@codacy/verity-cli 0.35.0-experimental.3a13a5e → 0.35.0-experimental.7c5e75b

package/bin/verity.js

@@ -23881,7 +23881,7 @@ async function readHookStdin() {
 
 // src/commands/standard.ts
 var import_promises10 = require("node:fs/promises");
-var import_yaml6 = __toESM2(require_dist());
+var import_yaml5 = __toESM2(require_dist());
 
 // src/lib/synthesize.ts
 var import_node_fs35 = require("node:fs");
@@ -24869,29 +24869,8 @@ function consentLines(p) {
   ];
 }
 
-// src/commands/standard-generate.ts
-var import_yaml5 = __toESM2(require_dist());
-
 // src/lib/generate-standard.ts
 var import_yaml4 = __toESM2(require_dist());
-async function generationStatus(opts) {
-  const res = await apiRequest({
-    method: "GET",
-    path: "/standards/generate",
-    serviceUrl: opts.serviceUrl,
-    token: opts.token,
-    verbose: opts.verbose,
-    cmd: "standard_generate_status"
-  });
-  if (!res.ok) {
-    if (res.http_status === 404 && /Unknown route/.test(res.error)) return "unsupported";
-    if (res.http_status === 400 && /Version must be a positive integer/.test(res.error)) return "unsupported";
-    return "unknown";
-  }
-  if (res.data.enabled === true) return "on";
-  if (res.data.enabled === false) return "off";
-  return "unknown";
-}
 var GENERATE_TIMEOUT_MS = 6e4;
 function rulesFrom(content, before) {
   const list2 = Array.isArray(content.custom_patterns) ? content.custom_patterns : [];
@@ -24990,94 +24969,6 @@ async function promptYes(question, opts) {
   return a === "" || a === "y" || a === "yes";
 }
 
-// src/commands/standard-generate.ts
-function generationBase() {
-  const local = readRepoFile(STANDARD_FILE);
-  try {
-    const parsed = local !== null ? (0, import_yaml5.parse)(local) : null;
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : buildStandard({ detected: detectProject() }, loadCatalog());
-  } catch (err2) {
-    printError(`${STANDARD_FILE} is not valid YAML: ${err2.message}. Fix it, or delete it, and run this again.`);
-    process.exit(1);
-  }
-}
-async function consentToSend(profile, yes) {
-  try {
-    writeRepoFile(PROFILE_FILE, JSON.stringify(profile, null, 2) + "\n");
-  } catch (err2) {
-    printError(`Could not write ${PROFILE_FILE} for you to read: ${err2.message}`);
-    process.exit(1);
-  }
-  for (const line2 of consentLines(profile)) printInfo(line2);
-  if (yes) return true;
-  if (!interactive()) {
-    printError(`Nothing was sent. Read ${PROFILE_FILE}, then run this again with --yes to send it.`);
-    process.exit(1);
-  }
-  const send = await promptYes("Send the profile? [Y/n] ", { nonInteractive: false });
-  if (!send) printInfo("Not sent. Nothing changed.");
-  return send;
-}
-async function runGenerate(globals, opts) {
-  const tokenResult = await resolveToken(globals.token);
-  const urlResult = await resolveServiceUrl(globals.serviceUrl);
-  if (!tokenResult.ok || !urlResult.ok) {
-    printError("Sign in first: verity login. Rule generation needs your Verity account.");
-    process.exit(1);
-  }
-  const status = await generationStatus({ serviceUrl: urlResult.data, token: tokenResult.data.token, verbose: globals.verbose });
-  if (opts.status) {
-    process.stdout.write(`${status}
-`);
-    return;
-  }
-  if (status === "off") {
-    printWarn("Rule generation is not switched on for this project yet. The built-in rules apply. Nothing was sent.");
-    return;
-  }
-  if (status === "unsupported") {
-    printWarn("This Verity service does not write project rules yet: it is older than this CLI. The built-in rules apply. Nothing was sent.");
-    return;
-  }
-  const base = generationBase();
-  const profile = buildRepoProfile();
-  if (!await consentToSend(profile, opts.yes === true)) return;
-  const spinner = startSpinner("Writing rules for this repository");
-  const outcome = await generateStandard({
-    serviceUrl: urlResult.data,
-    token: tokenResult.data.token,
-    profile,
-    base,
-    verbose: globals.verbose
-  });
-  if (outcome.status === "created") {
-    spinner.succeed(`${outcome.rules.length} ${outcome.rules.length === 1 ? "rule" : "rules"} for this repository \xB7 Standard v${outcome.version}`);
-    for (const r of outcome.rules) {
-      printInfo(`  ${r.id}`);
-      printInfo(`    ${r.description}`);
-      printInfo(`    Applies: ${r.scope} \xB7 ${r.basis}`);
-    }
-    if (outcome.rejected > 0) printInfo(`  ${outcome.rejected} proposed rule(s) were left out: too generic, or not safe to use.`);
-    printInfo(`Edit them in ${STANDARD_FILE}, then: verity standard push`);
-    if (outcome.warning) printWarn(outcome.warning);
-    return;
-  }
-  if (outcome.status === "exists") {
-    spinner.warn('This project already has a Standard on the Verity service. Run "verity init" to use it.');
-    return;
-  }
-  if (outcome.status === "disabled") {
-    spinner.warn("Rule generation is not switched on for this project yet. The built-in rules apply.");
-    return;
-  }
-  if (outcome.status === "unsupported") {
-    spinner.warn("This Verity service does not write project rules yet: it is older than this CLI. The built-in rules apply.");
-    return;
-  }
-  spinner.warn(`The rules could not be written: ${outcome.reason}`);
-  process.exit(1);
-}
-
 // src/commands/standard.ts
 function registerStandardCommands(program2) {
   const standard = program2.command("standard").description("Manage the project Standard");
@@ -25094,15 +24985,15 @@ function registerStandardCommands(program2) {
       serviceUrl: urlResult.ok ? urlResult.data : void 0
     });
     if ("refused" in result) {
-      printWarn(terminalText(result.refused, 300));
+      printWarn(result.refused);
       process.exit(1);
     }
-    printInfo(`  ${terminalText(describeDetected(result.detected), 400)}`);
-    for (const path of result.written) printInfo(`  ${terminalText(path, 200)} \u2713`);
-    for (const note of result.notes) printWarn(`  ${terminalText(note, 300)}`);
+    printInfo(`  ${describeDetected(result.detected)}`);
+    for (const path of result.written) printInfo(`  ${path} \u2713`);
+    for (const note of result.notes) printWarn(`  ${note}`);
     if (opts.push) {
       const pushed = await pushStandard(globals);
-      for (const line2 of pushed.lines) printInfo(`  ${terminalText(line2, 600)}`);
+      for (const line2 of pushed.lines) printInfo(`  ${line2}`);
       if (pushed.standardVersion !== null) {
         await correctVerityMdVersion({
           standard: result.standard,
@@ -25113,7 +25004,7 @@ function registerStandardCommands(program2) {
       }
     }
   });
-  standard.command("generate").description("Have Verity write project-specific rules from a profile of this repository (asks before sending it)").option("--yes", `Send the profile without asking (you have read ${PROFILE_FILE})`).option("--status", "Print whether the service writes project rules for this project: on, off, unsupported or unknown. Sends nothing.").action((opts) => runGenerate(program2.opts(), opts));
+  standard.command("generate").description("Have Verity write project-specific rules from a profile of this repository (asks before sending it)").option("--yes", `Send the profile without asking (you have read ${PROFILE_FILE})`).action((opts) => runGenerate(program2.opts(), opts));
   standard.command("push").description("Upload the project Standard to the service").option("--file <path>", "Path to standard YAML file", STANDARD_FILE).option("--created-by <name>", "Who created this version", "claude-code").action(async (opts) => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
@@ -25135,7 +25026,7 @@ function registerStandardCommands(program2) {
     }
     let content;
     try {
-      content = (0, import_yaml6.parse)(yamlContent);
+      content = (0, import_yaml5.parse)(yamlContent);
     } catch (err2) {
       printError(`Invalid YAML in ${opts.file}: ${err2.message}`);
       process.exit(1);
@@ -25151,10 +25042,10 @@ function registerStandardCommands(program2) {
       verbose: globals.verbose
     });
     if (!result.ok) {
-      printError(terminalText(result.error, 300));
+      printError(result.error);
       process.exit(1);
     }
-    printInfo(`Standard uploaded (version ${versionText(result.data.version)})`);
+    printInfo(`Standard uploaded (version ${result.data.version})`);
     printJson(result.data);
   });
   standard.command("get").description("Get the current Standard from the service").option("--version <n>", "Specific version number").action(async (opts) => {
@@ -25169,15 +25060,7 @@ function registerStandardCommands(program2) {
       printError(urlResult.error);
       process.exit(1);
     }
-    let path = "/standards/latest";
-    if (opts.version !== void 0) {
-      const version = Number(opts.version);
-      if (!/^[1-9][0-9]*$/.test(String(opts.version)) || !Number.isSafeInteger(version)) {
-        printError(`--version: "${terminalText(opts.version, 40)}" is not a Standard version. Use a positive whole number, such as --version 3.`);
-        process.exit(1);
-      }
-      path = `/standards/${version}`;
-    }
+    const path = opts.version ? `/standards/${opts.version}` : "/standards/latest";
     const result = await apiRequest({
       method: "GET",
       path,
@@ -25186,7 +25069,7 @@ function registerStandardCommands(program2) {
       verbose: globals.verbose
     });
     if (!result.ok) {
-      printError(terminalText(result.error, 300));
+      printError(result.error);
       process.exit(1);
     }
     printJson(result.data);
@@ -25211,24 +25094,93 @@ function registerStandardCommands(program2) {
       verbose: globals.verbose
     });
     if (!result.ok) {
-      printError(terminalText(result.error, 300));
+      printError(result.error);
       process.exit(1);
     }
-    const versions = Array.isArray(result.data.versions) ? result.data.versions : [];
+    const versions = result.data.versions;
     if (versions.length === 0) {
       printInfo("No Standard versions found.");
       return;
     }
     printInfo("Standard versions:");
     for (const v of versions) {
-      const date = typeof v.created_at === "string" ? v.created_at.slice(0, 19).replace("T", " ") : "unknown date";
+      const date = v.created_at.slice(0, 19).replace("T", " ");
       const by = v.created_by ?? "unknown";
-      printInfo(`  v${versionText(v.version)}  ${terminalText(date, 40)}  (by ${terminalText(by, 80)})`);
+      printInfo(`  v${v.version}  ${date}  (by ${by})`);
     }
   });
 }
-function versionText(value) {
-  return typeof value === "number" && Number.isSafeInteger(value) ? String(value) : "?";
+function generationBase() {
+  const local = readRepoFile(STANDARD_FILE);
+  try {
+    const parsed = local !== null ? (0, import_yaml5.parse)(local) : null;
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : buildStandard({ detected: detectProject() }, loadCatalog());
+  } catch (err2) {
+    printError(`${STANDARD_FILE} is not valid YAML: ${err2.message}. Fix it, or delete it, and run this again.`);
+    process.exit(1);
+  }
+}
+async function consentToSend(profile, yes) {
+  try {
+    writeRepoFile(PROFILE_FILE, JSON.stringify(profile, null, 2) + "\n");
+  } catch (err2) {
+    printError(`Could not write ${PROFILE_FILE} for you to read: ${err2.message}`);
+    process.exit(1);
+  }
+  for (const line2 of consentLines(profile)) printInfo(line2);
+  if (yes) return true;
+  if (!interactive()) {
+    printError(`Nothing was sent. Read ${PROFILE_FILE}, then run this again with --yes to send it.`);
+    process.exit(1);
+  }
+  const send = await promptYes("Send the profile? [Y/n] ", { nonInteractive: false });
+  if (!send) printInfo("Not sent. Nothing changed.");
+  return send;
+}
+async function runGenerate(globals, opts) {
+  const tokenResult = await resolveToken(globals.token);
+  const urlResult = await resolveServiceUrl(globals.serviceUrl);
+  if (!tokenResult.ok || !urlResult.ok) {
+    printError("Sign in first: verity login. Rule generation needs your Verity account.");
+    process.exit(1);
+  }
+  const base = generationBase();
+  const profile = buildRepoProfile();
+  if (!await consentToSend(profile, opts.yes === true)) return;
+  const spinner = startSpinner("Writing rules for this repository");
+  const outcome = await generateStandard({
+    serviceUrl: urlResult.data,
+    token: tokenResult.data.token,
+    profile,
+    base,
+    verbose: globals.verbose
+  });
+  if (outcome.status === "created") {
+    spinner.succeed(`${outcome.rules.length} ${outcome.rules.length === 1 ? "rule" : "rules"} for this repository \xB7 Standard v${outcome.version}`);
+    for (const r of outcome.rules) {
+      printInfo(`  ${r.id}`);
+      printInfo(`    ${r.description}`);
+      printInfo(`    Applies: ${r.scope} \xB7 ${r.basis}`);
+    }
+    if (outcome.rejected > 0) printInfo(`  ${outcome.rejected} proposed rule(s) were left out: too generic, or not safe to use.`);
+    printInfo(`Edit them in ${STANDARD_FILE}, then: verity standard push`);
+    if (outcome.warning) printWarn(outcome.warning);
+    return;
+  }
+  if (outcome.status === "exists") {
+    spinner.warn('This project already has a Standard on the Verity service. Run "verity init" to use it.');
+    return;
+  }
+  if (outcome.status === "disabled") {
+    spinner.warn("Rule generation is not switched on for this project yet. The built-in rules apply.");
+    return;
+  }
+  if (outcome.status === "unsupported") {
+    spinner.warn("This Verity service does not write project rules yet: it is older than this CLI. The built-in rules apply.");
+    return;
+  }
+  spinner.warn(`The rules could not be written: ${outcome.reason}`);
+  process.exit(1);
 }
 
 // src/commands/config.ts
@@ -28366,7 +28318,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.35.0-experimental.3a13a5e" : "dev";
+    return true ? "0.35.0-experimental.7c5e75b" : "dev";
   } catch {
     return "dev";
   }
@@ -32425,7 +32377,7 @@ async function repoContext(run4) {
 var import_promises13 = require("node:fs/promises");
 var import_node_fs50 = require("node:fs");
 var import_node_path39 = require("node:path");
-var import_yaml7 = __toESM2(require_dist());
+var import_yaml6 = __toESM2(require_dist());
 
 // src/lib/seed.ts
 function extractReadmeIntro(content) {
@@ -32736,7 +32688,7 @@ async function runSeed(opts) {
   let standardDoc;
   try {
     const raw = await (0, import_promises13.readFile)(STANDARD_FILE, "utf-8");
-    standardDoc = (0, import_yaml7.parse)(raw);
+    standardDoc = (0, import_yaml6.parse)(raw);
   } catch {
     return { created: 0, existing: 0, failed: 0, skipped: "no_standard", candidates: [] };
   }
@@ -34218,11 +34170,11 @@ async function render(run4) {
       const sev = String(f.severity ?? "").toLowerCase();
       return sev === "critical" || sev === "high";
     });
-    const fingerprint2 = findingsFingerprint(blocking);
+    const fingerprint = findingsFingerprint(blocking);
     const prior = readBlockState(currentCommit, {
       newUserPrompt: (conversation?.prompts?.length ?? 0) > 0
     });
-    const sameProblem = isSameProblem(prior.fingerprint, fingerprint2);
+    const sameProblem = isSameProblem(prior.fingerprint, fingerprint);
     const maxIterations = parseInt(opts.maxIterations, 10);
     const attempts = sameProblem ? prior.attempts + 1 : 1;
     const blocks = prior.blocks + 1;
@@ -34235,7 +34187,7 @@ async function render(run4) {
       maxIterations
     });
     if (decisionNow.block) {
-      writeBlockState(currentCommit, { attempts, blocks, fingerprint: fingerprint2 });
+      writeBlockState(currentCommit, { attempts, blocks, fingerprint });
       iteration = attempts;
     } else {
       release = decisionNow.release;
@@ -34246,7 +34198,7 @@ async function render(run4) {
         blocks,
         reviewed_files: codeDelta.files.length,
         cycle_cut: silenced,
-        fingerprint: fingerprint2
+        fingerprint
       });
     }
   }
@@ -36318,7 +36270,7 @@ async function runAgentReview(options) {
 // src/lib/effort.ts
 var import_node_fs66 = require("node:fs");
 var import_node_path54 = require("node:path");
-var import_yaml8 = __toESM2(require_dist());
+var import_yaml7 = __toESM2(require_dist());
 var EFFORT_PROFILES = {
   default: { pushDeadlineMs: 18e4, formal: { tier: "fast", maxRounds: 2, minScore: 0.7, costCapUsd: 1, maxTargets: 1, relaxedGates: false, dailyModels: 5, dailyCostUsd: 5 } },
   high: { pushDeadlineMs: 22e4, formal: { tier: "deep", maxRounds: 2, minScore: 0.6, costCapUsd: 2, maxTargets: 2, relaxedGates: false, dailyModels: 15, dailyCostUsd: 15 } },
@@ -36330,7 +36282,7 @@ function asEffort(value) {
 function resolveEffort(root, env = process.env) {
   if (env.VERITY_EFFORT) return asEffort(env.VERITY_EFFORT);
   try {
-    const standard = (0, import_yaml8.parse)((0, import_node_fs66.readFileSync)((0, import_node_path54.join)(root, STANDARD_FILE), "utf8"));
+    const standard = (0, import_yaml7.parse)((0, import_node_fs66.readFileSync)((0, import_node_path54.join)(root, STANDARD_FILE), "utf8"));
     return asEffort(standard?.process_constraints?.git_moment_effort);
   } catch {
     return "default";
@@ -38036,8 +37988,8 @@ function readVerified(root, now = Date.now()) {
     return [];
   }
 }
-function findVerified(root, file, symbol, fingerprint2, now = Date.now()) {
-  return readVerified(root, now).find((r) => r.file === file && r.symbol === symbol && r.fingerprint === fingerprint2) ?? null;
+function findVerified(root, file, symbol, fingerprint, now = Date.now()) {
+  return readVerified(root, now).find((r) => r.file === file && r.symbol === symbol && r.fingerprint === fingerprint) ?? null;
 }
 function recordVerified(root, rec, now = Date.now()) {
   const others = readVerified(root, now).filter((r) => !(r.file === rec.file && r.symbol === rec.symbol));
@@ -39970,99 +39922,14 @@ function registerWaiveCommand(program2) {
 }
 
 // src/commands/init/index.ts
-var import_node_fs77 = require("node:fs");
+var import_node_fs76 = require("node:fs");
 var import_promises19 = require("node:fs/promises");
-var import_node_path65 = require("node:path");
+var import_node_path64 = require("node:path");
 
-// src/lib/init-changes.ts
+// src/lib/init-trace.ts
 var import_node_crypto23 = require("node:crypto");
 var import_node_fs69 = require("node:fs");
-var import_node_os12 = require("node:os");
 var import_node_path57 = require("node:path");
-var REPO_FILES = [
-  ".gitignore",
-  "CLAUDE.md",
-  ".claude/settings.json",
-  ".claude/settings.local.json",
-  STANDARD_FILE,
-  VERITY_MD_FILE,
-  CODACY_CONFIG_FILE,
-  ".codacy/tools-configs/eslint.config.mjs"
-];
-var SKILLS_DIR = ".claude/skills";
-var MAX_HASH_BYTES = 2 * 1024 * 1024;
-var MAX_TREE_ENTRIES = 2e3;
-function userSettingsDir(env) {
-  return env.CLAUDE_CONFIG_DIR || (0, import_node_path57.join)(env.HOME || (0, import_node_os12.homedir)(), ".claude");
-}
-function fingerprint(root, rel) {
-  const opened = openRegularInRoot(root, rel);
-  if (!opened.ok) {
-    if (opened.reason === "missing") return null;
-    if (opened.reason === "symlink") {
-      try {
-        return `link:${(0, import_node_fs69.readlinkSync)((0, import_node_path57.join)(root, rel))}`;
-      } catch {
-        return "link";
-      }
-    }
-    return `refused:${opened.reason}`;
-  }
-  if (opened.size > MAX_HASH_BYTES) {
-    closeOpened(opened.fd);
-    return `size:${opened.size}`;
-  }
-  try {
-    return (0, import_node_crypto23.createHash)("sha256").update(readOpened(opened.fd, opened.size)).digest("hex");
-  } catch {
-    return "unreadable";
-  }
-}
-function treeFingerprint(root, dirRel) {
-  try {
-    if (!(0, import_node_fs69.lstatSync)((0, import_node_path57.join)(root, dirRel)).isDirectory()) return fingerprint(root, dirRel);
-  } catch {
-    return null;
-  }
-  const parts2 = [];
-  const walk2 = (rel) => {
-    let names2;
-    try {
-      names2 = (0, import_node_fs69.readdirSync)((0, import_node_path57.join)(root, rel)).sort();
-    } catch {
-      return;
-    }
-    for (const name2 of names2) {
-      if (parts2.length >= MAX_TREE_ENTRIES) return;
-      const relPath = `${rel}/${name2}`;
-      let st;
-      try {
-        st = (0, import_node_fs69.lstatSync)((0, import_node_path57.join)(root, relPath));
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) walk2(relPath);
-      else parts2.push(`${relPath}\0${fingerprint(root, relPath)}`);
-    }
-  };
-  walk2(dirRel);
-  return (0, import_node_crypto23.createHash)("sha256").update(parts2.join("\n")).digest("hex");
-}
-function snapshotInitFiles(root = process.cwd(), env = process.env) {
-  const snap = /* @__PURE__ */ new Map();
-  for (const f of REPO_FILES) snap.set(f, fingerprint(root, f));
-  snap.set(`${SKILLS_DIR}/`, treeFingerprint(root, SKILLS_DIR));
-  snap.set("~/.claude/settings.json", fingerprint(userSettingsDir(env), "settings.json"));
-  return snap;
-}
-function changedSince(before, after) {
-  return [...after.keys()].filter((k) => before.get(k) !== after.get(k));
-}
-
-// src/lib/init-trace.ts
-var import_node_crypto24 = require("node:crypto");
-var import_node_fs70 = require("node:fs");
-var import_node_path58 = require("node:path");
 var INIT_STEPS = [
   "started",
   "prerequisites",
@@ -40108,9 +39975,9 @@ function traceDisabled(env = process.env) {
 }
 var PENDING_NAME = "init-trace.json";
 var MAX_PENDING_BYTES = 64 * 1024;
-var verityHome2 = () => (0, import_node_path58.join)(process.env.HOME ?? "", ".verity");
+var verityHome2 = () => (0, import_node_path57.join)(process.env.HOME ?? "", ".verity");
 function pendingTracePath() {
-  return (0, import_node_path58.join)(verityHome2(), PENDING_NAME);
+  return (0, import_node_path57.join)(verityHome2(), PENDING_NAME);
 }
 var RUN_ID = /^[0-9a-f]{16}$/;
 var CLI_VERSION = /^[0-9A-Za-z.+-]{1,40}$/;
@@ -40168,10 +40035,10 @@ function writePending(runs) {
   try {
     const kept = runs.filter((r) => r.events.length > 0).slice(-MAX_PENDING_RUNS);
     if (kept.length === 0) {
-      (0, import_node_fs70.rmSync)(pendingTracePath(), { force: true });
+      (0, import_node_fs69.rmSync)(pendingTracePath(), { force: true });
       return;
     }
-    (0, import_node_fs70.mkdirSync)(verityHome2(), { recursive: true });
+    (0, import_node_fs69.mkdirSync)(verityHome2(), { recursive: true });
     if (!replaceInRoot(verityHome2(), PENDING_NAME, JSON.stringify(kept))) {
       logEvent("init_trace_save_refused", {});
     }
@@ -40214,7 +40081,7 @@ function startInitTrace(opts) {
   if (traceDisabled()) return NOOP;
   const startedAt = Date.now();
   const current = {
-    run_id: (0, import_node_crypto24.randomBytes)(8).toString("hex"),
+    run_id: (0, import_node_crypto23.randomBytes)(8).toString("hex"),
     mode: opts.mode,
     interactive: opts.interactive,
     cli_version: cliVersion(),
@@ -40864,194 +40731,32 @@ var Rail = class {
   }
 };
 
