  (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
-  (0, import_node_fs65.mkdirSync)(tmp, { recursive: true });
-  const zip = (0, import_node_path50.join)(tmp, asset);
+  const tmp = (0, import_node_path51.join)(home, ".tmp");
+  (0, import_node_fs66.rmSync)(tmp, { recursive: true, force: true });
+  (0, import_node_fs66.mkdirSync)(tmp, { recursive: true });
+  const zip = (0, import_node_path51.join)(tmp, asset);
   say(`downloading ${url}`);
   let lastPct = -1;
   try {
@@ -39383,40 +39549,40 @@ async function installLean(opts = {}) {
       }
     });
   } catch (err2) {
-    (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs66.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: err2.message };
   }
   say("verifying checksum");
   const verified = await verifyDownload(zip, asset);
   if (!verified.ok) {
-    (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs66.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: verified.error };
   }
   say("unpacking (this takes a minute)");
-  const unpack = (0, import_node_path50.join)(tmp, "unpack");
-  (0, import_node_fs65.mkdirSync)(unpack);
+  const unpack = (0, import_node_path51.join)(tmp, "unpack");
+  (0, import_node_fs66.mkdirSync)(unpack);
   const unpacked = unzip(zip, unpack);
   if (!unpacked.ok) {
-    (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs66.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: `unpack failed: ${unpacked.error}` };
   }
-  const entries = (0, import_node_fs65.readdirSync)(unpack);
-  const top = entries.length === 1 && (0, import_node_fs65.statSync)((0, import_node_path50.join)(unpack, entries[0])).isDirectory() ? (0, import_node_path50.join)(unpack, entries[0]) : unpack;
-  if (!(0, import_node_fs65.existsSync)((0, import_node_path50.join)(top, "bin", lakeBinary()))) {
-    (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
+  const entries = (0, import_node_fs66.readdirSync)(unpack);
+  const top = entries.length === 1 && (0, import_node_fs66.statSync)((0, import_node_path51.join)(unpack, entries[0])).isDirectory() ? (0, import_node_path51.join)(unpack, entries[0]) : unpack;
+  if (!(0, import_node_fs66.existsSync)((0, import_node_path51.join)(top, "bin", lakeBinary()))) {
+    (0, import_node_fs66.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: "the archive did not contain bin/lake" };
   }
-  (0, import_node_fs65.rmSync)(dir, { recursive: true, force: true });
-  (0, import_node_fs65.mkdirSync)(home, { recursive: true });
-  (0, import_node_fs65.renameSync)(top, dir);
-  (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
+  (0, import_node_fs66.rmSync)(dir, { recursive: true, force: true });
+  (0, import_node_fs66.mkdirSync)(home, { recursive: true });
+  (0, import_node_fs66.renameSync)(top, dir);
+  (0, import_node_fs66.rmSync)(tmp, { recursive: true, force: true });
   return { ok: true, dir };
 }
 
 // src/lib/remote-config.ts
-var import_node_fs66 = require("node:fs");
+var import_node_fs67 = require("node:fs");
 var import_promises19 = require("node:fs/promises");
-var import_node_path51 = require("node:path");
+var import_node_path52 = require("node:path");
 var import_yaml5 = __toESM2(require_dist());
 var IGNORE_RIDER = "verityignore";
 async function fetchRemoteSetup(opts) {
@@ -39461,7 +39627,7 @@ async function adoptRemoteSetup(found, opts) {
   written.push(STANDARD_FILE);
   if (rider !== null) {
     const localIgnore = projectPath(VERITYIGNORE_FILE);
-    if (!(0, import_node_fs66.existsSync)(localIgnore)) {
+    if (!(0, import_node_fs67.existsSync)(localIgnore)) {
       await writeOut(VERITYIGNORE_FILE, rider);
       written.push(VERITYIGNORE_FILE);
     } else {
@@ -39494,7 +39660,7 @@ async function adoptRemoteSetup(found, opts) {
 }
 async function writeOut(relative6, body2) {
   const target = projectPath(relative6);
-  await (0, import_promises19.mkdir)((0, import_node_path51.dirname)(target), { recursive: true });
+  await (0, import_promises19.mkdir)((0, import_node_path52.dirname)(target), { recursive: true });
   await (0, import_promises19.writeFile)(target, body2);
 }
 function describeRemote(found) {
@@ -39611,15 +39777,15 @@ async function runOptionalAuth(resolution, opts = {}) {
 }
 function resolveDataDir2() {
   const candidates2 = [
-    (0, import_node_path52.join)(__dirname, "..", "data"),
+    (0, import_node_path53.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path52.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path53.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path52.join)(process.cwd(), "cli", "data")
