@codacy/verity-cli 0.35.3-experimental.f980d82 → 0.35.4

package/bin/verity.js

@@ -14732,8 +14732,10 @@ var SECURITY_PATTERNS = [
   /(^|\/)pom\.xml$/,
   /(^|\/)gradle\.lockfile$/
 ];
-var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
+var PROD_SERVICE_ORIGIN = "https://server.verity.md";
+var LEGACY_PROD_SERVICE_ORIGIN = "https://ofcamwrjwrkazqvdchko.supabase.co";
+var PROD_SERVICE_URL = `${PROD_SERVICE_ORIGIN}/functions/v1`;
+var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -14823,6 +14825,36 @@ function rotateIfNeeded(file) {
 var import_promises = require("node:fs/promises");
 var import_node_path3 = require("node:path");
 var import_node_child_process2 = require("node:child_process");
+
+// src/lib/service-origin.ts
+var LEGACY = new URL(LEGACY_PROD_SERVICE_ORIGIN);
+function canonicalServiceUrl(raw) {
+  const trimmed = raw.trim();
+  let u;
+  try {
+    u = new URL(trimmed);
+  } catch {
+    return raw;
+  }
+  if (u.protocol !== LEGACY.protocol || u.host.toLowerCase() !== LEGACY.host || u.username !== "" || u.password !== "") {
+    return raw;
+  }
+  return trimmed.replace(/^https:\/\/[^/?#]+/i, PROD_SERVICE_ORIGIN);
+}
+function normalizeServiceUrl(raw) {
+  const trimmed = canonicalServiceUrl(raw).trim().replace(/\/+$/, "");
+  try {
+    const u = new URL(trimmed);
+    return `${u.protocol}//${u.host.toLowerCase()}${u.pathname.replace(/\/+$/, "")}`;
+  } catch {
+    return trimmed.toLowerCase();
+  }
+}
+function sameServiceUrl(a, b) {
+  return normalizeServiceUrl(a) === normalizeServiceUrl(b);
+}
+
+// src/lib/credentials.ts
 function globalCredentialsPath() {
   return `${process.env.HOME}/.verity/credentials`;
 }
@@ -14843,7 +14875,8 @@ function parseCredentialLine(line2) {
   const rest = idx === -1 ? line2 : line2.slice(idx);
   const tokenMatch = rest.match(TOKEN_RE);
   if (!tokenMatch) return null;
-  const serviceUrl = rest.match(/service_url:\s*(https?:\/\/\S+)/)?.[1];
+  const serviceUrlRaw = rest.match(/service_url:\s*(https?:\/\/\S+)/)?.[1];
+  const serviceUrl = serviceUrlRaw != null ? canonicalServiceUrl(serviceUrlRaw) : void 0;
   const userIdRaw = rest.match(/user_id:\s*(\d+)/)?.[1];
   const email = rest.match(/email:\s*(\S+)/)?.[1];
   return {
@@ -14865,7 +14898,7 @@ function encodeRemoteKey(remote) {
 function serializeCredential(remote, rec) {
   const key = encodeRemoteKey(remote);
   const out2 = [key ? `${key} token: ${rec.token}` : `token: ${rec.token}`];
-  if (rec.serviceUrl) out2.push(`service_url: ${rec.serviceUrl}`);
+  if (rec.serviceUrl) out2.push(`service_url: ${canonicalServiceUrl(rec.serviceUrl)}`);
   if (rec.userId != null) out2.push(`user_id: ${rec.userId}`);
   if (rec.email) out2.push(`email: ${rec.email}`);
   return out2.join(" ");
@@ -14938,7 +14971,7 @@ async function removeSupersededUserCredentials(loginServiceUrl, loginUserId) {
   let removed = 0;
   for (const line2 of content.split("\n")) {
     const parsed = parseCredentialLine(line2);
-    const superseded = parsed !== null && parsed.remote !== "" && parsed.rec.userId === loginUserId && (!parsed.rec.serviceUrl || parsed.rec.serviceUrl === loginServiceUrl);
+    const superseded = parsed !== null && parsed.remote !== "" && parsed.rec.userId === loginUserId && (!parsed.rec.serviceUrl || sameServiceUrl(parsed.rec.serviceUrl, loginServiceUrl));
     if (superseded) {
       removed++;
       continue;
@@ -14990,9 +15023,10 @@ function parseLocalCredentialFile(content) {
   const tokenMatch = content.match(/token:\s*((?:gate_|verity_)[a-f0-9]+)/);
   if (!tokenMatch) return null;
   const userIdMatch = content.match(/^user_id:\s*(\d+)/m);
+  const serviceUrl = content.match(/service_url:\s*(https?:\/\/\S+)/)?.[1];
   return {
     token: tokenMatch[1],
-    serviceUrl: content.match(/service_url:\s*(https?:\/\/\S+)/)?.[1],
+    serviceUrl: serviceUrl != null ? canonicalServiceUrl(serviceUrl) : void 0,
     userId: userIdMatch ? Number(userIdMatch[1]) : void 0,
     email: content.match(/^email:\s*(\S+)/m)?.[1]
   };
@@ -15306,15 +15340,7 @@ async function checkTokenPin(token, targetUrl) {
   if (!stored.serviceUrl) return { attach: false, reason: "unpinnable" };
   return normalizeUrl(stored.serviceUrl) === normalizeUrl(targetUrl) ? { attach: true } : { attach: false, reason: "mismatch", mintedFor: stored.serviceUrl };
 }
-function normalizeUrl(raw) {
-  const trimmed = raw.trim().replace(/\/+$/, "");
-  try {
-    const u = new URL(trimmed);
-    return `${u.protocol}//${u.host.toLowerCase()}${u.pathname.replace(/\/+$/, "")}`;
-  } catch {
-    return trimmed.toLowerCase();
-  }
-}
+var normalizeUrl = normalizeServiceUrl;
 function pinRefusalMessage(verdict, targetUrl) {
   if (verdict.reason === "unpinnable") {
     return `Refusing to send your Verity login to ${targetUrl}: this machine's credential does not record which service issued it, so it cannot be verified. Run "verity login" to re-issue it.`;
@@ -15325,7 +15351,7 @@ function pinRefusalMessage(verdict, targetUrl) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.35.3-experimental.f980d82" : "dev";
+    return true ? "0.35.4" : "dev";
   } catch {
     return "dev";
   }
@@ -15530,7 +15556,7 @@ async function serviceUrlFromVerityMd() {
     const line2 = content.split("\n").find((l) => /\*{0,2}(?:url|service)\*{0,2}\s*:/i.test(l));
     if (line2) {
       const urlMatch = line2.match(/https:\/\/[^\s]+/);
-      if (urlMatch) return urlMatch[0];
+      if (urlMatch) return canonicalServiceUrl(urlMatch[0]);
     }
   } catch {
   }
@@ -18048,6 +18074,124 @@ function describeRemote(found) {
   return `version ${found.standard.version}, pushed${who} on ${when}${also}`;
 }
 
+// src/lib/json-file.ts
+var import_promises3 = require("node:fs/promises");
+var import_node_path12 = require("node:path");
+function jsonSemanticEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) {
+    return a === b;
+  }
+  const aIsArr = Array.isArray(a);
+  const bIsArr = Array.isArray(b);
+  if (aIsArr || bIsArr) {
+    if (!aIsArr || !bIsArr || a.length !== b.length) return false;
+    for (let i2 = 0; i2 < a.length; i2++) {
+      if (!jsonSemanticEqual(a[i2], b[i2])) return false;
+    }
+    return true;
+  }
+  const ao = a;
+  const bo = b;
+  const aKeys = Object.keys(ao).filter((k) => ao[k] !== void 0);
+  const bKeys = Object.keys(bo).filter((k) => bo[k] !== void 0);
+  if (aKeys.length !== bKeys.length) return false;
+  for (const k of aKeys) {
+    if (bo[k] === void 0) return false;
+    if (!jsonSemanticEqual(ao[k], bo[k])) return false;
+  }
+  return true;
+}
+function detectJsonIndent(raw) {
+  const m = raw.match(/\n([ \t]+)\S/);
+  return m ? m[1] : 2;
+}
+async function writeJsonFilePreservingStyle(file, value) {
+  let currentRaw = null;
+  try {
+    currentRaw = await (0, import_promises3.readFile)(file, "utf-8");
+  } catch {
+    currentRaw = null;
+  }
+  if (currentRaw !== null) {
+    try {
+      if (jsonSemanticEqual(JSON.parse(currentRaw), value)) return false;
+    } catch {
+    }
+  }
+  const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
+  const next = JSON.stringify(value, null, indent) + "\n";
+  if (next === currentRaw) return false;
+  await (0, import_promises3.mkdir)((0, import_node_path12.dirname)(file), { recursive: true });
+  await (0, import_promises3.writeFile)(file, next);
+  return true;
+}
+
+// src/lib/setup-state.ts
+var SETUP_STATE_FILE = `${VERITY_DIR}/setup.json`;
+var MOMENTS = ["stop", "pre-commit", "pre-push"];
+var INTENSITIES = ["lightweight", "balanced", "thorough"];
+var TELEMETRY = ["enabled", "declined", "deferred"];
+var VERSION = /^[0-9A-Za-z.+-]{1,32}$/;
+var stamp = (v) => typeof v === "string" && v.length > 0 && v.length <= 64;
+function setupStateFrom(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+  const r = raw;
+  if (r.version !== 1) return null;
+  const out2 = { version: 1 };
+  if (INTENSITIES.includes(r.intensity)) out2.intensity = r.intensity;
+  if (Array.isArray(r.moments) && r.moments.every((m) => MOMENTS.includes(m))) {
+    out2.moments = [...new Set(r.moments)];
+  }
+  if (TELEMETRY.includes(r.telemetry)) out2.telemetry = r.telemetry;
+  if (Number.isSafeInteger(r.declinedStandardVersion) && r.declinedStandardVersion >= 1) {
+    out2.declinedStandardVersion = r.declinedStandardVersion;
+  }
+  if (Number.isSafeInteger(r.standardVersion) && r.standardVersion >= 1) {
+    out2.standardVersion = r.standardVersion;
+  }
+  const init2 = r.init;
+  if (init2 && typeof init2 === "object" && stamp(init2.completed_at) && typeof init2.cli_version === "string" && VERSION.test(init2.cli_version)) {
+    out2.init = { completed_at: init2.completed_at, cli_version: init2.cli_version };
+  }
+  const plugin = r.pluginSetup;
+  if (plugin && typeof plugin === "object" && typeof plugin.version === "string" && VERSION.test(plugin.version) && stamp(plugin.completed_at)) {
+    out2.pluginSetup = { version: plugin.version, completed_at: plugin.completed_at };
+  }
+  if (r.wiring === "project") out2.wiring = "project";
+  return out2;
+}
+var MAX_SETUP_BYTES = 64 * 1024;
+function readSetupText() {
+  const read2 = readRegularFileInRoot(repoRoot(), SETUP_STATE_FILE, MAX_SETUP_BYTES);
+  return read2.ok ? read2.content : null;
+}
+async function readSetupState() {
+  const raw = readSetupText();
+  if (raw === null) return null;
+  try {
+    return setupStateFrom(JSON.parse(raw));
+  } catch {
+    return null;
+  }
+}
+async function writeSetupState(patch) {
+  const current = await readSetupState() ?? { version: 1 };