-// src/commands/init/ui.ts
+// src/commands/migrate.ts
 var import_node_fs71 = require("node:fs");
+var import_node_path61 = require("node:path");
+var import_node_child_process19 = require("node:child_process");
+
+// src/lib/telemetry-local.ts
 var import_node_path59 = require("node:path");
-var import_node_os13 = require("node:os");
-var import_node_child_process18 = require("node:child_process");
-function createInitUi(opts) {
-  const term = opts.term ?? detectTerm();
-  const screen = new Screen(term);
-  const rail = new Rail(screen);
-  return { term, screen, rail, asking: !opts.defaultsOnly && screen.canAsk() };
+
+// src/lib/telemetry-settings.ts
+var import_promises16 = require("node:fs/promises");
+var import_node_os12 = require("node:os");
+var import_node_path58 = require("node:path");
+var SETTINGS_LOCAL_FILE2 = ".claude/settings.local.json";
+var OTEL_HEADERS_HELPER_CMD = "verity telemetry headers";
+var LEGACY_HEADER_KEY = "OTEL_EXPORTER_OTLP_HEADERS";
+var OTLP_ENDPOINT_KEYS = [
+  "OTEL_EXPORTER_OTLP_ENDPOINT",
+  "OTEL_EXPORTER_OTLP_METRICS_ENDPOINT",
+  "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT",
+  "OTEL_EXPORTER_OTLP_LOGS_ENDPOINT"
+];
+function claudeConfigDir2() {
+  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path58.join)((0, import_node_os12.homedir)(), ".claude");
 }
-function installInterrupt(ui) {
-  const stop2 = () => {
-    ui.rail.stopped();
-    ui.screen.release();
-    process.exit(130);
-  };
-  ui.screen.startInput(stop2);
-  process.once("SIGINT", stop2);
-}
-var SEEN_FILE = ".init-seen";
-function firstInitOnMachine(home = process.env.HOME || (0, import_node_os13.homedir)()) {
-  return !(0, import_node_fs71.existsSync)((0, import_node_path59.join)(home, ".verity", SEEN_FILE));
-}
-function markInitSeen(home = process.env.HOME || (0, import_node_os13.homedir)()) {
-  replaceInRoot((0, import_node_path59.join)(home, ".verity"), SEEN_FILE, `${(/* @__PURE__ */ new Date()).toISOString()}
-`);
-}
-function repoLabel() {
-  try {
-    const url = (0, import_node_child_process18.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-    const parsed = parseRemote(url);
-    if (parsed) return terminalText(`${parsed.owner}/${parsed.repo}`, 120);
-  } catch {
-  }
-  return terminalText((0, import_node_path59.basename)(repoRoot()), 120);
-}
-
-// src/lib/prereqs.ts
-var import_node_child_process19 = require("node:child_process");
-var import_node_fs72 = require("node:fs");
-var MIN_NODE_MAJOR = 20;
-function which(bin) {
-  return whichSync(bin, { real: false });
-}
-function checkNode() {
-  const version = process.version;
-  const major = Number.parseInt(version.slice(1), 10);
-  const ok = Number.isFinite(major) && major >= MIN_NODE_MAJOR;
-  return {
-    id: "node",
-    label: "Node.js",
-    status: ok ? "ok" : "missing",
-    detail: version,
-    remedy: ok ? void 0 : `Node.js ${MIN_NODE_MAJOR}+ required \u2014 update from https://nodejs.org`,
-    required: true
-  };
-}
-function checkGit() {
-  let detail = "";
-  try {
-    detail = (0, import_node_child_process19.execSync)("git --version", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return {
-      id: "git",
-      label: "git",
-      status: "missing",
-      detail: "not found",
-      remedy: "Install git from https://git-scm.com",
-      required: true
-    };
-  }
-  return { id: "git", label: "git", status: "ok", detail, required: true };
-}
-function checkClaude() {
-  const path = which("claude");
-  return {
-    id: "claude",
-    label: "Claude Code",
-    status: path ? "ok" : "warn",
-    detail: path ?? "not found",
-    remedy: path ? void 0 : "Hooks are wired but need Claude Code to fire \u2014 https://claude.com/claude-code",
-    required: false
-  };
-}
-var ANALYSIS_CLI_REMEDY = "Reinstall Verity, which includes it: npm install -g @codacy/verity-cli";
-function checkAnalysisCli(opts = {}) {
-  const base = { id: "analysis-cli", label: "@codacy/analysis-cli", required: false };
-  const analyzer = resolveAnalyzer(opts);
-  const shown = (opts.onPathDisplay ?? (() => which("codacy-analysis")))();
-  if (!analyzer) {
-    return { ...base, status: "warn", detail: "not found", remedy: `${ANALYSIS_CLI_REMEDY} (static findings are unavailable until then)` };
-  }
-  if (analyzer.source === "path") {
-    return { ...base, status: "ok", detail: `${shown ?? analyzer.path} (on PATH)`, source: "path" };
-  }
-  const unused = shown && !sameFile(shown, analyzer.path) ? shown : void 0;
-  return {
-    ...base,
-    status: "ok",
-    detail: `${analyzer.version} (bundled with Verity)`,
-    source: "bundled",
-    version: analyzer.version,
-    ...unused && { unused }
-  };
-}
-function sameFile(a, b) {
-  try {
-    return (0, import_node_fs72.realpathSync)(a) === (0, import_node_fs72.realpathSync)(b);
-  } catch {
-    return false;
-  }
-}
-var INSTALL_TIMEOUT_MS = 12e4;
-function run3(command, args2, opts = {}) {
-  return new Promise((resolve9) => {
-    const child = (0, import_node_child_process19.spawn)(command, args2, {
-      stdio: opts.inherit ? "inherit" : "pipe",
-      timeout: INSTALL_TIMEOUT_MS
-    });
-    child.on("error", () => resolve9(false));
-    child.on("close", (code) => resolve9(code === 0));
-  });
-}
-async function installAnalysisCli(opts = {}) {
-  const spinner = opts.quiet ? { succeed: () => {
-  }, warn: () => {
-  }, stop: () => {
-  } } : startSpinner("Installing @codacy/analysis-cli");
-  const ok = await run3("npm", ["install", "-g", "@codacy/analysis-cli"]);
-  if (ok) {
-    const check = checkAnalysisCli();
-    if (check.status === "ok") {
-      spinner.succeed("@codacy/analysis-cli installed");
-      return { ...check, justInstalled: true };
-    }
-    spinner.warn("npm reported success but codacy-analysis is not on PATH");
-    return check;
-  }
-  spinner.stop();
-  {
-    const failed = {
-      id: "analysis-cli",
-      label: "@codacy/analysis-cli",
-      status: "warn",
-      detail: "install failed",
-      remedy: ANALYSIS_CLI_REMEDY,
-      required: false
-    };
-    if (opts.sudo === false || !process.stdin.isTTY || !process.stdout.isTTY) return failed;
-    process.stderr.write("  Retrying with sudo (you may be asked for your password)\u2026\n");
-    const sudoOk = await run3("sudo", ["npm", "install", "-g", "@codacy/analysis-cli"], { inherit: true });
-    if (!sudoOk) return failed;
-    const check = checkAnalysisCli();
-    return check.status === "ok" ? { ...check, justInstalled: true } : check;
-  }
-}
-async function checkPrereqs(opts = {}) {
-  const checks = [checkNode(), checkGit(), checkClaude()];
-  let analysis = checkAnalysisCli();
-  if (analysis.status !== "ok" && opts.install) {
-    analysis = await installAnalysisCli();
-  }
-  checks.push(analysis);
-  return { checks, blocked: checks.some((c) => c.required && c.status !== "ok") };
-}
-
-// src/lib/telemetry-local.ts
-var import_node_path61 = require("node:path");
-
-// src/lib/telemetry-settings.ts
-var import_promises16 = require("node:fs/promises");
-var import_node_os14 = require("node:os");
-var import_node_path60 = require("node:path");
-var SETTINGS_LOCAL_FILE2 = ".claude/settings.local.json";
-var OTEL_HEADERS_HELPER_CMD = "verity telemetry headers";
-var LEGACY_HEADER_KEY = "OTEL_EXPORTER_OTLP_HEADERS";
-var OTLP_ENDPOINT_KEYS = [
-  "OTEL_EXPORTER_OTLP_ENDPOINT",
-  "OTEL_EXPORTER_OTLP_METRICS_ENDPOINT",
-  "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT",
-  "OTEL_EXPORTER_OTLP_LOGS_ENDPOINT"
-];
-function claudeConfigDir2() {
-  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path60.join)((0, import_node_os14.homedir)(), ".claude");
-}
-function userSettingsPath() {
-  return (0, import_node_path60.join)(claudeConfigDir2(), "settings.json");
+function userSettingsPath() {
+  return (0, import_node_path58.join)(claudeConfigDir2(), "settings.json");
 }
 function deriveOtlpEndpoint(serviceUrl) {
   return serviceUrl.replace(/\/+$/, "").replace(/\/v1$/, "") + "/v1/otlp";
@@ -41082,7 +40787,7 @@ function envOf(settings) {
   return env && typeof env === "object" && !Array.isArray(env) ? env : {};
 }
 function displayPath(path) {
-  const home = (0, import_node_os14.homedir)();
+  const home = (0, import_node_os12.homedir)();
   return home && path.startsWith(home + "/") ? "~" + path.slice(home.length) : path;
 }
 async function readSettingsFile(path) {
@@ -41172,19 +40877,19 @@ async function healLocalTelemetry(root = repoRoot()) {
   if (settings.env && Object.keys(env).length === 0) delete settings.env;
   if (plan.helper) delete settings.otelHeadersHelper;
   const next = nextLocalBytes(local.raw, settings);
-  if (next !== null && !replaceInRoot((0, import_node_path61.join)(root, ".claude"), "settings.local.json", next)) {
+  if (next !== null && !replaceInRoot((0, import_node_path59.join)(root, ".claude"), "settings.local.json", next)) {
     return { removed: [] };
   }
   return { removed: [...plan.envKeys, ...plan.helper ? ["otelHeadersHelper"] : []] };
 }
 
 // src/lib/telemetry-gate.ts
-var import_node_child_process20 = require("node:child_process");
-var import_node_fs73 = require("node:fs");
-var import_node_path62 = require("node:path");
+var import_node_child_process18 = require("node:child_process");
+var import_node_fs70 = require("node:fs");
+var import_node_path60 = require("node:path");
 var PROJECT_MARKERS = ["setup.json", "config.json"];
 function writtenOnThisMachine(root, rel) {
-  const r = (0, import_node_child_process20.spawnSync)("git", hardenedGitArgv(["ls-files", "--error-unmatch", "--", rel]), {
+  const r = (0, import_node_child_process18.spawnSync)("git", hardenedGitArgv(["ls-files", "--error-unmatch", "--", rel]), {
     cwd: root,
     env: hardenedGitEnv(),
     encoding: "utf-8",
@@ -41198,10 +40903,10 @@ function writtenOnThisMachine(root, rel) {
 function isTelemetryProject() {
   for (const root of [repoRoot(), mainWorktreeRoot()]) {
     if (!root) continue;
-    const dir = (0, import_node_path62.join)(root, VERITY_DIR);
+    const dir = (0, import_node_path60.join)(root, VERITY_DIR);
     if (isMachineStore(dir)) continue;
     for (const marker of PROJECT_MARKERS) {
-      if ((0, import_node_fs73.existsSync)((0, import_node_path62.join)(dir, marker)) && writtenOnThisMachine(root, `${VERITY_DIR}/${marker}`)) return true;
+      if ((0, import_node_fs70.existsSync)((0, import_node_path60.join)(dir, marker)) && writtenOnThisMachine(root, `${VERITY_DIR}/${marker}`)) return true;
     }
   }
   return false;
@@ -41330,1319 +41035,1301 @@ async function uninstallTelemetry() {
   return { ok: true, data: { removed, settingsPath: path, foreignEndpoint, healedLocalKeys: healed.removed } };
 }
 