+    (0, import_node_path53.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs67.existsSync)((0, import_node_path52.join)(candidate, "skills"))) {
+    if ((0, import_node_fs68.existsSync)((0, import_node_path53.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -39635,9 +39801,9 @@ async function skillIsCurrent(src, dest) {
   const list2 = (dir) => {
     const out2 = [];
     const walk2 = (d, prefix) => {
-      for (const e of (0, import_node_fs67.readdirSync)(d, { withFileTypes: true })) {
+      for (const e of (0, import_node_fs68.readdirSync)(d, { withFileTypes: true })) {
         const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk2((0, import_node_path52.join)(d, e.name), rel);
+        if (e.isDirectory()) walk2((0, import_node_path53.join)(d, e.name), rel);
         else if (e.isFile()) out2.push(rel);
       }
     };
@@ -39648,8 +39814,8 @@ async function skillIsCurrent(src, dest) {
     const shipped = list2(src);
     if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
     for (const rel of shipped) {
-      const a = await (0, import_promises20.readFile)((0, import_node_path52.join)(src, rel), "utf-8");
-      const b = await (0, import_promises20.readFile)((0, import_node_path52.join)(dest, rel), "utf-8");
+      const a = await (0, import_promises20.readFile)((0, import_node_path53.join)(src, rel), "utf-8");
+      const b = await (0, import_promises20.readFile)((0, import_node_path53.join)(dest, rel), "utf-8");
       if (a !== b) return false;
     }
     return true;
@@ -39852,7 +40018,7 @@ async function synthesizeLocally(opts) {
 async function healStaleAnalysisConfig(globals) {
   const configPath = projectPath(CODACY_CONFIG_FILE);
   const standardPath = projectPath(STANDARD_FILE);
-  if (!(0, import_node_fs67.existsSync)(configPath) || !(0, import_node_fs67.existsSync)(standardPath)) return;
+  if (!(0, import_node_fs68.existsSync)(configPath) || !(0, import_node_fs68.existsSync)(standardPath)) return;
   const validation = validatePatternIds();
   if (validation.status !== "invalid") return;
   printWarn("  Your analysis config names pattern ids that no longer resolve \u2014 those tools were");
@@ -39949,17 +40115,17 @@ async function handoffToSetup(enabled, claudeInstalled) {
 async function installSkills(force, step) {
   step("Installing skills");
   const dataDir = resolveDataDir2();
-  const skillsSource = (0, import_node_path52.join)(dataDir, "skills");
+  const skillsSource = (0, import_node_path53.join)(dataDir, "skills");
   const skillsDest = ".claude/skills";
   let skillsInstalled = 0;
   for (const skill of SKILLS) {
-    const src = (0, import_node_path52.join)(skillsSource, skill);
-    const dest = (0, import_node_path52.join)(skillsDest, skill);
-    if (!(0, import_node_fs67.existsSync)(src)) {
+    const src = (0, import_node_path53.join)(skillsSource, skill);
+    const dest = (0, import_node_path53.join)(skillsDest, skill);
+    if (!(0, import_node_fs68.existsSync)(src)) {
       printWarn(`  Skill data not found: ${skill}`);
       continue;
     }
-    if ((0, import_node_fs67.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) {
+    if ((0, import_node_fs68.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) {
       skillsInstalled++;
       continue;
     }
@@ -40108,7 +40274,7 @@ async function offerFormalVerification(defaultsOnly, pluginMode) {
   if (!toolchain) {
     const dir = pinnedVersionDir();
     const home = (0, import_node_os11.homedir)();
-    const shown = dir.startsWith(home + import_node_path52.sep) ? `~${dir.slice(home.length)}` : dir;
+    const shown = dir.startsWith(home + import_node_path53.sep) ? `~${dir.slice(home.length)}` : dir;
     console.log("");
     console.log(`    "yes" installs Lean 4 (${LEAN_DOWNLOAD_SIZE}) into ${shown}`);
   }
@@ -40167,7 +40333,7 @@ function registerInitCommand(program2) {
     const staleMarker = clearStalePluginMarker();
     const pluginMode = opts.plugin === false ? false : opts.pluginMode ?? pluginActiveHere();
     const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-    const isProject = projectMarkers.some((m) => (0, import_node_fs67.existsSync)(m));
+    const isProject = projectMarkers.some((m) => (0, import_node_fs68.existsSync)(m));
     if (!isProject) {
       printError("No project detected in the current directory.");
       printInfo('Run "verity init" from your project root.');
@@ -40270,7 +40436,7 @@ function registerInitCommand(program2) {
       untrackMemory: opts.untrackMemory === true,
       untrackState: opts.untrackState === true
     });
-    const globalVerityDir = (0, import_node_path52.join)(process.env.HOME ?? "", ".verity");
+    const globalVerityDir = (0, import_node_path53.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises20.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     step("Wiring Claude Code hooks");
@@ -40345,7 +40511,7 @@ function registerInitCommand(program2) {
     }
     step("Your project's Standard");
     let haveStandard = false;
-    if ((0, import_node_fs67.existsSync)(projectPath(STANDARD_FILE))) {
+    if ((0, import_node_fs68.existsSync)(projectPath(STANDARD_FILE))) {
       printInfo("  This project already has .verity/standard.yaml \u2014 keeping it.");
       haveStandard = true;
     } else {
@@ -40375,7 +40541,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.34.1-experimental.89100b5" : "dev"
+          cli_version: true ? "0.34.1-experimental.c910405" : "dev"
         }
       });
     } catch (err2) {
@@ -40425,8 +40591,8 @@ function registerInitCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-var import_node_fs68 = require("node:fs");
-var import_node_path53 = require("node:path");
+var import_node_fs69 = require("node:fs");
+var import_node_path54 = require("node:path");
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("Remove Verity from this project (skills, hooks, .verity/, VERITY.md)").option("--dry-run", "Show what would be removed without doing it").option("--purge-global", "Also remove ~/.verity/ (deletes saved tokens \u2014 reconnect requires re-registration)").option("--keep-verity-md", "Keep the project root VERITY.md file").action(async (opts) => {
     const dryRun = opts.dryRun ?? false;
@@ -40435,11 +40601,11 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name2 of PROJECT_SKILL_NAMES) {
-      const dir = (0, import_node_path53.join)(skillsRoot, name2);
-      if ((0, import_node_fs68.existsSync)(dir)) {
+      const dir = (0, import_node_path54.join)(skillsRoot, name2);
+      if ((0, import_node_fs69.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name2}/`,
-          apply: () => (0, import_node_fs68.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs69.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -40453,24 +40619,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs68.existsSync)(verityDir)) {
+    if ((0, import_node_fs69.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs68.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs69.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs68.existsSync)(verityMd)) {
+      if ((0, import_node_fs69.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs68.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs69.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs68.existsSync)(path) && (0, import_node_fs68.statSync)(path).isDirectory() && (0, import_node_fs68.readdirSync)(path).length === 0) {
-        (0, import_node_fs68.rmdirSync)(path);
+      if ((0, import_node_fs69.existsSync)(path) && (0, import_node_fs69.statSync)(path).isDirectory() && (0, import_node_fs69.readdirSync)(path).length === 0) {
+        (0, import_node_fs69.rmdirSync)(path);
       }
     };
     actions.push({
@@ -40481,11 +40647,11 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path53.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs68.existsSync)(globalVerityDir)) {
+    const globalVerityDir = (0, import_node_path54.join)(home, ".verity");
+    if (purgeGlobal && (0, import_node_fs69.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs68.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs69.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -40679,8 +40845,8 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs69 = require("node:fs");
-var import_node_path54 = require("node:path");
+var import_node_fs70 = require("node:fs");
+var import_node_path55 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -40717,11 +40883,11 @@ function registerResetCommand(program2) {
     }
     const cacheDir = projectPath(CACHE_DIR);
     let purged = 0;
-    if ((0, import_node_fs69.existsSync)(cacheDir)) {
-      for (const entry of (0, import_node_fs69.readdirSync)(cacheDir)) {
+    if ((0, import_node_fs70.existsSync)(cacheDir)) {
+      for (const entry of (0, import_node_fs70.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs69.unlinkSync)((0, import_node_path54.join)(cacheDir, entry));
+            (0, import_node_fs70.unlinkSync)((0, import_node_path55.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -40736,19 +40902,19 @@ function registerResetCommand(program2) {
       projectPath(`${VERITY_DIR}/.last-analysis`)
     ];
     for (const file of filesToClear) {
-      if ((0, import_node_fs69.existsSync)(file)) {
+      if ((0, import_node_fs70.existsSync)(file)) {
         try {
-          (0, import_node_fs69.writeFileSync)(file, "");
+          (0, import_node_fs70.writeFileSync)(file, "");
         } catch {
         }
       }
     }
     if (opts.all) {
       const logsDir = projectPath(`${VERITY_DIR}/.logs`);
-      if ((0, import_node_fs69.existsSync)(logsDir)) {
-        for (const entry of (0, import_node_fs69.readdirSync)(logsDir)) {
+      if ((0, import_node_fs70.existsSync)(logsDir)) {
+        for (const entry of (0, import_node_fs70.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs69.unlinkSync)((0, import_node_path54.join)(logsDir, entry));
+            (0, import_node_fs70.unlinkSync)((0, import_node_path55.join)(logsDir, entry));
           } catch {
           }
         }
@@ -40760,7 +40926,7 @@ function registerResetCommand(program2) {
 }
 
 // src/commands/reflect.ts
-var import_node_fs70 = require("node:fs");
+var import_node_fs71 = require("node:fs");
 
 // src/lib/reflection-globs.ts
 var MAX_GLOBS = 6;
@@ -40798,7 +40964,7 @@ async function writeNodeToDisk(args2) {
       { treePaths: listTrackedFiles(), recordBaseline: false }
     );
     if (written === 0) return false;
-    return (0, import_node_fs70.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
+    return (0, import_node_fs71.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
   } catch {
     return false;
   }
@@ -40874,7 +41040,7 @@ function registerReflectCommand(program2) {
     const userInput = input.text;
     if (userInput) {
       const validKinds = ["decision", "gotcha", "pattern", "security", "quality", "intent", "domain", "integration"];
-      const kind = validKinds.includes(opts.kind) ? opts.kind : "gotcha";
+      const kind2 = validKinds.includes(opts.kind) ? opts.kind : "gotcha";
       const confirmed = opts.confirmed === true;
       const source2 = confirmed ? "user" : "agent";
       const explicitGlobs = Array.isArray(opts.fileGlobs) ? opts.fileGlobs.map((g) => g.trim()).filter(Boolean) : [];
@@ -40886,7 +41052,7 @@ function registerReflectCommand(program2) {
         serviceUrl,
         token,
         body: {
-          kind,
+          kind: kind2,
           title: userInput.slice(0, 200),
           body: userInput,
           domains: [],
@@ -41235,9 +41401,9 @@ function registerRunCommand(program2) {
 }
 
 // src/commands/telemetry.ts
-var import_node_fs71 = require("node:fs");
+var import_node_fs72 = require("node:fs");
 async function recordTelemetryChoice(choice) {
-  if (!(0, import_node_fs71.existsSync)(projectPath(SETUP_STATE_FILE))) return;
+  if (!(0, import_node_fs72.existsSync)(projectPath(SETUP_STATE_FILE))) return;
   try {
     if ((await readSetupState())?.telemetry === choice) return;
     await writeSetupState({ telemetry: choice });
@@ -41314,8 +41480,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/commands/prove.ts
-var import_node_fs72 = require("node:fs");
-var import_node_path55 = require("node:path");
+var import_node_fs73 = require("node:fs");
+var import_node_path56 = require("node:path");
 
 // src/lib/prove/hint-pool.ts
 var STOP2 = /* @__PURE__ */ new Set([
@@ -41457,7 +41623,7 @@ function registerProveCommand(program2) {
       process.exit(2);
     }
     const limit = Math.max(1, Math.min(50, Number(opts.limit) || 10));
-    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path55.relative)(root, (0, import_node_path55.resolve)(p)) || ".") });
+    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path56.relative)(root, (0, import_node_path56.resolve)(p)) || ".") });
     if (opts.hint && paths.length === 0) {
       const hit = hintMatches(root, opts.hint);
       if (hit.files.length > 0) {
@@ -41511,7 +41677,7 @@ function registerProveCommand(program2) {
   });
   prove.command("check [model]").description("Elaborate a model (or every model) with the local Lean toolchain and report each property").option("--timeout <ms>", "Per-model timeout in ms", "120000").option("--json", "Machine-readable output").action((model, opts) => {
     const root = repoRoot();
-    if (!(0, import_node_fs72.existsSync)((0, import_node_path55.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs73.existsSync)((0, import_node_path56.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -41535,7 +41701,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
     const reports = [];
     for (const f of files) {
       const report = checkModel(tc, root, f, { timeoutMs: Math.max(1e3, Number(opts.timeout) || 12e4) });
-      report.file = (0, import_node_path55.relative)(root, f);
+      report.file = (0, import_node_path56.relative)(root, f);
       reports.push(report);
       try {
         writeResult(root, report);
@@ -41573,7 +41739,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
       printError("Not logged in \u2014 replays run on the Verity service. Run `verity login` first.");
       process.exit(2);
     }
-    if (!(0, import_node_fs72.existsSync)((0, import_node_path55.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs73.existsSync)((0, import_node_path56.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -41604,7 +41770,7 @@ ${report.error ?? ""}`);
       printInfo(opts.property ? `${model} ${opts.property} has no counterexample to replay` : `${model} has no counterexample to replay`);
       return;
     }
-    const modelSource = readRegularFileInRoot(root, (0, import_node_path55.relative)(root, file), 512 * 1024);
+    const modelSource = readRegularFileInRoot(root, (0, import_node_path56.relative)(root, file), 512 * 1024);
     if (!opts.json) printInfo(`replaying ${targets.length} counterexample(s) of ${model} in network-less containers (${Math.min(targets.length, REPLAY_CONCURRENCY)} at a time)\u2026`);
     const outcomes = await mapPool(targets, REPLAY_CONCURRENCY, async (p) => {
       const brief = buildReplayBrief(root, report, p, modelSource.ok ? modelSource.content : "");
@@ -41624,7 +41790,7 @@ ${report.error ?? ""}`);
   });
   prove.command("auto [files...]").description("The formal phase the pre-push guard runs: select one risky symbol among changed files, generate a model, check it, replay counterexamples (default files: the commits ahead of upstream)").option("--deadline <ms>", "Budget for the whole phase", "170000").option("--json", "Machine-readable output").action(async (paths, opts) => {
     const root = repoRoot();
-    let files = paths.map((p) => (0, import_node_path55.relative)(root, (0, import_node_path55.resolve)(p)));
+    let files = paths.map((p) => (0, import_node_path56.relative)(root, (0, import_node_path56.resolve)(p)));
     if (files.length === 0) {
       const ahead = runGitSync(root, ["diff", "--name-only", "@{upstream}...HEAD"]);
       const fallback = ahead.ok ? ahead : runGitSync(root, ["diff", "--name-only", "HEAD~1..HEAD"]);
@@ -41634,8 +41800,10 @@ ${report.error ?? ""}`);
       printInfo("No changed files to consider (nothing ahead of upstream). Pass paths explicitly.");
       return;
     }
-    const prep = await prepareFormalPhase(root, process.env, await proveAuth(program2) ?? void 0);
+    const auth2 = await proveAuth(program2);
+    const prep = await prepareFormalPhase(root, process.env, auth2 ?? void 0);
     const outcome = prep.ok ? await runFormalPhaseWithin({ root, files, deadlineAt: Date.now() + Math.max(3e4, Number(opts.deadline) || 17e4), deps: prep.deps }).catch((err2) => skippedOutcome("error", String(err2?.message ?? err2).slice(0, 200))) : skippedOutcome(prep.skip, prep.detail);
+    if (auth2) await postPhaseRecord(outcome, { moment: "on-demand", parentRunId: null, pushedFiles: [] }, auth2);
     if (opts.json) {
       printJson(outcome);
     } else {
@@ -41696,7 +41864,7 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
     let revise;
     if (opts.revise) {
       const existing = resolveModelFile(root, opts.revise);
-      const src = existing ? readRegularFileInRoot(root, (0, import_node_path55.relative)(root, existing), 64 * 1024) : null;
+      const src = existing ? readRegularFileInRoot(root, (0, import_node_path56.relative)(root, existing), 64 * 1024) : null;
       if (!src || !src.ok || !opts.note) {
         printError("--revise needs an existing model under Models/ and --note - with what the replay showed on stdin");
         process.exit(2);
@@ -41736,8 +41904,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("waive <file>").description("Dismiss the remembered formal finding(s) on a file for its current bytes \u2014 the accepted-risk path for a formal block").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action((file, opts) => {
     const root = repoRoot();
-    const rel0 = (0, import_node_path55.relative)(root, (0, import_node_path55.isAbsolute)(file) ? file : (0, import_node_path55.join)(root, file)).replace(/\\/g, "/");
-    const rel = rel0.startsWith("..") || (0, import_node_path55.isAbsolute)(rel0) ? null : rel0;
+    const rel0 = (0, import_node_path56.relative)(root, (0, import_node_path56.isAbsolute)(file) ? file : (0, import_node_path56.join)(root, file)).replace(/\\/g, "/");
+    const rel = rel0.startsWith("..") || (0, import_node_path56.isAbsolute)(rel0) ? null : rel0;
     if (!rel) {
       printError(`${file} is not inside this repository`);
       process.exit(2);
@@ -41753,8 +41921,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("hash <file>").description("Print the sha256 of a file, for a model header (Verity.model \u2026 sha256). Path is REPO-relative, as in the header").action((file) => {
     const root = repoRoot();
-    const rel = (0, import_node_path55.relative)(root, (0, import_node_path55.isAbsolute)(file) ? file : (0, import_node_path55.join)(root, file));
-    const digest = rel.startsWith("..") || (0, import_node_path55.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
+    const rel = (0, import_node_path56.relative)(root, (0, import_node_path56.isAbsolute)(file) ? file : (0, import_node_path56.join)(root, file));
+    const digest = rel.startsWith("..") || (0, import_node_path56.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
     if (!digest) {
       printError(`Cannot hash ${file}: it must be a regular file inside this repository (not a symlink)`);
       process.exit(2);
@@ -41788,10 +41956,10 @@ function refreshScaffold(root) {
 }
 
 // src/commands/lean.ts
-var import_node_fs73 = require("node:fs");
+var import_node_fs74 = require("node:fs");
 var import_node_child_process20 = require("node:child_process");
 var import_node_os12 = require("node:os");
-var import_node_path56 = require("node:path");
+var import_node_path57 = require("node:path");
 function registerLeanCommand(program2) {
   const lean = program2.command("lean").description("The Lean 4 toolchain formal verification needs (managed download, pinned by this CLI)");
   lean.command("status").option("--json", "Machine-readable output").description("Which toolchain would run, and whether it matches the pinned version").action((opts) => {
@@ -41808,7 +41976,7 @@ function registerLeanCommand(program2) {
     const managed = pinnedVersionDir();
     const matches = version ? version.includes(pin) : false;
     if (opts.json) {
-      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs73.existsSync)((0, import_node_path56.join)(managed, "bin")), asset: leanAssetName() });
+      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs74.existsSync)((0, import_node_path57.join)(managed, "bin")), asset: leanAssetName() });
       return;
     }
     printInfo(`pinned: ${LEAN_TOOLCHAIN}`);
@@ -41826,7 +41994,7 @@ function registerLeanCommand(program2) {
       process.exit(2);
     }
     const dir = pinnedVersionDir();
-    if ((0, import_node_fs73.existsSync)((0, import_node_path56.join)(dir, "bin", "lake")) && !opts.force) {
+    if ((0, import_node_fs74.existsSync)((0, import_node_path57.join)(dir, "bin", "lake")) && !opts.force) {
       printInfo(`already installed at ${dir}`);
       return;
     }
@@ -41862,18 +42030,18 @@ function registerLeanCommand(program2) {
   });
   lean.command("remove").description("Delete the Verity-managed toolchain for the pinned version").action(() => {
     const dir = pinnedVersionDir();
-    if (!(0, import_node_fs73.existsSync)(dir)) {
+    if (!(0, import_node_fs74.existsSync)(dir)) {
       printInfo("nothing to remove");
       return;
     }
-    (0, import_node_fs73.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs74.rmSync)(dir, { recursive: true, force: true });
     printInfo(`removed ${dir}`);
   });
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.34.1-experimental.89100b5").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.1-experimental.89100b5");
+program.name("verity").description("CLI for Verity quality gate service").version("0.34.1-experimental.c910405").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.1-experimental.c910405");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();