+  const next = { ...current, ...patch, version: 1 };
+  const raw = readSetupText();
+  if (raw !== null) {
+    try {
+      if (jsonSemanticEqual(JSON.parse(raw), next)) return next;
+    } catch {
+    }
+  }
+  const text3 = JSON.stringify(next, null, raw !== null ? detectJsonIndent(raw) : 2) + "\n";
+  if (!replaceInRoot(projectPath(VERITY_DIR), "setup.json", text3)) {
+    throw new Error(`Could not write ${SETUP_STATE_FILE}: it is a link, or ${VERITY_DIR} is not a folder of this repository`);
+  }
+  return next;
+}
+
 // src/lib/catalogue-conversion.ts
 var PACK_ID2 = /^[a-z][a-z0-9-]{0,39}$/;
 var MAX_PACKS2 = 12;
@@ -18078,6 +18222,12 @@ function count(v) {
 }
 
 // src/lib/push-setup.ts
+function latestFromConflict(result) {
+  const err2 = result.errorBody?.error;
+  const raw = err2 && typeof err2 === "object" ? err2.latest_version : void 0;
+  const n2 = typeof raw === "string" && /^[1-9][0-9]*$/.test(raw) ? Number(raw) : typeof raw === "number" ? raw : NaN;
+  return Number.isSafeInteger(n2) && n2 >= 1 ? n2 : null;
+}
 async function pushStandard(globals, opts = {}) {
   const lines = [];
   const token = await resolveToken(globals.token);
@@ -18113,11 +18263,15 @@ async function pushStandard(globals, opts = {}) {
       if (result.ok) {
         standardVersion = result.data.version;
         lines.push(`Standard pushed to Verity (v${result.data.version}) \u2713`);
+        if (Number.isSafeInteger(standardVersion) && standardVersion >= 1) {
+          await writeSetupState({ standardVersion }).catch(() => {
+          });
+        }
         const converted = conversionLine(result.data);
         if (converted) lines.push(converted);
       } else if (opts.expectedLatest !== void 0 && result.http_status === 409 && result.error.startsWith("STANDARD_EXISTS")) {
         lines.push("The service has a Standard now that this run did not see, so nothing was pushed over it.");
-        return { lines, standardVersion: null, conflict: true };
+        return { lines, standardVersion: null, conflict: true, latest: latestFromConflict(result) };
       } else {
         lines.push(`Could not push the Standard: ${terminalText(result.error, 300)} \u2014 run "verity standard push" later.`);
       }
@@ -18285,7 +18439,7 @@ async function finishSplitLogin(opts) {
   if (read2.status === "invalid") fail2("invalid", `the pending sign-in is unusable (${read2.reason}) \u2014 run "verity login --start" again`, true);
   if (read2.status === "expired") fail2("expired", 'the code expired before it was approved \u2014 run "verity login --start" again', true);
   const pending = read2.record;
-  if (pending.service_url !== opts.serviceUrl) {
+  if (!sameServiceUrl(pending.service_url, opts.serviceUrl)) {
     fail2(
       "service_changed",
       `the sign-in was started for ${pending.service_url}, but this machine now resolves ${opts.serviceUrl} \u2014 run "verity login --start" again`,
@@ -18646,61 +18800,6 @@ function registerLogoutCommand(program2) {
 // src/lib/hooks.ts
 var import_promises4 = require("node:fs/promises");
 var import_node_path13 = require("node:path");
-
-// src/lib/json-file.ts
-var import_promises3 = require("node:fs/promises");
-var import_node_path12 = require("node:path");
-function jsonSemanticEqual(a, b) {
-  if (a === b) return true;
-  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) {
-    return a === b;
-  }
-  const aIsArr = Array.isArray(a);
-  const bIsArr = Array.isArray(b);
-  if (aIsArr || bIsArr) {
-    if (!aIsArr || !bIsArr || a.length !== b.length) return false;
-    for (let i2 = 0; i2 < a.length; i2++) {
-      if (!jsonSemanticEqual(a[i2], b[i2])) return false;
-    }
-    return true;
-  }
-  const ao = a;
-  const bo = b;
-  const aKeys = Object.keys(ao).filter((k) => ao[k] !== void 0);
-  const bKeys = Object.keys(bo).filter((k) => bo[k] !== void 0);
-  if (aKeys.length !== bKeys.length) return false;
-  for (const k of aKeys) {
-    if (bo[k] === void 0) return false;
-    if (!jsonSemanticEqual(ao[k], bo[k])) return false;
-  }
-  return true;
-}
-function detectJsonIndent(raw) {
-  const m = raw.match(/\n([ \t]+)\S/);
-  return m ? m[1] : 2;
-}
-async function writeJsonFilePreservingStyle(file, value) {
-  let currentRaw = null;
-  try {
-    currentRaw = await (0, import_promises3.readFile)(file, "utf-8");
-  } catch {
-    currentRaw = null;
-  }
-  if (currentRaw !== null) {
-    try {
-      if (jsonSemanticEqual(JSON.parse(currentRaw), value)) return false;
-    } catch {
-    }
-  }
-  const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
-  const next = JSON.stringify(value, null, indent) + "\n";
-  if (next === currentRaw) return false;
-  await (0, import_promises3.mkdir)((0, import_node_path12.dirname)(file), { recursive: true });
-  await (0, import_promises3.writeFile)(file, next);
-  return true;
-}
-
-// src/lib/hooks.ts
 var VERITY_STOP_HOOK = {
   type: "command",
   command: "verity analyze",
@@ -19207,13 +19306,21 @@ function readConfigFile(path) {
         git_moments: [...new Set(moments)],
         ...source2 ? { git_moments_source: source2 } : {},
         ...raw.formal === "push" || raw.formal === "off" ? { formal: raw.formal } : {},
-        ...raw.turn_review === "on" || raw.turn_review === "off" ? { turn_review: raw.turn_review } : {}
+        ...raw.turn_review === "on" || raw.turn_review === "off" ? { turn_review: raw.turn_review } : {},
+        ...raw.verbose === "on" || raw.verbose === "off" ? { verbose: raw.verbose } : {}
       }
     };
   } catch {
     return { cfg: DEFAULTS };
   }
 }
+function readVerbose() {
+  try {
+    return readProjectConfigRaw().verbose === "on";
+  } catch {
+    return false;
+  }
+}
 function configRefusalMessage(reason) {
   switch (reason) {
     case "link":
@@ -19285,12 +19392,13 @@ function formalRefusalMessage(reason) {
   }
 }
 function writeProjectConfig(patch) {
-  const { git_moments, git_moments_source, formal, turn_review } = readProjectConfigRaw();
+  const { git_moments, git_moments_source, formal, turn_review, verbose } = readProjectConfigRaw();
   const next = {
     git_moments,
     ...git_moments_source ? { git_moments_source } : {},
     ...formal ? { formal } : {},
     ...turn_review ? { turn_review } : {},
+    ...verbose ? { verbose } : {},
     ...patch
   };
   writeRepoFile(PROJECT_CONFIG_FILE, JSON.stringify(next, null, 2) + "\n");
@@ -21085,13 +21193,15 @@ var import_node_child_process9 = require("node:child_process");
 var import_node_fs24 = require("node:fs");
 var VERITY_GITIGNORE_MARKER = "# Verity \u2014 machine-local state.";
 var SETTINGS_LOCAL_IGNORE_ENTRY = ".claude/settings.local.json";
+var BLOCK_COMMENT = [
+  "# Verity \u2014 machine-local state. Everything in .verity/ is ignored. The Standard",
+  "# is held by the Verity service (verity standard pull writes it here), and the",
+  "# knowledge graph under .verity/memory/ is rebuilt from it. Committing either",
+  "# puts generated files in every diff and pull request."
+];
 var VERITY_GITIGNORE_BLOCK = [
-  "# Verity \u2014 machine-local state. Everything in .verity/ is ignored except the",
-  "# shared standard, which is meant to be committed. The knowledge graph under",
-  "# .verity/memory/ is machine-local too: the service rebuilds it, and committing",
-  "# it puts generated notes in every diff and pull request.",
+  ...BLOCK_COMMENT,
   ".verity/*",
-  "!.verity/standard.yaml",
   SETTINGS_LOCAL_IGNORE_ENTRY,
   ""
 ].join("\n");
@@ -21116,9 +21226,11 @@ var SUPERSEDED_MEMORY_LINES = /* @__PURE__ */ new Set([
   ".verity/memory/log.md",
   SUPERSEDED_COMMENT
 ]);
-function isIgnored3(path) {
+var SUPERSEDED_STANDARD_LINE = "!.verity/standard.yaml";
+var OLD_COMMENT_LINES = /* @__PURE__ */ new Set([SUPERSEDED_COMMENT, ...MEMORY_COMMENT]);
+function isIgnored3(path, opts = {}) {
   try {
-    (0, import_node_child_process9.execSync)(`git check-ignore -q -- "${path}"`, { stdio: "pipe" });
+    (0, import_node_child_process9.execSync)(`git check-ignore -q ${opts.noIndex ? "--no-index " : ""}-- "${path}"`, { stdio: "pipe" });
     return true;
   } catch (err2) {
     return err2.status === 1 ? false : null;
@@ -21126,10 +21238,9 @@ function isIgnored3(path) {
 }
 function semanticsHold() {
   const snapshot = isIgnored3(".verity/.snapshot/__probe__");
-  const standard = isIgnored3(".verity/standard.yaml");
   const futureState = isIgnored3(".verity/.__probe-future-state__");
-  if (snapshot === null || standard === null || futureState === null) return null;
-  return snapshot === true && futureState === true && standard === false;
+  if (snapshot === null || futureState === null) return null;
+  return snapshot === true && futureState === true;
 }
 function memoryPosture() {
   const ignored = isIgnored3(".verity/memory/domain/__probe__.md");
@@ -21146,6 +21257,22 @@ function committedMemoryFiles() {
     return [];
   }
 }
+var STANDARD_PATH = ".verity/standard.yaml";
+function standardPosture() {
+  const ignored = isIgnored3(STANDARD_PATH, { noIndex: true });
+  if (ignored === null) return "unknown";
+  return ignored ? "ignored" : "committable";
+}
+function committedStandardFile() {
+  try {
+    return (0, import_node_child_process9.execSync)(`git ls-files -z -- ${STANDARD_PATH}`, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).split("\0").filter(Boolean).length > 0;
+  } catch {
+    return false;
+  }
+}
 var OPT_OUT_COMMENT_LINES = /* @__PURE__ */ new Set([
   MEMORY_OPT_OUT_MARKER,
   '# Remove these three lines (or run "verity memory untrack") to stop tracking it.'
@@ -21163,6 +21290,19 @@ function fenceMemoryLines(lines) {
   }
   return out2;
 }
+function fenceStandardLines(lines) {
+  const out2 = [];
+  for (const line2 of lines) {
+    const trimmed = line2.trim();
+    if (trimmed.startsWith(VERITY_GITIGNORE_MARKER) && trimmed !== BLOCK_COMMENT[0]) {
+      out2.push(...BLOCK_COMMENT);
+      continue;
+    }
+    if (trimmed === SUPERSEDED_STANDARD_LINE || OLD_COMMENT_LINES.has(trimmed)) continue;
+    out2.push(line2);
+  }
+  return out2;
+}
 function ensureVerityGitignore() {
   let content = "";
   try {
@@ -21174,9 +21314,11 @@ function ensureVerityGitignore() {
   const lines = content.split("\n");
   const needsRepair = lines.some((l) => BREAKING_ENTRIES.has(l.trim()));
   const hasSupersededMemory = hasMarker && !optedOut && lines.some((l) => SUPERSEDED_MEMORY_LINES.has(l.trim()));
+  const hasSupersededStandard = hasMarker && lines.some((l) => l.trim() === SUPERSEDED_STANDARD_LINE);
   const memoryIsCommitted = hasSupersededMemory && committedMemoryFiles().length > 0;
+  const standardIsCommitted = hasSupersededStandard && committedStandardFile();
   const verified = (result) => semanticsHold() === false ? "conflict" : result;
-  if (hasMarker && !needsRepair && !hasSupersededMemory) return verified("covered");
+  if (hasMarker && !needsRepair && !hasSupersededMemory && !hasSupersededStandard) return verified("covered");
   if (!hasMarker && !needsRepair) {
     if (semanticsHold() === true) return "covered";
   }
@@ -21185,6 +21327,9 @@ function ensureVerityGitignore() {
     if (needsRepair) {
       next = next.map((l) => BREAKING_ENTRIES.has(l.trim()) ? ".verity/*" : l);
     }
+    if (hasSupersededStandard && !standardIsCommitted) {
+      next = fenceStandardLines(next);
+    }
     if (hasSupersededMemory && !memoryIsCommitted) {
       next = fenceMemoryLines(next);
     }
@@ -21195,7 +21340,7 @@ function ensureVerityGitignore() {
     }
     if (text3 !== content) (0, import_node_fs24.writeFileSync)(".gitignore", text3);
     return verified(
-      memoryIsCommitted ? "memory-tracked" : hasSupersededMemory ? "memory-fenced" : needsRepair ? "repaired" : "added"
+      memoryIsCommitted ? "memory-tracked" : standardIsCommitted ? "standard-tracked" : hasSupersededMemory ? "memory-fenced" : hasSupersededStandard ? "standard-fenced" : needsRepair ? "repaired" : "added"
     );
   } catch {
     return "failed";
@@ -21210,7 +21355,7 @@ function untrackMemory() {
     return "failed";
   }
 }
-function writeFencedBlock() {
+function writeFencedBlock(fence) {
   let content = "";
   try {
     content = (0, import_node_fs24.readFileSync)(".gitignore", "utf-8");
@@ -21218,7 +21363,8 @@ function writeFencedBlock() {
   }
   const hasMarker = content.includes(VERITY_GITIGNORE_MARKER);
   let lines = content.split("\n").map((l) => BREAKING_ENTRIES.has(l.trim()) ? ".verity/*" : l);
-  lines = fenceMemoryLines(lines);
+  if (fence.standard) lines = fenceStandardLines(lines);
+  if (fence.memory) lines = fenceMemoryLines(lines);
   let text3 = lines.join("\n");
   if (!hasMarker) {
     const sep7 = text3 === "" ? "" : text3.endsWith("\n") ? "\n" : "\n\n";
@@ -21245,7 +21391,7 @@ function fenceMemory() {
     } catch {
     }
   };
-  if (!writeFencedBlock()) return { untracked: 0, ok: false };
+  if (!writeFencedBlock({ memory: true })) return { untracked: 0, ok: false };
   if (memoryPosture() !== "ignored") {
     restore();
     return { untracked: 0, ok: false };
@@ -21257,6 +21403,34 @@ function fenceMemory() {
   }
   return { untracked: tracked, ok: true };
 }
+function untrackStandard() {
+  let original = null;
+  try {
+    original = (0, import_node_fs24.readFileSync)(".gitignore", "utf-8");
+  } catch {
+    original = null;
+  }
+  const restore = () => {
+    try {
+      if (original === null) (0, import_node_fs24.rmSync)(".gitignore", { force: true });
+      else (0, import_node_fs24.writeFileSync)(".gitignore", original);
+    } catch {
+    }
+  };
+  if (!writeFencedBlock({ standard: true })) return { ok: false, why: "gitignore" };
+  if (standardPosture() !== "ignored") {
+    restore();
+    return { ok: false, why: "still-committable" };
+  }
+  if (!committedStandardFile()) return { ok: true, untracked: false };
+  try {
+    (0, import_node_child_process9.execSync)(`git rm --cached --quiet -- ${STANDARD_PATH}`, { stdio: "pipe" });
+    return { ok: true, untracked: true };
+  } catch {
+    restore();
+    return { ok: false, why: "index" };
+  }
+}
 function memoryOptOut() {
   try {
     return (0, import_node_fs24.readFileSync)(".gitignore", "utf-8").includes(MEMORY_OPT_OUT_MARKER);
@@ -21286,18 +21460,23 @@ function committedVerityState() {
   } catch {
     return [];
   }
-  return out2.split("\0").filter(Boolean).filter((p) => p !== ".verity/standard.yaml" && !p.startsWith(".verity/memory/"));
+  return out2.split("\0").filter(Boolean).filter((p) => p !== STANDARD_PATH && !p.startsWith(".verity/memory/"));
 }
 function untrackVerityState() {
   const tracked = committedVerityState();
   if (tracked.length === 0) return "none";
+  const standardWasTracked = committedStandardFile();
   try {
     (0, import_node_child_process9.execSync)("git rm -r --cached --quiet -- .verity", { stdio: "pipe" });
-    const keeps = [".verity/standard.yaml"];
-    if (memoryPosture() === "committable") keeps.push(".verity/memory");
-    for (const keep of keeps) {
+    if (standardWasTracked) {
       try {
-        (0, import_node_child_process9.execSync)(`git add -- "${keep}"`, { stdio: "pipe" });
+        (0, import_node_child_process9.execSync)(`git add -f -- ${STANDARD_PATH}`, { stdio: "pipe" });
+      } catch {
+      }
+    }
+    if (memoryPosture() === "committable") {
+      try {
+        (0, import_node_child_process9.execSync)("git add -- .verity/memory", { stdio: "pipe" });
       } catch {
       }
     }
@@ -21715,6 +21894,117 @@ var LEGACY_MD_END = "<!-- gate-memory:end -->";
 var LEGACY_PRESERVE_START = "<!-- gate-memory:preserve -->";
 var LEGACY_PRESERVE_END = "<!-- /gate-memory:preserve -->";
 var CLAUDE_MD_PROSE = [
+  "## Project Memory",
+  "",
+  "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
+  "non-trivial work, scan `.verity/memory/index.md` for decisions, gotchas, and patterns",
+  "that may apply to the change you are about to make. Open specific node files via",
+  "the Read tool when the title or scope suggests relevance.",
+  "",
+  "The graph is auto-maintained by Verity. Files at `.verity/memory/_archive/` are",
+  "superseded \u2014 ignore them unless investigating history.",
+  "",
+  "Knowledge the organization's other repositories learned is mirrored outside the",
+  "repo at `~/.verity/orgs/<host>/<owner>/memory/` (`verity memory org` lists it).",
+  "Each claim says where it came from; one that is wrong here is demoted for",
+  'everyone with `verity memory demote <id> --reason "\u2026"`.',
+  "",
+  "## Quality gate: accepted risks",
+  "",
+  "When the Verity pre-commit/pre-push gate FAILs, fix the findings \u2014 that is the",
+  'default. Use `verity waive <pattern-id> --file <path> --reason "\u2026"` ONLY to relay',
+  "a risk a human has explicitly accepted: a named code-review finding, an ADR, or",
+  "the user saying so in this conversation. The --reason must cite that source.",
+  "",
+  "Never waive on your own judgment, to get past a block, or pre-emptively. A waive",
+  "binds to the file's current bytes and voids automatically when the file changes,",
+  "and every waive is recorded in the run ledger. For a pattern-level false positive",
+  "use `verity feedback finding <run-id> <pattern-id> false_positive` instead.",
+  "",
+  "## Post-task reflection",
+  "",
+  `When a task is complete (you've created a PR, the user says "done" or "ship it",`,
+  "or the work is clearly finished), **draft the reflection yourself** \u2014 1\u20133",
+  "concrete things worth remembering (a decision, a gotcha, or a pattern), each",
+  "cited with the files / PR / commands / error-signatures it came from. Skip",
+  "entirely if nothing non-obvious happened \u2014 that judgement is the ONLY filter,",
+  "because nothing reviews the reflection before it lands.",
+  "",
+  "Then record it straight away. There is no confirm step, in any environment:",
+  "",
+  "```bash",
+  "verity reflect --user-input - --kind <kind> <<'VERITY_EOF_<random>'",
+  "<your draft>",
+  "VERITY_EOF_<random>",
+  "```",
+  "",
+  'The draft goes through the quoted heredoc, never inside `"\u2026"` on the command',
+  'line, where a `"` or `$(\u2026)` in it would run in the shell. Replace `<random>`',
+  "with 8 random letters and digits that you pick for this call, the same at both",
+  "ends. Text written before you picked them cannot end the heredoc early.",
+  "",
+  "Add `--confirmed` ONLY when the user authored or dictated the words. Without",
+  "it the node is stored as `source: agent` \u2014 Verity thought this, nobody checked",
+  "it. With it, `source: user` at full confidence \u2014 a person stands behind this.",
+  "Never claim the second for your own draft, however good it is.",
+  "",
+  "**Name the files in the text.** Verity scopes the reflection to the paths it",
+  "cites, and a reflection that names no file in this repo is never retrieved for",
+  "a later review \u2014 it is recorded and then invisible. The command says so when it",
+  "happens; `--file-globs '<path or glob>'` is the fix when the prose cannot carry",
+  "the paths.",
+  "",
+  "Then tell the user, in one line, what you recorded and where: the command",
+  "prints the node id, the path under `.verity/memory/`, and a dashboard link.",
+  "They did not agree to it in advance, so say it happened \u2014 editing or deleting",
+  "that file is how they correct it.",
+  "",
+  "> Durable, hand-curated guidance goes in the preserve region below (it survives",
+  "> regeneration) or anywhere OUTSIDE these markers. Everything else between the",
+  "> markers is tool-owned and overwritten on each run.",
+  "",
+  "## Housekeeping Turns",
+  "",
+  "When a turn will be pure housekeeping \u2014 pulling, installing dependencies,",
+  "rebasing, a formatting sweep you are not authoring \u2014 declare it BEFORE doing it:",
+  "",
+  "```bash",
+  'verity ignore --turn --agent --reason "pulling latest before starting"',
+  "```",
+  "",
+  "This skips the review for that turn, which saves the turn Verity would",
+  "otherwise spend saying it had nothing to say. Use `--for 30m` instead of",
+  "`--turn` when a single piece of housekeeping spans several turns.",
+  "",
+  "**It is a claim about the turn, not a way to silence review.** The declaration",
+  "is checked against what the turn actually did: if anything is authored \u2014 by you,",
+  "by a subagent, or by a shell command that can write files \u2014 it voids, the review",
+  "runs anyway, and the broken declaration is reported. So declare housekeeping you",
+  "are about to do, never work you have already done, and never as a way to get past",
+  "a finding. Declarations are budgeted per session and every one is recorded with",
+  "its reason.",
+  "",
+  "## Verity settings",
+  "",
+  "Change these only when the user asks. Each command prints what it changed.",
+  "",
+  "- When Verity reviews: `verity config moments turn,commit,push`. Give any of the",
+  "  three, or `none`. With no list, it prints the current setting.",
+  "- Formal verification at push: `verity config formal push`, or `verity config formal off`.",
+  "- The line Verity prints when a turn has nothing new to review: `verity config verbose on`,",
+  "  or `verity config verbose off` (the default).",
+  "- Project rules, written by Verity from this repository's history and docs:",
+  "  `verity standard generate`. It works only for a project with no Standard on the",
+  "  service. It writes `.verity/repo-profile.json` and sends nothing without consent.",
+  "  Show the user that file. Run the command again with `--yes` only after they agree.",
+  "- The rules themselves: run `verity standard pull` first (the file here can be behind",
+  "  the team's), edit `.verity/standard.yaml`, then run `verity standard push`."
+].join("\n");
+var CLAUDE_MD_PROSE_PRE_PULL = CLAUDE_MD_PROSE.replace(
+  /- The rules themselves: run `verity standard pull` first \(the file here can be behind\n  the team's\), edit `\.verity\/standard\.yaml`, then run `verity standard push`\.$/,
+  "- The rules themselves: edit `.verity/standard.yaml`, then run `verity standard push`."
+);
+var CLAUDE_MD_PROSE_PRE_VERBOSE = [
   "## Project Memory",
   "",
   "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
@@ -22351,6 +22641,8 @@ function stripKnownProse(interior) {
   const trimmed = interior.replace(/^\n+/, "");
   for (const prose of [
     CLAUDE_MD_PROSE,
+    CLAUDE_MD_PROSE_PRE_PULL,
+    CLAUDE_MD_PROSE_PRE_VERBOSE,
     CLAUDE_MD_PROSE_PRE_SETTINGS,
     CLAUDE_MD_PROSE_PRE_STDIN,
     CLAUDE_MD_PROSE_PRE_ORG,
@@ -25415,6 +25707,8 @@ async function generateStandard(opts) {
   } catch (err2) {
     return { status: "failed", reason: `the Standard is on the service (v${version}) but could not be written here: ${terminalText(err2.message, 200)}` };
   }
+  await writeSetupState({ standardVersion: version }).catch(() => {
+  });
   return {
     status: "created",
     version,
@@ -25595,68 +25889,6 @@ async function runGenerate(globals, opts) {
 var import_node_fs37 = require("node:fs");
 var import_yaml6 = __toESM2(require_dist());
 
-// src/lib/setup-state.ts
-var SETUP_STATE_FILE = `${VERITY_DIR}/setup.json`;
-var MOMENTS = ["stop", "pre-commit", "pre-push"];
-var INTENSITIES = ["lightweight", "balanced", "thorough"];
-var TELEMETRY = ["enabled", "declined", "deferred"];
-var VERSION = /^[0-9A-Za-z.+-]{1,32}$/;
-var stamp = (v) => typeof v === "string" && v.length > 0 && v.length <= 64;
-function setupStateFrom(raw) {
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
-  const r = raw;
-  if (r.version !== 1) return null;
-  const out2 = { version: 1 };
-  if (INTENSITIES.includes(r.intensity)) out2.intensity = r.intensity;
-  if (Array.isArray(r.moments) && r.moments.every((m) => MOMENTS.includes(m))) {
-    out2.moments = [...new Set(r.moments)];
-  }
-  if (TELEMETRY.includes(r.telemetry)) out2.telemetry = r.telemetry;
-  if (Number.isSafeInteger(r.declinedStandardVersion) && r.declinedStandardVersion >= 1) {
-    out2.declinedStandardVersion = r.declinedStandardVersion;
-  }
-  const init2 = r.init;
-  if (init2 && typeof init2 === "object" && stamp(init2.completed_at) && typeof init2.cli_version === "string" && VERSION.test(init2.cli_version)) {
-    out2.init = { completed_at: init2.completed_at, cli_version: init2.cli_version };
-  }
-  const plugin = r.pluginSetup;
-  if (plugin && typeof plugin === "object" && typeof plugin.version === "string" && VERSION.test(plugin.version) && stamp(plugin.completed_at)) {
-    out2.pluginSetup = { version: plugin.version, completed_at: plugin.completed_at };
-  }
-  if (r.wiring === "project") out2.wiring = "project";
-  return out2;
-}
-var MAX_SETUP_BYTES = 64 * 1024;
-function readSetupText() {
-  const read2 = readRegularFileInRoot(repoRoot(), SETUP_STATE_FILE, MAX_SETUP_BYTES);
-  return read2.ok ? read2.content : null;
-}
-async function readSetupState() {
-  const raw = readSetupText();
-  if (raw === null) return null;
-  try {
-    return setupStateFrom(JSON.parse(raw));
-  } catch {
-    return null;
-  }
-}
-async function writeSetupState(patch) {
-  const current = await readSetupState() ?? { version: 1 };
-  const next = { ...current, ...patch, version: 1 };
-  const raw = readSetupText();
-  if (raw !== null) {
-    try {
-      if (jsonSemanticEqual(JSON.parse(raw), next)) return next;
-    } catch {
-    }
-  }
-  const text3 = JSON.stringify(next, null, raw !== null ? detectJsonIndent(raw) : 2) + "\n";
-  if (!replaceInRoot(projectPath(VERITY_DIR), "setup.json", text3)) {
-    throw new Error(`Could not write ${SETUP_STATE_FILE}: it is a link, or ${VERITY_DIR} is not a folder of this repository`);
-  }
-  return next;
-}
-
 // src/commands/init/rules.ts
 async function projectLabel(token, serviceUrl, verbose) {
   try {
@@ -25801,6 +26033,8 @@ async function pullStandard(globals, opts = {}) {
     } catch {
     }
     if (local && typeof local === "object" && !Array.isArray(local) && sameStandard(local, remote.standard.content)) {
+      await writeSetupState({ standardVersion: version, declinedStandardVersion: void 0 }).catch(() => {
+      });
       return { status: "same", version };
     }
     try {
@@ -25811,7 +26045,7 @@ async function pullStandard(globals, opts = {}) {
   }
   try {
     const outcome = await adoptRemoteSetup(remote, { serviceUrl: url.data, projectId, expectStandard: readBytes });
-    await writeSetupState({ declinedStandardVersion: void 0 }).catch(() => {
+    await writeSetupState({ standardVersion: version, declinedStandardVersion: void 0 }).catch(() => {
     });
     return { status: "pulled", version, backup, notes: outcome.notes };
   } catch (err2) {
@@ -26030,8 +26264,13 @@ function registerStandardCommands(program2) {
     for (const path of result.written) printInfo(`  ${terminalText(path, 200)} \u2713`);
     for (const note of result.notes) printWarn(`  ${terminalText(note, 300)}`);
     if (opts.push) {
-      const pushed = await pushStandard(globals);
+      const token = await resolveToken(globals.token);
+      const expected = token.ok && urlResult.ok ? await expectedLatestForPush(globals, token.data.token, urlResult.data) : void 0;
+      const pushed = await pushStandard(globals, expected !== void 0 ? { expectedLatest: expected } : {});
       for (const line2 of pushed.lines) printInfo(`  ${terminalText(line2, 600)}`);
+      if (pushed.conflict) {
+        printWarn(`  The team's Standard is v${pushed.latest ?? "?"} now. Run verity standard pull to use it here, or verity standard push --force to replace it with this file.`);
+      }
       if (pushed.standardVersion !== null) {
         await correctVerityMdVersion({
           standard: result.standard,
@@ -26045,7 +26284,7 @@ function registerStandardCommands(program2) {
   standard.command("generate").description("Have Verity write project-specific rules from a profile of this repository (asks before sending it)").option("--yes", `Send the profile without asking (you have read ${PROFILE_FILE})`).option("--status", "Print whether the service writes project rules for this project: on, off, unsupported or unknown. Sends nothing.").action((opts) => runGenerate(program2.opts(), opts));
   standard.command("pull").description("Write the team's Standard on the service into .verity/standard.yaml (keeps a copy of yours)").action(() => runPull(program2.opts()));
   standard.command("catalogue [pack]").description("What each review pack holds: every pack, or the rules of one (core, api, data, \u2026)").option("--json", "Print the catalogue as JSON").action((pack, opts) => runCatalogue(program2.opts(), pack, opts));
-  standard.command("push").description("Upload the project Standard to the service").option("--file <path>", "Path to standard YAML file", STANDARD_FILE).option("--created-by <name>", "Who created this version", "claude-code").action(async (opts) => {
+  standard.command("push").description("Upload the project Standard to the service, as the next version after the one this machine last saw").option("--file <path>", "Path to standard YAML file", STANDARD_FILE).option("--created-by <name>", "Who created this version", "claude-code").option("--force", "Upload even when the team's Standard moved since this machine last pulled or pushed it").action(async (opts) => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
     if (!tokenResult.ok) {
@@ -26068,19 +26307,33 @@ function registerStandardCommands(program2) {
       process.exit(1);
     }
     if (upload.warning) printWarn(terminalText(upload.warning, 600));
+    const expected = opts.force ? void 0 : await expectedLatestForPush(globals, tokenResult.data.token, urlResult.data);
     const result = await apiRequest({
       method: "POST",
       path: "/standards",
       serviceUrl: urlResult.data,
       token: tokenResult.data.token,
-      body: { content: upload.content, created_by: upload.createdBy },
+      body: {
+        content: upload.content,
+        created_by: upload.createdBy,
+        ...expected !== void 0 ? { expected_latest: expected } : {}
+      },
       verbose: globals.verbose
     });
     if (!result.ok) {
+      if (expected !== void 0 && result.http_status === 409 && result.error.startsWith("STANDARD_EXISTS")) {
+        const latest = latestFromConflict(result);
+        printError(latest !== null ? `The team's Standard is v${latest} now${expected !== null ? `, and this machine last saw v${expected}` : ", and this machine saw none"}. Nothing was pushed. Run "verity standard pull" first (it keeps a copy of your file), put your changes into the pulled file, then push again. To replace v${latest} with this file as it is: verity standard push --force` : `The service has no Standard for this project, but this machine last saw v${expected}. Nothing was pushed. To share this file as v1: verity standard push --force`);
+        process.exit(1);
+      }
       printError(terminalText(result.error, 300));
       process.exit(1);
     }
     printInfo(`Standard uploaded (version ${versionText(result.data.version)})`);
+    if (Number.isSafeInteger(result.data.version) && result.data.version >= 1) {
+      await writeSetupState({ standardVersion: result.data.version }).catch(() => {
+      });
+    }
     const converted = conversionLine(result.data);
     if (converted) {
       printInfo(converted);
@@ -26088,6 +26341,7 @@ function registerStandardCommands(program2) {
     }
     printJson(result.data);
   });
+  standard.command("untrack").description(`Stop tracking ${STANDARD_FILE} in git: Verity keeps it on each machine, and reviews read the service`).action(() => runUntrack());
   standard.command("get").description("Get the current Standard from the service").option("--version <n>", "Specific version number").option("--resolved", "Show it as a review reads it: the catalogue packs in `extends` expanded into patterns").action(async (opts) => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
@@ -26162,6 +26416,32 @@ function registerStandardCommands(program2) {
 function versionText(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? String(value) : "?";
 }
+async function expectedLatestForPush(globals, token, serviceUrl) {
+  const state = await readSetupState();
+  if (state?.standardVersion !== void 0) return state.standardVersion;
+  const remote = await fetchRemoteSetup({ token, serviceUrl, verbose: globals.verbose });
+  if (remote.status === "found") {
+    printInfo(`This machine had no record of the team's Standard. It is v${remote.standard.version} on the service, and this push replaces it.`);
+    return remote.standard.version;
+  }
+  if (remote.status === "none") return null;
+  printWarn(`Could not read the team's Standard from the service (${terminalText(remote.reason, 200)}), so this push is not conditional on it.`);
+  return void 0;
+}
+function runUntrack() {
+  const wasTracked = committedStandardFile();
+  const result = untrackStandard();
+  if (!result.ok) {
+    printError(result.why === "gitignore" ? "Could not write .gitignore. Nothing changed." : result.why === "still-committable" ? `Git still lets ${STANDARD_FILE} be committed after the .gitignore change, so nothing was untracked and .gitignore is as it was. A nested .gitignore re-includes it: check with git check-ignore -v --no-index ${STANDARD_FILE}` : `Could not remove ${STANDARD_FILE} from the git index. .gitignore is as it was.`);
+    process.exit(1);
+  }
+  if (!wasTracked) {
+    printInfo(`${STANDARD_FILE} is not tracked in git. Git ignores it from here on; nothing else changed.`);
+    return;
+  }
+  printInfo(`Untracked ${STANDARD_FILE} (staged). The file stays on disk here. Commit to finish.`);
+  printInfo("Teammates lose the file on their next pull: `verity standard pull` (or `verity init`) writes the team's Standard back for them. Reviews read the Standard on the service, so none is affected.");
+}
 var UPLOAD_MAX_BYTES = 512 * 1024;
 function readUploadFile(file) {
   const root = realOrSelf(repoRoot());
@@ -26343,6 +26623,18 @@ function registerConfigCommands(program2) {
     printInfo(state === "push" ? "Formal verification at push: on for this checkout (Lean must be installed \u2014 verity lean status)" : "Formal verification at push: off");
     if (state === "push") printInfo("The phase runs with your Verity login (a push without one is skipped and says so: not-logged-in)");
   });
+  config.command("verbose [state]").description('Get or set the line Verity prints when a turn has nothing new to review: "on" or "off" (the default)').action((state) => {
+    if (state === void 0) {
+      process.stdout.write((readProjectConfig().verbose === "on" ? "on" : "off") + "\n");
+      return;
+    }
+    if (state !== "on" && state !== "off") {
+      printError(`Unrecognised state: ${state}. Use "on" or "off".`);
+      process.exit(1);
+    }
+    writeProjectConfig({ verbose: state });
+    printInfo(state === "on" ? "Verbose: on. A turn with nothing new to review now says so." : "Verbose: off. A turn with nothing new to review says nothing.");
+  });
   config.command("push").description("Upload .codacy/codacy.config.json to the service (not used by the gate, which runs Trivy only)").option("--file <path>", "Path to config file", CODACY_CONFIG_FILE).action(async (opts) => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
@@ -26818,8 +27110,8 @@ function timeAgo(isoDate) {
 }
 var PLAN_NAME = { free: "Free", pro: "Pro", fleet: "Fleet", enterprise: "Enterprise" };
 function planLine(plan, accounts) {
-  const teams = accounts.filter((a) => a.kind !== "personal").map((a) => `${a.name} (${PLAN_NAME[a.plan] ?? a.plan})`);
-  return `${PLAN_NAME[plan] ?? plan}${teams.length ? ` \xB7 member of ${teams.join(", ")}` : ""} \u2014 limits: "verity usage"`;
+  const teams = accounts.filter((a) => !(a.is_owner ?? a.kind === "personal")).map((a) => `${terminalText(a.name)} (${PLAN_NAME[a.plan] ?? terminalText(a.plan)})`);
+  return `${PLAN_NAME[plan] ?? terminalText(plan)}${teams.length ? ` \xB7 member of ${teams.join(", ")}` : ""} \u2014 limits: "verity usage"`;
 }
 function registerStatusCommand(program2) {
   program2.command("status").description("Show project quality status").option("--history", "Include recent run history").option("--limit <n>", "Number of history entries (1-100)", "5").option("--json", "Output raw JSON").action(async (opts) => {
@@ -27070,7 +27362,7 @@ function dollars(cents2) {
   return `$${((cents2 ?? 0) / 100).toFixed(2)}`;
 }
 function link(l) {
-  return (l.upgrade_url ?? "https://verity.md/upgrade").replace(/^https?:\/\//, "");
+  return terminalUrl(l.upgrade_url) || "https://verity.md/upgrade";
 }
 function detail(l, now) {
   const reset = resetPhrase(l, now, true);
@@ -27081,7 +27373,8 @@ function detail(l, now) {
     return `Extra usage reached this month's ${dollars(l.limit)} cap. ${Reset}. ${way2}`;
   }
   if (l.period === "week") {
-    const who = shared && l.account ? `${l.account} used its` : "You used your";
+    const team = shared ? terminalText(l.account) : "";
+    const who = team ? `${team} used its` : "You used your";
     const way2 = l.budget === "free" ? `Upgrade: ${link(l)}` : shared ? `An admin can turn on extra usage, or upgrade: ${link(l)}` : `Turn on extra usage or upgrade: ${link(l)}`;
     return `${who} ${l.limit} ${METER[l.meter]} this week. ${Reset}. ${way2}`;
   }
@@ -27160,8 +27453,11 @@ function windowText(w, resetsAt, now, weekly) {
 function cents(n2) {
   return n2 === null ? "\u2014" : n2 < 100 ? `${n2}\xA2` : `$${(n2 / 100).toFixed(2)}`;
 }
+function ownsAccount(b) {
+  return b?.account?.is_owner ?? b?.account?.kind === "personal";
+}
 function extraOffText(b, ui) {
-  if (b.account?.kind === "personal") return `off \u2014 turn it on at ${ui}/account/billing`;
+  if (ownsAccount(b)) return `off \u2014 turn it on at ${ui}/account/billing`;
   return "off \u2014 a team admin can turn it on";
 }
 function renderBudget(b, now = /* @__PURE__ */ new Date(), ui = uiBase()) {
@@ -27177,12 +27473,14 @@ function renderBudget(b, now = /* @__PURE__ */ new Date(), ui = uiBase()) {
   return lines;
 }
 function budgetName(b) {
-  return b.account ? `${PLAN2[b.plan]} \xB7 ${b.account.name} (${b.account.kind})` : PLAN2[b.plan];
+  if (!b.account) return PLAN2[b.plan];
+  const name2 = terminalText(b.account.name);
+  return ownsAccount(b) ? `${PLAN2[b.plan]} \xB7 ${name2} (your plan)` : `${PLAN2[b.plan]} \xB7 ${name2}`;
 }
 function payerText(b) {
   if (!b || !b.account) return "your Free plan";
-  if (b.account.kind === "personal") return `your personal ${PLAN2[b.plan]} plan`;
-  return `the ${PLAN2[b.plan]} plan of ${b.account.name}`;
+  if (ownsAccount(b)) return `your ${PLAN2[b.plan]} plan`;
+  return `the ${PLAN2[b.plan]} plan of ${terminalText(b.account.name)}`;
 }
 function renderLimits(d, now = /* @__PURE__ */ new Date()) {
   const ui = d.ui_url ? d.ui_url.replace(/\/+$/, "") : uiBase();
@@ -27190,10 +27488,10 @@ function renderLimits(d, now = /* @__PURE__ */ new Date()) {
   if (!d.enforced) lines.push(d.mode === "shadow" ? "Limits are counted, not yet enforced." : "Limits are not active.");
   const payer = d.budgets.find((b) => b.applies_here);
   if (d.team_here && !d.team_here.member) {
-    lines.push(d.team_here.auto_join ? `${d.team_here.name} pays for Verity in this repository. Your first review here makes you a member (${d.team_here.default_plan}).` : `${d.team_here.name} pays for Verity here for its members. An admin approves new members. Until an admin adds you, ${payerText(payer)} pays for your reviews here.`);
+    lines.push(d.team_here.auto_join ? `${terminalText(d.team_here.name)} pays for Verity in this repository. Your first review here makes you a member (${terminalText(d.team_here.default_plan)}).` : `${terminalText(d.team_here.name)} pays for Verity here for its members. An admin approves new members. Until an admin adds you, ${payerText(payer)} pays for your reviews here.`);
   }
-  const hasPersonal = d.budgets.some((b) => b.account?.kind === "personal");
-  const shown = d.budgets.filter((b) => !(hasPersonal && b.budget === "free"));
+  const hasOwn = d.budgets.some((b) => ownsAccount(b));
+  const shown = d.budgets.filter((b) => !(hasOwn && b.budget === "free"));
   const full = payer ? shown.filter((b) => b === payer) : shown;
   for (const b of full) {
     lines.push("");
@@ -30244,7 +30542,13 @@ async function passAndExit(run4, reason, skip, kindOverride) {
   const AGENT_SILENT_SKIPS = /* @__PURE__ */ new Set([]);
   const agentNote = AGENT_SILENT_SKIPS.has(skip) ? null : note;
   const HUMAN_SILENT_SKIPS = /* @__PURE__ */ new Set(["command-only-turn"]);
-  const humanNote = HUMAN_SILENT_SKIPS.has(skip) ? null : `Verity: ${reason}`;
+  const quiet = quietSkip({
+    skip,
+    kind: skipKind,
+    nothingChanged: nothingChanged(run4),
+    verbose: readVerbose()
+  });
+  const humanNote = HUMAN_SILENT_SKIPS.has(skip) || quiet ? null : `Verity: ${reason}`;
   printJsonCompact(
     buildHookOutput(
       verdict,
@@ -30257,6 +30561,22 @@ async function passAndExit(run4, reason, skip, kindOverride) {
   );
   process.exit(0);
 }
+var NOTHING_NEW = /* @__PURE__ */ new Set(["no-delta-since-last-review", "no-analyzable-files"]);
+var QUIET_ON_CLEAN_TREE = /* @__PURE__ */ new Set([
+  "debounce",
+  "verity-command",
+  "bare-acknowledgment",
+  "reflection-prompt",
+  "skip-mode",
+  "zero-increment"
+]);
+function quietSkip(s) {
+  if (s.verbose || s.kind !== "policy") return false;
+  return NOTHING_NEW.has(s.skip) || QUIET_ON_CLEAN_TREE.has(s.skip) && s.nothingChanged;
+}
+function nothingChanged(run4) {
+  return partitionVerityOwned(run4.changedUniverse).kept.length === 0;
+}
 
 // src/commands/analyze/phases/02-scope.ts
 async function scope(run4) {
@@ -31148,7 +31468,8 @@ async function evidence(run4) {
         const scoped = scopeToAuthored(allForReview, actionSummary);
         const canTrustNoneAuthored = scoped.signal === "none-authored" && authorshipIsObservable;
         if (canTrustNoneAuthored && !hasNonEditAuthorship(actionSummary, sessionAuthoredCode)) {
-          await passAndExit(run4, "No agent-authored code this turn \u2014 working-tree changes were not authored by this session", "zero-increment");
+          const why = nothingChanged(run4) ? "No code changed this turn" : "No agent-authored code this turn \u2014 working-tree changes were not authored by this session";
+          await passAndExit(run4, why, "zero-increment");
         }
         if (scoped.signal === "none-authored" && !authorshipIsObservable) {
           logEvent("none_authored_unverifiable", {
@@ -34195,15 +34516,23 @@ function renderNodeMarkdown(candidate, nodeId, createdAt) {
   ].join("\n");
   return fm;
 }
-async function runSeed(opts) {
-  if (!(0, import_node_fs53.existsSync)(STANDARD_FILE)) {
-    return { created: 0, existing: 0, failed: 0, skipped: "no_standard", candidates: [] };
+async function standardForSeed(opts) {
+  if ((0, import_node_fs53.existsSync)(STANDARD_FILE)) {
+    const raw = readRepoFile(STANDARD_FILE);
+    if (raw === null) return null;
+    try {
+      const parsed = (0, import_yaml9.parse)(raw);
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    } catch {
+      return null;
+    }
   }
-  let standardDoc;
-  try {
-    const raw = await (0, import_promises11.readFile)(STANDARD_FILE, "utf-8");
-    standardDoc = (0, import_yaml9.parse)(raw);
-  } catch {
+  const remote = await fetchRemoteSetup({ serviceUrl: opts.serviceUrl, token: opts.token, verbose: opts.verbose });
+  return remote.status === "found" ? remote.standard.content : null;
+}
+async function runSeed(opts) {
+  const standardDoc = await standardForSeed(opts);
+  if (standardDoc === null) {
     return { created: 0, existing: 0, failed: 0, skipped: "no_standard", candidates: [] };
   }
   const knowledgeSpec = standardDoc.knowledge_spec ?? {};
@@ -34330,9 +34659,8 @@ async function memoryManifest(run4) {
   try {
     await ensureMemoryDir();
     const seedMarker = (0, import_node_path43.join)(VERITY_DIR, ".seeded");
-    const hasStandard = (0, import_node_fs54.existsSync)(STANDARD_FILE);
     const alreadyTried = (0, import_node_fs54.existsSync)(seedMarker);
-    if (hasStandard && !alreadyTried) {
+    if (!alreadyTried) {
       const preManifest = await buildManifest();
       if (preManifest.nodes.length === 0) {
         try {
@@ -43225,8 +43553,8 @@ async function scaffoldStep(ui, given = {}) {
     rail.warn(".gitignore: could not write the Verity block");
     rail.line("Add it by hand: .verity/ holds copies of analyzed files, including any secret the gate flagged.");
   } else if (ignore === "conflict") {
-    rail.warn(".gitignore: git still ignores .verity/standard.yaml");
-    rail.line("A global or nested .gitignore covers it, so the Standard cannot be committed. Check: git check-ignore -v .verity/standard.yaml");
+    rail.warn(".gitignore: git does not ignore the files under .verity/");
+    rail.line("A nested .gitignore re-includes them, so copies of analyzed files, including any secret the gate flagged, can be committed. Check: git check-ignore -v .verity/.snapshot/x");
   } else if (ignore === "memory-tracked") {
     rail.warn("This project commits its knowledge graph");
   }
@@ -43241,15 +43569,25 @@ async function scaffoldStep(ui, given = {}) {
       rail.line("They show up in every diff. Stop with: verity memory untrack (or keep them on purpose: verity memory track)");
     }
   }
+  if (committedStandardFile()) {
+    if (given.untrackStandard) {
+      const result = untrackStandard();
+      if (result.ok) rail.line(`Untracked ${STANDARD_FILE} (staged). Commit to finish. Teammates get it back with: verity standard pull`);
+      else rail.line(`Could not untrack ${STANDARD_FILE}. Run: verity standard untrack`, "warn");
+    } else {
+      rail.warn(`${STANDARD_FILE} is tracked in git`);
+      rail.line("Verity keeps it on each machine now, and reviews read the Standard on the service. Stop tracking it with: verity standard untrack");
+    }
+  }
   const tracked = committedVerityState();
   if (tracked.length > 0) {
     if (given.untrackState || ui.asking && await askUntrackState(ui, tracked)) {
       const result = untrackVerityState();
       if (result === "untracked") rail.line("Untracked the Verity state files (staged). Commit to finish.");
-      else if (result === "failed") rail.line("Could not untrack them. Run: git rm -r --cached .verity && git add .verity/standard.yaml", "warn");
+      else if (result === "failed") rail.line("Could not untrack them. Run: verity init --untrack-state", "warn");
     } else {
       rail.warn(`${tracked.length} Verity state file(s) are tracked in git`);
-      rail.line(`For example ${terminalText(tracked[0], 200)}. Fix: git rm -r --cached .verity && git add .verity/standard.yaml`);
+      rail.line(`For example ${terminalText(tracked[0], 200)}. Fix: verity init --untrack-state`);
     }
   }
   retireCodacyConfig(ui);
@@ -43499,13 +43837,20 @@ function sayPacks(ui, plan) {
 }
 
 // src/commands/init/team-standard.ts
+function refusalOutcome(code) {
+  return code === "FORBIDDEN" ? "denied" : "sign-in-needed";
+}
 async function lookUpTeamStandard(opts) {
   if (!opts.adopt) return { status: "skipped", why: "no-adopt" };
   const token = await resolveToken(opts.globals.token);
   const url = await resolveServiceUrl(opts.globals.serviceUrl);
   if (!token.ok || !url.ok) return { status: "skipped", why: "not-signed-in" };
   const found = await fetchRemoteSetup({ token: token.data.token, serviceUrl: url.data, verbose: opts.globals.verbose });
-  if (found.status === "unavailable") return { status: "unavailable", reason: terminalText(found.reason, 300) };
+  if (found.status === "unavailable") {
+    const denial = authDenialRemedy(found.reason);
+    if (denial) return { status: "denied", code: denial.code, reason: terminalText(found.reason, 300) };
+    return { status: "unavailable", reason: terminalText(found.reason, 300) };
+  }
   if (found.status === "none") return { status: "none" };
   if (opts.previous?.declinedStandardVersion === found.standard.version) {
     return { status: "declined-before", version: found.standard.version, found };
@@ -43522,10 +43867,8 @@ async function writeTeamStandard(team, opts) {
       serviceUrl: url.data,
       projectId: await projectLabel(token.data.token, url.data, opts.globals.verbose)
     });
-    if (opts.previous?.declinedStandardVersion != null) {
-      await writeSetupState({ declinedStandardVersion: void 0 }).catch(() => {
-      });
-    }
+    await writeSetupState({ standardVersion: found.standard.version, declinedStandardVersion: void 0 }).catch(() => {
+    });
     return { status: "adopted", version: found.standard.version, summary: describeRemote(found), notes: outcome.notes };
   } catch (err2) {
     return { status: "write-failed", reason: terminalText(err2.message, 300) };
@@ -43546,6 +43889,17 @@ async function askTeamChoice(ui, team) {
   rail.collapse();
   return k === "n" ? "new" : "use";
 }
+async function askKeepOrPull(ui, team) {
+  const { rail, screen } = ui;
+  rail.active(`${STANDARD_FILE} differs from your team's Standard`);
+  rail.line(`On the service: ${describeRemote(team.found)}. Reviews use that one.`);
+  rail.line(`Use it here too (a copy of your file is kept), or keep your file and share it over the team's later: verity standard push`);
+  rail.gap();
+  rail.keys([["Enter", "use the team's"], ["k", "keep yours"]]);
+  const k = await screen.key(["enter", "k"], "enter", { freshMs: 300 });
+  rail.collapse();
+  return k === "k" ? "keep" : "use";
+}
 function sayAdopted(ui, team) {
   ui.rail.done(`Using your team's Standard v${team.version}`);
   ui.rail.line(terminalText(team.summary, 300));
@@ -43614,19 +43968,19 @@ async function deriveFromCatalogue(ui, globals, plan, expectedLatest) {
     return { ok: false, version: null };
   }
 }
-function localStandardProblem() {
+function localStandard() {
   const raw = readRepoFile(STANDARD_FILE);
-  if (raw === null) return `${STANDARD_FILE} is a link, not a regular file, or larger than 512 KB.`;
+  if (raw === null) return { ok: false, problem: `${STANDARD_FILE} is a link, not a regular file, or larger than 512 KB.` };
   let parsed;
   try {
     parsed = (0, import_yaml10.parse)(raw);
   } catch (err2) {
-    return `${STANDARD_FILE} is not valid YAML: ${terminalText(err2 instanceof Error ? err2.message : String(err2), 200)}`;
+    return { ok: false, problem: `${STANDARD_FILE} is not valid YAML: ${terminalText(err2 instanceof Error ? err2.message : String(err2), 200)}` };
   }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return `${STANDARD_FILE} holds no Standard.`;
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return { ok: false, problem: `${STANDARD_FILE} holds no Standard.` };
   const valid = validateStandardContent(parsed);
-  if (!valid.ok) return `${STANDARD_FILE} is not a Standard the service accepts: ${terminalText(valid.error, 200)}`;
-  return null;
+  if (!valid.ok) return { ok: false, problem: `${STANDARD_FILE} is not a Standard the service accepts: ${terminalText(valid.error, 200)}` };
+  return { ok: true, content: parsed };
 }
 function removeLocalStandard() {
   const path = projectPath(STANDARD_FILE);
@@ -43679,12 +44033,12 @@ async function standardStep(ui, ctx) {
       return end({ source: "adopted", version: again.version, profile: profile2 });
     }
     removeLocalStandard();
-    if (again.status === "write-failed" || again.status === "unavailable") rail.line(terminalText(again.reason, 300));
-    return { ...leaveTeamStandard(again.status === "write-failed" ? "write-failed" : "unavailable", null), profile: profile2 };
+    if (again.status === "write-failed" || again.status === "unavailable" || again.status === "denied") rail.line(terminalText(again.reason, 300));
+    return { ...leaveTeamStandard(again.status === "write-failed" ? "write-failed" : again.status === "denied" ? refusalOutcome(again.code) : "unavailable", null), profile: profile2 };
   };
   const leaveTeamStandard = (why, version) => {
-    rail.line(why === "write-failed" ? `The team's Standard${version !== null ? ` v${version}` : ""} stays in effect for reviews. Nothing was sent to the service.` : "If the team has a Standard on the service, it stays in effect for reviews. Nothing was written here or to the service.");
-    rail.line(why === "unavailable" ? "Run verity init again once the Verity service answers." : "Fix the cause above, then run verity init again.");
+    rail.line(why === "write-failed" ? `The team's Standard${version !== null ? ` v${version}` : ""} stays in effect for reviews. Nothing was sent to the service.` : why === "denied" ? "Verity has no access to this repository, so nothing was read or written here or on the service." : why === "sign-in-needed" ? "The Verity service did not accept your sign-in, so nothing was read or written here or on the service." : "If the team has a Standard on the service, it stays in effect for reviews. Nothing was written here or to the service.");
+    rail.line(why === "unavailable" ? "Run verity init again once the Verity service answers." : why === "denied" ? "Give the Verity GitHub App access to this repository (the line above says how), then run: verity login, and verity init. Verity reads your repository access from GitHub only when you sign in." : why === "sign-in-needed" ? "Sign in again: run verity login, then verity init." : "Fix the cause above, then run verity init again.");
     return end({ source: "none", version: null, profile: notAsked, teamInEffect: why });
   };
   const useTeam = async (team2) => {
@@ -43706,7 +44060,7 @@ async function standardStep(ui, ctx) {
       rail.line(`Reviews use the team's Standard v${team2.version} on the service. Fix ${STANDARD_FILE}, or replace it with the team's: verity standard pull`);
       return end({ source: "kept", version: team2.version, profile: notAsked });
     }
-    rail.line(team2.status === "none" ? `There is no Standard on the service either, so reviews have no rules. Fix ${STANDARD_FILE}, or delete it, then run verity init again.` : team2.status === "unavailable" ? `The Verity service did not answer (${terminalText(team2.reason, 200)}), so no Standard is confirmed. Fix ${STANDARD_FILE}, then run verity init again.` : `No Standard on the service was looked up. Fix ${STANDARD_FILE}, or sign in, then run verity init again.`);