-// src/commands/init/steps.ts
-function languageShares(d) {
-  const total = d.languages.reduce((n2, l) => n2 + (d.languageCounts[l] ?? 0), 0);
-  if (total === 0) return [];
-  const shares = d.languages.map((l) => ({ name: displayName(l), pct: Math.round((d.languageCounts[l] ?? 0) / total * 100) }));
-  const top = shares.slice(0, 2);
-  const rest = 100 - top.reduce((n2, s) => n2 + s.pct, 0);
-  return rest > 0 && shares.length > 2 ? [...top, { name: "Other", pct: rest }] : top;
+// src/commands/migrate.ts
+var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
+function defaultNpmRemover(pkg) {
+  (0, import_node_child_process19.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
 }
-var NAMES = {
-  typescript: "TypeScript",
-  javascript: "JavaScript",
-  python: "Python",
-  go: "Go",
-  java: "Java",
-  kotlin: "Kotlin",
-  ruby: "Ruby",
-  rust: "Rust",
-  c: "C",
-  cpp: "C++",
-  shell: "Shell",
-  dockerfile: "Dockerfile",
-  csharp: "C#",
-  php: "PHP",
-  swift: "Swift",
-  scala: "Scala",
-  sql: "SQL"
-};
-var displayName = (l) => NAMES[l] ?? l.charAt(0).toUpperCase() + l.slice(1);
-var STACK_NAMES = {
-  "next.js": "Next.js",
-  next: "Next.js",
-  react: "React",
-  vue: "Vue",
-  angular: "Angular",
-  svelte: "Svelte",
-  express: "Express",
-  nestjs: "NestJS",
-  fastify: "Fastify",
-  prisma: "Prisma",
-  django: "Django",
-  flask: "Flask",
-  fastapi: "FastAPI",
-  rails: "Rails",
-  spring: "Spring",
-  vitest: "Vitest",
-  jest: "Jest",
-  mocha: "Mocha",
-  playwright: "Playwright",
-  cypress: "Cypress",
-  supabase: "Supabase",
-  stripe: "Stripe",
-  tailwind: "Tailwind"
-};
-async function repoStep(ui, detected) {
-  ui.rail.done("Looked at your repository");
-  await ui.rail.languages(languageShares(detected));
-  const stack = [...detected.frameworks, detected.buildSystem, detected.testFramework].filter(Boolean).map((n2) => STACK_NAMES[n2.toLowerCase()] ?? n2);
-  const files = `${detected.filesScanned.toLocaleString("en-US")} ${detected.filesScanned === 1 ? "file" : "files"}`;
-  ui.rail.line([...stack, files].join(" \xB7 "), stack.length ? "plain" : "muted");
-  ui.rail.gap();
-  ui.rail.settle();
+function git2(cwd, args2) {
+  (0, import_node_child_process19.execFileSync)("git", hardenedGitArgv(args2), { cwd, stdio: "pipe", env: hardenedGitEnv() });
 }
-async function prerequisitesStep(ui) {
-  const report = await checkPrereqs({ install: false });
-  const analysis = report.checks.find((c) => c.id === "analysis-cli");
-  if (analysis && analysis.status !== "ok") {
-    const s = ui.screen.s;
-    const installed2 = await ui.screen.spin(`${s.gray}\u2502${s.reset}  `, () => "Verity's copy of the Codacy analysis CLI is missing. Installing it (it runs the Trivy security scan)", installAnalysisCli({ quiet: true, sudo: false }));
-    report.checks[report.checks.indexOf(analysis)] = installed2;
-    if (installed2.status === "ok") ui.rail.ticked("Installed the Codacy analysis CLI");
+function isGitTracked(cwd, relPath) {
+  try {
+    git2(cwd, ["ls-files", "--error-unmatch", "--", relPath]);
+    return true;
+  } catch {
+    return false;
   }
-  for (const c of report.checks) {
-    if (c.status === "ok") continue;
-    ui.rail.warn(terminalText(`${c.label}: ${c.detail}`, 300));
-    if (c.remedy) ui.rail.line(terminalText(c.remedy, 300));
+}
+function isGitRepo(cwd) {
+  try {
+    git2(cwd, ["rev-parse", "--is-inside-work-tree"]);
+    return true;
+  } catch {
+    return false;
   }
-  ui.rail.settle();
-  return !report.checks.some((c) => c.required && c.status !== "ok");
 }
-async function telemetryStep(ui, answer, resumeDeferred, globals, previous) {
-  if (answer === "already-on") return "enabled";
-  if (answer === "no") return "declined";
-  if (answer === "turn-off") {
-    const removed = await uninstallTelemetry();
-    if (removed.ok) ui.rail.done("Cost & usage telemetry turned off (--telemetry off)");
-    else ui.rail.warn(`Could not turn telemetry off: ${terminalText(removed.error, 200)}`);
-    ui.rail.settle();
-    return "declined";
+async function runMigration(opts = {}) {
+  const root = opts.cwd ?? repoRoot();
+  const home = opts.home ?? process.env.HOME ?? "";
+  const npmRemover = opts.npmRemover ?? defaultNpmRemover;
+  const actions = [];
+  const movedProjectDir = migrateProjectDir(root, actions);
+  migrateGlobalCredentials(home, actions);
+  await migrateLegacyHooks(root, actions);
+  await migrateClaudeMd(root, actions);
+  migrateStandardFile(root, actions);
+  await migrateLocalTelemetry(root, actions);
+  removeLegacyPackage(movedProjectDir, npmRemover, actions);
+  return { actions, migrated: actions.length > 0 };
+}
+function migrateProjectDir(root, actions) {
+  const gateDir = (0, import_node_path61.join)(root, ".gate");
+  const verityDir = (0, import_node_path61.join)(root, ".verity");
+  if ((0, import_node_fs71.existsSync)(gateDir) && !(0, import_node_fs71.existsSync)(verityDir)) {
+    return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if (answer === "not-asked" && !resumeDeferred) {
-    if (!ui.asking || previous === "declined") return void 0;
-    if (!(await resolveToken(globals.token)).ok) return void 0;
-    if ((await checkTelemetry()).enabled) return "enabled";
-    if (!await askTelemetry(ui)) {
-      ui.rail.line("Telemetry stays off. Turn it on later: verity telemetry install", "muted");
-      ui.rail.settle();
-      return "declined";
-    }
+  if ((0, import_node_fs71.existsSync)(gateDir) && (0, import_node_fs71.existsSync)(verityDir)) {
+    return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
-  const token = await resolveToken(globals.token);
-  const url = await resolveServiceUrl(globals.serviceUrl);
-  if (!token.ok || !url.ok) {
-    ui.rail.line("Telemetry needs sign-in. Then run: verity telemetry install", "warn");
-    ui.rail.settle();
-    return "deferred";
+  return false;
+}
+function migrateProjectDirRename(root, gateDir, verityDir, actions) {
+  let moved = false;
+  if (isGitRepo(root) && isGitTracked(root, ".gate")) {
+    if (hasStagedChanges(root)) {
+      printWarn(
+        "Migrating .gate \u2192 .verity with `git mv` while the index has staged changes \u2014 the rename will be staged alongside them. Review `git status` before committing."
+      );
+    }
+    try {
+      git2(root, ["mv", "--", ".gate", ".verity"]);
+      actions.push("Moved .gate/ \u2192 .verity/ (git mv, staged)");
+      moved = true;
+    } catch {
+    }
   }
-  const installed2 = await installTelemetry(url.data);
-  if (installed2.ok) {
-    ui.rail.done("Cost & usage telemetry on");
-    ui.rail.line("It starts with your next Claude Code session. See cost and usage at /usage.");
-  } else {
-    ui.rail.warn(`Could not turn telemetry on: ${terminalText(installed2.error, 200)}`);
+  if (moved) {
+    if ((0, import_node_fs71.existsSync)(gateDir)) {
+      const carried = carryLegacyContents(gateDir, verityDir);
+      if (carried > 0) {
+        actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
+      }
+      try {
+        (0, import_node_fs71.rmSync)(gateDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+    return true;
   }
-  ui.rail.gap();
-  ui.rail.settle();
-  return installed2.ok ? "enabled" : void 0;
-}
-async function askTelemetry(ui) {
-  const { rail, screen } = ui;
-  rail.active("Send Claude Code cost and usage from this machine to Verity?");
-  rail.line("Token counts, cost, models, tool names and the repository name, from every Claude Code session on this machine. No prompts, no code, no file contents.");
-  rail.line("See it on the /usage page. Turn it off any time: verity telemetry uninstall");
-  rail.gap();
-  rail.keys([["Enter", "yes"], ["n", "no"]]);
-  const k = await screen.key(["enter", "n"], "enter", { freshMs: 300 });
-  rail.collapse();
-  return k !== "n";
-}
-function signInDetail(outcome) {
-  if (outcome === "already" || outcome === "new") return ["ok", outcome];
-  if (outcome === "declined" || outcome === "unattended") return ["skipped", outcome];
-  return ["failed", outcome === "unreachable" ? "unreachable" : "error"];
-}
-function formalDefault(previous, opts = {}) {
-  const cfg = readProjectConfig();
-  if (previous?.init?.completed_at || opts.setUpBefore || cfg.formal !== void 0 || cfg.formal_refused) return false;
-  writeProjectConfig({ formal: "push" });
+  moveDir(gateDir, verityDir);
+  actions.push("Moved .gate/ \u2192 .verity/");
   return true;
 }
-function sayFormalOn(ui) {
-  ui.rail.done("Formal verification at push: on");
-  ui.rail.line("At push, Verity checks a small model of the riskiest changed function and replays any counterexample on the real code. That function's source is sent to Verity for the replay.");
-  ui.rail.line("Only a reproduced bug can block, and most pushes get no model. Turn it off: verity config formal off");
-}
-function backgroundStep(ui, opts) {
-  const { rail } = ui;
-  const formal = readProjectConfig().formal;
-  const said = opts.formalNew === true && formal === "push";
-  if (said) sayFormalOn(ui);
-  const lean = shouldStartBackgroundInstall({ formal });
-  const leanStarted = lean.start && startBackgroundInstall({ cli: opts.cli });
-  const trivy = startTrivyPrewarm();
-  const parts2 = [
-    ...trivy ? ["Trivy security scanner"] : [],
-    ...leanStarted ? ["Lean 4 for formal checks at push (800 MB)"] : [],
-    ...!lean.start && lean.why === "running" ? ["Lean 4 (already downloading)"] : []
-  ];
-  if (parts2.length) {
-    if (said) rail.gap();
-    rail.done("Getting ready in the background");
-    rail.line(parts2.join(" \xB7 "));
-    if (leanStarted) rail.line(said ? "Progress: verity lean status" : "Progress: verity lean status. Turn formal checks off: verity config formal off");
-  } else if (!lean.start && lean.why === "installed" && formal === "push" && !said) {
-    rail.done("Formal verification at push: on");
-  }
-  if (!lean.start && lean.why === "disk") {
-    rail.warn("Formal verification is on, but Lean 4 needs more disk space");
-    rail.line(`${lean.detail}. Free some space, then run: verity lean install`);
-  } else if (!lean.start && lean.why === "no-release" && formal === "push") {
-    rail.line("Lean 4 has no release for this machine, so the formal check at push is skipped.");
+function migrateProjectDirCarry(gateDir, verityDir, actions) {
+  const carried = carryLegacyContents(gateDir, verityDir);
+  if (carried > 0) {
+    actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
-  if (parts2.length || said || !lean.start && lean.why === "disk") rail.gap();
-  rail.settle();
-}
-
-// src/commands/init/scaffold.ts
-var import_promises17 = require("node:fs/promises");
-
-// src/lib/codacy-legacy.ts
-var import_node_child_process21 = require("node:child_process");
-var VERITY_ESLINT_CONFIG_FILE = ".codacy/tools-configs/eslint.config.mjs";
-var VERITY_ESLINT_LOCAL_PATH = "./.codacy/tools-configs/eslint.config.mjs";
-var VERITY_ESLINT_FIRST_LINE = "// Verity-owned ESLint config for the quality gate.";
-var MAX_BYTES = 256 * 1024;
-function classifyCodacyConfig(root = repoRoot()) {
-  const cfg = readRegularFileInRoot(root, CODACY_CONFIG_FILE, MAX_BYTES);
-  if (!cfg.ok) return cfg.reason === "missing" ? "none" : "foreign";
-  let parsed;
   try {
-    parsed = JSON.parse(cfg.content);
+    (0, import_node_fs71.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
-    return "foreign";
   }
-  const tools = typeof parsed === "object" && parsed !== null ? parsed.tools : void 0;
-  const pointsAtVerity2 = Array.isArray(tools) && tools.some((t) => typeof t === "object" && t !== null && t.localConfigurationFile === VERITY_ESLINT_LOCAL_PATH);
-  if (!pointsAtVerity2) return "foreign";
-  const eslint = readRegularFileInRoot(root, VERITY_ESLINT_CONFIG_FILE, MAX_BYTES);
-  return eslint.ok && eslint.content.startsWith(VERITY_ESLINT_FIRST_LINE) ? "verity" : "foreign";
+  return carried > 0;
 }
-function isTracked(root, path) {
-  try {
-    (0, import_node_child_process21.execFileSync)("git", ["ls-files", "--error-unmatch", "--", path], { cwd: root, stdio: "pipe" });
-    return true;
-  } catch {
-    return false;
+function migrateGlobalCredentials(home, actions) {
+  if (!home) return;
+  const gateCreds = (0, import_node_path61.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path61.join)(home, ".verity", "credentials");
+  if (!(0, import_node_fs71.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs71.existsSync)(verityCreds)) {
+    (0, import_node_fs71.mkdirSync)((0, import_node_path61.join)(home, ".verity"), { recursive: true });
+    moveFile(gateCreds, verityCreds);
+    actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
+    return;
+  }
+  const added = mergeGlobalCredentials(gateCreds, verityCreds);
+  if (added > 0) {
+    actions.push(
+      `Merged ${added} legacy credential line(s) from ~/.gate/credentials into ~/.verity/credentials`
+    );
   }
 }
-function removeVerityCodacyConfig(root = repoRoot()) {
-  const removed = [];
-  const untracked = [];
+async function migrateLegacyHooks(root, actions) {
+  const settings = await readSettingsAt(root);
+  const settingsBefore = JSON.stringify(settings);
+  const updatedSettings = removeVerityHooks(settings);
+  if (settingsBefore !== JSON.stringify(updatedSettings)) {
+    await writeSettingsAt(root, updatedSettings);
+    actions.push("Stripped legacy gate hooks from .claude/settings.json");
+  }
+}
+async function migrateClaudeMd(root, actions) {
+  const claudeMd = (0, import_node_path61.join)(root, "CLAUDE.md");
+  const hadLegacyBlock = (0, import_node_fs71.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  if (!hadLegacyBlock) return;
   try {
-    for (const f of [CODACY_CONFIG_FILE, VERITY_ESLINT_CONFIG_FILE]) {
-      if (!isTracked(root, f)) {
-        untracked.push(f);
-        continue;
-      }
-      (0, import_node_child_process21.execFileSync)("git", ["rm", "--quiet", "--", f], { cwd: root, stdio: "pipe" });
-      removed.push(f);
-    }
+    await ensureClaudeMdPointer(root);
+    actions.push("Rewrote legacy gate-memory block in CLAUDE.md");
   } catch (err2) {
-    return { ok: false, removed, error: err2.message };
+    printWarn(`Could not rewrite CLAUDE.md block: ${err2.message}`);
   }
-  return { ok: true, removed, untracked };
 }
-
-// src/commands/init/scaffold.ts
-async function scaffoldStep(ui, given = {}) {
-  const { rail } = ui;
-  await (0, import_promises17.mkdir)(VERITY_DIR, { recursive: true });
-  await ensureMemoryDir();
-  const ignore = ensureVerityGitignore();
-  if (ignore === "failed") {
-    rail.warn(".gitignore: could not write the Verity block");
-    rail.line("Add it by hand: .verity/ holds copies of analyzed files, including any secret the gate flagged.");
-  } else if (ignore === "conflict") {
-    rail.warn(".gitignore: git still ignores .verity/standard.yaml");
-    rail.line("A global or nested .gitignore covers it, so the Standard cannot be committed. Check: git check-ignore -v .verity/standard.yaml");
-  } else if (ignore === "memory-tracked") {
-    rail.warn("This project commits its knowledge graph");
-  }
-  const trackedMemory = memoryOptOut() ? [] : committedMemoryFiles();
-  if (trackedMemory.length > 0) {
-    if (given.untrackMemory) {
-      const result = fenceMemory();
-      if (result.ok) rail.line(`Untracked ${result.untracked} knowledge-graph file(s) (staged). Commit to finish.`);
-      else rail.line("Could not untrack the knowledge graph. Run: verity memory untrack", "warn");
-    } else {
-      rail.warn(`${trackedMemory.length} knowledge-graph file(s) are tracked in git`);
-      rail.line("They show up in every diff. Stop with: verity memory untrack (or keep them on purpose: verity memory track)");
-    }
-  }
-  const tracked = committedVerityState();
-  if (tracked.length > 0) {
-    if (given.untrackState || ui.asking && await askUntrackState(ui, tracked)) {
-      const result = untrackVerityState();
-      if (result === "untracked") rail.line("Untracked the Verity state files (staged). Commit to finish.");
-      else if (result === "failed") rail.line("Could not untrack them. Run: git rm -r --cached .verity && git add .verity/standard.yaml", "warn");
-    } else {
-      rail.warn(`${tracked.length} Verity state file(s) are tracked in git`);
-      rail.line(`For example ${terminalText(tracked[0], 200)}. Fix: git rm -r --cached .verity && git add .verity/standard.yaml`);
+function migrateStandardFile(root, actions) {
+  const gateMd = (0, import_node_path61.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path61.join)(root, "VERITY.md");
+  if (!(0, import_node_fs71.existsSync)(gateMd) || (0, import_node_fs71.existsSync)(verityMd)) return;
+  let moved = false;
+  if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
+    try {
+      git2(root, ["mv", "--", "GATE.md", "VERITY.md"]);
+      moved = true;
+    } catch {
     }
   }
-  retireCodacyConfig(ui);
+  if (!moved) moveFile(gateMd, verityMd);
+  const content = readFileSyncSafe(verityMd);
+  const refreshed = content.split("GATE.md").join("VERITY.md");
+  if (refreshed !== content) (0, import_node_fs71.writeFileSync)(verityMd, refreshed);
+  actions.push("Renamed GATE.md \u2192 VERITY.md");
+}
+async function migrateLocalTelemetry(root, actions) {
+  const { removed } = await healLocalTelemetry(root);
+  if (removed.length === 0) return;
+  actions.push(
+    `Removed ${removed.length} old Verity telemetry key(s) from ${SETTINGS_LOCAL_FILE2} (Claude Code ignores them there). Run "verity telemetry install" to export from this machine.`
+  );
+}
+function removeLegacyPackage(movedProjectDir, npmRemover, actions) {
+  if (!movedProjectDir) return;
   try {
-    await ensureClaudeMdPointer();
+    npmRemover(LEGACY_NPM_PACKAGE);
+    actions.push(`Removed legacy global package ${LEGACY_NPM_PACKAGE}`);
   } catch (err2) {
-    rail.line(`Could not update CLAUDE.md: ${err2.message}`, "warn");
+    printWarn(
+      `Could not remove ${LEGACY_NPM_PACKAGE} (${err2.message}). Remove it manually: npm rm -g ${LEGACY_NPM_PACKAGE}`
+    );
   }
-  const cfg = readProjectConfig();
-  if (cfg.formal_refused) rail.line(`Formal verification: off \u2014 ${formalRefusalMessage(cfg.formal_refused)}`, "warn");
-  rail.settle();
 }
-async function askUntrackState(ui, tracked) {
-  const { rail, screen } = ui;
-  rail.active(`${tracked.length} Verity state file(s) are tracked in git`);
-  rail.line(`For example ${terminalText(tracked[0], 200)}. They can hold copies of secrets the gate flagged, and each push shares them.`);
-  rail.line("Stop tracking them? The files stay on disk, and the removal is staged for you to commit.");
-  rail.line("Copies already pushed stay in the git history: rotate any secret the gate flagged.");
-  rail.gap();
-  rail.keys([["Enter", "stop tracking them"], ["n", "keep them tracked"]]);
-  const k = await screen.key(["enter", "n"], "enter", { freshMs: 300 });
-  rail.collapse();
-  return k !== "n";
+function credentialRemoteKey(line2) {
+  const trimmed = line2.trim();
+  if (trimmed === "") return null;
+  const idx = trimmed.indexOf(" token:");
+  return idx === -1 ? trimmed : trimmed.slice(0, idx).trim();
 }
-function retireCodacyConfig(ui) {
-  const kind2 = classifyCodacyConfig();
-  if (kind2 === "none") return;
-  if (kind2 === "foreign") {
-    ui.rail.line("Verity no longer reads .codacy/. Remove it if nothing else uses it.", "muted");
-    return;
+function mergeGlobalCredentials(gateCreds, verityCreds) {
+  const verityContent = readFileSyncSafe(verityCreds);
+  const existingKeys = new Set(
+    verityContent.split("\n").map(credentialRemoteKey).filter((k) => k !== null)
+  );
+  const toAppend = [];
+  for (const line2 of readFileSyncSafe(gateCreds).split("\n")) {
+    const key = credentialRemoteKey(line2);
+    if (key === null || existingKeys.has(key)) continue;
+    existingKeys.add(key);
+    toAppend.push(line2.replace(/\r$/, ""));
   }
-  const result = removeVerityCodacyConfig();
-  if (result.ok) {
-    if (result.removed.length > 0) {
-      ui.rail.done("Removed the .codacy/ config that an older Verity wrote (staged)");
-      ui.rail.line("Verity runs Trivy from .verity/static-analysis.json now. To keep the files: git restore --staged --worktree .codacy");
-    }
-    if (result.untracked.length > 0) {
-      ui.rail.line(`An older Verity wrote ${result.untracked.join(" and ")}, and Verity no longer uses them. Remove them by hand: rm ${result.untracked.join(" ")}`, "warn");
-    }
-  } else {
-    ui.rail.warn("Could not remove the .codacy/ config that an older Verity wrote");
-    ui.rail.line(terminalText(result.error, 200));
+  if (toAppend.length > 0) {
+    const sep7 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
+    (0, import_node_fs71.writeFileSync)(verityCreds, verityContent + sep7 + toAppend.join("\n") + "\n");
   }
+  (0, import_node_fs71.rmSync)(gateCreds, { force: true });
+  return toAppend.length;
 }
-
-// src/commands/init/wiring.ts
-var import_node_fs74 = require("node:fs");
-var import_promises18 = require("node:fs/promises");
-var import_node_path63 = require("node:path");
-var DEFAULT_MOMENTS = ["stop", "pre-commit", "pre-push"];
-async function momentsFromInstalledHooks() {
-  const status = await checkAllVerityHooks();
-  const wired = [];
-  if (status.stop) wired.push("stop");
-  if (status.guardOn.includes("commit")) wired.push("pre-commit");
-  if (status.guardOn.includes("push")) wired.push("pre-push");
-  return wired.length > 0 ? wired : DEFAULT_MOMENTS;
-}
-async function askSetupQuestions(_defaultsOnly, previous, given = {}) {
-  const moments = given.moments ?? (previous?.moments?.length ? previous.moments : await momentsFromInstalledHooks());
-  let telemetry = "not-asked";
-  if (given.telemetry !== void 0) {
-    const enabled = (await checkTelemetry()).enabled;
-    telemetry = given.telemetry ? enabled ? "already-on" : "yes" : enabled ? "turn-off" : "no";
+function readFileSyncSafe(path) {
+  try {
+    return (0, import_node_fs71.readFileSync)(path, "utf-8");
+  } catch {
+    return "";
   }
-  return { moments, telemetry };
-}
-function parseTelemetryAnswer(raw) {
-  const v = raw.trim().toLowerCase();
-  if (v === "on") return true;
-  if (v === "off") return false;
-  return null;
-}
-function planMoments(answers, opts) {
-  const existing = readProjectConfig();
-  const keptUserChoice = !opts.given && existing.git_moments_source === "user";
-  const gitMoments = keptUserChoice ? existing.git_moments : [
-    ...answers.includes("pre-commit") ? ["commit"] : [],
-    ...answers.includes("pre-push") ? ["push"] : []
-  ];
-  const turnOn = keptUserChoice && existing.turn_review ? existing.turn_review === "on" : answers.includes("stop");
-  return {
-    momentIds: [
-      ...turnOn ? ["stop"] : [],
-      ...gitMoments.includes("commit") ? ["pre-commit"] : [],
-      ...gitMoments.includes("push") ? ["pre-push"] : []
-    ],
-    gitMoments,
-    turnOn,
-    keptUserChoice
-  };
 }
-function momentsStep(ui, plan) {
-  const said = describeReviewMoments(plan.momentIds);
-  if (plan.momentIds.length === 0) {
-    ui.rail.warn("Verity reviews nothing");
-    ui.rail.line("Code changes are not reviewed. Turn the moments on: verity config moments turn,commit,push", "warn");
-  } else {
-    ui.rail.done(`Verity reviews ${said}`);
-    ui.rail.line("To change it, run verity config moments, or just ask Claude.");
+function hasStagedChanges(root) {
+  try {
+    git2(root, ["diff", "--cached", "--quiet", ...DIFF_READ_FLAGS]);
+    return false;
+  } catch {
+    return true;
   }
-  if (plan.keptUserChoice) {
-    ui.rail.line(`Keeping the git moments you set: ${plan.gitMoments.join(", ") || "none"} (this run asked no questions, so it does not overrule them).`);
+}
+function moveDir(from, to) {
+  try {
+    (0, import_node_fs71.renameSync)(from, to);
+  } catch (err2) {
+    if (err2.code !== "EXDEV") throw err2;
+    (0, import_node_fs71.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs71.rmSync)(from, { recursive: true, force: true });
   }
-  ui.rail.gap();
-  ui.rail.settle();
 }
-var SKILLS = [
-  "verity-setup",
-  "verity-analyze",
-  "verity-status",
-  "verity-feedback",
-  "verity-learn",
-  "verity-memory",
-  "verity-insights",
-  "verity-reflect",
-  "verity-init",
-  "verity-prove"
-];
-function resolveDataDir2() {
-  const candidates2 = [
-    (0, import_node_path63.join)(__dirname, "..", "data"),
-    (0, import_node_path63.join)(__dirname, "..", "..", "data"),
-    (0, import_node_path63.join)(process.cwd(), "cli", "data")
-  ];
-  for (const candidate of candidates2) {
-    if ((0, import_node_fs74.existsSync)((0, import_node_path63.join)(candidate, "skills"))) return candidate;
+function moveFile(from, to) {
+  try {
+    (0, import_node_fs71.renameSync)(from, to);
+  } catch (err2) {
+    if (err2.code !== "EXDEV") throw err2;
+    (0, import_node_fs71.cpSync)(from, to);
+    (0, import_node_fs71.rmSync)(from, { force: true });
   }
-  throw new Error("Could not find Verity skill data. Reinstall: npm install -g @codacy/verity-cli");
 }
-async function skillIsCurrent(src, dest) {
-  const list2 = (dir) => {
-    const out2 = [];
-    const walk2 = (d, prefix) => {
-      for (const e of (0, import_node_fs74.readdirSync)(d, { withFileTypes: true })) {
-        const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk2((0, import_node_path63.join)(d, e.name), rel);
-        else if (e.isFile()) out2.push(rel);
+function carryLegacyContents(gateDir, verityDir) {
+  if (!isRealDir(gateDir) || !isRealDir(verityDir)) return 0;
+  let copied = 0;
+  const walk2 = (relDir) => {
+    let entries;
+    try {
+      entries = (0, import_node_fs71.readdirSync)((0, import_node_path61.join)(gateDir, relDir), { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const rel = relDir ? (0, import_node_path61.join)(relDir, entry.name) : entry.name;
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        walk2(rel);
+        continue;
       }
-    };
-    walk2(dir, "");
-    return out2.sort();
+      if (!entry.isFile() || !ensureRealDirs(verityDir, relDir)) continue;
+      const opened = openRegularInRoot(gateDir, rel);
+      if (!opened.ok) continue;
+      try {
+        (0, import_node_fs71.writeFileSync)((0, import_node_path61.join)(verityDir, rel), readOpened(opened.fd, opened.size), { flag: "wx", mode: 384 });
+        copied++;
+      } catch {
+      }
+    }
   };
+  walk2("");
+  return copied;
+}
+function isRealDir(path) {
   try {
-    const shipped = list2(src);
-    if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
-    for (const rel of shipped) {
-      if (await (0, import_promises18.readFile)((0, import_node_path63.join)(src, rel), "utf-8") !== await (0, import_promises18.readFile)((0, import_node_path63.join)(dest, rel), "utf-8")) return false;
-    }
-    return true;
+    const st = (0, import_node_fs71.lstatSync)(path);
+    return st.isDirectory() && !st.isSymbolicLink();
   } catch {
     return false;
   }
 }
-async function installSkills(force) {
-  const source2 = (0, import_node_path63.join)(resolveDataDir2(), "skills");
-  const missing = [];
-  for (const skill of SKILLS) {
-    const src = (0, import_node_path63.join)(source2, skill);
-    const dest = (0, import_node_path63.join)(".claude/skills", skill);
-    if (!(0, import_node_fs74.existsSync)(src)) {
-      missing.push(skill);
-      continue;
+function ensureRealDirs(root, relDir) {
+  let current = root;
+  for (const segment of relDir.split(/[\\/]/).filter(Boolean)) {
+    current = (0, import_node_path61.join)(current, segment);
+    try {
+      (0, import_node_fs71.mkdirSync)(current);
+    } catch (e) {
+      if (e.code !== "EEXIST") return false;
     }
-    if ((0, import_node_fs74.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) continue;
-    await (0, import_promises18.mkdir)(dest, { recursive: true });
-    await (0, import_promises18.cp)(src, dest, { recursive: true, force: true });
+    if (!isRealDir(current)) return false;
   }
-  return missing;
+  return true;
 }
-async function hooksStep(ui, ctx) {
-  const { rail } = ui;
-  if (ctx.staleMarker) rail.line(`Cleared a stale plugin marker \u2014 ${ctx.staleMarker} is no longer installed.`);
-  if (!ctx.plan.keptUserChoice) {
-    writeProjectConfig({ git_moments: ctx.plan.gitMoments, git_moments_source: "init", turn_review: ctx.plan.turnOn ? "on" : "off" });
-  }
-  if (ctx.pluginMode) {
-    rail.done(`Hooks here: the Verity Claude Code plugin${ctx.pluginWhere}`);
-    rail.line("Skills and hooks come from the plugin, so this run installs neither, and removes any this project still has from an npm install.");
-    rail.line("Want this project to own its own copy instead? Uninstall the plugin, or use --no-plugin.");
-    const settings = await readSettings();
-    const stripped = removeVerityHooks(settings);
-    if (JSON.stringify(settings.hooks ?? {}) !== JSON.stringify(stripped.hooks ?? {})) {
-      await writeSettings(stripped);
-      rail.line("Removed this project's Verity hooks from .claude/settings.json. The plugin wires them now, so each turn is reviewed once.");
+async function needsMigration(root = repoRoot()) {
+  const gateDir = (0, import_node_path61.join)(root, ".gate");
+  const verityDir = (0, import_node_path61.join)(root, ".verity");
+  if ((0, import_node_fs71.existsSync)(gateDir) && !(0, import_node_fs71.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs71.existsSync)(gateDir) && (0, import_node_fs71.existsSync)(verityDir)) {
+    if ((0, import_node_fs71.existsSync)((0, import_node_path61.join)(gateDir, "credentials")) && !(0, import_node_fs71.existsSync)((0, import_node_path61.join)(verityDir, "credentials"))) {
+      return true;
     }
-    const removed = removeProjectSkills();
-    if (removed.length > 0) rail.line(`Removed ${removed.length} project-local skill${removed.length === 1 ? "" : "s"} that the plugin supersedes.`);
-  } else {
-    if (ctx.overridingPlugin) {
-      rail.warn("Hooks here: this project's .claude/settings.json (--no-plugin)");
-      rail.line("The Verity plugin is active on this machine and would own them. Both sets fire; the settings.json copy stands down at run time, so each turn is reviewed once.");
-    } else {
-      rail.done("Hooks here: this project's .claude/settings.json");
+    if ((0, import_node_fs71.existsSync)((0, import_node_path61.join)(gateDir, "memory")) && !(0, import_node_fs71.existsSync)((0, import_node_path61.join)(verityDir, "memory"))) {
+      return true;
     }
-    const missing = await installSkills(ctx.force);
-    if (missing.length > 0) rail.line(`Skill data not found: ${missing.join(", ")}`, "warn");
-    await applyMomentSelection(ctx.plan.momentIds);
   }
-  rail.gap();
-  rail.settle();
+  const claudeMd = (0, import_node_path61.join)(root, "CLAUDE.md");
+  if ((0, import_node_fs71.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+    return true;
+  }
+  if ((0, import_node_fs71.existsSync)((0, import_node_path61.join)(root, "GATE.md")) && !(0, import_node_fs71.existsSync)((0, import_node_path61.join)(root, "VERITY.md"))) {
+    return true;
+  }
+  if (await hasLegacyHooksAt(root)) return true;
+  return false;
+}
+function registerMigrateCommand(program2) {
+  program2.command("migrate").description("Migrate a legacy GATE.md install to Verity (.gate \u2192 .verity, hooks, CLAUDE.md)").action(async () => {
+    let result;
+    try {
+      result = await runMigration();
+    } catch (err2) {
+      printError(`Migration failed: ${err2.message}`);
+      process.exitCode = 1;
+      return;
+    }
+    if (!result.migrated) {
+      printInfo("Nothing to migrate \u2014 this project is already on Verity.");
+      return;
+    }
+    printInfo("Migration complete:");
+    for (const a of result.actions) printInfo(`  ${a} \u2713`);
+  });
 }
 
-// src/commands/init/standard.ts
-var import_node_fs75 = require("node:fs");
-
-// src/commands/init/rules.ts
-async function projectLabel(token, serviceUrl, verbose) {
+// src/commands/init/ui.ts
+var import_node_fs72 = require("node:fs");
+var import_node_path62 = require("node:path");
+var import_node_os13 = require("node:os");
+var import_node_child_process20 = require("node:child_process");
+function createInitUi(opts) {
+  const term = opts.term ?? detectTerm();
+  const screen = new Screen(term);
+  const rail = new Rail(screen);
+  return { term, screen, rail, asking: !opts.defaultsOnly && screen.canAsk() };
+}
+function installInterrupt(ui) {
+  const stop2 = () => {
+    ui.rail.stopped();
+    ui.screen.release();
+    process.exit(130);
+  };
+  ui.screen.startInput(stop2);
+  process.once("SIGINT", stop2);
+}
+var SEEN_FILE = ".init-seen";
+function firstInitOnMachine(home = process.env.HOME || (0, import_node_os13.homedir)()) {
+  return !(0, import_node_fs72.existsSync)((0, import_node_path62.join)(home, ".verity", SEEN_FILE));
+}
+function markInitSeen(home = process.env.HOME || (0, import_node_os13.homedir)()) {
+  replaceInRoot((0, import_node_path62.join)(home, ".verity"), SEEN_FILE, `${(/* @__PURE__ */ new Date()).toISOString()}
+`);
+}
+function repoLabel() {
   try {
-    const who = await whoami(token, serviceUrl, verbose);
-    return who.ok ? who.data.project_id : null;
+    const url = (0, import_node_child_process20.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    const parsed = parseRemote(url);
+    if (parsed) return terminalText(`${parsed.owner}/${parsed.repo}`, 120);
   } catch {
-    return null;
   }
+  return terminalText((0, import_node_path62.basename)(repoRoot()), 120);
 }
-function profilePreview(profile) {
-  return JSON.stringify(profile, null, 2).split("\n").slice(0, 12).map((l) => terminalText(l, 400)).concat(["\u2026", `The whole profile: ${PROFILE_FILE}`]);
-}
-async function rulesOffered(ui, globals) {
-  const token = await resolveToken(globals.token);
-  const url = await resolveServiceUrl(globals.serviceUrl);
-  if (!token.ok || !url.ok) return false;
-  const status = await generationStatus({ serviceUrl: url.data, token: token.data.token, verbose: globals.verbose });
-  if (status === "off") ui.rail.line("Project rules are not switched on for this project yet. The built-in rules apply.");
-  if (status === "unsupported") {
-    ui.rail.line(`This Verity service (${terminalText(url.data, 200)}) does not write project rules yet: it is older than this CLI. The built-in rules apply.`);
-  }
-  return status === "on" || status === "unknown";
+
+// src/lib/prereqs.ts
+var import_node_child_process21 = require("node:child_process");
+var import_node_fs73 = require("node:fs");
+var MIN_NODE_MAJOR = 20;
+function which(bin) {
+  return whichSync(bin, { real: false });
 }
-async function askToSend(ui, profile) {
-  const { rail, screen } = ui;
-  const lines = consentLines(profile);
-  rail.active("Write review rules for this repository?");
-  rail.box(lines.slice(1, -1));
-  rail.line(lines[lines.length - 1]);
-  rail.gap();
-  rail.keys([["Enter", "send"], ["v", "view the profile"], ["n", "skip"]]);
-  let allowed = ["enter", "v", "n"];
-  for (; ; ) {
-    const k = await screen.key(allowed, "n", { freshMs: 300 });
-    if (k !== "v") {
-      rail.collapse();
-      return k === "enter";
-    }
-    rail.gap();
-    for (const l of profilePreview(profile)) rail.line(l);
-    rail.gap();
-    rail.keys([["Enter", "send"], ["n", "skip"]]);
-    allowed = ["enter", "n"];
-  }
+function checkNode() {
+  const version = process.version;
+  const major = Number.parseInt(version.slice(1), 10);
+  const ok = Number.isFinite(major) && major >= MIN_NODE_MAJOR;
+  return {
+    id: "node",
+    label: "Node.js",
+    status: ok ? "ok" : "missing",
+    detail: version,
+    remedy: ok ? void 0 : `Node.js ${MIN_NODE_MAJOR}+ required \u2014 update from https://nodejs.org`,
+    required: true
+  };
 }
-async function generate(ui, globals, profile, replaces) {
-  const { rail, screen } = ui;
-  const s = screen.s;
-  const token = await resolveToken(globals.token);
-  const url = await resolveServiceUrl(globals.serviceUrl);
-  if (!token.ok || !url.ok) return { status: "fallback" };
-  const commits = profile.history.commits.length;
-  const fixes = profile.history.commits.filter((c) => c.fix).length;
-  const reverts = profile.history.commits.filter((c) => /^revert\b/i.test(c.subject)).length;
-  rail.active("Writing review rules");
-  await rail.counted(([c, f, r]) => `${s.green}\u2713${s.reset} Read ${c} commits ${s.gray}\xB7${s.reset} ${f} fixes ${s.gray}\xB7${s.reset} ${r} reverts`, [commits, fixes, reverts]);
-  if (profile.docs.length) rail.ticked(`Read ${profile.docs.map((d) => terminalText(d.name, 120)).join(" and ")}`);
-  if (ui.term.screen && !ui.term.motion) rail.line("Writing rules for this repository\u2026");
-  const started = Date.now();
-  const base = buildStandard({ detected: detectProject() }, loadCatalog());
-  const outcome = await screen.spin(`${s.gray}\u2502${s.reset}  `, () => "Writing rules for this repository", generateStandard({
-    serviceUrl: url.data,
-    token: token.data.token,
-    profile,
-    base,
-    projectId: await projectLabel(token.data.token, url.data, globals.verbose),
-    verbose: globals.verbose,
-    replaces
-  }));
-  rail.collapse();
-  if (outcome.status === "exists") return { status: "exists" };
-  if (outcome.status === "disabled") {
-    rail.line("Project rules are not switched on for this project yet. The built-in rules apply.");
-    rail.gap();
-    return { status: "fallback" };
-  }
-  if (outcome.status === "unsupported") {
-    rail.line(`This Verity service (${terminalText(url.data, 200)}) does not write project rules yet: it is older than this CLI. The built-in rules apply.`);
-    rail.gap();
-    return { status: "fallback" };
+function checkGit() {
+  let detail = "";
+  try {
+    detail = (0, import_node_child_process21.execSync)("git --version", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+    return {
+      id: "git",
+      label: "git",
+      status: "missing",
+      detail: "not found",
+      remedy: "Install git from https://git-scm.com",
+      required: true
+    };
   }
-  if (outcome.status === "failed") {
-    rail.warn("The rules could not be written this time");
-    rail.line(terminalText(outcome.reason, 300));
-    rail.line("The built-in rules apply. Try again later: verity standard generate");
-    rail.gap();
-    return { status: "fallback" };
+  return { id: "git", label: "git", status: "ok", detail, required: true };
+}
+function checkClaude() {
+  const path = which("claude");
+  return {
+    id: "claude",
+    label: "Claude Code",
+    status: path ? "ok" : "warn",
+    detail: path ?? "not found",
+    remedy: path ? void 0 : "Hooks are wired but need Claude Code to fire \u2014 https://claude.com/claude-code",
+    required: false
+  };
+}
+var ANALYSIS_CLI_REMEDY = "Reinstall Verity, which includes it: npm install -g @codacy/verity-cli";
+function checkAnalysisCli(opts = {}) {
+  const base = { id: "analysis-cli", label: "@codacy/analysis-cli", required: false };
+  const analyzer = resolveAnalyzer(opts);
+  const shown = (opts.onPathDisplay ?? (() => which("codacy-analysis")))();
+  if (!analyzer) {
+    return { ...base, status: "warn", detail: "not found", remedy: `${ANALYSIS_CLI_REMEDY} (static findings are unavailable until then)` };
   }
-  const secs2 = Math.max(1, Math.round((Date.now() - started) / 1e3));
-  const docs = profile.docs.length;
-  if (outcome.rules.length === 0) {
-    rail.warn("No project rules this time");
-    rail.line("The proposed rules were too generic, or not safe to use. The built-in rules apply.");
-  } else {
-    const n2 = outcome.rules.length;
-    const from = [`${commits} ${commits === 1 ? "commit" : "commits"}`, ...docs ? [`${docs} ${docs === 1 ? "doc" : "docs"}`] : []].join(" and ");
-    rail.done(`${n2} ${n2 === 1 ? "rule" : "rules"} for this repository ${s.gray}\xB7 from ${from} \xB7 ${secs2}s${s.reset}`);
-    await rail.rules(outcome.rules);
-    if (outcome.rejected > 0) rail.line(`${outcome.rejected} proposed ${outcome.rejected === 1 ? "rule was" : "rules were"} left out: too generic, or not safe to use.`);
+  if (analyzer.source === "path") {
+    return { ...base, status: "ok", detail: `${shown ?? analyzer.path} (on PATH)`, source: "path" };
   }
-  rail.gap();
-  rail.done(`Standard v${outcome.version} saved`);
-  rail.line(`Your team gets the same rules. Edit them in ${STANDARD_FILE}`);
-  if (outcome.warning) rail.line(terminalText(outcome.warning, 600), "warn");
-  return { status: "created", version: outcome.version };
+  const unused = shown && !sameFile(shown, analyzer.path) ? shown : void 0;
+  return {
+    ...base,
+    status: "ok",
+    detail: `${analyzer.version} (bundled with Verity)`,
+    source: "bundled",
+    version: analyzer.version,
+    ...unused && { unused }
+  };
 }
-
-// src/commands/init/team-standard.ts
-async function lookUpTeamStandard(opts) {
-  if (!opts.adopt) return { status: "skipped", why: "no-adopt" };
-  const token = await resolveToken(opts.globals.token);
-  const url = await resolveServiceUrl(opts.globals.serviceUrl);
-  if (!token.ok || !url.ok) return { status: "skipped", why: "not-signed-in" };
-  const found = await fetchRemoteSetup({ token: token.data.token, serviceUrl: url.data, verbose: opts.globals.verbose });
-  if (found.status === "unavailable") return { status: "unavailable", reason: terminalText(found.reason, 300) };
-  if (found.status === "none") return { status: "none" };
-  if (opts.previous?.declinedStandardVersion === found.standard.version) {
-    return { status: "declined-before", version: found.standard.version };
+function sameFile(a, b) {
+  try {
+    return (0, import_node_fs73.realpathSync)(a) === (0, import_node_fs73.realpathSync)(b);
+  } catch {
+    return false;
   }
-  return { status: "found", found, version: found.standard.version };
 }
-async function writeTeamStandard(team, opts) {
-  const token = await resolveToken(opts.globals.token);
-  const url = await resolveServiceUrl(opts.globals.serviceUrl);
-  if (!token.ok || !url.ok) return { status: "skipped", why: "not-signed-in" };
-  const found = team.found;
-  try {
-    const outcome = await adoptRemoteSetup(found, {
-      serviceUrl: url.data,
-      projectId: await projectLabel(token.data.token, url.data, opts.globals.verbose)
+var INSTALL_TIMEOUT_MS = 12e4;
+function run3(command, args2, opts = {}) {
+  return new Promise((resolve9) => {
+    const child = (0, import_node_child_process21.spawn)(command, args2, {
+      stdio: opts.inherit ? "inherit" : "pipe",
+      timeout: INSTALL_TIMEOUT_MS
     });
-    if (opts.previous?.declinedStandardVersion != null) {
-      await writeSetupState({ declinedStandardVersion: void 0 }).catch(() => {
-      });
+    child.on("error", () => resolve9(false));
+    child.on("close", (code) => resolve9(code === 0));
+  });
+}
+async function installAnalysisCli(opts = {}) {
+  const spinner = opts.quiet ? { succeed: () => {
+  }, warn: () => {
+  }, stop: () => {
+  } } : startSpinner("Installing @codacy/analysis-cli");
+  const ok = await run3("npm", ["install", "-g", "@codacy/analysis-cli"]);
+  if (ok) {
+    const check = checkAnalysisCli();
+    if (check.status === "ok") {
+      spinner.succeed("@codacy/analysis-cli installed");
+      return { ...check, justInstalled: true };
     }
-    return { status: "adopted", version: found.standard.version, summary: describeRemote(found), notes: outcome.notes };
-  } catch (err2) {
-    return { status: "write-failed", reason: terminalText(err2.message, 300) };
+    spinner.warn("npm reported success but codacy-analysis is not on PATH");
+    return check;
+  }
+  spinner.stop();
+  {
+    const failed = {
+      id: "analysis-cli",
+      label: "@codacy/analysis-cli",
+      status: "warn",
+      detail: "install failed",
+      remedy: ANALYSIS_CLI_REMEDY,
+      required: false
+    };
+    if (opts.sudo === false || !process.stdin.isTTY || !process.stdout.isTTY) return failed;
+    process.stderr.write("  Retrying with sudo (you may be asked for your password)\u2026\n");
+    const sudoOk = await run3("sudo", ["npm", "install", "-g", "@codacy/analysis-cli"], { inherit: true });
+    if (!sudoOk) return failed;
+    const check = checkAnalysisCli();
+    return check.status === "ok" ? { ...check, justInstalled: true } : check;
   }
 }
-async function adoptTeamStandard(opts) {
-  const team = await lookUpTeamStandard(opts);
-  return team.status === "found" ? writeTeamStandard(team, opts) : team;
-}
-async function askTeamChoice(ui, team) {
-  const { rail, screen } = ui;
-  rail.active("Your team already has a Standard for this repository");
-  rail.line(describeRemote(team.found));
-  rail.line(`Use it to review with the same rules as everyone else. A new one becomes v${team.version + 1} for the whole team.`);
-  rail.gap();
-  rail.keys([["Enter", "use it"], ["n", "create a new one"]]);
-  const k = await screen.key(["enter", "n"], "enter", { freshMs: 300 });
-  rail.collapse();
-  return k === "n" ? "new" : "use";
-}
-function sayAdopted(ui, team) {
-  ui.rail.done(`Using your team's Standard v${team.version}`);
-  ui.rail.line(terminalText(team.summary, 300));
-  ui.rail.line(`Edit it in ${STANDARD_FILE}, then share the change: verity standard push`);
-  for (const note of team.notes) ui.rail.line(terminalText(note, 300), "warn");
+async function checkPrereqs(opts = {}) {
+  const checks = [checkNode(), checkGit(), checkClaude()];
+  let analysis = checkAnalysisCli();
+  if (analysis.status !== "ok" && opts.install) {
+    analysis = await installAnalysisCli();
+  }
+  checks.push(analysis);
+  return { checks, blocked: checks.some((c) => c.required && c.status !== "ok") };
 }
 
-// src/commands/init/standard.ts
-async function deriveFromCatalogue(ui, globals) {
-  const url = await resolveServiceUrl(globals.serviceUrl);
-  try {
-    const result = await runSynthesis({ serviceUrl: url.ok ? url.data : void 0 });
-    if ("refused" in result) {
-      ui.rail.warn("No Standard was written");
-      ui.rail.line(terminalText(result.refused, 300));
-      return { ok: false, version: null };
-    }
-    const pushed = await pushStandard(globals);
-    if (pushed.standardVersion !== null) {
-      await correctVerityMdVersion({
-        standard: result.standard,
-        version: pushed.standardVersion,
-        tools: result.tools,
-        serviceUrl: url.ok ? url.data : void 0
-      });
-      ui.rail.done(`Standard v${pushed.standardVersion} saved`);
-      ui.rail.line(`Your team gets the same rules. Edit them in ${STANDARD_FILE}`);
-    } else {
-      ui.rail.done("Standard saved on this machine");
-    }
-    for (const line2 of pushed.lines) {
-      if (line2.startsWith("Standard pushed")) continue;
-      if (line2.startsWith("Not signed in")) ui.rail.line(`Sign in to share it with your team: verity login, then verity standard push. Edit it in ${STANDARD_FILE}`);
-      else ui.rail.line(terminalText(line2, 600), "warn");
-    }
-    for (const note of result.notes) ui.rail.line(terminalText(note, 300), "warn");
-    return { ok: true, version: pushed.standardVersion };
-  } catch (err2) {
-    ui.rail.warn("No Standard was written");
-    ui.rail.line(terminalText(err2.message, 300));
-    return { ok: false, version: null };
-  }
+// src/commands/init/steps.ts
+function languageShares(d) {
+  const total = d.languages.reduce((n2, l) => n2 + (d.languageCounts[l] ?? 0), 0);
+  if (total === 0) return [];
+  const shares = d.languages.map((l) => ({ name: displayName(l), pct: Math.round((d.languageCounts[l] ?? 0) / total * 100) }));
+  const top = shares.slice(0, 2);
+  const rest = 100 - top.reduce((n2, s) => n2 + s.pct, 0);
+  return rest > 0 && shares.length > 2 ? [...top, { name: "Other", pct: rest }] : top;
 }
-async function standardStep(ui, ctx) {
-  const { rail } = ui;
-  const s = ui.screen.s;
-  const notAsked = { outcome: "skipped", detail: "none" };
-  const end = (r) => {
-    rail.gap();
-    rail.settle();
-    return r;
-  };
-  const derived = async (profile2) => {
-    const d = await deriveFromCatalogue(ui, ctx.globals);
-    return end({ source: d.ok ? "derived" : "none", version: d.version, profile: profile2 });
-  };
-  if ((0, import_node_fs75.existsSync)(projectPath(STANDARD_FILE))) {
-    const sync = await pushLocalStandardIfMissing(ctx.globals);
-    rail.done("Kept your Standard");
-    rail.line(`${STANDARD_FILE} is already here, so this run leaves it as it is. Edit it there, then share the change: verity standard push`);
-    if (sync.status === "pushed") {
-      rail.line(sync.version !== null ? `It was only on this machine. It is shared now as v${sync.version}.` : "It is only on this machine:", sync.version !== null ? "muted" : "warn");
-      for (const line2 of sync.lines) if (!line2.startsWith("Standard pushed")) rail.line(terminalText(line2, 600), "warn");
-    }
-    return end({ source: "kept", version: sync.status === "pushed" ? sync.version : null, profile: notAsked });
+var NAMES = {
+  typescript: "TypeScript",
+  javascript: "JavaScript",
+  python: "Python",
+  go: "Go",
+  java: "Java",
+  kotlin: "Kotlin",
+  ruby: "Ruby",
+  rust: "Rust",
+  c: "C",
+  cpp: "C++",
+  shell: "Shell",
+  dockerfile: "Dockerfile",
+  csharp: "C#",
+  php: "PHP",
+  swift: "Swift",
+  scala: "Scala",
+  sql: "SQL"
+};
+var displayName = (l) => NAMES[l] ?? l.charAt(0).toUpperCase() + l.slice(1);
+var STACK_NAMES = {
+  "next.js": "Next.js",
+  next: "Next.js",
+  react: "React",
+  vue: "Vue",
+  angular: "Angular",
+  svelte: "Svelte",
+  express: "Express",
+  nestjs: "NestJS",
+  fastify: "Fastify",
+  prisma: "Prisma",
+  django: "Django",
+  flask: "Flask",
+  fastapi: "FastAPI",
+  rails: "Rails",
+  spring: "Spring",
+  vitest: "Vitest",
+  jest: "Jest",
+  mocha: "Mocha",
+  playwright: "Playwright",
+  cypress: "Cypress",
+  supabase: "Supabase",
+  stripe: "Stripe",
+  tailwind: "Tailwind"
+};
+async function repoStep(ui, detected) {
+  ui.rail.done("Looked at your repository");
+  await ui.rail.languages(languageShares(detected));
+  const stack = [...detected.frameworks, detected.buildSystem, detected.testFramework].filter(Boolean).map((n2) => STACK_NAMES[n2.toLowerCase()] ?? n2);
+  const files = `${detected.filesScanned.toLocaleString("en-US")} ${detected.filesScanned === 1 ? "file" : "files"}`;
+  ui.rail.line([...stack, files].join(" \xB7 "), stack.length ? "plain" : "muted");
+  ui.rail.gap();
+  ui.rail.settle();
+}
+async function prerequisitesStep(ui) {
+  const report = await checkPrereqs({ install: false });
+  const analysis = report.checks.find((c) => c.id === "analysis-cli");
+  if (analysis && analysis.status !== "ok") {
+    const s = ui.screen.s;
+    const installed2 = await ui.screen.spin(`${s.gray}\u2502${s.reset}  `, () => "Verity's copy of the Codacy analysis CLI is missing. Installing it (it runs the Trivy security scan)", installAnalysisCli({ quiet: true, sudo: false }));
+    report.checks[report.checks.indexOf(analysis)] = installed2;
+    if (installed2.status === "ok") ui.rail.ticked("Installed the Codacy analysis CLI");
   }
-  const team = await lookUpTeamStandard(ctx);
-  let replaces;
-  if (team.status === "found") {
-    const choice = ctx.standard ?? (ui.asking ? await askTeamChoice(ui, team) : "use");
-    if (choice === "use") {
-      const adopted = await writeTeamStandard(team, ctx);
-      if (adopted.status === "adopted") {
-        sayAdopted(ui, adopted);
-        return end({ source: "adopted", version: adopted.version, profile: notAsked });
-      }
-      rail.warn("Could not write the team's Standard here");
-      if (adopted.status === "write-failed") rail.line(terminalText(adopted.reason, 300));
-      return derived(notAsked);
-    }
-    await writeSetupState({ declinedStandardVersion: team.version }).catch(() => {
-    });
-    rail.done(`Creating a new Standard ${s.gray}\xB7 it becomes v${team.version + 1} for the team${ctx.standard ? " (--standard new)" : ""}${s.reset}`);
-    replaces = team.version;
-  } else if (team.status === "declined-before") {
-    rail.line(`This project turned down the team's Standard v${team.version} before, so this run builds its own.`);
-    return derived(notAsked);
+  for (const c of report.checks) {
+    if (c.status === "ok") continue;
+    ui.rail.warn(`${c.label}: ${c.detail}`);
+    if (c.remedy) ui.rail.line(c.remedy);
   }
-  if (team.status === "unavailable") {
-    rail.warn("Could not ask the Verity service for this repository's Standard");
-    rail.line(terminalText(team.reason, 300));
-    return derived(notAsked);
+  ui.rail.settle();
+  return !report.checks.some((c) => c.required && c.status !== "ok");
+}
+async function telemetryStep(ui, answer, resumeDeferred, globals) {
+  if (answer === "already-on") return "enabled";
+  if (answer === "no") return "declined";
+  if (answer === "turn-off") {
+    const removed = await uninstallTelemetry();
+    if (removed.ok) ui.rail.done("Cost & usage telemetry turned off (--telemetry off)");
+    else ui.rail.warn(`Could not turn telemetry off: ${terminalText(removed.error, 200)}`);
+    ui.rail.settle();
+    return "declined";
   }
-  if (team.status === "skipped") return derived(notAsked);
-  if (!await rulesOffered(ui, ctx.globals)) return derived(notAsked);
-  const profile = buildRepoProfile();
-  try {
-    writeRepoFile(PROFILE_FILE, JSON.stringify(profile, null, 2) + "\n");
-  } catch (err2) {
-    rail.warn(`Could not write ${PROFILE_FILE} for you to read, so nothing was sent`);
-    rail.line(terminalText(err2.message, 200));
-    return derived({ outcome: "failed", detail: "error" });
+  if (answer !== "yes" && !resumeDeferred) return void 0;
+  const token = await resolveToken(globals.token);
+  const url = await resolveServiceUrl(globals.serviceUrl);
+  if (!token.ok || !url.ok) {
+    ui.rail.line("Telemetry needs sign-in. Then run: verity telemetry install", "warn");
+    ui.rail.settle();
+    return "deferred";
   }
-  let detail;
-  let send;
-  if (ctx.profile) {
-    send = ctx.profile === "send";
-    detail = "given";
-  } else if (ui.asking) {
-    send = await askToSend(ui, profile);
-    detail = send ? "asked" : "declined";
+  const installed2 = await installTelemetry(url.data);
+  if (installed2.ok) {
+    ui.rail.done("Cost & usage telemetry on");
+    ui.rail.line("It starts with your next Claude Code session. See cost and usage at /usage.");
   } else {
-    send = false;
-    detail = "unattended";
+    ui.rail.warn(`Could not turn telemetry on: ${terminalText(installed2.error, 200)}`);
+  }
+  ui.rail.gap();
+  ui.rail.settle();
+  return installed2.ok ? "enabled" : "deferred";
+}
+function signInDetail(outcome) {
+  if (outcome === "already" || outcome === "new") return ["ok", outcome];
+  if (outcome === "declined" || outcome === "unattended") return ["skipped", outcome];
+  return ["failed", outcome === "unreachable" ? "unreachable" : "error"];
+}
+function formalDefault(previous, opts = {}) {
+  const cfg = readProjectConfig();
+  if (previous?.init?.completed_at || opts.setUpBefore || cfg.formal !== void 0 || cfg.formal_refused) return false;
+  writeProjectConfig({ formal: "push" });
+  return true;
+}
+function sayFormalOn(ui) {
+  ui.rail.done("Formal verification at push: on");
+  ui.rail.line("At push, Verity checks a small model of the riskiest changed function and replays any counterexample on the real code. That function's source is sent to Verity for the replay.");
+  ui.rail.line("Only a reproduced bug can block, and most pushes get no model. Turn it off: verity config formal off");
+}
+function backgroundStep(ui, opts) {
+  const { rail } = ui;
+  const formal = readProjectConfig().formal;
+  const said = opts.formalNew === true && formal === "push";
+  if (said) sayFormalOn(ui);
+  const lean = shouldStartBackgroundInstall({ formal });
+  const leanStarted = lean.start && startBackgroundInstall({ cli: opts.cli });
+  const trivy = startTrivyPrewarm();
+  const parts2 = [
+    ...trivy ? ["Trivy security scanner"] : [],
+    ...leanStarted ? ["Lean 4 for formal checks at push (800 MB)"] : [],
+    ...!lean.start && lean.why === "running" ? ["Lean 4 (already downloading)"] : []
+  ];
+  if (parts2.length) {
+    if (said) rail.gap();
+    rail.done("Getting ready in the background");
+    rail.line(parts2.join(" \xB7 "));
+    if (leanStarted) rail.line(said ? "Progress: verity lean status" : "Progress: verity lean status. Turn formal checks off: verity config formal off");
+  } else if (!lean.start && lean.why === "installed" && formal === "push" && !said) {
+    rail.done("Formal verification at push: on");
   }
-  if (!send) {
-    rail.warn("Profile not sent");
-    rail.line(detail === "unattended" ? "Nobody was asked, so nothing was sent. Your Standard has the built-in rules only." : "Your Standard has the built-in rules only.");
-    rail.line(`Add project rules later: verity standard generate (read ${PROFILE_FILE} first)`);
-    rail.gap();
-    return derived({ outcome: "skipped", detail });
+  if (!lean.start && lean.why === "disk") {
+    rail.warn("Formal verification is on, but Lean 4 needs more disk space");
+    rail.line(`${lean.detail}. Free some space, then run: verity lean install`);
+  } else if (!lean.start && lean.why === "no-release" && formal === "push") {
+    rail.line("Lean 4 has no release for this machine, so the formal check at push is skipped.");
   }
-  if (detail === "given") rail.done(`Profile sent ${s.gray}\xB7 no source code (--profile send)${s.reset}`);
-  else rail.done(`Profile sent ${s.gray}\xB7 no source code${s.reset}`);
-  rail.gap();
+  if (parts2.length || said || !lean.start && lean.why === "disk") rail.gap();
   rail.settle();
-  const generated = await generate(ui, ctx.globals, profile, replaces);
-  if (generated.status === "created") {
-    return end({ source: "generated", version: generated.version, profile: { outcome: "ok", detail } });
-  }
-  if (generated.status === "exists") {
-    const again = await adoptTeamStandard(ctx);
-    if (again.status === "adopted") {
-      sayAdopted(ui, again);
-      return end({ source: "adopted", version: again.version, profile: { outcome: "ok", detail } });
-    }
-  }
-  return derived({ outcome: "ok", detail });
 }
 
-// src/commands/init/finish.ts
-async function finishRun(ui, ctx) {
+// src/commands/init/scaffold.ts
+var import_promises17 = require("node:fs/promises");
+async function scaffoldStep(ui, given = {}) {
   const { rail } = ui;
-  const s = ui.screen.s;
-  const secs2 = Math.max(1, Math.round((Date.now() - ctx.started) / 1e3));
-  if (!ctx.haveStandard) {
-    sayChanged(ui, ctx.before);
-    rail.end(`${s.yellow}Not finished:${s.reset} no Standard was written, so the gate cannot review.`, "Fix the error above, then run verity init again.");
-    return;
+  await (0, import_promises17.mkdir)(VERITY_DIR, { recursive: true });
+  await ensureMemoryDir();
+  const ignore = ensureVerityGitignore();
+  if (ignore === "failed") {
+    rail.warn(".gitignore: could not write the Verity block");
+    rail.line("Add it by hand: .verity/ holds copies of analyzed files, including any secret the gate flagged.");
+  } else if (ignore === "conflict") {
+    rail.warn(".gitignore: git still ignores .verity/standard.yaml");
+    rail.line("A global or nested .gitignore covers it, so the Standard cannot be committed. Check: git check-ignore -v .verity/standard.yaml");
+  } else if (ignore === "memory-tracked") {
+    rail.warn("This project commits its knowledge graph");
   }
-  if (ctx.pluginMode) {
-    const version = activePluginVersion();
-    if (version) await writeSetupState({ pluginSetup: { version, completed_at: (/* @__PURE__ */ new Date()).toISOString() }, wiring: void 0 });
-  } else if (ctx.noPlugin) {
-    await writeSetupState({ wiring: "project" });
+  const trackedMemory = memoryOptOut() ? [] : committedMemoryFiles();
+  if (trackedMemory.length > 0) {
+    if (given.untrackMemory) {
+      const result = fenceMemory();
+      if (result.ok) rail.line(`Untracked ${result.untracked} knowledge-graph file(s) (staged). Commit to finish.`);
+      else rail.line("Could not untrack the knowledge graph. Run: verity memory untrack", "warn");
+    } else {
+      rail.warn(`${trackedMemory.length} knowledge-graph file(s) are tracked in git`);
+      rail.line("They show up in every diff. Stop with: verity memory untrack (or keep them on purpose: verity memory track)");
+    }
   }
-  sayChanged(ui, ctx.before);
-  const next = ctx.momentIds.length === 0 ? "Verity reviews nothing until you turn a moment on: verity config moments turn,commit,push" : ctx.pluginMode ? ctx.signedIn ? "Verity reviews from your next turn." : "The security scan runs from your next turn. Sign in for AI review: verity login" : ctx.signedIn ? "Start a new Claude Code session. Verity reviews from its first turn." : "Start a new Claude Code session. The security scan runs from the first turn.";
-  rail.end(`${s.green}${s.bold}Ready${s.reset} ${s.gray}in ${secs2}s.${s.reset}`, next);
-}
-function sayChanged(ui, before) {
-  const changed = changedSince(before, snapshotInitFiles());
-  if (changed.length === 0) return;
-  ui.rail.line(`Changed: ${changed.join(", ")}. Details: verity doctor`, "muted");
-}
-
-// src/commands/migrate.ts
-var import_node_fs76 = require("node:fs");
-var import_node_path64 = require("node:path");
-var import_node_child_process22 = require("node:child_process");
-var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
-function defaultNpmRemover(pkg) {
-  (0, import_node_child_process22.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
-}
-function git2(cwd, args2) {
-  (0, import_node_child_process22.execFileSync)("git", hardenedGitArgv(args2), { cwd, stdio: "pipe", env: hardenedGitEnv() });
-}
-function isGitTracked(cwd, relPath) {
-  try {
-    git2(cwd, ["ls-files", "--error-unmatch", "--", relPath]);
-    return true;
-  } catch {
-    return false;
+  const tracked = committedVerityState();
+  if (tracked.length > 0) {
+    if (given.untrackState) {
+      const result = untrackVerityState();
+      if (result === "untracked") rail.line("Untracked the Verity state files (staged). Commit to finish.");
+      else if (result === "failed") rail.line("Could not untrack them. Run: git rm -r --cached .verity && git add .verity/standard.yaml", "warn");
+    } else {
+      rail.warn(`${tracked.length} Verity state file(s) are tracked in git`);
+      rail.line(`For example ${tracked[0]}. Fix: git rm -r --cached .verity && git add .verity/standard.yaml`);
+    }
   }
-}
-function isGitRepo(cwd) {
   try {
-    git2(cwd, ["rev-parse", "--is-inside-work-tree"]);
-    return true;
-  } catch {
-    return false;
+    await ensureClaudeMdPointer();
+  } catch (err2) {
+    rail.line(`Could not update CLAUDE.md: ${err2.message}`, "warn");
   }
+  const cfg = readProjectConfig();
+  if (cfg.formal_refused) rail.line(`Formal verification: off \u2014 ${formalRefusalMessage(cfg.formal_refused)}`, "warn");
+  rail.settle();
 }
-async function runMigration(opts = {}) {
-  const root = opts.cwd ?? repoRoot();
-  const home = opts.home ?? process.env.HOME ?? "";
-  const npmRemover = opts.npmRemover ?? defaultNpmRemover;
-  const actions = [];
-  const movedProjectDir = migrateProjectDir(root, actions);
-  migrateGlobalCredentials(home, actions);
-  await migrateLegacyHooks(root, actions);
-  await migrateClaudeMd(root, actions);
-  migrateStandardFile(root, actions);
-  await migrateLocalTelemetry(root, actions);
-  removeLegacyPackage(movedProjectDir, npmRemover, actions);
-  return { actions, migrated: actions.length > 0 };
+
+// src/commands/init/wiring.ts
+var import_node_fs74 = require("node:fs");
+var import_promises18 = require("node:fs/promises");
+var import_node_path63 = require("node:path");
+var DEFAULT_MOMENTS = ["stop", "pre-commit", "pre-push"];
+async function momentsFromInstalledHooks() {
+  const status = await checkAllVerityHooks();
+  const wired = [];
+  if (status.stop) wired.push("stop");
+  if (status.guardOn.includes("commit")) wired.push("pre-commit");
+  if (status.guardOn.includes("push")) wired.push("pre-push");
+  return wired.length > 0 ? wired : DEFAULT_MOMENTS;
 }
-function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path64.join)(root, ".gate");
-  const verityDir = (0, import_node_path64.join)(root, ".verity");
-  if ((0, import_node_fs76.existsSync)(gateDir) && !(0, import_node_fs76.existsSync)(verityDir)) {
-    return migrateProjectDirRename(root, gateDir, verityDir, actions);
-  }
-  if ((0, import_node_fs76.existsSync)(gateDir) && (0, import_node_fs76.existsSync)(verityDir)) {
-    return migrateProjectDirCarry(gateDir, verityDir, actions);
+async function askSetupQuestions(_defaultsOnly, previous, given = {}) {
+  const moments = given.moments ?? (previous?.moments?.length ? previous.moments : await momentsFromInstalledHooks());
+  let telemetry = "not-asked";
+  if (given.telemetry !== void 0) {
+    const enabled = (await checkTelemetry()).enabled;
+    telemetry = given.telemetry ? enabled ? "already-on" : "yes" : enabled ? "turn-off" : "no";
   }
-  return false;
+  return { moments, telemetry };
 }
-function migrateProjectDirRename(root, gateDir, verityDir, actions) {
-  let moved = false;
-  if (isGitRepo(root) && isGitTracked(root, ".gate")) {
-    if (hasStagedChanges(root)) {
-      printWarn(
-        "Migrating .gate \u2192 .verity with `git mv` while the index has staged changes \u2014 the rename will be staged alongside them. Review `git status` before committing."
-      );
-    }
-    try {
-      git2(root, ["mv", "--", ".gate", ".verity"]);
-      actions.push("Moved .gate/ \u2192 .verity/ (git mv, staged)");
-      moved = true;
-    } catch {
-    }
-  }
-  if (moved) {
-    if ((0, import_node_fs76.existsSync)(gateDir)) {
-      const carried = carryLegacyContents(gateDir, verityDir);
-      if (carried > 0) {
-        actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
-      }
-      try {
-        (0, import_node_fs76.rmSync)(gateDir, { recursive: true, force: true });
-      } catch {
-      }
-    }
-    return true;
-  }
-  moveDir(gateDir, verityDir);
-  actions.push("Moved .gate/ \u2192 .verity/");
-  return true;
+function parseTelemetryAnswer(raw) {
+  const v = raw.trim().toLowerCase();
+  if (v === "on") return true;
+  if (v === "off") return false;
+  return null;
 }
-function migrateProjectDirCarry(gateDir, verityDir, actions) {
-  const carried = carryLegacyContents(gateDir, verityDir);
-  if (carried > 0) {
-    actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
-  }
-  try {
-    (0, import_node_fs76.rmSync)(gateDir, { recursive: true, force: true });
-  } catch {
-  }
-  return carried > 0;
+function planMoments(answers, opts) {
+  const existing = readProjectConfig();
+  const keptUserChoice = !opts.given && existing.git_moments_source === "user";
+  const gitMoments = keptUserChoice ? existing.git_moments : [
+    ...answers.includes("pre-commit") ? ["commit"] : [],
+    ...answers.includes("pre-push") ? ["push"] : []
+  ];
+  const turnOn = keptUserChoice && existing.turn_review ? existing.turn_review === "on" : answers.includes("stop");
+  return {
+    momentIds: [
+      ...turnOn ? ["stop"] : [],
+      ...gitMoments.includes("commit") ? ["pre-commit"] : [],
+      ...gitMoments.includes("push") ? ["pre-push"] : []
+    ],
+    gitMoments,
+    turnOn,
+    keptUserChoice
+  };
 }
-function migrateGlobalCredentials(home, actions) {
-  if (!home) return;
-  const gateCreds = (0, import_node_path64.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path64.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs76.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs76.existsSync)(verityCreds)) {
-    (0, import_node_fs76.mkdirSync)((0, import_node_path64.join)(home, ".verity"), { recursive: true });
-    moveFile(gateCreds, verityCreds);
-    actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
-    return;
+function momentsStep(ui, plan) {
+  const said = describeReviewMoments(plan.momentIds);
+  if (plan.momentIds.length === 0) {
+    ui.rail.warn("Verity reviews nothing");
+    ui.rail.line("Code changes are not reviewed. Turn the moments on: verity config moments turn,commit,push", "warn");
+  } else {
+    ui.rail.done(`Verity reviews ${said}`);
+    ui.rail.line("To change it, run verity config moments, or just ask Claude.");
   }
-  const added = mergeGlobalCredentials(gateCreds, verityCreds);
-  if (added > 0) {
-    actions.push(
-      `Merged ${added} legacy credential line(s) from ~/.gate/credentials into ~/.verity/credentials`
-    );
+  if (plan.keptUserChoice) {
+    ui.rail.line(`Keeping the git moments you set: ${plan.gitMoments.join(", ") || "none"} (this run asked no questions, so it does not overrule them).`);
   }
+  ui.rail.gap();
+  ui.rail.settle();
 }
-async function migrateLegacyHooks(root, actions) {
-  const settings = await readSettingsAt(root);
-  const settingsBefore = JSON.stringify(settings);
-  const updatedSettings = removeVerityHooks(settings);
-  if (settingsBefore !== JSON.stringify(updatedSettings)) {
-    await writeSettingsAt(root, updatedSettings);
-    actions.push("Stripped legacy gate hooks from .claude/settings.json");
+var SKILLS = [
+  "verity-setup",
+  "verity-analyze",
+  "verity-status",
+  "verity-feedback",
+  "verity-learn",
+  "verity-memory",
+  "verity-insights",
+  "verity-reflect",
+  "verity-init",
+  "verity-prove"
+];
+function resolveDataDir2() {
+  const candidates2 = [
+    (0, import_node_path63.join)(__dirname, "..", "data"),
+    (0, import_node_path63.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path63.join)(process.cwd(), "cli", "data")
+  ];
+  for (const candidate of candidates2) {
+    if ((0, import_node_fs74.existsSync)((0, import_node_path63.join)(candidate, "skills"))) return candidate;
   }
+  throw new Error("Could not find Verity skill data. Reinstall: npm install -g @codacy/verity-cli");
 }
-async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path64.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs76.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
-  if (!hadLegacyBlock) return;
+async function skillIsCurrent(src, dest) {
+  const list2 = (dir) => {
+    const out2 = [];
+    const walk2 = (d, prefix) => {
+      for (const e of (0, import_node_fs74.readdirSync)(d, { withFileTypes: true })) {
+        const rel = prefix ? `${prefix}/${e.name}` : e.name;
+        if (e.isDirectory()) walk2((0, import_node_path63.join)(d, e.name), rel);
+        else if (e.isFile()) out2.push(rel);
+      }
+    };
+    walk2(dir, "");
+    return out2.sort();
+  };
   try {
-    await ensureClaudeMdPointer(root);
-    actions.push("Rewrote legacy gate-memory block in CLAUDE.md");
-  } catch (err2) {
-    printWarn(`Could not rewrite CLAUDE.md block: ${err2.message}`);
+    const shipped = list2(src);
+    if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
+    for (const rel of shipped) {
+      if (await (0, import_promises18.readFile)((0, import_node_path63.join)(src, rel), "utf-8") !== await (0, import_promises18.readFile)((0, import_node_path63.join)(dest, rel), "utf-8")) return false;
+    }
+    return true;
+  } catch {
+    return false;
   }
 }
-function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path64.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path64.join)(root, "VERITY.md");
-  if (!(0, import_node_fs76.existsSync)(gateMd) || (0, import_node_fs76.existsSync)(verityMd)) return;
-  let moved = false;
-  if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
-    try {
-      git2(root, ["mv", "--", "GATE.md", "VERITY.md"]);
-      moved = true;
-    } catch {
+async function installSkills(force) {
+  const source2 = (0, import_node_path63.join)(resolveDataDir2(), "skills");
+  const missing = [];
+  for (const skill of SKILLS) {
+    const src = (0, import_node_path63.join)(source2, skill);
+    const dest = (0, import_node_path63.join)(".claude/skills", skill);
+    if (!(0, import_node_fs74.existsSync)(src)) {
+      missing.push(skill);
+      continue;
     }
+    if ((0, import_node_fs74.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) continue;
+    await (0, import_promises18.mkdir)(dest, { recursive: true });
+    await (0, import_promises18.cp)(src, dest, { recursive: true, force: true });
   }
-  if (!moved) moveFile(gateMd, verityMd);
-  const content = readFileSyncSafe(verityMd);
-  const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs76.writeFileSync)(verityMd, refreshed);
-  actions.push("Renamed GATE.md \u2192 VERITY.md");
-}
-async function migrateLocalTelemetry(root, actions) {
-  const { removed } = await healLocalTelemetry(root);
-  if (removed.length === 0) return;
-  actions.push(
-    `Removed ${removed.length} old Verity telemetry key(s) from ${SETTINGS_LOCAL_FILE2} (Claude Code ignores them there). Run "verity telemetry install" to export from this machine.`
-  );
+  return missing;
 }
-function removeLegacyPackage(movedProjectDir, npmRemover, actions) {
-  if (!movedProjectDir) return;
-  try {
-    npmRemover(LEGACY_NPM_PACKAGE);
-    actions.push(`Removed legacy global package ${LEGACY_NPM_PACKAGE}`);
-  } catch (err2) {
-    printWarn(
-      `Could not remove ${LEGACY_NPM_PACKAGE} (${err2.message}). Remove it manually: npm rm -g ${LEGACY_NPM_PACKAGE}`
-    );
+async function hooksStep(ui, ctx) {
+  const { rail } = ui;
+  if (ctx.staleMarker) rail.line(`Cleared a stale plugin marker \u2014 ${ctx.staleMarker} is no longer installed.`);
+  if (!ctx.plan.keptUserChoice) {
+    writeProjectConfig({ git_moments: ctx.plan.gitMoments, git_moments_source: "init", turn_review: ctx.plan.turnOn ? "on" : "off" });
   }
+  if (ctx.pluginMode) {
+    rail.done(`Hooks here: the Verity Claude Code plugin${ctx.pluginWhere}`);
+    rail.line("Skills and hooks come from the plugin, so this run installs neither, and removes any this project still has from an npm install.");
+    rail.line("Want this project to own its own copy instead? Uninstall the plugin, or use --no-plugin.");
+    const settings = await readSettings();
+    const stripped = removeVerityHooks(settings);
+    if (JSON.stringify(settings.hooks ?? {}) !== JSON.stringify(stripped.hooks ?? {})) {
+      await writeSettings(stripped);
+      rail.line("Removed this project's Verity hooks from .claude/settings.json. The plugin wires them now, so each turn is reviewed once.");
+    }
+    const removed = removeProjectSkills();
+    if (removed.length > 0) rail.line(`Removed ${removed.length} project-local skill${removed.length === 1 ? "" : "s"} that the plugin supersedes.`);
+  } else {
+    if (ctx.overridingPlugin) {
+      rail.warn("Hooks here: this project's .claude/settings.json (--no-plugin)");
+      rail.line("The Verity plugin is active on this machine and would own them. Both sets fire; the settings.json copy stands down at run time, so each turn is reviewed once.");
+    } else {
+      rail.done("Hooks here: this project's .claude/settings.json");
+    }
+    const missing = await installSkills(ctx.force);
+    if (missing.length > 0) rail.line(`Skill data not found: ${missing.join(", ")}`, "warn");
+    await applyMomentSelection(ctx.plan.momentIds);
+  }
+  rail.gap();
+  rail.settle();
 }
-function credentialRemoteKey(line2) {
-  const trimmed = line2.trim();
-  if (trimmed === "") return null;
-  const idx = trimmed.indexOf(" token:");
-  return idx === -1 ? trimmed : trimmed.slice(0, idx).trim();
-}
-function mergeGlobalCredentials(gateCreds, verityCreds) {
-  const verityContent = readFileSyncSafe(verityCreds);
-  const existingKeys = new Set(
-    verityContent.split("\n").map(credentialRemoteKey).filter((k) => k !== null)
-  );
-  const toAppend = [];
-  for (const line2 of readFileSyncSafe(gateCreds).split("\n")) {
-    const key = credentialRemoteKey(line2);
-    if (key === null || existingKeys.has(key)) continue;
-    existingKeys.add(key);
-    toAppend.push(line2.replace(/\r$/, ""));
+
+// src/commands/init/sign-in.ts
+var import_node_child_process22 = require("node:child_process");
+async function classifyExistingLogin(serviceUrl, remote, opts) {
+  const existing = await resolveToken(opts.token);
+  if (!existing.ok) return { kind: "none" };
+  const who = await whoami(existing.data.token, serviceUrl, opts.verbose);
+  if (who.ok && who.data.logged_in) {
+    return {
+      kind: "signed-in",
+      identity: terminalText(who.data.email ?? `user #${who.data.user_id}`, 120),
+      // Being logged in does not mean THIS repo is covered (VRT-83): grants come
+      // from the login sweep. grant_status is non-null only when a grant exists.
+      covered: remote ? who.data.grant_status != null : null,
+      nudge: reverifyNudge(who.data)
+    };
   }
-  if (toAppend.length > 0) {
-    const sep7 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs76.writeFileSync)(verityCreds, verityContent + sep7 + toAppend.join("\n") + "\n");
+  if (!who.ok) {
+    const denial = authDenialRemedy(who.error);
+    if (denial) return { kind: "rejected", code: denial.code, remedy: denial.remedy };
+    const identity = existing.data.userId != null ? terminalText(existing.data.email ?? `user #${existing.data.userId}`, 120) : null;
+    return { kind: "cached", identity, detail: terminalText(who.error, 200) };
   }
-  (0, import_node_fs76.rmSync)(gateCreds, { force: true });
-  return toAppend.length;
+  return { kind: "anonymous" };
 }
-function readFileSyncSafe(path) {
+function gitRemote() {
   try {
-    return (0, import_node_fs76.readFileSync)(path, "utf-8");
+    return (0, import_node_child_process22.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
     return "";
   }
 }
-function hasStagedChanges(root) {
-  try {
-    git2(root, ["diff", "--cached", "--quiet", ...DIFF_READ_FLAGS]);
-    return false;
-  } catch {
-    return true;
-  }
-}
-function moveDir(from, to) {
-  try {
-    (0, import_node_fs76.renameSync)(from, to);
-  } catch (err2) {
-    if (err2.code !== "EXDEV") throw err2;
-    (0, import_node_fs76.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs76.rmSync)(from, { recursive: true, force: true });
-  }
+function sayWhatASkipCosts(ui) {
+  ui.rail.line("Without sign-in, only the local security scan runs. AI review needs sign-in.");
+  ui.rail.line("Sign in later: verity login");
 }
-function moveFile(from, to) {
-  try {
-    (0, import_node_fs76.renameSync)(from, to);
-  } catch (err2) {
-    if (err2.code !== "EXDEV") throw err2;
-    (0, import_node_fs76.cpSync)(from, to);
-    (0, import_node_fs76.rmSync)(from, { force: true });
+function coverageLines(ui, repo, covered) {
+  if (covered === null) {
+    ui.rail.line("This folder has no git remote, so there is no project to sync to.");
+  } else if (covered) {
+    ui.rail.line(`${repo} is covered.`);
+  } else {
+    ui.rail.line(`${repo} is not covered by your Verity access, so nothing syncs.`, "warn");
+    ui.rail.line("Give the Verity GitHub App access to it, then run: verity login");
   }
 }
-function carryLegacyContents(gateDir, verityDir) {
-  if (!isRealDir(gateDir) || !isRealDir(verityDir)) return 0;
-  let copied = 0;
-  const walk2 = (relDir) => {
-    let entries;
-    try {
-      entries = (0, import_node_fs76.readdirSync)((0, import_node_path64.join)(gateDir, relDir), { withFileTypes: true });
-    } catch {
-      return;
+async function signInStep(ui, resolution, opts) {
+  const { rail, screen } = ui;
+  const s = screen.s;
+  const end = (outcome) => {
+    rail.gap();
+    rail.settle();
+    return outcome;
+  };
+  let named = false;
+  const nameTarget = () => {
+    if (named) return;
+    named = true;
+    rail.note(`Verity service: ${terminalText(resolution.url, 200)}${resolution.source === "default" ? " (the default)" : ` (from ${resolution.source})`}`);
+  };
+  if ((await resolveToken(opts.token)).ok) nameTarget();
+  const heal = await maybeHealServiceUrl(resolution, opts.verbose);
+  const serviceUrl = heal.serviceUrl;
+  const remote = gitRemote();
+  if (heal.healed) {
+    rail.warn("The saved Verity service no longer answers");
+    rail.line("Sign in again to repair ~/.verity/credentials.");
+  } else {
+    const state = await classifyExistingLogin(serviceUrl, remote, opts);
+    if (state.kind === "signed-in") {
+      rail.done(`Signed in as ${s.bold}${state.identity}${s.reset}`);
+      coverageLines(ui, opts.repo, state.covered);
+      if (state.nudge) rail.line(state.nudge, "warn");
+      return end("already");
     }
-    for (const entry of entries) {
-      const rel = relDir ? (0, import_node_path64.join)(relDir, entry.name) : entry.name;
-      if (entry.isSymbolicLink()) continue;
-      if (entry.isDirectory()) {
-        walk2(rel);
-        continue;
-      }
-      if (!entry.isFile() || !ensureRealDirs(verityDir, relDir)) continue;
-      const opened = openRegularInRoot(gateDir, rel);
-      if (!opened.ok) continue;
-      try {
-        (0, import_node_fs76.writeFileSync)((0, import_node_path64.join)(verityDir, rel), readOpened(opened.fd, opened.size), { flag: "wx", mode: 384 });
-        copied++;
-      } catch {
-      }
+    if (state.kind === "cached") {
+      rail.done(state.identity ? `Signed in as ${s.bold}${state.identity}${s.reset} (cached)` : "Using your existing Verity token");
+      rail.line(`Could not reach the Verity service to confirm it: ${state.detail}`);
+      return end("unreachable");
+    }
+    if (state.kind === "rejected") {
+      rail.warn(`Your Verity sign-in was rejected (${state.code})`);
+      rail.line(state.remedy);
+    } else if (state.kind === "anonymous") {
+      rail.warn("This project has only an anonymous Verity token");
+      rail.line("The gate runs, but no runs are saved and Verity keeps no memory of this project.");
+    }
+    rail.settle();
+  }
+  if (!ui.asking) {
+    rail.warn(ui.term.screen ? "Sign-in skipped (--yes)" : "Sign-in skipped (no terminal to ask on)");
+    sayWhatASkipCosts(ui);
+    return end("unattended");
+  }
+  rail.active("Sign in with GitHub");
+  rail.line("One sign-in covers every repository on this machine.");
+  rail.line("Signing in does not give Verity access to the contents of your repositories.");
+  rail.gap();
+  rail.keys([["Enter", "open the browser"], ["s", "skip"]]);
+  const choice = await screen.key(["enter", "s"], "s");
+  if (choice === "s") {
+    rail.collapse();
+    rail.warn("Sign-in skipped");
+    sayWhatASkipCosts(ui);
+    return end("declined");
+  }
+  const failed = (why) => {
+    rail.collapse();
+    rail.warn("Sign-in did not complete");
+    rail.line(terminalText(why, 300));
+    sayWhatASkipCosts(ui);
+    return end("failed");
+  };
+  nameTarget();
+  const code = await requestDeviceCode();
+  if (!code.ok) return failed(code.error);
+  const dc = code.data;
+  const copied = copyToClipboard(dc.user_code);
+  const opened = openInBrowser(dc.verification_uri);
+  rail.line(opened ? `Opened ${dc.verification_uri} in your browser. If no window appeared, open it and enter the code.` : `Open ${dc.verification_uri} and enter the code.`, opened ? "muted" : "plain");
+  const prefix = `${s.gray}\u2502${s.reset}  `;
+  const polled = await screen.breathe(
+    prefix,
+    () => `Waiting for you in the browser \xB7 code ${s.bold}${dc.user_code}${s.reset}${copied ? ` ${s.gray}(copied)${s.reset}` : ""}`,
+    pollDeviceToken(dc, { codeExpiresAt: Date.now() + dc.expires_in * 1e3, quiet: true })
+  );
+  if (!polled.ok) return failed(polled.error);
+  let gaveUp = null;
+  const appInstallUi = {
+    wait: async (ctx, visible) => {
+      rail.line(`The Verity GitHub App cannot see ${ctx.owner}/${ctx.repo} yet. Install it${ctx.opened ? " (opened in your browser)" : ""}:`, "warn");
+      rail.line(ctx.installUrl, "plain");
+      return screen.breathe(prefix, () => `Waiting for the install on ${ctx.owner}`, visible);
+    },
+    gaveUp: (message) => {
+      gaveUp = message;
     }
   };
-  walk2("");
-  return copied;
+  const login = await screen.spin(prefix, () => "Signing in to Verity", loginOnce({
+    serviceUrl,
+    remote: remote || void 0,
+    verbose: opts.verbose,
+    providerToken: polled.data,
+    appInstallUi
+  }));
+  if (!login.ok) return failed(login.error);
+  const report = await describeLoginOutcome(login.data, { remote: remote || void 0, verbose: opts.verbose });
+  rail.collapse();
+  const identity = terminalText(login.data.email ?? (login.data.userId != null ? `user #${login.data.userId}` : "your account"), 120);
+  rail.done(`Signed in as ${s.bold}${identity}${s.reset}`);
+  if (gaveUp) rail.line(terminalText(gaveUp, 300), "warn");
+  for (const line2 of report.slice(1)) {
+    if (line2.level === "verbose") continue;
+    rail.line(line2.text.trim().replace(/^✓\s*/, ""), line2.level === "warn" ? "warn" : "muted");
+  }
+  return end("new");
 }
-function isRealDir(path) {
+
+// src/commands/init/standard.ts
+var import_node_fs75 = require("node:fs");
+
+// src/commands/init/rules.ts
+async function projectLabel(token, serviceUrl, verbose) {
   try {
-    const st = (0, import_node_fs76.lstatSync)(path);
-    return st.isDirectory() && !st.isSymbolicLink();
+    const who = await whoami(token, serviceUrl, verbose);
+    return who.ok ? who.data.project_id : null;
   } catch {
-    return false;
+    return null;
   }
 }
-function ensureRealDirs(root, relDir) {
-  let current = root;
-  for (const segment of relDir.split(/[\\/]/).filter(Boolean)) {
-    current = (0, import_node_path64.join)(current, segment);
-    try {
-      (0, import_node_fs76.mkdirSync)(current);
-    } catch (e) {
-      if (e.code !== "EEXIST") return false;
+function profilePreview(profile) {
+  return JSON.stringify(profile, null, 2).split("\n").slice(0, 12).map((l) => terminalText(l, 400)).concat(["\u2026", `The whole profile: ${PROFILE_FILE}`]);
+}
+async function askToSend(ui, profile) {
+  const { rail, screen } = ui;
+  const lines = consentLines(profile);
+  rail.active("Write review rules for this repository?");
+  rail.box(lines.slice(1, -1));
+  rail.line(lines[lines.length - 1]);
+  rail.gap();
+  rail.keys([["Enter", "send"], ["v", "view the profile"], ["n", "skip"]]);
+  let allowed = ["enter", "v", "n"];
+  for (; ; ) {
+    const k = await screen.key(allowed, "n", { freshMs: 300 });
+    if (k !== "v") {
+      rail.collapse();
+      return k === "enter";
     }
-    if (!isRealDir(current)) return false;
+    rail.gap();
+    for (const l of profilePreview(profile)) rail.line(l);
+    rail.gap();
+    rail.keys([["Enter", "send"], ["n", "skip"]]);
+    allowed = ["enter", "n"];
   }
-  return true;
 }
-async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path64.join)(root, ".gate");
-  const verityDir = (0, import_node_path64.join)(root, ".verity");
-  if ((0, import_node_fs76.existsSync)(gateDir) && !(0, import_node_fs76.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs76.existsSync)(gateDir) && (0, import_node_fs76.existsSync)(verityDir)) {
-    if ((0, import_node_fs76.existsSync)((0, import_node_path64.join)(gateDir, "credentials")) && !(0, import_node_fs76.existsSync)((0, import_node_path64.join)(verityDir, "credentials"))) {
-      return true;
-    }
-    if ((0, import_node_fs76.existsSync)((0, import_node_path64.join)(gateDir, "memory")) && !(0, import_node_fs76.existsSync)((0, import_node_path64.join)(verityDir, "memory"))) {
-      return true;
-    }
+async function generate(ui, globals, profile, replaces) {
+  const { rail, screen } = ui;
+  const s = screen.s;
+  const token = await resolveToken(globals.token);
+  const url = await resolveServiceUrl(globals.serviceUrl);
+  if (!token.ok || !url.ok) return { status: "fallback" };
+  const commits = profile.history.commits.length;
+  const fixes = profile.history.commits.filter((c) => c.fix).length;
+  const reverts = profile.history.commits.filter((c) => /^revert\b/i.test(c.subject)).length;
+  rail.active("Writing review rules");
+  await rail.counted(([c, f, r]) => `${s.green}\u2713${s.reset} Read ${c} commits ${s.gray}\xB7${s.reset} ${f} fixes ${s.gray}\xB7${s.reset} ${r} reverts`, [commits, fixes, reverts]);
+  if (profile.docs.length) rail.ticked(`Read ${profile.docs.map((d) => terminalText(d.name, 120)).join(" and ")}`);
+  if (ui.term.screen && !ui.term.motion) rail.line("Writing rules for this repository\u2026");
+  const started = Date.now();
+  const base = buildStandard({ detected: detectProject() }, loadCatalog());
+  const outcome = await screen.spin(`${s.gray}\u2502${s.reset}  `, () => "Writing rules for this repository", generateStandard({
+    serviceUrl: url.data,
+    token: token.data.token,
+    profile,
+    base,
+    projectId: await projectLabel(token.data.token, url.data, globals.verbose),
+    verbose: globals.verbose,
+    replaces
+  }));
+  rail.collapse();
+  if (outcome.status === "exists") return { status: "exists" };
+  if (outcome.status === "disabled") {
+    rail.line("Project rules are not switched on for this project yet. The built-in rules apply.");
+    rail.gap();
+    return { status: "fallback" };
   }
-  const claudeMd = (0, import_node_path64.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs76.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
-    return true;
+  if (outcome.status === "unsupported") {
+    rail.line(`This Verity service (${terminalText(url.data, 200)}) does not write project rules yet: it is older than this CLI. The built-in rules apply.`);
+    rail.gap();
+    return { status: "fallback" };
   }
-  if ((0, import_node_fs76.existsSync)((0, import_node_path64.join)(root, "GATE.md")) && !(0, import_node_fs76.existsSync)((0, import_node_path64.join)(root, "VERITY.md"))) {
-    return true;
+  if (outcome.status === "failed") {
+    rail.warn("The rules could not be written this time");
+    rail.line(terminalText(outcome.reason, 300));
+    rail.line("The built-in rules apply. Try again later: verity standard generate");
+    rail.gap();
+    return { status: "fallback" };
   }
-  if (await hasLegacyHooksAt(root)) return true;
-  return false;
-}
-function registerMigrateCommand(program2) {
-  program2.command("migrate").description("Migrate a legacy GATE.md install to Verity (.gate \u2192 .verity, hooks, CLAUDE.md)").action(async () => {
-    let result;
-    try {
-      result = await runMigration();
-    } catch (err2) {
-      printError(`Migration failed: ${err2.message}`);
-      process.exitCode = 1;
-      return;
-    }
-    if (!result.migrated) {
-      printInfo("Nothing to migrate \u2014 this project is already on Verity.");
-      return;
-    }
-    printInfo("Migration complete:");
-    for (const a of result.actions) printInfo(`  ${a} \u2713`);
-  });
+  const secs2 = Math.max(1, Math.round((Date.now() - started) / 1e3));
+  const docs = profile.docs.length;
+  if (outcome.rules.length === 0) {
+    rail.warn("No project rules this time");
+    rail.line("The proposed rules were too generic, or not safe to use. The built-in rules apply.");
+  } else {
+    const n2 = outcome.rules.length;
+    const from = [`${commits} ${commits === 1 ? "commit" : "commits"}`, ...docs ? [`${docs} ${docs === 1 ? "doc" : "docs"}`] : []].join(" and ");
+    rail.done(`${n2} ${n2 === 1 ? "rule" : "rules"} for this repository ${s.gray}\xB7 from ${from} \xB7 ${secs2}s${s.reset}`);
+    await rail.rules(outcome.rules);
+    if (outcome.rejected > 0) rail.line(`${outcome.rejected} proposed ${outcome.rejected === 1 ? "rule was" : "rules were"} left out: too generic, or not safe to use.`);
+  }
+  rail.gap();
+  rail.done(`Standard v${outcome.version} saved`);
+  rail.line(`Your team gets the same rules. Edit them in ${STANDARD_FILE}`);
+  if (outcome.warning) rail.line(terminalText(outcome.warning, 600), "warn");
+  return { status: "created", version: outcome.version };
 }
 
-// src/commands/init/sign-in.ts
-var import_node_child_process23 = require("node:child_process");
-async function classifyExistingLogin(serviceUrl, remote, opts) {
-  const existing = await resolveToken(opts.token);
-  if (!existing.ok) return { kind: "none" };
-  const who = await whoami(existing.data.token, serviceUrl, opts.verbose);
-  if (who.ok && who.data.logged_in) {
-    return {
-      kind: "signed-in",
-      identity: terminalText(who.data.email ?? `user #${who.data.user_id}`, 120),
-      // Being logged in does not mean THIS repo is covered (VRT-83): grants come
-      // from the login sweep. grant_status is non-null only when a grant exists.
-      covered: remote ? who.data.grant_status != null : null,
-      nudge: reverifyNudge(who.data)
-    };
-  }
-  if (!who.ok) {
-    const denial = authDenialRemedy(who.error);
-    if (denial) return { kind: "rejected", code: denial.code, remedy: denial.remedy };
-    const identity = existing.data.userId != null ? terminalText(existing.data.email ?? `user #${existing.data.userId}`, 120) : null;
-    return { kind: "cached", identity, detail: terminalText(who.error, 200) };
+// src/commands/init/standard.ts
+async function lookUpTeamStandard(opts) {
+  if (!opts.adopt) return { status: "skipped", why: "no-adopt" };
+  const token = await resolveToken(opts.globals.token);
+  const url = await resolveServiceUrl(opts.globals.serviceUrl);
+  if (!token.ok || !url.ok) return { status: "skipped", why: "not-signed-in" };
+  const found = await fetchRemoteSetup({ token: token.data.token, serviceUrl: url.data, verbose: opts.globals.verbose });
+  if (found.status === "unavailable") return { status: "unavailable", reason: terminalText(found.reason, 300) };
+  if (found.status === "none") return { status: "none" };
+  if (opts.previous?.declinedStandardVersion === found.standard.version) {
+    return { status: "declined-before", version: found.standard.version };
   }
-  return { kind: "anonymous" };
+  return { status: "found", found, version: found.standard.version };
 }
-function gitRemote() {
+async function writeTeamStandard(team, opts) {
+  const token = await resolveToken(opts.globals.token);
+  const url = await resolveServiceUrl(opts.globals.serviceUrl);
+  if (!token.ok || !url.ok) return { status: "skipped", why: "not-signed-in" };
+  const found = team.found;
   try {
-    return (0, import_node_child_process23.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
+    const outcome = await adoptRemoteSetup(found, {
+      serviceUrl: url.data,
+      projectId: await projectLabel(token.data.token, url.data, opts.globals.verbose)
+    });
+    if (opts.previous?.declinedStandardVersion != null) {
+      await writeSetupState({ declinedStandardVersion: void 0 }).catch(() => {
+      });
+    }
+    return { status: "adopted", version: found.standard.version, summary: describeRemote(found), notes: outcome.notes };
+  } catch (err2) {
+    return { status: "write-failed", reason: terminalText(err2.message, 300) };
   }
 }
-function sayWhatASkipCosts(ui) {
-  ui.rail.line("Without sign-in, only the local security scan runs. AI review needs sign-in.");
-  ui.rail.line("Sign in later: verity login");
+async function adoptTeamStandard(opts) {
+  const team = await lookUpTeamStandard(opts);
+  return team.status === "found" ? writeTeamStandard(team, opts) : team;
 }
-function coverageLines(ui, repo, covered) {
-  if (covered === null) {
-    ui.rail.line("This folder has no git remote, so there is no project to sync to.");
-  } else if (covered) {
-    ui.rail.line(`${repo} is covered.`);
-  } else {
-    ui.rail.line(`${repo} is not covered by your Verity access, so nothing syncs.`, "warn");
-    ui.rail.line("Give the Verity GitHub App access to it, then run: verity login");
+async function askTeamChoice(ui, team) {
+  const { rail, screen } = ui;
+  rail.active("Your team already has a Standard for this repository");
+  rail.line(describeRemote(team.found));
+  rail.line(`Use it to review with the same rules as everyone else. A new one becomes v${team.version + 1} for the whole team.`);
+  rail.gap();
+  rail.keys([["Enter", "use it"], ["n", "create a new one"]]);
+  const k = await screen.key(["enter", "n"], "enter", { freshMs: 300 });
+  rail.collapse();
+  return k === "n" ? "new" : "use";
+}
+function sayAdopted(ui, team) {
+  ui.rail.done(`Using your team's Standard v${team.version}`);
+  ui.rail.line(terminalText(team.summary, 300));
+  for (const note of team.notes) ui.rail.line(terminalText(note, 300), "warn");
+}
+async function deriveFromCatalogue(ui, globals) {
+  const url = await resolveServiceUrl(globals.serviceUrl);
+  try {
+    const result = await runSynthesis({ serviceUrl: url.ok ? url.data : void 0 });
+    if ("refused" in result) {
+      ui.rail.warn("No Standard was written");
+      ui.rail.line(result.refused);
+      return { ok: false, version: null };
+    }
+    const pushed = await pushStandard(globals);
+    if (pushed.standardVersion !== null) {
+      await correctVerityMdVersion({
+        standard: result.standard,
+        version: pushed.standardVersion,
+        tools: result.tools,
+        serviceUrl: url.ok ? url.data : void 0
+      });
+      ui.rail.done(`Standard v${pushed.standardVersion} saved`);
+      ui.rail.line(`Your team gets the same rules. Edit them in ${STANDARD_FILE}`);
+    } else {
+      ui.rail.done("Standard saved on this machine");
+    }
+    for (const line2 of pushed.lines) {
+      if (line2.startsWith("Standard pushed")) continue;
+      if (line2.startsWith("Not signed in")) ui.rail.line(`Sign in to share it with your team: verity login, then verity standard push. Edit it in ${STANDARD_FILE}`);
+      else ui.rail.line(line2, "warn");
+    }
+    for (const note of result.notes) ui.rail.line(note, "warn");
+    return { ok: true, version: pushed.standardVersion };
+  } catch (err2) {
+    ui.rail.warn("No Standard was written");
+    ui.rail.line(terminalText(err2.message, 300));
+    return { ok: false, version: null };
   }
 }
-async function signInStep(ui, resolution, opts) {
-  const { rail, screen } = ui;
-  const s = screen.s;
-  const end = (outcome) => {
+async function standardStep(ui, ctx) {
+  const { rail } = ui;
+  const s = ui.screen.s;
+  const notAsked = { outcome: "skipped", detail: "none" };
+  const end = (r) => {
     rail.gap();
     rail.settle();
-    return outcome;
+    return r;
   };
-  let named = false;
-  const nameTarget = () => {
-    if (named) return;
-    named = true;
-    rail.note(`Verity service: ${terminalText(resolution.url, 200)}${resolution.source === "default" ? " (the default)" : ` (from ${resolution.source})`}`);
+  const derived = async (profile2) => {
+    const d = await deriveFromCatalogue(ui, ctx.globals);
+    return end({ source: d.ok ? "derived" : "none", version: d.version, profile: profile2 });
   };
-  if ((await resolveToken(opts.token)).ok) nameTarget();
-  const heal = await maybeHealServiceUrl(resolution, opts.verbose);
-  const serviceUrl = heal.serviceUrl;
-  const remote = gitRemote();
-  if (heal.healed) {
-    rail.warn("The saved Verity service no longer answers");
-    rail.line("Sign in again to repair ~/.verity/credentials.");
-  } else {
-    const state = await classifyExistingLogin(serviceUrl, remote, opts);
-    if (state.kind === "signed-in") {
-      rail.done(`Signed in as ${s.bold}${state.identity}${s.reset}`);
-      coverageLines(ui, opts.repo, state.covered);
-      if (state.nudge) rail.line(state.nudge, "warn");
-      return end("already");
-    }
-    if (state.kind === "cached") {
-      rail.done(state.identity ? `Signed in as ${s.bold}${state.identity}${s.reset} (cached)` : "Using your existing Verity token");
-      rail.line(`Could not reach the Verity service to confirm it: ${state.detail}`);
-      return end("unreachable");
-    }
-    if (state.kind === "rejected") {
-      rail.warn(`Your Verity sign-in was rejected (${state.code})`);
-      rail.line(state.remedy);
-    } else if (state.kind === "anonymous") {
-      rail.warn("This project has only an anonymous Verity token");
-      rail.line("The gate runs, but no runs are saved and Verity keeps no memory of this project.");
+  if ((0, import_node_fs75.existsSync)(projectPath(STANDARD_FILE))) {
+    const sync = await pushLocalStandardIfMissing(ctx.globals);
+    rail.done("Kept your Standard");
+    rail.line(`${STANDARD_FILE} is already here, so this run leaves it as it is.`);
+    if (sync.status === "pushed") {
+      rail.line(sync.version !== null ? `It was only on this machine. It is shared now as v${sync.version}.` : "It is only on this machine:", sync.version !== null ? "muted" : "warn");
+      for (const line2 of sync.lines) if (!line2.startsWith("Standard pushed")) rail.line(line2, "warn");
     }
-    rail.settle();
-  }
-  if (!ui.asking) {
-    rail.warn(ui.term.screen ? "Sign-in skipped (--yes)" : "Sign-in skipped (no terminal to ask on)");
-    sayWhatASkipCosts(ui);
-    return end("unattended");
-  }
-  rail.active("Sign in with GitHub");
-  rail.line("One sign-in covers every repository on this machine.");
-  rail.line("Signing in does not give Verity access to the contents of your repositories.");
-  rail.gap();
-  rail.keys([["Enter", "open the browser"], ["s", "skip"]]);
-  const choice = await screen.key(["enter", "s"], "s");
-  if (choice === "s") {
-    rail.collapse();
-    rail.warn("Sign-in skipped");
-    sayWhatASkipCosts(ui);
-    return end("declined");
+    return end({ source: "kept", version: sync.status === "pushed" ? sync.version : null, profile: notAsked });
   }
-  const failed = (why) => {
-    rail.collapse();
-    rail.warn("Sign-in did not complete");
-    rail.line(terminalText(why, 300));
-    sayWhatASkipCosts(ui);
-    return end("failed");
-  };
-  nameTarget();
-  const code = await requestDeviceCode();
-  if (!code.ok) return failed(code.error);
-  const dc = code.data;
-  const copied = copyToClipboard(dc.user_code);
-  const opened = openInBrowser(dc.verification_uri);
-  rail.line(opened ? `Opened ${dc.verification_uri} in your browser. If no window appeared, open it and enter the code.` : `Open ${dc.verification_uri} and enter the code.`, opened ? "muted" : "plain");
-  const prefix = `${s.gray}\u2502${s.reset}  `;
-  const polled = await screen.breathe(
-    prefix,
-    () => `Waiting for you in the browser \xB7 code ${s.bold}${dc.user_code}${s.reset}${copied ? ` ${s.gray}(copied)${s.reset}` : ""}`,
-    pollDeviceToken(dc, { codeExpiresAt: Date.now() + dc.expires_in * 1e3, quiet: true })
-  );
-  if (!polled.ok) return failed(polled.error);
-  let gaveUp = null;
-  const appInstallUi = {
-    wait: async (ctx, visible) => {
-      rail.line(`The Verity GitHub App cannot see ${ctx.owner}/${ctx.repo} yet. Install it${ctx.opened ? " (opened in your browser)" : ""}:`, "warn");
-      rail.line(ctx.installUrl, "plain");
-      return screen.breathe(prefix, () => `Waiting for the install on ${ctx.owner}`, visible);
-    },
-    gaveUp: (message) => {
-      gaveUp = message;
+  const team = await lookUpTeamStandard(ctx);
+  let replaces;
+  if (team.status === "found") {
+    const choice = ctx.standard ?? (ui.asking ? await askTeamChoice(ui, team) : "use");
+    if (choice === "use") {
+      const adopted = await writeTeamStandard(team, ctx);
+      if (adopted.status === "adopted") {
+        sayAdopted(ui, adopted);
+        return end({ source: "adopted", version: adopted.version, profile: notAsked });
+      }
+      rail.warn("Could not write the team's Standard here");
+      if (adopted.status === "write-failed") rail.line(adopted.reason);
+      return derived(notAsked);
     }
-  };
-  const login = await screen.spin(prefix, () => "Signing in to Verity", loginOnce({
-    serviceUrl,
-    remote: remote || void 0,
-    verbose: opts.verbose,
-    providerToken: polled.data,
-    appInstallUi
-  }));
-  if (!login.ok) return failed(login.error);
-  const report = await describeLoginOutcome(login.data, { remote: remote || void 0, verbose: opts.verbose });
-  rail.collapse();
-  const identity = terminalText(login.data.email ?? (login.data.userId != null ? `user #${login.data.userId}` : "your account"), 120);
-  rail.done(`Signed in as ${s.bold}${identity}${s.reset}`);
-  if (gaveUp) rail.line(terminalText(gaveUp, 300), "warn");
-  for (const line2 of report.slice(1)) {
-    if (line2.level === "verbose") continue;
-    rail.line(line2.text.trim().replace(/^✓\s*/, ""), line2.level === "warn" ? "warn" : "muted");
+    await writeSetupState({ declinedStandardVersion: team.version }).catch(() => {
+    });
+    rail.done(`Creating a new Standard ${s.gray}\xB7 it becomes v${team.version + 1} for the team${ctx.standard ? " (--standard new)" : ""}${s.reset}`);
+    replaces = team.version;
+  } else if (team.status === "declined-before") {
+    rail.line(`This project turned down the team's Standard v${team.version} before, so this run builds its own.`);
+    return derived(notAsked);
   }
-  return end("new");
-}
-
-// src/commands/init/phases.ts
-async function moveGateInstall(ui) {
-  if (!await needsMigration()) return;
-  try {
-    const result = await runMigration();
-    ui.rail.done("Moved a GATE.md install to Verity");
-    for (const a of result.actions) ui.rail.line(a);
-  } catch (err2) {
-    ui.rail.warn(`The GATE.md migration failed: ${terminalText(err2.message, 200)}`);
+  if (team.status === "unavailable") {
+    rail.warn("Could not ask the Verity service for this repository's Standard");
+    rail.line(team.reason);
+    return derived(notAsked);
   }
-  ui.rail.settle();
-}
-async function signInSafely(ui, globals) {
+  if (team.status === "skipped") return derived(notAsked);
+  const profile = buildRepoProfile();
   try {
-    return await signInStep(ui, await resolveServiceUrlForAuth(globals.serviceUrl), { token: globals.token, verbose: globals.verbose, repo: repoLabel() });
+    writeRepoFile(PROFILE_FILE, JSON.stringify(profile, null, 2) + "\n");
   } catch (err2) {
-    ui.rail.collapse();
-    ui.rail.warn(`Sign-in did not complete: ${terminalText(err2.message, 200)}`);
-    ui.rail.gap();
-    ui.rail.settle();
-    return "failed";
+    rail.warn(`Could not write ${PROFILE_FILE} for you to read, so nothing was sent`);
+    rail.line(terminalText(err2.message, 200));
+    return derived({ outcome: "failed", detail: "error" });
   }
-}
-function traceTelemetry(trace, telemetry, answer) {
-  if (telemetry === "enabled") trace.mark("telemetry", "ok", answer === "already-on" ? "already" : "new");
-  else if (telemetry === "declined") trace.mark("telemetry", "skipped", "declined");
-  else if (telemetry === "deferred") trace.mark("telemetry", "failed", "none");
-  else trace.mark("telemetry", "skipped", "unattended");
-}
-async function recordAnswers(ui, momentIds, telemetry) {
-  try {
-    await writeSetupState({
-      moments: momentIds,
-      ...telemetry ? { telemetry } : {},
-      init: { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.0-experimental.3a13a5e" : "dev" }
-    });
-  } catch (err2) {
-    ui.rail.line(`Could not record the setup answers: ${terminalText(err2.message, 200)}`, "warn");
+  let detail;
+  let send;
+  if (ctx.profile) {
+    send = ctx.profile === "send";
+    detail = "given";
+  } else if (ui.asking) {
+    send = await askToSend(ui, profile);
+    detail = send ? "asked" : "declined";
+  } else {
+    send = false;
+    detail = "unattended";
+  }
+  if (!send) {
+    rail.warn("Profile not sent");
+    rail.line(detail === "unattended" ? "Nobody was asked, so nothing was sent. Your Standard has the built-in rules only." : "Your Standard has the built-in rules only.");
+    rail.line(`Add project rules later: verity standard generate (read ${PROFILE_FILE} first)`);
+    rail.gap();
+    return derived({ outcome: "skipped", detail });
+  }
+  if (detail === "given") rail.done(`Profile sent ${s.gray}\xB7 no source code (--profile send)${s.reset}`);
+  else rail.done(`Profile sent ${s.gray}\xB7 no source code${s.reset}`);
+  rail.gap();
+  rail.settle();
+  const generated = await generate(ui, ctx.globals, profile, replaces);
+  if (generated.status === "created") {
+    return end({ source: "generated", version: generated.version, profile: { outcome: "ok", detail } });
+  }
+  if (generated.status === "exists") {
+    const again = await adoptTeamStandard(ctx);
+    if (again.status === "adopted") {
+      sayAdopted(ui, again);
+      return end({ source: "adopted", version: again.version, profile: { outcome: "ok", detail } });
+    }
   }
+  return derived({ outcome: "ok", detail });
 }
 
 // src/commands/init/index.ts
-function parseInitFlags(opts) {
+async function runInit(program2, opts) {
+  const started = Date.now();
+  const globals = program2.opts();
+  const defaultsOnly = (opts.yes ?? false) || !interactive();
   let givenMoments;
   if (opts.moments != null) {
     const parsed = parseMomentSelection(String(opts.moments));
     if ("error" in parsed) {
-      printError(terminalText(parsed.error, 300));
+      printError(parsed.error);
       process.exit(1);
     }
     givenMoments = parsed.moments;
@@ -42651,7 +42338,7 @@ function parseInitFlags(opts) {
   if (opts.telemetry != null) {
     const parsed = parseTelemetryAnswer(String(opts.telemetry));
     if (parsed === null) {
-      printError(`--telemetry: unrecognised "${terminalText(String(opts.telemetry), 60)}". Valid: on, off.`);
+      printError(`--telemetry: unrecognised "${opts.telemetry}". Valid: on, off.`);
       process.exit(1);
     }
     givenTelemetry = parsed;
@@ -42660,7 +42347,7 @@ function parseInitFlags(opts) {
   if (opts.profile != null) {
     const v = String(opts.profile).trim().toLowerCase();
     if (v !== "send" && v !== "skip") {
-      printError(`--profile: unrecognised "${terminalText(String(opts.profile), 60)}". Valid: send, skip.`);
+      printError(`--profile: unrecognised "${opts.profile}". Valid: send, skip.`);
       process.exit(1);
     }
     profileAnswer = v;
@@ -42669,24 +42356,16 @@ function parseInitFlags(opts) {
   if (opts.standard != null) {
     const v = String(opts.standard).trim().toLowerCase();
     if (v !== "use" && v !== "new") {
-      printError(`--standard: unrecognised "${terminalText(String(opts.standard), 60)}". Valid: use, new.`);
+      printError(`--standard: unrecognised "${opts.standard}". Valid: use, new.`);
       process.exit(1);
     }
     standardAnswer = v;
   }
-  return { givenMoments, givenTelemetry, profileAnswer, standardAnswer };
-}
-async function runInit(program2, opts) {
-  const started = Date.now();
-  const globals = program2.opts();
-  const defaultsOnly = (opts.yes ?? false) || !interactive();
-  const { givenMoments, givenTelemetry, profileAnswer, standardAnswer } = parseInitFlags(opts);
   const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-  if (!projectMarkers.some((m) => (0, import_node_fs77.existsSync)(m))) {
+  if (!projectMarkers.some((m) => (0, import_node_fs76.existsSync)(m))) {
     printError('No project detected in the current directory. Run "verity init" from your project root.');
     process.exit(1);
   }
-  const before = snapshotInitFiles();
   const stale = clearStalePluginMarker();
   const pluginMode = opts.plugin === false ? false : opts.pluginMode ?? pluginActiveHere();
   const install = pluginMode ? activePluginInstall() : null;
@@ -42699,7 +42378,16 @@ async function runInit(program2, opts) {
     await wordmark(ui.screen, { reveal: firstInitOnMachine() });
     rail.open(repoLabel());
     if (opts.intensity != null) rail.line("--intensity is ignored: static analysis is Trivy only.", "warn");
-    await moveGateInstall(ui);
+    if (await needsMigration()) {
+      try {
+        const result = await runMigration();
+        rail.done("Moved a GATE.md install to Verity");
+        for (const a of result.actions) rail.line(a);
+      } catch (err2) {
+        rail.warn(`The GATE.md migration failed: ${terminalText(err2.message, 200)}`);
+      }
+      rail.settle();
+    }
     if (!await prerequisitesStep(ui)) {
       rail.end("Stopped: a required tool is missing.", "Install it, then run verity init again.");
       trace.mark("prerequisites", "failed", "blocked");
@@ -42710,10 +42398,10 @@ async function runInit(program2, opts) {
     trace.mark("prerequisites", "ok");
     await scaffoldStep(ui, { untrackMemory: opts.untrackMemory === true, untrackState: opts.untrackState === true });
     trace.mark("scaffold", "ok");
-    await (0, import_promises19.mkdir)((0, import_node_path65.join)(process.env.HOME ?? "", ".verity"), { recursive: true });
+    await (0, import_promises19.mkdir)((0, import_node_path64.join)(process.env.HOME ?? "", ".verity"), { recursive: true });
     await repoStep(ui, detectProject());
     const previous = await readSetupState();
-    const setUpBefore = (0, import_node_fs77.existsSync)(projectPath(STANDARD_FILE));
+    const setUpBefore = (0, import_node_fs76.existsSync)(projectPath(STANDARD_FILE));
     const answers = await askSetupQuestions(defaultsOnly, previous, { moments: givenMoments, telemetry: givenTelemetry });
     trace.mark("questions", "ok", givenMoments || givenTelemetry !== void 0 || profileAnswer || standardAnswer ? "asked" : "defaults");
     const plan = planMoments(answers.moments, { given: givenMoments !== void 0, defaultsOnly });
@@ -42729,40 +42417,66 @@ async function runInit(program2, opts) {
       force: opts.force ?? false
     });
     trace.mark("hooks", "ok", pluginMode ? "plugin" : "project");
-    const signIn = await signInSafely(ui, globals);
+    let signIn;
+    try {
+      signIn = await signInStep(ui, await resolveServiceUrlForAuth(globals.serviceUrl), { token: globals.token, verbose: globals.verbose, repo: repoLabel() });
+    } catch (err2) {
+      rail.collapse();
+      rail.warn(`Sign-in did not complete: ${terminalText(err2.message, 200)}`);
+      rail.gap();
+      rail.settle();
+      signIn = "failed";
+    }
     trace.mark("sign_in", ...signInDetail(signIn));
     const signedIn = signIn === "already" || signIn === "new" || signIn === "unreachable";
-    const telemetry = await telemetryStep(ui, answers.telemetry, answers.telemetry === "not-asked" && previous?.telemetry === "deferred", globals, previous?.telemetry);
-    traceTelemetry(trace, telemetry, answers.telemetry);
+    const telemetry = await telemetryStep(ui, answers.telemetry, answers.telemetry === "not-asked" && previous?.telemetry === "deferred", globals);
+    if (telemetry === "enabled") trace.mark("telemetry", "ok", answers.telemetry === "already-on" ? "already" : "new");
+    else if (telemetry === "declined") trace.mark("telemetry", "skipped", "declined");
+    else if (telemetry === "deferred") trace.mark("telemetry", "failed", "none");
+    else trace.mark("telemetry", "skipped", "unattended");
     const standard = await standardStep(ui, { globals, previous, adopt: opts.adopt !== false, profile: profileAnswer, standard: standardAnswer });
     trace.mark("profile", standard.profile.outcome, standard.profile.detail);
     const haveStandard = standard.source !== "none";
     trace.mark("standard", haveStandard ? "ok" : "failed", standard.source);
     const formalNew = formalDefault(previous, { setUpBefore });
     backgroundStep(ui, { cli: process.argv[1], formalNew });
-    await recordAnswers(ui, plan.momentIds, telemetry);
+    try {
+      await writeSetupState({
+        // The effective answer: the next run starts from this record.
+        moments: plan.momentIds,
+        ...telemetry ? { telemetry } : {},
+        init: { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.0-experimental.7c5e75b" : "dev" }
+      });
+    } catch (err2) {
+      rail.line(`Could not record the setup answers: ${terminalText(err2.message, 200)}`, "warn");
+    }
     trace.mark("completed", haveStandard ? "ok" : "failed", haveStandard ? void 0 : "none");
     await trace.settle();
-    await finishRun(ui, {
-      started,
-      before,
-      haveStandard,
-      pluginMode,
-      noPlugin: opts.plugin === false,
-      signedIn,
-      momentIds: plan.momentIds
-    });
+    const secs2 = Math.max(1, Math.round((Date.now() - started) / 1e3));
+    const s = ui.screen.s;
+    if (!haveStandard) {
+      rail.end(`${s.yellow}Not finished:${s.reset} this project has no Standard, so the gate cannot review.`, "Run verity init again, or /verity-setup in Claude Code.");
+    } else {
+      if (pluginMode) {
+        const version = activePluginVersion();
+        if (version) await writeSetupState({ pluginSetup: { version, completed_at: (/* @__PURE__ */ new Date()).toISOString() }, wiring: void 0 });
+      } else if (opts.plugin === false) {
+        await writeSetupState({ wiring: "project" });
+      }
+      const next = plan.momentIds.length === 0 ? "Verity reviews nothing until you turn a moment on: verity config moments turn,commit,push" : pluginMode ? signedIn ? "Verity reviews from your next turn." : "The security scan runs from your next turn. Sign in for AI review: verity login" : signedIn ? "Start a new Claude Code session. Verity reviews from its first turn." : "Start a new Claude Code session. The security scan runs from the first turn.";
+      rail.end(`${s.green}${s.bold}Ready${s.reset} ${s.gray}in ${secs2}s.${s.reset}`, next);
+    }
     markInitSeen();
   } finally {
     ui.screen.release();
   }
 }
 function registerInitCommand(program2) {
-  program2.command("init").alias("setup").description("Set up Verity in this project: sign in, telemetry, and the Standard; every other choice is a stated default").option("--force", "Reinstall the skills even when they are up to date (hooks are always reconciled)").option("-y, --yes", "Ask nothing: skip sign-in unless already signed in, and send the profile only with --profile send").option("--profile <send|skip>", "Answer the repo-profile question without asking (the plugin asks in the session)").option("--standard <use|new>", "When the team already has a Standard: use it, or create a new one (the plugin asks in the session; unattended runs use it)").option("--no-setup", "Ignored: init no longer hands off to /verity-setup (kept for old scripts)").option("--plugin-mode", "The Claude Code plugin owns the skills and hooks: install neither, and remove any this project already has").option("--no-plugin", "Ignore any Claude Code plugin here and wire this project's own skills and hooks").option("--no-adopt", "Don't use this repository's Standard from the service; build a new one").option("--moments <list>", 'Set when Verity reviews without the default: stop,pre-commit,pre-push \u2014 or "none"').option("--intensity <level>", "Ignored: static analysis is Trivy only (kept so older plugin skills keep working)").option("--telemetry <on|off>", "Answer the telemetry question without asking: send cost & usage from this machine, or not").option("--untrack-memory", "Stop tracking the knowledge graph in git (init does not ask)").option("--untrack-state", "Untrack committed Verity state without asking (a terminal run asks when it finds some)").action((opts) => runInit(program2, opts));
+  program2.command("init").alias("setup").description("Set up Verity in this project: two questions (sign in, and send a repo profile); every other choice is a stated default").option("--force", "Reinstall the skills even when they are up to date (hooks are always reconciled)").option("-y, --yes", "Ask nothing: skip sign-in unless already signed in, and send the profile only with --profile send").option("--profile <send|skip>", "Answer the repo-profile question without asking (the plugin asks in the session)").option("--standard <use|new>", "When the team already has a Standard: use it, or create a new one (the plugin asks in the session; unattended runs use it)").option("--no-setup", "Ignored: init no longer hands off to /verity-setup (kept for old scripts)").option("--plugin-mode", "The Claude Code plugin owns the skills and hooks: install neither, and remove any this project already has").option("--no-plugin", "Ignore any Claude Code plugin here and wire this project's own skills and hooks").option("--no-adopt", "Don't use this repository's Standard from the service; build a new one").option("--moments <list>", 'Set when Verity reviews without the default: stop,pre-commit,pre-push \u2014 or "none"').option("--intensity <level>", "Ignored: static analysis is Trivy only (kept so older plugin skills keep working)").option("--telemetry <on|off>", "Turn cost & usage telemetry on or off (init does not ask)").option("--untrack-memory", "Stop tracking the knowledge graph in git (init does not ask)").option("--untrack-state", "Untrack committed Verity state (init does not ask)").action((opts) => runInit(program2, opts));
 }
 
 // src/commands/doctor.ts
-var import_node_fs78 = require("node:fs");
+var import_node_fs77 = require("node:fs");
 async function buildReport() {
   const prereqs = await checkPrereqs({ install: false });
   const state = await readSetupState();
@@ -42771,8 +42485,8 @@ async function buildReport() {
   const provenance = cliProvenance();
   const telemetry = await checkTelemetry();
   const artifacts = {
-    standard: (0, import_node_fs78.existsSync)(projectPath(STANDARD_FILE)),
-    verityMd: (0, import_node_fs78.existsSync)(projectPath(VERITY_MD_FILE))
+    standard: (0, import_node_fs77.existsSync)(projectPath(STANDARD_FILE)),
+    verityMd: (0, import_node_fs77.existsSync)(projectPath(VERITY_MD_FILE))
   };
   const next = [];
   for (const c of prereqs.checks) {
@@ -42931,8 +42645,8 @@ function registerDoctorCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-var import_node_fs79 = require("node:fs");
-var import_node_path66 = require("node:path");
+var import_node_fs78 = require("node:fs");
+var import_node_path65 = require("node:path");
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("Remove Verity from this project (skills, hooks, .verity/, VERITY.md)").option("--dry-run", "Show what would be removed without doing it").option("--purge-global", "Also remove ~/.verity/ (deletes saved tokens \u2014 reconnect requires re-registration)").option("--keep-verity-md", "Keep the project root VERITY.md file").action(async (opts) => {
     const dryRun = opts.dryRun ?? false;
@@ -42941,11 +42655,11 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name2 of PROJECT_SKILL_NAMES) {
-      const dir = (0, import_node_path66.join)(skillsRoot, name2);
-      if ((0, import_node_fs79.existsSync)(dir)) {
+      const dir = (0, import_node_path65.join)(skillsRoot, name2);
+      if ((0, import_node_fs78.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name2}/`,
-          apply: () => (0, import_node_fs79.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs78.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -42959,24 +42673,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs79.existsSync)(verityDir)) {
+    if ((0, import_node_fs78.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs79.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs78.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs79.existsSync)(verityMd)) {
+      if ((0, import_node_fs78.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs79.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs78.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs79.existsSync)(path) && (0, import_node_fs79.statSync)(path).isDirectory() && (0, import_node_fs79.readdirSync)(path).length === 0) {
-        (0, import_node_fs79.rmdirSync)(path);
+      if ((0, import_node_fs78.existsSync)(path) && (0, import_node_fs78.statSync)(path).isDirectory() && (0, import_node_fs78.readdirSync)(path).length === 0) {
+        (0, import_node_fs78.rmdirSync)(path);
       }
     };
     actions.push({
@@ -42987,11 +42701,11 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path66.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs79.existsSync)(globalVerityDir)) {
+    const globalVerityDir = (0, import_node_path65.join)(home, ".verity");
+    if (purgeGlobal && (0, import_node_fs78.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs79.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs78.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -43210,8 +42924,8 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs80 = require("node:fs");
-var import_node_path67 = require("node:path");
+var import_node_fs79 = require("node:fs");
+var import_node_path66 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -43251,18 +42965,18 @@ function registerResetCommand(program2) {
       } catch {
       }
     }
-    const purged = purgeVerityDir((0, import_node_path67.basename)(CACHE_DIR), (name2) => name2.startsWith("pending-"));
+    const purged = purgeVerityDir((0, import_node_path66.basename)(CACHE_DIR), (name2) => name2.startsWith("pending-"));
     if (purged === null) printError(`Did not purge ${CACHE_DIR}: it is not a directory inside ${VERITY_DIR}.`);
     const stateDir2 = projectPath(VERITY_DIR);
     const filesToClear = [
-      (0, import_node_path67.basename)(INTENT_FILE),
-      (0, import_node_path67.basename)(HASH_FILE),
-      (0, import_node_path67.basename)(BASELINE_SHA_FILE),
+      (0, import_node_path66.basename)(INTENT_FILE),
+      (0, import_node_path66.basename)(HASH_FILE),
+      (0, import_node_path66.basename)(BASELINE_SHA_FILE),
       ".iteration-count",
       ".last-analysis"
     ];
     for (const name2 of filesToClear) {
-      if (lstatOrNull((0, import_node_path67.join)(stateDir2, name2)) && !replaceInRoot(stateDir2, name2, "")) {
+      if (lstatOrNull((0, import_node_path66.join)(stateDir2, name2)) && !replaceInRoot(stateDir2, name2, "")) {
         printError(`Did not clear ${VERITY_DIR}/${name2}: it is not a regular file inside ${VERITY_DIR}.`);
       }
     }
@@ -43277,29 +42991,29 @@ function registerResetCommand(program2) {
 }
 function lstatOrNull(path) {
   try {
-    return (0, import_node_fs80.lstatSync)(path);
+    return (0, import_node_fs79.lstatSync)(path);
   } catch {
     return null;
   }
 }
 function purgeVerityDir(child, select) {
   const verityDir = projectPath(VERITY_DIR);
-  const dir = (0, import_node_path67.join)(verityDir, child);
+  const dir = (0, import_node_path66.join)(verityDir, child);
   const parent = lstatOrNull(verityDir);
   const st = lstatOrNull(dir);
   if (!st) return 0;
   if (!parent || parent.isSymbolicLink() || !parent.isDirectory()) return null;
   if (st.isSymbolicLink() || !st.isDirectory()) return null;
   try {
-    if ((0, import_node_fs80.realpathSync)(dir) !== (0, import_node_path67.join)((0, import_node_fs80.realpathSync)(verityDir), child)) return null;
+    if ((0, import_node_fs79.realpathSync)(dir) !== (0, import_node_path66.join)((0, import_node_fs79.realpathSync)(verityDir), child)) return null;
   } catch {
     return null;
   }
   let removed = 0;
-  for (const entry of (0, import_node_fs80.readdirSync)(dir, { withFileTypes: true })) {
+  for (const entry of (0, import_node_fs79.readdirSync)(dir, { withFileTypes: true })) {
     if (entry.isDirectory() || !select(entry.name)) continue;
     try {
-      (0, import_node_fs80.unlinkSync)((0, import_node_path67.join)(dir, entry.name));
+      (0, import_node_fs79.unlinkSync)((0, import_node_path66.join)(dir, entry.name));
       removed++;
     } catch {
     }
@@ -43308,7 +43022,7 @@ function purgeVerityDir(child, select) {
 }
 
 // src/commands/reflect.ts
-var import_node_fs81 = require("node:fs");
+var import_node_fs80 = require("node:fs");
 
 // src/lib/reflection-globs.ts
 var MAX_GLOBS = 6;
@@ -43346,7 +43060,7 @@ async function writeNodeToDisk(args2) {
       { treePaths: listTrackedFiles(), recordBaseline: false }
     );
     if (written === 0) return false;
-    return (0, import_node_fs81.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
+    return (0, import_node_fs80.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
   } catch {
     return false;
   }
@@ -43783,7 +43497,7 @@ function registerRunCommand(program2) {
 }
 
 // src/commands/telemetry.ts
-var import_node_fs82 = require("node:fs");
+var import_node_fs81 = require("node:fs");
 var SCOPE = "every Claude Code session on this machine";
 function declineHeaders(why) {
   process.stderr.write(`Verity telemetry is off here: ${why} Nothing is exported from this session.
@@ -43791,7 +43505,7 @@ function declineHeaders(why) {
   process.exitCode = 1;
 }
 async function recordTelemetryChoice(choice) {
-  if (!(0, import_node_fs82.existsSync)(projectPath(SETUP_STATE_FILE))) return;
+  if (!(0, import_node_fs81.existsSync)(projectPath(SETUP_STATE_FILE))) return;
   try {
     if ((await readSetupState())?.telemetry === choice) return;
     await writeSetupState({ telemetry: choice });
@@ -44041,8 +43755,8 @@ function registerUsageCommand(program2) {
 }
 
 // src/commands/prove.ts
-var import_node_fs83 = require("node:fs");
-var import_node_path68 = require("node:path");
+var import_node_fs82 = require("node:fs");
+var import_node_path67 = require("node:path");
 
 // src/lib/prove/hint-pool.ts
 var STOP2 = /* @__PURE__ */ new Set([
@@ -44184,7 +43898,7 @@ function registerProveCommand(program2) {
       process.exit(2);
     }
     const limit = Math.max(1, Math.min(50, Number(opts.limit) || 10));
-    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path68.relative)(root, (0, import_node_path68.resolve)(p)) || ".") });
+    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path67.relative)(root, (0, import_node_path67.resolve)(p)) || ".") });
     if (opts.hint && paths.length === 0) {
       const hit = hintMatches(root, opts.hint);
       if (hit.files.length > 0) {
@@ -44238,7 +43952,7 @@ function registerProveCommand(program2) {
   });
   prove.command("check [model]").description("Elaborate a model (or every model) with the local Lean toolchain and report each property").option("--timeout <ms>", "Per-model timeout in ms", "120000").option("--json", "Machine-readable output").action((model, opts) => {
     const root = repoRoot();
-    if (!(0, import_node_fs83.existsSync)((0, import_node_path68.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs82.existsSync)((0, import_node_path67.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -44262,7 +43976,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
     const reports = [];
     for (const f of files) {
       const report = checkModel(tc, root, f, { timeoutMs: Math.max(1e3, Number(opts.timeout) || 12e4) });
-      report.file = (0, import_node_path68.relative)(root, f);
+      report.file = (0, import_node_path67.relative)(root, f);
       reports.push(report);
       try {
         writeResult(root, report);
@@ -44300,7 +44014,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
       printError("Not logged in \u2014 replays run on the Verity service. Run `verity login` first.");
       process.exit(2);
     }
-    if (!(0, import_node_fs83.existsSync)((0, import_node_path68.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs82.existsSync)((0, import_node_path67.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -44331,7 +44045,7 @@ ${report.error ?? ""}`);
       printInfo(opts.property ? `${model} ${opts.property} has no counterexample to replay` : `${model} has no counterexample to replay`);
       return;
     }
-    const modelSource = readRegularFileInRoot(root, (0, import_node_path68.relative)(root, file), 512 * 1024);
+    const modelSource = readRegularFileInRoot(root, (0, import_node_path67.relative)(root, file), 512 * 1024);
     if (!opts.json) printInfo(`replaying ${targets.length} counterexample(s) of ${model} in network-less containers (${Math.min(targets.length, REPLAY_CONCURRENCY)} at a time)\u2026`);
     const outcomes = await mapPool(targets, REPLAY_CONCURRENCY, async (p) => {
       const brief = buildReplayBrief(root, report, p, modelSource.ok ? modelSource.content : "");
@@ -44351,7 +44065,7 @@ ${report.error ?? ""}`);
   });
   prove.command("auto [files...]").description("The formal phase the pre-push guard runs: select one risky symbol among changed files, generate a model, check it, replay counterexamples (default files: the commits ahead of upstream)").option("--deadline <ms>", "Budget for the whole phase", "170000").option("--json", "Machine-readable output").action(async (paths, opts) => {
     const root = repoRoot();
-    let files = paths.map((p) => (0, import_node_path68.relative)(root, (0, import_node_path68.resolve)(p)));
+    let files = paths.map((p) => (0, import_node_path67.relative)(root, (0, import_node_path67.resolve)(p)));
     if (files.length === 0) {
       const ahead = runGitSync(root, ["diff", "--name-only", "@{upstream}...HEAD"]);
       const fallback = ahead.ok ? ahead : runGitSync(root, ["diff", "--name-only", "HEAD~1..HEAD"]);
@@ -44425,7 +44139,7 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
     let revise;
     if (opts.revise) {
       const existing = resolveModelFile(root, opts.revise);
-      const src = existing ? readRegularFileInRoot(root, (0, import_node_path68.relative)(root, existing), 64 * 1024) : null;
+      const src = existing ? readRegularFileInRoot(root, (0, import_node_path67.relative)(root, existing), 64 * 1024) : null;
       if (!src || !src.ok || !opts.note) {
         printError("--revise needs an existing model under Models/ and --note - with what the replay showed on stdin");
         process.exit(2);
@@ -44465,8 +44179,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("waive <file>").description("Dismiss the remembered formal finding(s) on a file for its current bytes \u2014 the accepted-risk path for a formal block").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action((file, opts) => {
     const root = repoRoot();
-    const rel0 = (0, import_node_path68.relative)(root, (0, import_node_path68.isAbsolute)(file) ? file : (0, import_node_path68.join)(root, file)).replace(/\\/g, "/");
-    const rel = rel0.startsWith("..") || (0, import_node_path68.isAbsolute)(rel0) ? null : rel0;
+    const rel0 = (0, import_node_path67.relative)(root, (0, import_node_path67.isAbsolute)(file) ? file : (0, import_node_path67.join)(root, file)).replace(/\\/g, "/");
+    const rel = rel0.startsWith("..") || (0, import_node_path67.isAbsolute)(rel0) ? null : rel0;
     if (!rel) {
       printError(`${file} is not inside this repository`);
       process.exit(2);
@@ -44482,8 +44196,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("hash <file>").description("Print the sha256 of a file, for a model header (Verity.model \u2026 sha256). Path is REPO-relative, as in the header").action((file) => {
     const root = repoRoot();
-    const rel = (0, import_node_path68.relative)(root, (0, import_node_path68.isAbsolute)(file) ? file : (0, import_node_path68.join)(root, file));
-    const digest = rel.startsWith("..") || (0, import_node_path68.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
+    const rel = (0, import_node_path67.relative)(root, (0, import_node_path67.isAbsolute)(file) ? file : (0, import_node_path67.join)(root, file));
+    const digest = rel.startsWith("..") || (0, import_node_path67.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
     if (!digest) {
       printError(`Cannot hash ${file}: it must be a regular file inside this repository (not a symlink)`);
       process.exit(2);
@@ -44517,10 +44231,10 @@ function refreshScaffold(root) {
 }
 
 // src/commands/lean.ts
-var import_node_fs84 = require("node:fs");
-var import_node_child_process24 = require("node:child_process");
-var import_node_os15 = require("node:os");
-var import_node_path69 = require("node:path");
+var import_node_fs83 = require("node:fs");
+var import_node_child_process23 = require("node:child_process");
+var import_node_os14 = require("node:os");
+var import_node_path68 = require("node:path");
 function registerLeanCommand(program2) {
   const lean = program2.command("lean").description("The Lean 4 toolchain formal verification needs (managed download, pinned by this CLI)");
   lean.command("status").option("--json", "Machine-readable output").description("Which toolchain would run, and whether it matches the pinned version").action((opts) => {
@@ -44528,7 +44242,7 @@ function registerLeanCommand(program2) {
     let version = null;
     if (tc) {
       try {
-        version = (0, import_node_child_process24.execFileSync)(tc.lake.replace(/lake(\.exe)?$/, "lean$1"), ["--version"], { env: tc.env, encoding: "utf-8", timeout: 1e4 }).trim();
+        version = (0, import_node_child_process23.execFileSync)(tc.lake.replace(/lake(\.exe)?$/, "lean$1"), ["--version"], { env: tc.env, encoding: "utf-8", timeout: 1e4 }).trim();
       } catch {
         version = null;
       }
@@ -44539,7 +44253,7 @@ function registerLeanCommand(program2) {
     const bg = readInstallState();
     const background = bg ? { ...bg, running: bg.state === "running" && installRunning() } : null;
     if (opts.json) {
-      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs84.existsSync)((0, import_node_path69.join)(managed, "bin")), asset: leanAssetName(), background });
+      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs83.existsSync)((0, import_node_path68.join)(managed, "bin")), asset: leanAssetName(), background });
       return;
     }
     printInfo(`pinned: ${LEAN_TOOLCHAIN}`);
@@ -44556,11 +44270,11 @@ function registerLeanCommand(program2) {
     if (opts.background) process.exit(await runBackgroundInstall());
     const asset = leanAssetName();
     if (!asset) {
-      printError(`no Lean release for ${(0, import_node_os15.platform)()}/${(0, import_node_os15.arch)()}`);
+      printError(`no Lean release for ${(0, import_node_os14.platform)()}/${(0, import_node_os14.arch)()}`);
       process.exit(2);
     }
     const dir = pinnedVersionDir();
-    if ((0, import_node_fs84.existsSync)((0, import_node_path69.join)(dir, "bin", "lake")) && !opts.force) {
+    if ((0, import_node_fs83.existsSync)((0, import_node_path68.join)(dir, "bin", "lake")) && !opts.force) {
       printInfo(`already installed at ${dir}`);
       return;
     }
@@ -44596,20 +44310,20 @@ function registerLeanCommand(program2) {
   });
   lean.command("remove").description("Delete the Verity-managed toolchain for the pinned version").action(() => {
     const dir = pinnedVersionDir();
-    if (!(0, import_node_fs84.existsSync)(dir)) {
+    if (!(0, import_node_fs83.existsSync)(dir)) {
       printInfo("nothing to remove");
       return;
     }
-    (0, import_node_fs84.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs83.rmSync)(dir, { recursive: true, force: true });
     printInfo(`removed ${dir}`);
   });
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.35.0-experimental.3a13a5e").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.35.0-experimental.7c5e75b").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
   const isTelemetryHelper = actionCommand.name() === "headers" && actionCommand.parent?.name() === "telemetry";
   if (!isTelemetryHelper) {
-    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.0-experimental.3a13a5e");
+    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.0-experimental.7c5e75b");
   }
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {