@codacy/verity-cli 0.35.3 → 0.35.4

package/CHANGELOG.md

@@ -64,6 +64,48 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.35.4] — 2026-11-10
+
+### 📐 The Standard file is machine-local
+
+- **`.verity/standard.yaml` is no longer committed.** Reviews read the Standard
+  on the Verity service, and the service copy moves without the file (`verity
+  standard generate` on another machine, the catalogue conversion, a suggestion
+  accepted on the dashboard), so the committed copy was routinely stale. The
+  file is now this machine's working copy: `verity init` and `verity standard
+  pull` write it from the service, and the `.gitignore` block `verity init`
+  writes ignores it. A project whose file is already tracked is not converted:
+  `verity init` and `verity doctor` say so and name `verity standard untrack`,
+  which stages the removal (the file stays on disk). Teammates get the file
+  back with `verity standard pull`. `.verityignore` and `VERITY.md` stay
+  committed.
+- **`verity standard push` is conditional.** It sends the version this machine
+  last pulled, adopted, pushed or matched, and the service writes the next
+  version only when that is still the latest. Otherwise nothing is written, and
+  the message names `verity standard pull` (pull, re-apply your changes, push
+  again) and `--force`, which keeps the old unconditional push. A machine with
+  no record reads the latest first and expects exactly that.
+- **`verity init` with a Standard file here compares it with the team's.** The
+  same Standard: kept, and named as that version. None on the service: shared.
+  A different one: init asks (Enter uses the team's, `k` keeps yours), and an
+  unattended run uses the team's; your file is kept as
+  `.verity/standard.<time>.yaml`. `--standard use` is honoured here now. Before,
+  the file was kept without a look at the team's, so a teammate on a cloned
+  repository was never told it differed, and a push of it replaced the team's.
+- **`verity doctor`** reports a tracked Standard file, and a missing file is no
+  longer "run `synthesize --push`" (which would replace the team's Standard
+  with a derived one from a clone): it is `verity standard pull` when this
+  machine knows the team's version, and `verity init` otherwise.
+- **The one-time knowledge seed** reads the Standard on the service when there is
+  no file here, so a checkout without the file seeds its graph too.
+
+### 🌐 The service has a domain
+
+- **The Verity service is `https://server.verity.md`.** A new login, and every
+  credential and VERITY.md that names the old `ofcamwrjwrkazqvdchko.supabase.co`
+  address, uses it. Nothing to do: the old address names the same service and
+  keeps working, and a login made against one address is accepted at the other.
+
 ## [0.35.3] — 2026-11-05
 
 ### 🔧 Fixes

package/bin/verity.js

@@ -14732,7 +14732,9 @@ var SECURITY_PATTERNS = [
   /(^|\/)pom\.xml$/,
   /(^|\/)gradle\.lockfile$/
 ];
-var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
+var PROD_SERVICE_ORIGIN = "https://server.verity.md";
+var LEGACY_PROD_SERVICE_ORIGIN = "https://ofcamwrjwrkazqvdchko.supabase.co";
+var PROD_SERVICE_URL = `${PROD_SERVICE_ORIGIN}/functions/v1`;
 var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
@@ -14823,6 +14825,36 @@ function rotateIfNeeded(file) {
 var import_promises = require("node:fs/promises");
 var import_node_path3 = require("node:path");
 var import_node_child_process2 = require("node:child_process");
+
+// src/lib/service-origin.ts
+var LEGACY = new URL(LEGACY_PROD_SERVICE_ORIGIN);
+function canonicalServiceUrl(raw) {
+  const trimmed = raw.trim();
+  let u;
+  try {
+    u = new URL(trimmed);
+  } catch {
+    return raw;
+  }
+  if (u.protocol !== LEGACY.protocol || u.host.toLowerCase() !== LEGACY.host || u.username !== "" || u.password !== "") {
+    return raw;
+  }
+  return trimmed.replace(/^https:\/\/[^/?#]+/i, PROD_SERVICE_ORIGIN);
+}
+function normalizeServiceUrl(raw) {
+  const trimmed = canonicalServiceUrl(raw).trim().replace(/\/+$/, "");
+  try {
+    const u = new URL(trimmed);
+    return `${u.protocol}//${u.host.toLowerCase()}${u.pathname.replace(/\/+$/, "")}`;
+  } catch {
+    return trimmed.toLowerCase();
+  }
+}
+function sameServiceUrl(a, b) {
+  return normalizeServiceUrl(a) === normalizeServiceUrl(b);
+}
+
+// src/lib/credentials.ts
 function globalCredentialsPath() {
   return `${process.env.HOME}/.verity/credentials`;
 }
@@ -14843,7 +14875,8 @@ function parseCredentialLine(line2) {
   const rest = idx === -1 ? line2 : line2.slice(idx);
   const tokenMatch = rest.match(TOKEN_RE);
   if (!tokenMatch) return null;
-  const serviceUrl = rest.match(/service_url:\s*(https?:\/\/\S+)/)?.[1];
+  const serviceUrlRaw = rest.match(/service_url:\s*(https?:\/\/\S+)/)?.[1];
+  const serviceUrl = serviceUrlRaw != null ? canonicalServiceUrl(serviceUrlRaw) : void 0;
   const userIdRaw = rest.match(/user_id:\s*(\d+)/)?.[1];
   const email = rest.match(/email:\s*(\S+)/)?.[1];
   return {
@@ -14865,7 +14898,7 @@ function encodeRemoteKey(remote) {
 function serializeCredential(remote, rec) {
   const key = encodeRemoteKey(remote);
   const out2 = [key ? `${key} token: ${rec.token}` : `token: ${rec.token}`];
-  if (rec.serviceUrl) out2.push(`service_url: ${rec.serviceUrl}`);
+  if (rec.serviceUrl) out2.push(`service_url: ${canonicalServiceUrl(rec.serviceUrl)}`);
   if (rec.userId != null) out2.push(`user_id: ${rec.userId}`);
   if (rec.email) out2.push(`email: ${rec.email}`);
   return out2.join(" ");
@@ -14938,7 +14971,7 @@ async function removeSupersededUserCredentials(loginServiceUrl, loginUserId) {
   let removed = 0;
   for (const line2 of content.split("\n")) {
     const parsed = parseCredentialLine(line2);
-    const superseded = parsed !== null && parsed.remote !== "" && parsed.rec.userId === loginUserId && (!parsed.rec.serviceUrl || parsed.rec.serviceUrl === loginServiceUrl);
+    const superseded = parsed !== null && parsed.remote !== "" && parsed.rec.userId === loginUserId && (!parsed.rec.serviceUrl || sameServiceUrl(parsed.rec.serviceUrl, loginServiceUrl));
     if (superseded) {
       removed++;
       continue;
@@ -14990,9 +15023,10 @@ function parseLocalCredentialFile(content) {
   const tokenMatch = content.match(/token:\s*((?:gate_|verity_)[a-f0-9]+)/);
   if (!tokenMatch) return null;
   const userIdMatch = content.match(/^user_id:\s*(\d+)/m);
+  const serviceUrl = content.match(/service_url:\s*(https?:\/\/\S+)/)?.[1];
   return {
     token: tokenMatch[1],
-    serviceUrl: content.match(/service_url:\s*(https?:\/\/\S+)/)?.[1],
+    serviceUrl: serviceUrl != null ? canonicalServiceUrl(serviceUrl) : void 0,
     userId: userIdMatch ? Number(userIdMatch[1]) : void 0,
     email: content.match(/^email:\s*(\S+)/m)?.[1]
   };
@@ -15306,15 +15340,7 @@ async function checkTokenPin(token, targetUrl) {
   if (!stored.serviceUrl) return { attach: false, reason: "unpinnable" };
   return normalizeUrl(stored.serviceUrl) === normalizeUrl(targetUrl) ? { attach: true } : { attach: false, reason: "mismatch", mintedFor: stored.serviceUrl };
 }
-function normalizeUrl(raw) {
-  const trimmed = raw.trim().replace(/\/+$/, "");
-  try {
-    const u = new URL(trimmed);
-    return `${u.protocol}//${u.host.toLowerCase()}${u.pathname.replace(/\/+$/, "")}`;
-  } catch {
-    return trimmed.toLowerCase();
-  }
-}
+var normalizeUrl = normalizeServiceUrl;
 function pinRefusalMessage(verdict, targetUrl) {
   if (verdict.reason === "unpinnable") {
     return `Refusing to send your Verity login to ${targetUrl}: this machine's credential does not record which service issued it, so it cannot be verified. Run "verity login" to re-issue it.`;
@@ -15325,7 +15351,7 @@ function pinRefusalMessage(verdict, targetUrl) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.35.3" : "dev";
+    return true ? "0.35.4" : "dev";
   } catch {
     return "dev";
   }
@@ -15530,7 +15556,7 @@ async function serviceUrlFromVerityMd() {
     const line2 = content.split("\n").find((l) => /\*{0,2}(?:url|service)\*{0,2}\s*:/i.test(l));
     if (line2) {
       const urlMatch = line2.match(/https:\/\/[^\s]+/);
-      if (urlMatch) return urlMatch[0];
+      if (urlMatch) return canonicalServiceUrl(urlMatch[0]);
     }
   } catch {
   }
@@ -18048,6 +18074,124 @@ function describeRemote(found) {
   return `version ${found.standard.version}, pushed${who} on ${when}${also}`;
 }
 
+// src/lib/json-file.ts
+var import_promises3 = require("node:fs/promises");
+var import_node_path12 = require("node:path");
+function jsonSemanticEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) {
+    return a === b;
+  }
+  const aIsArr = Array.isArray(a);
+  const bIsArr = Array.isArray(b);
+  if (aIsArr || bIsArr) {
+    if (!aIsArr || !bIsArr || a.length !== b.length) return false;
+    for (let i2 = 0; i2 < a.length; i2++) {
+      if (!jsonSemanticEqual(a[i2], b[i2])) return false;
+    }
+    return true;
+  }
+  const ao = a;
+  const bo = b;
+  const aKeys = Object.keys(ao).filter((k) => ao[k] !== void 0);
+  const bKeys = Object.keys(bo).filter((k) => bo[k] !== void 0);
+  if (aKeys.length !== bKeys.length) return false;
+  for (const k of aKeys) {
+    if (bo[k] === void 0) return false;
+    if (!jsonSemanticEqual(ao[k], bo[k])) return false;
+  }
+  return true;
+}
+function detectJsonIndent(raw) {
+  const m = raw.match(/\n([ \t]+)\S/);
+  return m ? m[1] : 2;
+}
+async function writeJsonFilePreservingStyle(file, value) {
+  let currentRaw = null;
+  try {
+    currentRaw = await (0, import_promises3.readFile)(file, "utf-8");
+  } catch {
+    currentRaw = null;
+  }
+  if (currentRaw !== null) {
+    try {
+      if (jsonSemanticEqual(JSON.parse(currentRaw), value)) return false;
+    } catch {
+    }
+  }
+  const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
+  const next = JSON.stringify(value, null, indent) + "\n";
+  if (next === currentRaw) return false;
+  await (0, import_promises3.mkdir)((0, import_node_path12.dirname)(file), { recursive: true });
+  await (0, import_promises3.writeFile)(file, next);
+  return true;
+}
+
+// src/lib/setup-state.ts
+var SETUP_STATE_FILE = `${VERITY_DIR}/setup.json`;
+var MOMENTS = ["stop", "pre-commit", "pre-push"];
+var INTENSITIES = ["lightweight", "balanced", "thorough"];
+var TELEMETRY = ["enabled", "declined", "deferred"];
+var VERSION = /^[0-9A-Za-z.+-]{1,32}$/;
+var stamp = (v) => typeof v === "string" && v.length > 0 && v.length <= 64;
+function setupStateFrom(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+  const r = raw;
+  if (r.version !== 1) return null;
+  const out2 = { version: 1 };
+  if (INTENSITIES.includes(r.intensity)) out2.intensity = r.intensity;
+  if (Array.isArray(r.moments) && r.moments.every((m) => MOMENTS.includes(m))) {
+    out2.moments = [...new Set(r.moments)];
+  }
+  if (TELEMETRY.includes(r.telemetry)) out2.telemetry = r.telemetry;
+  if (Number.isSafeInteger(r.declinedStandardVersion) && r.declinedStandardVersion >= 1) {
+    out2.declinedStandardVersion = r.declinedStandardVersion;
+  }
+  if (Number.isSafeInteger(r.standardVersion) && r.standardVersion >= 1) {
+    out2.standardVersion = r.standardVersion;
+  }
+  const init2 = r.init;
+  if (init2 && typeof init2 === "object" && stamp(init2.completed_at) && typeof init2.cli_version === "string" && VERSION.test(init2.cli_version)) {
+    out2.init = { completed_at: init2.completed_at, cli_version: init2.cli_version };
+  }
+  const plugin = r.pluginSetup;
+  if (plugin && typeof plugin === "object" && typeof plugin.version === "string" && VERSION.test(plugin.version) && stamp(plugin.completed_at)) {
+    out2.pluginSetup = { version: plugin.version, completed_at: plugin.completed_at };
+  }
+  if (r.wiring === "project") out2.wiring = "project";
+  return out2;
+}
+var MAX_SETUP_BYTES = 64 * 1024;
+function readSetupText() {
+  const read2 = readRegularFileInRoot(repoRoot(), SETUP_STATE_FILE, MAX_SETUP_BYTES);
+  return read2.ok ? read2.content : null;
+}
+async function readSetupState() {
+  const raw = readSetupText();
+  if (raw === null) return null;
+  try {
+    return setupStateFrom(JSON.parse(raw));
+  } catch {
+    return null;
+  }
+}
+async function writeSetupState(patch) {
+  const current = await readSetupState() ?? { version: 1 };
+  const next = { ...current, ...patch, version: 1 };
+  const raw = readSetupText();
+  if (raw !== null) {
+    try {
+      if (jsonSemanticEqual(JSON.parse(raw), next)) return next;
+    } catch {
+    }
+  }
+  const text3 = JSON.stringify(next, null, raw !== null ? detectJsonIndent(raw) : 2) + "\n";
+  if (!replaceInRoot(projectPath(VERITY_DIR), "setup.json", text3)) {
+    throw new Error(`Could not write ${SETUP_STATE_FILE}: it is a link, or ${VERITY_DIR} is not a folder of this repository`);
+  }
+  return next;
+}
+
 // src/lib/catalogue-conversion.ts
 var PACK_ID2 = /^[a-z][a-z0-9-]{0,39}$/;
 var MAX_PACKS2 = 12;
@@ -18078,6 +18222,12 @@ function count(v) {
 }
 
 // src/lib/push-setup.ts
+function latestFromConflict(result) {
+  const err2 = result.errorBody?.error;
+  const raw = err2 && typeof err2 === "object" ? err2.latest_version : void 0;
+  const n2 = typeof raw === "string" && /^[1-9][0-9]*$/.test(raw) ? Number(raw) : typeof raw === "number" ? raw : NaN;
+  return Number.isSafeInteger(n2) && n2 >= 1 ? n2 : null;
+}
 async function pushStandard(globals, opts = {}) {
   const lines = [];
   const token = await resolveToken(globals.token);
@@ -18113,11 +18263,15 @@ async function pushStandard(globals, opts = {}) {
       if (result.ok) {
         standardVersion = result.data.version;
         lines.push(`Standard pushed to Verity (v${result.data.version}) \u2713`);
+        if (Number.isSafeInteger(standardVersion) && standardVersion >= 1) {
+          await writeSetupState({ standardVersion }).catch(() => {
+          });
+        }
         const converted = conversionLine(result.data);
         if (converted) lines.push(converted);
       } else if (opts.expectedLatest !== void 0 && result.http_status === 409 && result.error.startsWith("STANDARD_EXISTS")) {
         lines.push("The service has a Standard now that this run did not see, so nothing was pushed over it.");
-        return { lines, standardVersion: null, conflict: true };
+        return { lines, standardVersion: null, conflict: true, latest: latestFromConflict(result) };
       } else {
         lines.push(`Could not push the Standard: ${terminalText(result.error, 300)} \u2014 run "verity standard push" later.`);
       }
@@ -18285,7 +18439,7 @@ async function finishSplitLogin(opts) {
   if (read2.status === "invalid") fail2("invalid", `the pending sign-in is unusable (${read2.reason}) \u2014 run "verity login --start" again`, true);
   if (read2.status === "expired") fail2("expired", 'the code expired before it was approved \u2014 run "verity login --start" again', true);
   const pending = read2.record;
-  if (pending.service_url !== opts.serviceUrl) {
+  if (!sameServiceUrl(pending.service_url, opts.serviceUrl)) {
     fail2(
       "service_changed",
       `the sign-in was started for ${pending.service_url}, but this machine now resolves ${opts.serviceUrl} \u2014 run "verity login --start" again`,
@@ -18646,61 +18800,6 @@ function registerLogoutCommand(program2) {
 // src/lib/hooks.ts
 var import_promises4 = require("node:fs/promises");
 var import_node_path13 = require("node:path");
-
-// src/lib/json-file.ts
-var import_promises3 = require("node:fs/promises");
-var import_node_path12 = require("node:path");
-function jsonSemanticEqual(a, b) {
-  if (a === b) return true;
-  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) {
-    return a === b;
-  }
-  const aIsArr = Array.isArray(a);
-  const bIsArr = Array.isArray(b);
-  if (aIsArr || bIsArr) {
-    if (!aIsArr || !bIsArr || a.length !== b.length) return false;
-    for (let i2 = 0; i2 < a.length; i2++) {
-      if (!jsonSemanticEqual(a[i2], b[i2])) return false;
-    }
-    return true;
-  }
-  const ao = a;
-  const bo = b;
-  const aKeys = Object.keys(ao).filter((k) => ao[k] !== void 0);
-  const bKeys = Object.keys(bo).filter((k) => bo[k] !== void 0);
-  if (aKeys.length !== bKeys.length) return false;
-  for (const k of aKeys) {
-    if (bo[k] === void 0) return false;
-    if (!jsonSemanticEqual(ao[k], bo[k])) return false;
-  }
-  return true;
-}
-function detectJsonIndent(raw) {
-  const m = raw.match(/\n([ \t]+)\S/);
-  return m ? m[1] : 2;
-}
-async function writeJsonFilePreservingStyle(file, value) {
-  let currentRaw = null;
-  try {
-    currentRaw = await (0, import_promises3.readFile)(file, "utf-8");
-  } catch {
-    currentRaw = null;
-  }
-  if (currentRaw !== null) {
-    try {
-      if (jsonSemanticEqual(JSON.parse(currentRaw), value)) return false;
-    } catch {
-    }
-  }
-  const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
-  const next = JSON.stringify(value, null, indent) + "\n";
-  if (next === currentRaw) return false;
-  await (0, import_promises3.mkdir)((0, import_node_path12.dirname)(file), { recursive: true });
-  await (0, import_promises3.writeFile)(file, next);
-  return true;
-}
-
-// src/lib/hooks.ts
 var VERITY_STOP_HOOK = {
   type: "command",
   command: "verity analyze",
@@ -21094,13 +21193,15 @@ var import_node_child_process9 = require("node:child_process");
 var import_node_fs24 = require("node:fs");
 var VERITY_GITIGNORE_MARKER = "# Verity \u2014 machine-local state.";
 var SETTINGS_LOCAL_IGNORE_ENTRY = ".claude/settings.local.json";
+var BLOCK_COMMENT = [
+  "# Verity \u2014 machine-local state. Everything in .verity/ is ignored. The Standard",
+  "# is held by the Verity service (verity standard pull writes it here), and the",
+  "# knowledge graph under .verity/memory/ is rebuilt from it. Committing either",
+  "# puts generated files in every diff and pull request."
+];
 var VERITY_GITIGNORE_BLOCK = [
-  "# Verity \u2014 machine-local state. Everything in .verity/ is ignored except the",
-  "# shared standard, which is meant to be committed. The knowledge graph under",
-  "# .verity/memory/ is machine-local too: the service rebuilds it, and committing",
-  "# it puts generated notes in every diff and pull request.",
+  ...BLOCK_COMMENT,
   ".verity/*",
-  "!.verity/standard.yaml",
   SETTINGS_LOCAL_IGNORE_ENTRY,
   ""
 ].join("\n");
@@ -21125,9 +21226,11 @@ var SUPERSEDED_MEMORY_LINES = /* @__PURE__ */ new Set([
   ".verity/memory/log.md",
   SUPERSEDED_COMMENT
 ]);
-function isIgnored3(path) {
+var SUPERSEDED_STANDARD_LINE = "!.verity/standard.yaml";
+var OLD_COMMENT_LINES = /* @__PURE__ */ new Set([SUPERSEDED_COMMENT, ...MEMORY_COMMENT]);
+function isIgnored3(path, opts = {}) {
   try {
-    (0, import_node_child_process9.execSync)(`git check-ignore -q -- "${path}"`, { stdio: "pipe" });
+    (0, import_node_child_process9.execSync)(`git check-ignore -q ${opts.noIndex ? "--no-index " : ""}-- "${path}"`, { stdio: "pipe" });
     return true;
   } catch (err2) {
     return err2.status === 1 ? false : null;
@@ -21135,10 +21238,9 @@ function isIgnored3(path) {
 }
 function semanticsHold() {
   const snapshot = isIgnored3(".verity/.snapshot/__probe__");
-  const standard = isIgnored3(".verity/standard.yaml");
   const futureState = isIgnored3(".verity/.__probe-future-state__");
-  if (snapshot === null || standard === null || futureState === null) return null;
-  return snapshot === true && futureState === true && standard === false;
+  if (snapshot === null || futureState === null) return null;
+  return snapshot === true && futureState === true;
 }
 function memoryPosture() {
   const ignored = isIgnored3(".verity/memory/domain/__probe__.md");
@@ -21155,6 +21257,22 @@ function committedMemoryFiles() {
     return [];
   }
 }
+var STANDARD_PATH = ".verity/standard.yaml";
+function standardPosture() {
+  const ignored = isIgnored3(STANDARD_PATH, { noIndex: true });
+  if (ignored === null) return "unknown";
+  return ignored ? "ignored" : "committable";
+}
+function committedStandardFile() {
+  try {
+    return (0, import_node_child_process9.execSync)(`git ls-files -z -- ${STANDARD_PATH}`, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).split("\0").filter(Boolean).length > 0;
+  } catch {
+    return false;
+  }
+}
 var OPT_OUT_COMMENT_LINES = /* @__PURE__ */ new Set([
   MEMORY_OPT_OUT_MARKER,
   '# Remove these three lines (or run "verity memory untrack") to stop tracking it.'
@@ -21172,6 +21290,19 @@ function fenceMemoryLines(lines) {
   }
   return out2;
 }
+function fenceStandardLines(lines) {
+  const out2 = [];
+  for (const line2 of lines) {
+    const trimmed = line2.trim();
+    if (trimmed.startsWith(VERITY_GITIGNORE_MARKER) && trimmed !== BLOCK_COMMENT[0]) {
+      out2.push(...BLOCK_COMMENT);
+      continue;
+    }
+    if (trimmed === SUPERSEDED_STANDARD_LINE || OLD_COMMENT_LINES.has(trimmed)) continue;
+    out2.push(line2);
+  }
+  return out2;
+}
 function ensureVerityGitignore() {
   let content = "";
   try {
@@ -21183,9 +21314,11 @@ function ensureVerityGitignore() {
   const lines = content.split("\n");
   const needsRepair = lines.some((l) => BREAKING_ENTRIES.has(l.trim()));
   const hasSupersededMemory = hasMarker && !optedOut && lines.some((l) => SUPERSEDED_MEMORY_LINES.has(l.trim()));
+  const hasSupersededStandard = hasMarker && lines.some((l) => l.trim() === SUPERSEDED_STANDARD_LINE);
   const memoryIsCommitted = hasSupersededMemory && committedMemoryFiles().length > 0;
+  const standardIsCommitted = hasSupersededStandard && committedStandardFile();
   const verified = (result) => semanticsHold() === false ? "conflict" : result;
-  if (hasMarker && !needsRepair && !hasSupersededMemory) return verified("covered");
+  if (hasMarker && !needsRepair && !hasSupersededMemory && !hasSupersededStandard) return verified("covered");
   if (!hasMarker && !needsRepair) {
     if (semanticsHold() === true) return "covered";
   }
@@ -21194,6 +21327,9 @@ function ensureVerityGitignore() {
     if (needsRepair) {
       next = next.map((l) => BREAKING_ENTRIES.has(l.trim()) ? ".verity/*" : l);
     }
+    if (hasSupersededStandard && !standardIsCommitted) {
+      next = fenceStandardLines(next);
+    }
     if (hasSupersededMemory && !memoryIsCommitted) {
       next = fenceMemoryLines(next);
     }
@@ -21204,7 +21340,7 @@ function ensureVerityGitignore() {
     }
     if (text3 !== content) (0, import_node_fs24.writeFileSync)(".gitignore", text3);
     return verified(
-      memoryIsCommitted ? "memory-tracked" : hasSupersededMemory ? "memory-fenced" : needsRepair ? "repaired" : "added"
+      memoryIsCommitted ? "memory-tracked" : standardIsCommitted ? "standard-tracked" : hasSupersededMemory ? "memory-fenced" : hasSupersededStandard ? "standard-fenced" : needsRepair ? "repaired" : "added"
     );
   } catch {
     return "failed";
@@ -21219,7 +21355,7 @@ function untrackMemory() {
     return "failed";
   }
 }
-function writeFencedBlock() {
+function writeFencedBlock(fence) {
   let content = "";
   try {
     content = (0, import_node_fs24.readFileSync)(".gitignore", "utf-8");
@@ -21227,7 +21363,8 @@ function writeFencedBlock() {
   }
   const hasMarker = content.includes(VERITY_GITIGNORE_MARKER);
   let lines = content.split("\n").map((l) => BREAKING_ENTRIES.has(l.trim()) ? ".verity/*" : l);
-  lines = fenceMemoryLines(lines);
+  if (fence.standard) lines = fenceStandardLines(lines);
+  if (fence.memory) lines = fenceMemoryLines(lines);
   let text3 = lines.join("\n");
   if (!hasMarker) {
     const sep7 = text3 === "" ? "" : text3.endsWith("\n") ? "\n" : "\n\n";
@@ -21254,7 +21391,7 @@ function fenceMemory() {
     } catch {
     }
   };
-  if (!writeFencedBlock()) return { untracked: 0, ok: false };
+  if (!writeFencedBlock({ memory: true })) return { untracked: 0, ok: false };
   if (memoryPosture() !== "ignored") {
     restore();
     return { untracked: 0, ok: false };
@@ -21266,6 +21403,34 @@ function fenceMemory() {
   }
   return { untracked: tracked, ok: true };
 }
+function untrackStandard() {
+  let original = null;
+  try {
+    original = (0, import_node_fs24.readFileSync)(".gitignore", "utf-8");
+  } catch {
+    original = null;
+  }
+  const restore = () => {
+    try {
+      if (original === null) (0, import_node_fs24.rmSync)(".gitignore", { force: true });
+      else (0, import_node_fs24.writeFileSync)(".gitignore", original);
+    } catch {
+    }
+  };
+  if (!writeFencedBlock({ standard: true })) return { ok: false, why: "gitignore" };
+  if (standardPosture() !== "ignored") {
+    restore();
+    return { ok: false, why: "still-committable" };
+  }
+  if (!committedStandardFile()) return { ok: true, untracked: false };
+  try {
+    (0, import_node_child_process9.execSync)(`git rm --cached --quiet -- ${STANDARD_PATH}`, { stdio: "pipe" });
+    return { ok: true, untracked: true };
+  } catch {
+    restore();
+    return { ok: false, why: "index" };
+  }
+}
 function memoryOptOut() {
   try {
     return (0, import_node_fs24.readFileSync)(".gitignore", "utf-8").includes(MEMORY_OPT_OUT_MARKER);
@@ -21295,18 +21460,23 @@ function committedVerityState() {
   } catch {
     return [];
   }
-  return out2.split("\0").filter(Boolean).filter((p) => p !== ".verity/standard.yaml" && !p.startsWith(".verity/memory/"));
+  return out2.split("\0").filter(Boolean).filter((p) => p !== STANDARD_PATH && !p.startsWith(".verity/memory/"));
 }
 function untrackVerityState() {
   const tracked = committedVerityState();
   if (tracked.length === 0) return "none";
+  const standardWasTracked = committedStandardFile();
   try {
     (0, import_node_child_process9.execSync)("git rm -r --cached --quiet -- .verity", { stdio: "pipe" });
-    const keeps = [".verity/standard.yaml"];
-    if (memoryPosture() === "committable") keeps.push(".verity/memory");
-    for (const keep of keeps) {
+    if (standardWasTracked) {
       try {
-        (0, import_node_child_process9.execSync)(`git add -- "${keep}"`, { stdio: "pipe" });
+        (0, import_node_child_process9.execSync)(`git add -f -- ${STANDARD_PATH}`, { stdio: "pipe" });
+      } catch {
+      }
+    }
+    if (memoryPosture() === "committable") {
+      try {
+        (0, import_node_child_process9.execSync)("git add -- .verity/memory", { stdio: "pipe" });
       } catch {
       }
     }
@@ -21827,8 +21997,13 @@ var CLAUDE_MD_PROSE = [
   "  `verity standard generate`. It works only for a project with no Standard on the",
   "  service. It writes `.verity/repo-profile.json` and sends nothing without consent.",
   "  Show the user that file. Run the command again with `--yes` only after they agree.",
-  "- The rules themselves: edit `.verity/standard.yaml`, then run `verity standard push`."
+  "- The rules themselves: run `verity standard pull` first (the file here can be behind",
+  "  the team's), edit `.verity/standard.yaml`, then run `verity standard push`."
 ].join("\n");
+var CLAUDE_MD_PROSE_PRE_PULL = CLAUDE_MD_PROSE.replace(
+  /- The rules themselves: run `verity standard pull` first \(the file here can be behind\n  the team's\), edit `\.verity\/standard\.yaml`, then run `verity standard push`\.$/,
+  "- The rules themselves: edit `.verity/standard.yaml`, then run `verity standard push`."
+);
 var CLAUDE_MD_PROSE_PRE_VERBOSE = [
   "## Project Memory",
   "",
@@ -22466,6 +22641,7 @@ function stripKnownProse(interior) {
   const trimmed = interior.replace(/^\n+/, "");
   for (const prose of [
     CLAUDE_MD_PROSE,
+    CLAUDE_MD_PROSE_PRE_PULL,
     CLAUDE_MD_PROSE_PRE_VERBOSE,
     CLAUDE_MD_PROSE_PRE_SETTINGS,
     CLAUDE_MD_PROSE_PRE_STDIN,
@@ -25531,6 +25707,8 @@ async function generateStandard(opts) {
   } catch (err2) {
     return { status: "failed", reason: `the Standard is on the service (v${version}) but could not be written here: ${terminalText(err2.message, 200)}` };
   }
+  await writeSetupState({ standardVersion: version }).catch(() => {
+  });
   return {
     status: "created",
     version,
@@ -25711,68 +25889,6 @@ async function runGenerate(globals, opts) {
 var import_node_fs37 = require("node:fs");
 var import_yaml6 = __toESM2(require_dist());
 
-// src/lib/setup-state.ts
-var SETUP_STATE_FILE = `${VERITY_DIR}/setup.json`;
-var MOMENTS = ["stop", "pre-commit", "pre-push"];
-var INTENSITIES = ["lightweight", "balanced", "thorough"];
-var TELEMETRY = ["enabled", "declined", "deferred"];
-var VERSION = /^[0-9A-Za-z.+-]{1,32}$/;
-var stamp = (v) => typeof v === "string" && v.length > 0 && v.length <= 64;
-function setupStateFrom(raw) {
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
-  const r = raw;
-  if (r.version !== 1) return null;
-  const out2 = { version: 1 };
-  if (INTENSITIES.includes(r.intensity)) out2.intensity = r.intensity;
-  if (Array.isArray(r.moments) && r.moments.every((m) => MOMENTS.includes(m))) {
-    out2.moments = [...new Set(r.moments)];
-  }
-  if (TELEMETRY.includes(r.telemetry)) out2.telemetry = r.telemetry;
-  if (Number.isSafeInteger(r.declinedStandardVersion) && r.declinedStandardVersion >= 1) {
-    out2.declinedStandardVersion = r.declinedStandardVersion;
-  }
-  const init2 = r.init;
-  if (init2 && typeof init2 === "object" && stamp(init2.completed_at) && typeof init2.cli_version === "string" && VERSION.test(init2.cli_version)) {
-    out2.init = { completed_at: init2.completed_at, cli_version: init2.cli_version };
-  }
-  const plugin = r.pluginSetup;
-  if (plugin && typeof plugin === "object" && typeof plugin.version === "string" && VERSION.test(plugin.version) && stamp(plugin.completed_at)) {
-    out2.pluginSetup = { version: plugin.version, completed_at: plugin.completed_at };
-  }
-  if (r.wiring === "project") out2.wiring = "project";
-  return out2;
-}
-var MAX_SETUP_BYTES = 64 * 1024;
-function readSetupText() {
-  const read2 = readRegularFileInRoot(repoRoot(), SETUP_STATE_FILE, MAX_SETUP_BYTES);
-  return read2.ok ? read2.content : null;
-}
-async function readSetupState() {
-  const raw = readSetupText();
-  if (raw === null) return null;
-  try {
-    return setupStateFrom(JSON.parse(raw));
-  } catch {
-    return null;
-  }
-}
-async function writeSetupState(patch) {
-  const current = await readSetupState() ?? { version: 1 };
-  const next = { ...current, ...patch, version: 1 };
-  const raw = readSetupText();
-  if (raw !== null) {
-    try {
-      if (jsonSemanticEqual(JSON.parse(raw), next)) return next;
-    } catch {
-    }
-  }
-  const text3 = JSON.stringify(next, null, raw !== null ? detectJsonIndent(raw) : 2) + "\n";
-  if (!replaceInRoot(projectPath(VERITY_DIR), "setup.json", text3)) {
-    throw new Error(`Could not write ${SETUP_STATE_FILE}: it is a link, or ${VERITY_DIR} is not a folder of this repository`);
-  }
-  return next;
-}
-
 // src/commands/init/rules.ts
 async function projectLabel(token, serviceUrl, verbose) {
   try {
@@ -25917,6 +26033,8 @@ async function pullStandard(globals, opts = {}) {
     } catch {
     }
     if (local && typeof local === "object" && !Array.isArray(local) && sameStandard(local, remote.standard.content)) {
+      await writeSetupState({ standardVersion: version, declinedStandardVersion: void 0 }).catch(() => {
+      });
       return { status: "same", version };
     }
     try {
@@ -25927,7 +26045,7 @@ async function pullStandard(globals, opts = {}) {
   }
   try {
     const outcome = await adoptRemoteSetup(remote, { serviceUrl: url.data, projectId, expectStandard: readBytes });
-    await writeSetupState({ declinedStandardVersion: void 0 }).catch(() => {
+    await writeSetupState({ standardVersion: version, declinedStandardVersion: void 0 }).catch(() => {
     });
     return { status: "pulled", version, backup, notes: outcome.notes };
   } catch (err2) {
@@ -26146,8 +26264,13 @@ function registerStandardCommands(program2) {
     for (const path of result.written) printInfo(`  ${terminalText(path, 200)} \u2713`);
     for (const note of result.notes) printWarn(`  ${terminalText(note, 300)}`);
     if (opts.push) {
-      const pushed = await pushStandard(globals);
+      const token = await resolveToken(globals.token);
+      const expected = token.ok && urlResult.ok ? await expectedLatestForPush(globals, token.data.token, urlResult.data) : void 0;
+      const pushed = await pushStandard(globals, expected !== void 0 ? { expectedLatest: expected } : {});
       for (const line2 of pushed.lines) printInfo(`  ${terminalText(line2, 600)}`);
+      if (pushed.conflict) {
+        printWarn(`  The team's Standard is v${pushed.latest ?? "?"} now. Run verity standard pull to use it here, or verity standard push --force to replace it with this file.`);
+      }
       if (pushed.standardVersion !== null) {
         await correctVerityMdVersion({
           standard: result.standard,
@@ -26161,7 +26284,7 @@ function registerStandardCommands(program2) {
   standard.command("generate").description("Have Verity write project-specific rules from a profile of this repository (asks before sending it)").option("--yes", `Send the profile without asking (you have read ${PROFILE_FILE})`).option("--status", "Print whether the service writes project rules for this project: on, off, unsupported or unknown. Sends nothing.").action((opts) => runGenerate(program2.opts(), opts));
   standard.command("pull").description("Write the team's Standard on the service into .verity/standard.yaml (keeps a copy of yours)").action(() => runPull(program2.opts()));
   standard.command("catalogue [pack]").description("What each review pack holds: every pack, or the rules of one (core, api, data, \u2026)").option("--json", "Print the catalogue as JSON").action((pack, opts) => runCatalogue(program2.opts(), pack, opts));
-  standard.command("push").description("Upload the project Standard to the service").option("--file <path>", "Path to standard YAML file", STANDARD_FILE).option("--created-by <name>", "Who created this version", "claude-code").action(async (opts) => {
+  standard.command("push").description("Upload the project Standard to the service, as the next version after the one this machine last saw").option("--file <path>", "Path to standard YAML file", STANDARD_FILE).option("--created-by <name>", "Who created this version", "claude-code").option("--force", "Upload even when the team's Standard moved since this machine last pulled or pushed it").action(async (opts) => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
     if (!tokenResult.ok) {
@@ -26184,19 +26307,33 @@ function registerStandardCommands(program2) {
       process.exit(1);
     }
     if (upload.warning) printWarn(terminalText(upload.warning, 600));
+    const expected = opts.force ? void 0 : await expectedLatestForPush(globals, tokenResult.data.token, urlResult.data);
     const result = await apiRequest({
       method: "POST",
       path: "/standards",
       serviceUrl: urlResult.data,
       token: tokenResult.data.token,
-      body: { content: upload.content, created_by: upload.createdBy },
+      body: {
+        content: upload.content,
+        created_by: upload.createdBy,
+        ...expected !== void 0 ? { expected_latest: expected } : {}
+      },
       verbose: globals.verbose
     });
     if (!result.ok) {
+      if (expected !== void 0 && result.http_status === 409 && result.error.startsWith("STANDARD_EXISTS")) {
+        const latest = latestFromConflict(result);
+        printError(latest !== null ? `The team's Standard is v${latest} now${expected !== null ? `, and this machine last saw v${expected}` : ", and this machine saw none"}. Nothing was pushed. Run "verity standard pull" first (it keeps a copy of your file), put your changes into the pulled file, then push again. To replace v${latest} with this file as it is: verity standard push --force` : `The service has no Standard for this project, but this machine last saw v${expected}. Nothing was pushed. To share this file as v1: verity standard push --force`);
+        process.exit(1);
+      }
       printError(terminalText(result.error, 300));
       process.exit(1);
     }
     printInfo(`Standard uploaded (version ${versionText(result.data.version)})`);
+    if (Number.isSafeInteger(result.data.version) && result.data.version >= 1) {
+      await writeSetupState({ standardVersion: result.data.version }).catch(() => {
+      });
+    }
     const converted = conversionLine(result.data);
     if (converted) {
       printInfo(converted);
@@ -26204,6 +26341,7 @@ function registerStandardCommands(program2) {
     }
     printJson(result.data);
   });
+  standard.command("untrack").description(`Stop tracking ${STANDARD_FILE} in git: Verity keeps it on each machine, and reviews read the service`).action(() => runUntrack());
   standard.command("get").description("Get the current Standard from the service").option("--version <n>", "Specific version number").option("--resolved", "Show it as a review reads it: the catalogue packs in `extends` expanded into patterns").action(async (opts) => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
@@ -26278,6 +26416,32 @@ function registerStandardCommands(program2) {
 function versionText(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? String(value) : "?";
 }
+async function expectedLatestForPush(globals, token, serviceUrl) {
+  const state = await readSetupState();
+  if (state?.standardVersion !== void 0) return state.standardVersion;
+  const remote = await fetchRemoteSetup({ token, serviceUrl, verbose: globals.verbose });
+  if (remote.status === "found") {
+    printInfo(`This machine had no record of the team's Standard. It is v${remote.standard.version} on the service, and this push replaces it.`);
+    return remote.standard.version;
+  }
+  if (remote.status === "none") return null;
+  printWarn(`Could not read the team's Standard from the service (${terminalText(remote.reason, 200)}), so this push is not conditional on it.`);
+  return void 0;
+}
+function runUntrack() {
+  const wasTracked = committedStandardFile();
+  const result = untrackStandard();
+  if (!result.ok) {
+    printError(result.why === "gitignore" ? "Could not write .gitignore. Nothing changed." : result.why === "still-committable" ? `Git still lets ${STANDARD_FILE} be committed after the .gitignore change, so nothing was untracked and .gitignore is as it was. A nested .gitignore re-includes it: check with git check-ignore -v --no-index ${STANDARD_FILE}` : `Could not remove ${STANDARD_FILE} from the git index. .gitignore is as it was.`);
+    process.exit(1);
+  }
+  if (!wasTracked) {
+    printInfo(`${STANDARD_FILE} is not tracked in git. Git ignores it from here on; nothing else changed.`);
+    return;
+  }
+  printInfo(`Untracked ${STANDARD_FILE} (staged). The file stays on disk here. Commit to finish.`);
+  printInfo("Teammates lose the file on their next pull: `verity standard pull` (or `verity init`) writes the team's Standard back for them. Reviews read the Standard on the service, so none is affected.");
+}
 var UPLOAD_MAX_BYTES = 512 * 1024;
 function readUploadFile(file) {
   const root = realOrSelf(repoRoot());
@@ -34352,15 +34516,23 @@ function renderNodeMarkdown(candidate, nodeId, createdAt) {
   ].join("\n");
   return fm;
 }
-async function runSeed(opts) {
-  if (!(0, import_node_fs53.existsSync)(STANDARD_FILE)) {
-    return { created: 0, existing: 0, failed: 0, skipped: "no_standard", candidates: [] };
+async function standardForSeed(opts) {
+  if ((0, import_node_fs53.existsSync)(STANDARD_FILE)) {
+    const raw = readRepoFile(STANDARD_FILE);
+    if (raw === null) return null;
+    try {
+      const parsed = (0, import_yaml9.parse)(raw);
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    } catch {
+      return null;
+    }
   }
-  let standardDoc;
-  try {
-    const raw = await (0, import_promises11.readFile)(STANDARD_FILE, "utf-8");
-    standardDoc = (0, import_yaml9.parse)(raw);
-  } catch {
+  const remote = await fetchRemoteSetup({ serviceUrl: opts.serviceUrl, token: opts.token, verbose: opts.verbose });
+  return remote.status === "found" ? remote.standard.content : null;
+}
+async function runSeed(opts) {
+  const standardDoc = await standardForSeed(opts);
+  if (standardDoc === null) {
     return { created: 0, existing: 0, failed: 0, skipped: "no_standard", candidates: [] };
   }
   const knowledgeSpec = standardDoc.knowledge_spec ?? {};
@@ -34487,9 +34659,8 @@ async function memoryManifest(run4) {
   try {
     await ensureMemoryDir();
     const seedMarker = (0, import_node_path43.join)(VERITY_DIR, ".seeded");
-    const hasStandard = (0, import_node_fs54.existsSync)(STANDARD_FILE);
     const alreadyTried = (0, import_node_fs54.existsSync)(seedMarker);
-    if (hasStandard && !alreadyTried) {
+    if (!alreadyTried) {
       const preManifest = await buildManifest();
       if (preManifest.nodes.length === 0) {
         try {
@@ -43382,8 +43553,8 @@ async function scaffoldStep(ui, given = {}) {
     rail.warn(".gitignore: could not write the Verity block");
     rail.line("Add it by hand: .verity/ holds copies of analyzed files, including any secret the gate flagged.");
   } else if (ignore === "conflict") {
-    rail.warn(".gitignore: git still ignores .verity/standard.yaml");
-    rail.line("A global or nested .gitignore covers it, so the Standard cannot be committed. Check: git check-ignore -v .verity/standard.yaml");
+    rail.warn(".gitignore: git does not ignore the files under .verity/");
+    rail.line("A nested .gitignore re-includes them, so copies of analyzed files, including any secret the gate flagged, can be committed. Check: git check-ignore -v .verity/.snapshot/x");
   } else if (ignore === "memory-tracked") {
     rail.warn("This project commits its knowledge graph");
   }
@@ -43398,15 +43569,25 @@ async function scaffoldStep(ui, given = {}) {
       rail.line("They show up in every diff. Stop with: verity memory untrack (or keep them on purpose: verity memory track)");
     }
   }
+  if (committedStandardFile()) {
+    if (given.untrackStandard) {
+      const result = untrackStandard();
+      if (result.ok) rail.line(`Untracked ${STANDARD_FILE} (staged). Commit to finish. Teammates get it back with: verity standard pull`);
+      else rail.line(`Could not untrack ${STANDARD_FILE}. Run: verity standard untrack`, "warn");
+    } else {
+      rail.warn(`${STANDARD_FILE} is tracked in git`);
+      rail.line("Verity keeps it on each machine now, and reviews read the Standard on the service. Stop tracking it with: verity standard untrack");
+    }
+  }
   const tracked = committedVerityState();
   if (tracked.length > 0) {
     if (given.untrackState || ui.asking && await askUntrackState(ui, tracked)) {
       const result = untrackVerityState();
       if (result === "untracked") rail.line("Untracked the Verity state files (staged). Commit to finish.");
-      else if (result === "failed") rail.line("Could not untrack them. Run: git rm -r --cached .verity && git add .verity/standard.yaml", "warn");
+      else if (result === "failed") rail.line("Could not untrack them. Run: verity init --untrack-state", "warn");
     } else {
       rail.warn(`${tracked.length} Verity state file(s) are tracked in git`);
-      rail.line(`For example ${terminalText(tracked[0], 200)}. Fix: git rm -r --cached .verity && git add .verity/standard.yaml`);
+      rail.line(`For example ${terminalText(tracked[0], 200)}. Fix: verity init --untrack-state`);
     }
   }
   retireCodacyConfig(ui);
@@ -43686,10 +43867,8 @@ async function writeTeamStandard(team, opts) {
       serviceUrl: url.data,
       projectId: await projectLabel(token.data.token, url.data, opts.globals.verbose)
     });
-    if (opts.previous?.declinedStandardVersion != null) {
-      await writeSetupState({ declinedStandardVersion: void 0 }).catch(() => {
-      });
-    }
+    await writeSetupState({ standardVersion: found.standard.version, declinedStandardVersion: void 0 }).catch(() => {
+    });
     return { status: "adopted", version: found.standard.version, summary: describeRemote(found), notes: outcome.notes };
   } catch (err2) {
     return { status: "write-failed", reason: terminalText(err2.message, 300) };
@@ -43710,6 +43889,17 @@ async function askTeamChoice(ui, team) {
   rail.collapse();
   return k === "n" ? "new" : "use";
 }
+async function askKeepOrPull(ui, team) {
+  const { rail, screen } = ui;
+  rail.active(`${STANDARD_FILE} differs from your team's Standard`);
+  rail.line(`On the service: ${describeRemote(team.found)}. Reviews use that one.`);
+  rail.line(`Use it here too (a copy of your file is kept), or keep your file and share it over the team's later: verity standard push`);
+  rail.gap();
+  rail.keys([["Enter", "use the team's"], ["k", "keep yours"]]);
+  const k = await screen.key(["enter", "k"], "enter", { freshMs: 300 });
+  rail.collapse();
+  return k === "k" ? "keep" : "use";
+}
 function sayAdopted(ui, team) {
   ui.rail.done(`Using your team's Standard v${team.version}`);
   ui.rail.line(terminalText(team.summary, 300));
@@ -43778,19 +43968,19 @@ async function deriveFromCatalogue(ui, globals, plan, expectedLatest) {
     return { ok: false, version: null };
   }
 }
-function localStandardProblem() {
+function localStandard() {
   const raw = readRepoFile(STANDARD_FILE);
-  if (raw === null) return `${STANDARD_FILE} is a link, not a regular file, or larger than 512 KB.`;
+  if (raw === null) return { ok: false, problem: `${STANDARD_FILE} is a link, not a regular file, or larger than 512 KB.` };
   let parsed;
   try {
     parsed = (0, import_yaml10.parse)(raw);
   } catch (err2) {
-    return `${STANDARD_FILE} is not valid YAML: ${terminalText(err2 instanceof Error ? err2.message : String(err2), 200)}`;
+    return { ok: false, problem: `${STANDARD_FILE} is not valid YAML: ${terminalText(err2 instanceof Error ? err2.message : String(err2), 200)}` };
   }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return `${STANDARD_FILE} holds no Standard.`;
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return { ok: false, problem: `${STANDARD_FILE} holds no Standard.` };
   const valid = validateStandardContent(parsed);
-  if (!valid.ok) return `${STANDARD_FILE} is not a Standard the service accepts: ${terminalText(valid.error, 200)}`;
-  return null;
+  if (!valid.ok) return { ok: false, problem: `${STANDARD_FILE} is not a Standard the service accepts: ${terminalText(valid.error, 200)}` };
+  return { ok: true, content: parsed };
 }
 function removeLocalStandard() {
   const path = projectPath(STANDARD_FILE);
@@ -43883,26 +44073,77 @@ async function standardStep(ui, ctx) {
     }
     rail.done(`Set your Standard aside ${s.gray}\xB7 a copy is in ${aside.path}${s.reset}`);
   }
-  if ((0, import_node_fs77.existsSync)(projectPath(STANDARD_FILE))) {
-    const problem = localStandardProblem();
-    if (problem !== null) return unusableHere(problem);
-    const sync = await pushLocalStandardIfMissing(ctx.globals);
-    rail.done("Kept your Standard");
-    rail.line(`${STANDARD_FILE} is already here, so this run leaves it as it is. Edit it there, then share the change: verity standard push`);
+  const keptHints = async () => {
     if (!usesReviewPacks()) {
       rail.line("It does not use review packs. To move it to packs and keep your rules: verity standard push. To build a new one: verity init --standard new", "muted");
     }
-    if (sync.status === "pushed") {
-      rail.line(sync.version !== null ? `It was only on this machine. It is shared now as v${sync.version}.` : "It is only on this machine:", sync.version !== null ? "muted" : "warn");
-      for (const line2 of sync.lines) if (!line2.startsWith("Standard pushed")) rail.line(terminalText(line2, 600), "warn");
+    if (!hasProjectRules() && await rulesOn(ctx.globals)) {
+      rail.line("It has no project rules yet. Add them from a repo profile: verity standard generate");
+    }
+  };
+  const keptHere = async (local) => {
+    const team2 = await lookUpTeamStandard(ctx);
+    if (team2.status === "found" || team2.status === "declined-before") {
+      if (sameStandard(local, team2.found.standard.content)) {
+        rail.done(`Kept your Standard ${s.gray}\xB7 it is the team's v${team2.version}${s.reset}`);
+        rail.line(`Edit it in ${STANDARD_FILE}, then share the change: verity standard push`);
+        await writeSetupState({ standardVersion: team2.version }).catch(() => {
+        });
+        await keptHints();
+        return end({ source: "kept", version: team2.version, profile: notAsked });
+      }
+      const choice = ctx.standard === "use" ? "use" : team2.status === "declined-before" ? "keep" : ui.asking ? await askKeepOrPull(ui, team2) : "use";
+      if (choice === "use") {
+        const pulled = await pullStandard(ctx.globals);
+        if (pulled.status === "pulled" || pulled.status === "same") {
+          rail.done(`Using your team's Standard v${pulled.version}`);
+          rail.line(terminalText(describeRemote(team2.found), 300));
+          if (pulled.status === "pulled" && pulled.backup) rail.line(`Your file is kept as ${pulled.backup}`, "muted");
+          rail.line(`Edit it in ${STANDARD_FILE}, then share the change: verity standard push`);
+          if (pulled.status === "pulled") for (const note of pulled.notes) rail.line(terminalText(note, 300), "warn");
+          return end({ source: "adopted", version: pulled.version, profile: notAsked });
+        }
+        rail.warn("Could not write the team's Standard here");
+        rail.line(pulled.status === "failed" ? terminalText(pulled.message, 300) : `${STANDARD_FILE} changed while this ran.`);
+        rail.line(`Reviews use the team's Standard v${team2.version} on the service. To write it here: verity standard pull`);
+        return end({ source: "kept", version: team2.version, profile: notAsked });
+      }
+      rail.done(`Kept your Standard ${s.gray}\xB7 it differs from the team's v${team2.version}${s.reset}`);
+      rail.line(team2.status === "declined-before" ? `This project turned down the team's Standard v${team2.version} before, so this run keeps yours. Reviews use the team's.` : "Reviews use the team's Standard on the service.");
+      rail.line(`To share yours over the team's: verity standard push. To use the team's here: verity standard pull`);
+      await writeSetupState({ standardVersion: team2.version }).catch(() => {
+      });
+      await keptHints();
+      return end({ source: "kept", version: team2.version, profile: notAsked });
     }
-    if (sync.status === "skipped" && sync.reason === "unavailable") {
+    rail.done("Kept your Standard");
+    rail.line(`${STANDARD_FILE} is already here, so this run leaves it as it is. Edit it there, then share the change: verity standard push`);
+    let version = null;
+    if (team2.status === "none") {
+      const pushed = await pushStandard(ctx.globals, { expectedLatest: null });
+      if (pushed.conflict) {
+        rail.line("Someone shared a Standard for this repository while this ran. Reviews use theirs; to compare with yours, run verity init again, or verity standard pull.", "warn");
+      } else if (pushed.standardVersion !== null) {
+        version = pushed.standardVersion;
+        rail.line(`It was only on this machine. It is shared now as v${version}.`, "muted");
+      } else {
+        rail.line("It is only on this machine:", "warn");
+      }
+      for (const line2 of pushed.lines) if (!line2.startsWith("Standard pushed")) rail.line(terminalText(line2, 600), "warn");
+    }
+    if (team2.status === "unavailable") {
       rail.line(`It could not be shared: the Verity service did not answer. It is shared at the first review once the service answers, or now with: verity standard push`, "warn");
     }
-    if (!hasProjectRules() && await rulesOn(ctx.globals)) {
-      rail.line("It has no project rules yet. Add them from a repo profile: verity standard generate");
+    if (team2.status === "denied") {
+      rail.line(`It could not be compared with the team's: ${terminalText(team2.reason, 300)}`, "warn");
     }
-    return end({ source: "kept", version: sync.status === "pushed" ? sync.version : null, profile: notAsked });
+    await keptHints();
+    return end({ source: "kept", version, profile: notAsked });
+  };
+  if ((0, import_node_fs77.existsSync)(projectPath(STANDARD_FILE))) {
+    const local = localStandard();
+    if (!local.ok) return unusableHere(local.problem);
+    return keptHere(local.content);
   }
   const team = await lookUpTeamStandard(ctx);
   let replaces;
@@ -44605,7 +44846,7 @@ async function recordAnswers(ui, momentIds, telemetry, completed) {
       moments: momentIds,
       ...telemetry ? { telemetry } : {},
       // A failed run also clears an earlier stamp: "done" describes this checkout now.
-      init: completed ? { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.3" : "dev" } : void 0
+      init: completed ? { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.4" : "dev" } : void 0
     });
   } catch (err2) {
     ui.rail.line(`Could not record the setup answers: ${terminalText(err2.message, 200)}`, "warn");
@@ -44684,7 +44925,7 @@ async function runInit(program2, opts) {
       process.exit(1);
     }
     trace.mark("prerequisites", "ok");
-    await scaffoldStep(ui, { untrackMemory: opts.untrackMemory === true, untrackState: opts.untrackState === true });
+    await scaffoldStep(ui, { untrackMemory: opts.untrackMemory === true, untrackStandard: opts.untrackStandard === true, untrackState: opts.untrackState === true });
     trace.mark("scaffold", "ok");
     await (0, import_promises17.mkdir)((0, import_node_path68.join)((0, import_node_os15.homedir)(), ".verity"), { recursive: true });
     await repoStep(ui, detectProject());
@@ -44735,7 +44976,7 @@ async function runInit(program2, opts) {
   }
 }
 function registerInitCommand(program2) {
-  program2.command("init").alias("setup").description("Set up Verity in this project: sign in, telemetry, and the Standard; every other choice is a stated default").option("--force", "Reinstall the skills even when they are up to date (hooks are always reconciled)").option("-y, --yes", "Ask nothing: skip sign-in unless already signed in, and send the profile only with --profile send").option("--profile <send|skip>", "Answer the repo-profile question without asking (the plugin asks in the session)").option("--standard <use|new>", "When the team already has a Standard: use it, or create a new one (the plugin asks in the session; unattended runs use it)").option("--no-setup", "Ignored: init no longer hands off to /verity-setup (kept for old scripts)").option("--plugin-mode", "The Claude Code plugin owns the skills and hooks: install neither, and remove any this project already has").option("--no-plugin", "Ignore any Claude Code plugin here and wire this project's own skills and hooks").option("--no-adopt", "Don't use this repository's Standard from the service; build a new one").option("--moments <list>", 'Set when Verity reviews without the default: stop,pre-commit,pre-push \u2014 or "none"').option("--intensity <level>", "Ignored: static analysis is Trivy only (kept so older plugin skills keep working)").option("--telemetry <on|off>", "Answer the telemetry question without asking: send cost & usage from this machine, or not").option("--untrack-memory", "Stop tracking the knowledge graph in git (init does not ask)").option("--untrack-state", "Untrack committed Verity state without asking (a terminal run asks when it finds some)").action((opts) => runInit(program2, opts));
+  program2.command("init").alias("setup").description("Set up Verity in this project: sign in, telemetry, and the Standard; every other choice is a stated default").option("--force", "Reinstall the skills even when they are up to date (hooks are always reconciled)").option("-y, --yes", "Ask nothing: skip sign-in unless already signed in, and send the profile only with --profile send").option("--profile <send|skip>", "Answer the repo-profile question without asking (the plugin asks in the session)").option("--standard <use|new>", "When the team already has a Standard: use it, or create a new one (the plugin asks in the session; unattended runs use it)").option("--no-setup", "Ignored: init no longer hands off to /verity-setup (kept for old scripts)").option("--plugin-mode", "The Claude Code plugin owns the skills and hooks: install neither, and remove any this project already has").option("--no-plugin", "Ignore any Claude Code plugin here and wire this project's own skills and hooks").option("--no-adopt", "Don't use this repository's Standard from the service; build a new one").option("--moments <list>", 'Set when Verity reviews without the default: stop,pre-commit,pre-push \u2014 or "none"').option("--intensity <level>", "Ignored: static analysis is Trivy only (kept so older plugin skills keep working)").option("--telemetry <on|off>", "Answer the telemetry question without asking: send cost & usage from this machine, or not").option("--untrack-memory", "Stop tracking the knowledge graph in git (init does not ask)").option("--untrack-standard", "Stop tracking .verity/standard.yaml in git: Verity keeps it on each machine (init does not ask)").option("--untrack-state", "Untrack committed Verity state without asking (a terminal run asks when it finds some)").action((opts) => runInit(program2, opts));
 }
 
 // src/commands/doctor.ts
@@ -44764,17 +45005,23 @@ async function buildReport() {
   if (legacyOnly) {
     next.push(`Run "verity init" \u2014 it moves the old GATE.md install, with its Standard (${LEGACY_STANDARD_FILE}), to .verity/.`);
   }
+  const standard = { tracked: committedStandardFile(), version: state?.standardVersion ?? null };
   const missing = [
     !artifacts.standard && !legacyOnly && ".verity/standard.yaml",
     !artifacts.verityMd && !legacyOnly && "VERITY.md"
   ].filter((x) => !!x);
-  if (missing.length === 2) {
-    next.push('Run "verity standard synthesize --push" \u2014 it derives the Standard and VERITY.md from this codebase.');
+  if (!artifacts.standard && !legacyOnly) {
+    next.push(standard.version !== null ? `Run "verity standard pull" \u2014 the team's Standard (v${standard.version}) is on the service, and this machine has no copy of it.` : `Run "verity init" \u2014 it writes the team's Standard from the service, or builds one when the team has none.`);
   } else if (missing.length > 0) {
     next.push(
       `Missing ${missing.join(" and ")}. Run "verity standard synthesize --force" to regenerate \u2014 note that replaces the Standard.`
     );
   }
+  if (standard.tracked) {
+    next.push(
+      '.verity/standard.yaml is tracked in git. Verity keeps it on each machine now, and reviews read the Standard on the service. Run "verity standard untrack" to stop tracking it (the file stays on disk; teammates get it back with "verity standard pull").'
+    );
+  }
   const noAnalysisMoment = !hooks.stop && hooks.guardOn.length === 0;
   const configRead = readProjectConfig();
   if (configRead.refused) next.push(configRefusalMessage(configRead.refused));
@@ -44852,6 +45099,7 @@ async function buildReport() {
     artifacts,
     memory: memory2,
     trackedState,
+    standard,
     next
   };
 }
@@ -44899,7 +45147,7 @@ function registerDoctorCommand(program2) {
     if (process.platform === "win32") printWarn(WINDOWS_STATIC_NOTE);
     else printInfo("Static analysis: Trivy (dependencies, malicious packages, secrets)");
     printInfo("Artifacts:");
-    printInfo(`  .verity/standard.yaml: ${report.artifacts.standard ? "\u2713" : report.artifacts.legacyStandard ? `not yet (an old GATE.md Standard is at ${LEGACY_STANDARD_FILE}; verity init moves it)` : "missing"}`);
+    printInfo(`  .verity/standard.yaml: ${report.artifacts.standard ? report.standard.tracked ? "\u2713 (tracked in git \u2014 Verity keeps it machine-local now: verity standard untrack)" : "\u2713" : report.artifacts.legacyStandard ? `not yet (an old GATE.md Standard is at ${LEGACY_STANDARD_FILE}; verity init moves it)` : report.standard.version !== null ? `not on this machine (the team's v${report.standard.version} is on the service: verity standard pull)` : "missing"}`);
     printInfo(`  VERITY.md: ${report.artifacts.verityMd ? "\u2713" : "missing"}`);
     printInfo(
       `  .verity/memory/: ${report.memory.trackedFiles > 0 ? `${report.memory.trackedFiles} file(s) tracked in git \u2014 they appear in every diff` : report.memory.posture === "ignored" ? "machine-local \u2713" : "not tracked"}`
@@ -46528,10 +46776,10 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.35.3").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.35.4").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
   const isTelemetryHelper = actionCommand.name() === "headers" && actionCommand.parent?.name() === "telemetry";
   if (!isTelemetryHelper) {
-    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.3");
+    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.4");
   }
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {

package/data/skills/verity-init/SKILL.md

@@ -37,9 +37,15 @@ Use this one report:
 - **`hooks.versions.skew` is set** → tell the user first, in one line, with
   `hooks.versions.skew.remedy`.
 - **`artifacts.standard` or `artifacts.legacyStandard` is true** → this project
-  already has a Standard here. `legacyStandard` is an old GATE.md Standard at
-  `.gate/standard.yaml`: init moves it to `.verity/` first, then keeps it. Do not
-  ask question 2. Init keeps the Standard and sends no profile.
+  already has a Standard file here. `legacyStandard` is an old GATE.md Standard at
+  `.gate/standard.yaml`: init moves it to `.verity/` first. Do not ask question 2,
+  and init sends no profile. The file is this machine's working copy of the
+  team's Standard: init keeps it when it is the team's or the team has none yet
+  (then it shares it), and writes the team's here when the two differ (the file
+  is kept as a copy, `.verity/standard.<time>.yaml`). Reviews read the Standard
+  on the service either way.
+- **`standard.tracked` is true** → `.verity/standard.yaml` is tracked in git, from
+  an install older than 0.36.0. Question 3b applies.
 
 When both are false, also run:
 
@@ -119,6 +125,14 @@ say how many files)
 | `Yes, untrack it (recommended)` | The files stay on disk. Their removal from the index is staged for you to commit. Generated notes stop appearing in every diff. |
 | `No, not now` | Nothing changes. `verity memory track` records it as deliberate. |
 
+**3b — "Stop tracking `.verity/standard.yaml` in git?"** (only when
+`standard.tracked` is true)
+
+| Option | Description |
+|---|---|
+| `Yes, untrack it (recommended)` | Verity keeps the Standard on the service and writes the file on each machine (`verity init`, `verity standard pull`). The file stays on disk here; its removal from the index is staged for you to commit. Teammates lose the file on their next pull and get it back with `verity standard pull`. Reviews are not affected: they read the service. |
+| `No, not now` | Nothing changes. `verity doctor` keeps reporting it; `verity standard untrack` does it later. |
+
 **4 — "Untrack committed Verity state?"** (only when `trackedState.files > 0`;
 say how many files)
 
@@ -201,7 +215,7 @@ can sign the machine in to a different server, and the plugin follows that sign-
 One command. It asks nothing:
 
 ```bash
-verity init --yes [--standard <use|new>] --profile <send|skip> [--telemetry <on|off>] [--untrack-memory] [--untrack-state]
+verity init --yes [--standard <use|new>] --profile <send|skip> [--telemetry <on|off>] [--untrack-memory] [--untrack-standard] [--untrack-state]
 ```
 
 - Question 2a: `Use it` → `--standard use`. `Create a new one from a repo
@@ -210,7 +224,7 @@ verity init --yes [--standard <use|new>] --profile <send|skip> [--telemetry <on|
 - Question 2b: `--profile send` only when the user said yes and signed in.
   Otherwise `--profile skip`.
 - When question 2 was not asked, leave `--standard` and `--profile` off.
-- `--untrack-memory` and `--untrack-state` only on a yes.
+- `--untrack-memory`, `--untrack-standard` and `--untrack-state` only on a yes.
 - Question 5: `--telemetry on` on a yes, `--telemetry off` on a no. When it was
   not asked, leave `--telemetry` off.
 - Do not pass `--moments`. Without it, init keeps the moments the project has,
@@ -235,9 +249,10 @@ verity doctor --json
 
 Summarise from this report and from init's output, not from memory:
 
-- the Standard: **kept**, **adopted** from the team, **written** from the profile
-  (with its rules), or built from the catalogue. When it is a new one that
-  replaced the team's, say which version it replaced;
+- the Standard: **kept**, **adopted** from the team (when the file here differed,
+  say that the old file is kept as a copy and where), **written** from the
+  profile (with its rules), or built from the catalogue. When it is a new one
+  that replaced the team's, say which version it replaced;
 - the moments in effect. Say: "Verity reviews every turn, every commit and every
   push. To change it, run `verity config moments`, or just ask me.";
 - what init removed (superseded skills, duplicate hooks). Those skill folders are

package/data/skills/verity-setup/SKILL.md

@@ -82,10 +82,13 @@ Branch on the same `doctor` output:
 - **`artifacts.standard` is true and `phases.setup.done` is true** → the
   project already has a Standard, derived or adopted. Your job is the part the CLI
   leaves empty: propose 2–5 `custom_patterns` from the codebase, show them, and on
-  the user's agreement add them to `.verity/standard.yaml` and run
-  `verity standard push`. Do NOT rewrite the rest of the Standard — `standard push`
-  auto-versions, so a full re-synthesis lands as the version everybody is then
-  held to.
+  the user's agreement run `verity standard pull` first (the file here is this
+  machine's working copy and can be behind the team's), add them to
+  `.verity/standard.yaml`, and run `verity standard push`. Do NOT rewrite the rest
+  of the Standard — `standard push` auto-versions, so a full re-synthesis lands as
+  the version everybody is then held to. A push that answers "the team's Standard
+  is vN now" means someone changed it since the pull: pull again, re-apply the
+  patterns, push again.
 - **`artifacts.verityMd` is true and the user did not pass `--force`** → already
   configured. Say "Already configured. Run `/verity-setup --force` to
   reconfigure." and stop.
@@ -249,7 +252,11 @@ The `verity` CLI handles YAML→JSON conversion automatically:
 verity standard push
 ```
 
-This reads `.verity/standard.yaml`, converts it to JSON, and uploads it. Verify the output shows `version: 1`.
+This reads `.verity/standard.yaml`, converts it to JSON, and uploads it as the next
+version after the one this machine last saw. Verify the output shows `version: 1`.
+If it answers that the team's Standard moved, run `verity standard pull`, re-apply
+the changes to the pulled file, and push again. The file is machine-local: do not
+commit it.
 
 ### Seed the knowledge base
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.35.3",
+  "version": "0.35.4",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",