+    rail.line(team2.status === "none" ? `There is no Standard on the service either, so reviews have no rules. Fix ${STANDARD_FILE}, or delete it, then run verity init again.` : team2.status === "unavailable" ? `The Verity service did not answer (${terminalText(team2.reason, 200)}), so no Standard is confirmed. Fix ${STANDARD_FILE}, then run verity init again.` : team2.status === "denied" && refusalOutcome(team2.code) === "denied" ? `Verity has no access to this repository (${terminalText(team2.reason, 200)}). Fix ${STANDARD_FILE}, give the Verity GitHub App access, then run verity login and verity init.` : team2.status === "denied" ? `The Verity service did not accept your sign-in (${terminalText(team2.reason, 200)}). Fix ${STANDARD_FILE}, then run verity login and verity init.` : `No Standard on the service was looked up. Fix ${STANDARD_FILE}, or sign in, then run verity init again.`);
     return end({ source: "none", version: null, profile: notAsked });
   };
   if (ctx.standard === "new" && (0, import_node_fs77.lstatSync)(projectPath(STANDARD_FILE), { throwIfNoEntry: false })) {
@@ -43719,26 +44073,77 @@ async function standardStep(ui, ctx) {
     }
     rail.done(`Set your Standard aside ${s.gray}\xB7 a copy is in ${aside.path}${s.reset}`);
   }
-  if ((0, import_node_fs77.existsSync)(projectPath(STANDARD_FILE))) {
-    const problem = localStandardProblem();
-    if (problem !== null) return unusableHere(problem);
-    const sync = await pushLocalStandardIfMissing(ctx.globals);
-    rail.done("Kept your Standard");
-    rail.line(`${STANDARD_FILE} is already here, so this run leaves it as it is. Edit it there, then share the change: verity standard push`);
+  const keptHints = async () => {
     if (!usesReviewPacks()) {
       rail.line("It does not use review packs. To move it to packs and keep your rules: verity standard push. To build a new one: verity init --standard new", "muted");
     }
-    if (sync.status === "pushed") {
-      rail.line(sync.version !== null ? `It was only on this machine. It is shared now as v${sync.version}.` : "It is only on this machine:", sync.version !== null ? "muted" : "warn");
-      for (const line2 of sync.lines) if (!line2.startsWith("Standard pushed")) rail.line(terminalText(line2, 600), "warn");
+    if (!hasProjectRules() && await rulesOn(ctx.globals)) {
+      rail.line("It has no project rules yet. Add them from a repo profile: verity standard generate");
+    }
+  };
+  const keptHere = async (local) => {
+    const team2 = await lookUpTeamStandard(ctx);
+    if (team2.status === "found" || team2.status === "declined-before") {
+      if (sameStandard(local, team2.found.standard.content)) {
+        rail.done(`Kept your Standard ${s.gray}\xB7 it is the team's v${team2.version}${s.reset}`);
+        rail.line(`Edit it in ${STANDARD_FILE}, then share the change: verity standard push`);
+        await writeSetupState({ standardVersion: team2.version }).catch(() => {
+        });
+        await keptHints();
+        return end({ source: "kept", version: team2.version, profile: notAsked });
+      }
+      const choice = ctx.standard === "use" ? "use" : team2.status === "declined-before" ? "keep" : ui.asking ? await askKeepOrPull(ui, team2) : "use";
+      if (choice === "use") {
+        const pulled = await pullStandard(ctx.globals);
+        if (pulled.status === "pulled" || pulled.status === "same") {
+          rail.done(`Using your team's Standard v${pulled.version}`);
+          rail.line(terminalText(describeRemote(team2.found), 300));
+          if (pulled.status === "pulled" && pulled.backup) rail.line(`Your file is kept as ${pulled.backup}`, "muted");
+          rail.line(`Edit it in ${STANDARD_FILE}, then share the change: verity standard push`);
+          if (pulled.status === "pulled") for (const note of pulled.notes) rail.line(terminalText(note, 300), "warn");
+          return end({ source: "adopted", version: pulled.version, profile: notAsked });
+        }
+        rail.warn("Could not write the team's Standard here");
+        rail.line(pulled.status === "failed" ? terminalText(pulled.message, 300) : `${STANDARD_FILE} changed while this ran.`);
+        rail.line(`Reviews use the team's Standard v${team2.version} on the service. To write it here: verity standard pull`);
+        return end({ source: "kept", version: team2.version, profile: notAsked });
+      }
+      rail.done(`Kept your Standard ${s.gray}\xB7 it differs from the team's v${team2.version}${s.reset}`);
+      rail.line(team2.status === "declined-before" ? `This project turned down the team's Standard v${team2.version} before, so this run keeps yours. Reviews use the team's.` : "Reviews use the team's Standard on the service.");
+      rail.line(`To share yours over the team's: verity standard push. To use the team's here: verity standard pull`);
+      await writeSetupState({ standardVersion: team2.version }).catch(() => {
+      });
+      await keptHints();
+      return end({ source: "kept", version: team2.version, profile: notAsked });
+    }
+    rail.done("Kept your Standard");
+    rail.line(`${STANDARD_FILE} is already here, so this run leaves it as it is. Edit it there, then share the change: verity standard push`);
+    let version = null;
+    if (team2.status === "none") {
+      const pushed = await pushStandard(ctx.globals, { expectedLatest: null });
+      if (pushed.conflict) {
+        rail.line("Someone shared a Standard for this repository while this ran. Reviews use theirs; to compare with yours, run verity init again, or verity standard pull.", "warn");
+      } else if (pushed.standardVersion !== null) {
+        version = pushed.standardVersion;
+        rail.line(`It was only on this machine. It is shared now as v${version}.`, "muted");
+      } else {
+        rail.line("It is only on this machine:", "warn");
+      }
+      for (const line2 of pushed.lines) if (!line2.startsWith("Standard pushed")) rail.line(terminalText(line2, 600), "warn");
     }
-    if (sync.status === "skipped" && sync.reason === "unavailable") {
+    if (team2.status === "unavailable") {
       rail.line(`It could not be shared: the Verity service did not answer. It is shared at the first review once the service answers, or now with: verity standard push`, "warn");
     }
-    if (!hasProjectRules() && await rulesOn(ctx.globals)) {
-      rail.line("It has no project rules yet. Add them from a repo profile: verity standard generate");
+    if (team2.status === "denied") {
+      rail.line(`It could not be compared with the team's: ${terminalText(team2.reason, 300)}`, "warn");
     }
-    return end({ source: "kept", version: sync.status === "pushed" ? sync.version : null, profile: notAsked });
+    await keptHints();
+    return end({ source: "kept", version, profile: notAsked });
+  };
+  if ((0, import_node_fs77.existsSync)(projectPath(STANDARD_FILE))) {
+    const local = localStandard();
+    if (!local.ok) return unusableHere(local.problem);
+    return keptHere(local.content);
   }
   const team = await lookUpTeamStandard(ctx);
   let replaces;
@@ -43761,6 +44166,12 @@ async function standardStep(ui, ctx) {
     rail.line(terminalText(team.reason, 300));
     return leaveTeamStandard("unavailable", null);
   }
+  if (team.status === "denied") {
+    const refused2 = refusalOutcome(team.code);
+    rail.warn(refused2 === "denied" ? "Verity cannot access this repository yet" : "The Verity service did not accept your sign-in");
+    rail.line(terminalText(team.reason, 300));
+    return leaveTeamStandard(refused2, null);
+  }
   if (team.status === "skipped") return derived(notAsked);
   if (!await rulesOffered(ui, ctx.globals)) return derived(notAsked);
   const profile = buildRepoProfile();
@@ -43811,10 +44222,10 @@ async function standardStep(ui, ctx) {
       sayAdopted(ui, again);
       return end({ source: "adopted", version: again.version, profile: { outcome: "ok", detail: detail2 } });
     }
-    if (again.status === "unavailable" || again.status === "write-failed") {
-      rail.warn(again.status === "unavailable" ? "Could not read the team's new Standard from the Verity service" : "Could not write the team's Standard here");
+    if (again.status === "unavailable" || again.status === "write-failed" || again.status === "denied") {
+      rail.warn(again.status === "write-failed" ? "Could not write the team's Standard here" : "Could not read the team's new Standard from the Verity service");
       rail.line(terminalText(again.reason, 300));
-      return { ...leaveTeamStandard(again.status, null), profile: { outcome: "ok", detail: detail2 } };
+      return { ...leaveTeamStandard(again.status === "denied" ? refusalOutcome(again.code) : again.status, null), profile: { outcome: "ok", detail: detail2 } };
     }
   }
   return derived({ outcome: "ok", detail: detail2 });
@@ -43830,8 +44241,8 @@ async function finishRun(ui, ctx) {
     sayChanged(ui, ctx.before);
     if (ctx.teamInEffect) {
       rail.end(
-        ctx.teamInEffect === "unavailable" ? `${s.yellow}Not finished:${s.reset} the Verity service did not answer, so this machine has no Standard yet.` : `${s.yellow}Not finished:${s.reset} the team's Standard could not be written on this machine. Reviews still use it on the service.`,
-        ctx.teamInEffect === "unavailable" ? "Run verity init again once the Verity service answers." : "Fix the error above, then run verity init again."
+        ctx.teamInEffect === "unavailable" ? `${s.yellow}Not finished:${s.reset} the Verity service did not answer, so this machine has no Standard yet.` : ctx.teamInEffect === "denied" ? `${s.yellow}Not finished:${s.reset} Verity has no access to this repository yet, so it cannot review it.` : ctx.teamInEffect === "sign-in-needed" ? `${s.yellow}Not finished:${s.reset} the Verity service did not accept your sign-in, so this machine has no Standard yet.` : `${s.yellow}Not finished:${s.reset} the team's Standard could not be written on this machine. Reviews still use it on the service.`,
+        ctx.teamInEffect === "unavailable" ? "Run verity init again once the Verity service answers." : ctx.teamInEffect === "denied" ? "Give the Verity GitHub App access to this repository, then run: verity login, and verity init. Verity reads your repository access from GitHub only when you sign in." : ctx.teamInEffect === "sign-in-needed" ? "Sign in again: run verity login, then verity init." : "Fix the error above, then run verity init again."
       );
       return;
     }
@@ -44227,13 +44638,14 @@ async function classifyExistingLogin(serviceUrl, remote, opts) {
   if (!existing.ok) return { kind: "none" };
   const who = await whoami(existing.data.token, serviceUrl, opts.verbose);
   if (who.ok && who.data.logged_in) {
+    const nudge = reverifyNudge(who.data);
     return {
       kind: "signed-in",
       identity: terminalText(who.data.email ?? `user #${who.data.user_id}`, 120),
       // Being logged in does not mean THIS repo is covered (VRT-83): grants come
       // from the login sweep. grant_status is non-null only when a grant exists.
       covered: remote ? who.data.grant_status != null : null,
-      nudge: reverifyNudge(who.data)
+      nudge: nudge && terminalText(nudge, 200)
     };
   }
   if (!who.ok) {
@@ -44263,6 +44675,7 @@ function coverageLines(ui, repo, covered) {
   } else {
     ui.rail.line(`${repo} is not covered by your Verity access, so nothing syncs.`, "warn");
     ui.rail.line("Give the Verity GitHub App access to it, then run: verity login");
+    ui.rail.line("Verity reads your repository access from GitHub only when you sign in. The new sign-in is how Verity sees the repository.", "muted");
   }
 }
 async function signInStep(ui, resolution, opts) {
@@ -44283,6 +44696,7 @@ async function signInStep(ui, resolution, opts) {
   const heal = await maybeHealServiceUrl(resolution, opts.verbose);
   const serviceUrl = heal.serviceUrl;
   const remote = gitRemote();
+  let grantAccess = false;
   if (heal.healed) {
     rail.warn("The saved Verity service no longer answers");
     rail.line("Sign in again to repair ~/.verity/credentials.");
@@ -44290,9 +44704,14 @@ async function signInStep(ui, resolution, opts) {
     const state = await classifyExistingLogin(serviceUrl, remote, opts);
     if (state.kind === "signed-in") {
       rail.done(`Signed in as ${s.bold}${state.identity}${s.reset}`);
-      coverageLines(ui, opts.repo, state.covered);
       if (state.nudge) rail.line(state.nudge, "warn");
-      return end("already");
+      if (state.covered !== false || !ui.asking) {
+        coverageLines(ui, opts.repo, state.covered);
+        return end("already");
+      }
+      rail.line(`Verity can't see ${opts.repo} yet: the Verity GitHub App has no access to it.`, "warn");
+      grantAccess = true;
+      rail.settle();
     }
     if (state.kind === "cached") {
       rail.done(state.identity ? `Signed in as ${s.bold}${state.identity}${s.reset} (cached)` : "Using your existing Verity token");
@@ -44313,16 +44732,28 @@ async function signInStep(ui, resolution, opts) {
     sayWhatASkipCosts(ui);
     return end("unattended");
   }
-  rail.active("Sign in with GitHub");
-  rail.line("One sign-in covers every repository on this machine.");
-  rail.line("Signing in does not give Verity access to the contents of your repositories.");
+  if (grantAccess) {
+    rail.active(`Give Verity access to ${opts.repo}`);
+    rail.line("Verity reads your repository access from GitHub only when you sign in.");
+    rail.line("So sign in again: Verity opens the page where you add this repository to its app, and waits.");
+    rail.line("When the repository is added, Verity can see it, and this run continues.");
+  } else {
+    rail.active("Sign in with GitHub");
+    rail.line("One sign-in covers every repository on this machine.");
+    rail.line("Signing in does not give Verity access to the contents of your repositories.");
+  }
   rail.gap();
   rail.keys([["Enter", "open the browser"], ["s", "skip"]]);
   const choice = await screen.key(["enter", "s"], "s");
   if (choice === "s") {
     rail.collapse();
-    rail.warn("Sign-in skipped");
-    sayWhatASkipCosts(ui);
+    rail.warn(grantAccess ? "Access skipped" : "Sign-in skipped");
+    if (grantAccess) {
+      rail.line(`Verity can't review ${opts.repo} until its GitHub App has access to it.`);
+      rail.line("Later: add the repository to the Verity app, then run verity login. Verity reads your repository access from GitHub only when you sign in.");
+    } else {
+      sayWhatASkipCosts(ui);
+    }
     return end("declined");
   }
   const failed = (why) => {
@@ -44338,20 +44769,23 @@ async function signInStep(ui, resolution, opts) {
   const dc = code.data;
   const copied = copyToClipboard(dc.user_code);
   const opened = openInBrowser(dc.verification_uri);
-  rail.line(opened ? `Opened ${dc.verification_uri} in your browser. If no window appeared, open it and enter the code.` : `Open ${dc.verification_uri} and enter the code.`, opened ? "muted" : "plain");
+  const where2 = terminalText(dc.verification_uri, 200);
+  const userCode = terminalText(dc.user_code, 40);
+  rail.line(opened ? `Opened ${where2} in your browser. If no window appeared, open it and enter the code.` : `Open ${where2} and enter the code.`, opened ? "muted" : "plain");
   const prefix = `${s.gray}\u2502${s.reset}  `;
   const polled = await screen.breathe(
     prefix,
-    () => `Waiting for you in the browser \xB7 code ${s.bold}${dc.user_code}${s.reset}${copied ? ` ${s.gray}(copied)${s.reset}` : ""}`,
+    () => `Waiting for you in the browser \xB7 code ${s.bold}${userCode}${s.reset}${copied ? ` ${s.gray}(copied)${s.reset}` : ""}`,
     pollDeviceToken(dc, { codeExpiresAt: Date.now() + dc.expires_in * 1e3, quiet: true })
   );
   if (!polled.ok) return failed(polled.error);
   let gaveUp = null;
   const appInstallUi = {
     wait: async (ctx, visible) => {
-      rail.line(`The Verity GitHub App cannot see ${ctx.owner}/${ctx.repo} yet. Install it${ctx.opened ? " (opened in your browser)" : ""}:`, "warn");
-      rail.line(ctx.installUrl, "plain");
-      return screen.breathe(prefix, () => `Waiting for the install on ${ctx.owner}`, visible);
+      const owner = terminalText(ctx.owner, 100);
+      rail.line(`The Verity GitHub App cannot see ${owner}/${terminalText(ctx.repo, 100)} yet. Install it${ctx.opened ? " (opened in your browser)" : ""}:`, "warn");
+      rail.line(terminalText(ctx.installUrl, 300), "plain");
+      return screen.breathe(prefix, () => `Waiting for the install on ${owner}`, visible);
     },
     gaveUp: (message) => {
       gaveUp = message;
@@ -44372,7 +44806,7 @@ async function signInStep(ui, resolution, opts) {
   if (gaveUp) rail.line(terminalText(gaveUp, 300), "warn");
   for (const line2 of report.slice(1)) {
     if (line2.level === "verbose") continue;
-    rail.line(line2.text.trim().replace(/^✓\s*/, ""), line2.level === "warn" ? "warn" : "muted");
+    rail.line(terminalText(line2.text.trim().replace(/^✓\s*/, ""), 300), line2.level === "warn" ? "warn" : "muted");
   }
   return end("new");
 }
@@ -44412,7 +44846,7 @@ async function recordAnswers(ui, momentIds, telemetry, completed) {
       moments: momentIds,
       ...telemetry ? { telemetry } : {},
       // A failed run also clears an earlier stamp: "done" describes this checkout now.
-      init: completed ? { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.3-experimental.f980d82" : "dev" } : void 0
+      init: completed ? { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.4" : "dev" } : void 0
     });
   } catch (err2) {
     ui.rail.line(`Could not record the setup answers: ${terminalText(err2.message, 200)}`, "warn");
@@ -44491,7 +44925,7 @@ async function runInit(program2, opts) {
       process.exit(1);
     }
     trace.mark("prerequisites", "ok");
-    await scaffoldStep(ui, { untrackMemory: opts.untrackMemory === true, untrackState: opts.untrackState === true });
+    await scaffoldStep(ui, { untrackMemory: opts.untrackMemory === true, untrackStandard: opts.untrackStandard === true, untrackState: opts.untrackState === true });
     trace.mark("scaffold", "ok");
     await (0, import_promises17.mkdir)((0, import_node_path68.join)((0, import_node_os15.homedir)(), ".verity"), { recursive: true });
     await repoStep(ui, detectProject());
@@ -44542,7 +44976,7 @@ async function runInit(program2, opts) {
   }
 }
 function registerInitCommand(program2) {
-  program2.command("init").alias("setup").description("Set up Verity in this project: sign in, telemetry, and the Standard; every other choice is a stated default").option("--force", "Reinstall the skills even when they are up to date (hooks are always reconciled)").option("-y, --yes", "Ask nothing: skip sign-in unless already signed in, and send the profile only with --profile send").option("--profile <send|skip>", "Answer the repo-profile question without asking (the plugin asks in the session)").option("--standard <use|new>", "When the team already has a Standard: use it, or create a new one (the plugin asks in the session; unattended runs use it)").option("--no-setup", "Ignored: init no longer hands off to /verity-setup (kept for old scripts)").option("--plugin-mode", "The Claude Code plugin owns the skills and hooks: install neither, and remove any this project already has").option("--no-plugin", "Ignore any Claude Code plugin here and wire this project's own skills and hooks").option("--no-adopt", "Don't use this repository's Standard from the service; build a new one").option("--moments <list>", 'Set when Verity reviews without the default: stop,pre-commit,pre-push \u2014 or "none"').option("--intensity <level>", "Ignored: static analysis is Trivy only (kept so older plugin skills keep working)").option("--telemetry <on|off>", "Answer the telemetry question without asking: send cost & usage from this machine, or not").option("--untrack-memory", "Stop tracking the knowledge graph in git (init does not ask)").option("--untrack-state", "Untrack committed Verity state without asking (a terminal run asks when it finds some)").action((opts) => runInit(program2, opts));
+  program2.command("init").alias("setup").description("Set up Verity in this project: sign in, telemetry, and the Standard; every other choice is a stated default").option("--force", "Reinstall the skills even when they are up to date (hooks are always reconciled)").option("-y, --yes", "Ask nothing: skip sign-in unless already signed in, and send the profile only with --profile send").option("--profile <send|skip>", "Answer the repo-profile question without asking (the plugin asks in the session)").option("--standard <use|new>", "When the team already has a Standard: use it, or create a new one (the plugin asks in the session; unattended runs use it)").option("--no-setup", "Ignored: init no longer hands off to /verity-setup (kept for old scripts)").option("--plugin-mode", "The Claude Code plugin owns the skills and hooks: install neither, and remove any this project already has").option("--no-plugin", "Ignore any Claude Code plugin here and wire this project's own skills and hooks").option("--no-adopt", "Don't use this repository's Standard from the service; build a new one").option("--moments <list>", 'Set when Verity reviews without the default: stop,pre-commit,pre-push \u2014 or "none"').option("--intensity <level>", "Ignored: static analysis is Trivy only (kept so older plugin skills keep working)").option("--telemetry <on|off>", "Answer the telemetry question without asking: send cost & usage from this machine, or not").option("--untrack-memory", "Stop tracking the knowledge graph in git (init does not ask)").option("--untrack-standard", "Stop tracking .verity/standard.yaml in git: Verity keeps it on each machine (init does not ask)").option("--untrack-state", "Untrack committed Verity state without asking (a terminal run asks when it finds some)").action((opts) => runInit(program2, opts));
 }
 
 // src/commands/doctor.ts
@@ -44571,17 +45005,23 @@ async function buildReport() {
   if (legacyOnly) {
     next.push(`Run "verity init" \u2014 it moves the old GATE.md install, with its Standard (${LEGACY_STANDARD_FILE}), to .verity/.`);
   }
+  const standard = { tracked: committedStandardFile(), version: state?.standardVersion ?? null };
   const missing = [
     !artifacts.standard && !legacyOnly && ".verity/standard.yaml",
     !artifacts.verityMd && !legacyOnly && "VERITY.md"
   ].filter((x) => !!x);
-  if (missing.length === 2) {
-    next.push('Run "verity standard synthesize --push" \u2014 it derives the Standard and VERITY.md from this codebase.');
+  if (!artifacts.standard && !legacyOnly) {
+    next.push(standard.version !== null ? `Run "verity standard pull" \u2014 the team's Standard (v${standard.version}) is on the service, and this machine has no copy of it.` : `Run "verity init" \u2014 it writes the team's Standard from the service, or builds one when the team has none.`);
   } else if (missing.length > 0) {
     next.push(
       `Missing ${missing.join(" and ")}. Run "verity standard synthesize --force" to regenerate \u2014 note that replaces the Standard.`
     );
   }
+  if (standard.tracked) {
+    next.push(
+      '.verity/standard.yaml is tracked in git. Verity keeps it on each machine now, and reviews read the Standard on the service. Run "verity standard untrack" to stop tracking it (the file stays on disk; teammates get it back with "verity standard pull").'
+    );
+  }
   const noAnalysisMoment = !hooks.stop && hooks.guardOn.length === 0;
   const configRead = readProjectConfig();
   if (configRead.refused) next.push(configRefusalMessage(configRead.refused));
@@ -44659,6 +45099,7 @@ async function buildReport() {
     artifacts,
     memory: memory2,
     trackedState,
+    standard,
     next
   };
 }
@@ -44706,7 +45147,7 @@ function registerDoctorCommand(program2) {
     if (process.platform === "win32") printWarn(WINDOWS_STATIC_NOTE);
     else printInfo("Static analysis: Trivy (dependencies, malicious packages, secrets)");
     printInfo("Artifacts:");
-    printInfo(`  .verity/standard.yaml: ${report.artifacts.standard ? "\u2713" : report.artifacts.legacyStandard ? `not yet (an old GATE.md Standard is at ${LEGACY_STANDARD_FILE}; verity init moves it)` : "missing"}`);
+    printInfo(`  .verity/standard.yaml: ${report.artifacts.standard ? report.standard.tracked ? "\u2713 (tracked in git \u2014 Verity keeps it machine-local now: verity standard untrack)" : "\u2713" : report.artifacts.legacyStandard ? `not yet (an old GATE.md Standard is at ${LEGACY_STANDARD_FILE}; verity init moves it)` : report.standard.version !== null ? `not on this machine (the team's v${report.standard.version} is on the service: verity standard pull)` : "missing"}`);
     printInfo(`  VERITY.md: ${report.artifacts.verityMd ? "\u2713" : "missing"}`);
     printInfo(
       `  .verity/memory/: ${report.memory.trackedFiles > 0 ? `${report.memory.trackedFiles} file(s) tracked in git \u2014 they appear in every diff` : report.memory.posture === "ignored" ? "machine-local \u2713" : "not tracked"}`
@@ -46335,10 +46776,10 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.35.3-experimental.f980d82").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.35.4").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
   const isTelemetryHelper = actionCommand.name() === "headers" && actionCommand.parent?.name() === "telemetry";
   if (!isTelemetryHelper) {
-    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.3-experimental.f980d82");
+    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.4");
   }
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {