@codacy/verity-cli 0.35.3 → 0.35.5

package/bin/verity.js

@@ -14732,7 +14732,9 @@ var SECURITY_PATTERNS = [
   /(^|\/)pom\.xml$/,
   /(^|\/)gradle\.lockfile$/
 ];
-var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
+var PROD_SERVICE_ORIGIN = "https://server.verity.md";
+var LEGACY_PROD_SERVICE_ORIGIN = "https://ofcamwrjwrkazqvdchko.supabase.co";
+var PROD_SERVICE_URL = `${PROD_SERVICE_ORIGIN}/functions/v1`;
 var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
@@ -14823,6 +14825,36 @@ function rotateIfNeeded(file) {
 var import_promises = require("node:fs/promises");
 var import_node_path3 = require("node:path");
 var import_node_child_process2 = require("node:child_process");
+
+// src/lib/service-origin.ts
+var LEGACY = new URL(LEGACY_PROD_SERVICE_ORIGIN);
+function canonicalServiceUrl(raw) {
+  const trimmed = raw.trim();
+  let u;
+  try {
+    u = new URL(trimmed);
+  } catch {
+    return raw;
+  }
+  if (u.protocol !== LEGACY.protocol || u.host.toLowerCase() !== LEGACY.host || u.username !== "" || u.password !== "") {
+    return raw;
+  }
+  return trimmed.replace(/^https:\/\/[^/?#]+/i, PROD_SERVICE_ORIGIN);
+}
+function normalizeServiceUrl(raw) {
+  const trimmed = canonicalServiceUrl(raw).trim().replace(/\/+$/, "");
+  try {
+    const u = new URL(trimmed);
+    return `${u.protocol}//${u.host.toLowerCase()}${u.pathname.replace(/\/+$/, "")}`;
+  } catch {
+    return trimmed.toLowerCase();
+  }
+}
+function sameServiceUrl(a, b) {
+  return normalizeServiceUrl(a) === normalizeServiceUrl(b);
+}
+
+// src/lib/credentials.ts
 function globalCredentialsPath() {
   return `${process.env.HOME}/.verity/credentials`;
 }
@@ -14843,7 +14875,8 @@ function parseCredentialLine(line2) {
   const rest = idx === -1 ? line2 : line2.slice(idx);
   const tokenMatch = rest.match(TOKEN_RE);
   if (!tokenMatch) return null;
-  const serviceUrl = rest.match(/service_url:\s*(https?:\/\/\S+)/)?.[1];
+  const serviceUrlRaw = rest.match(/service_url:\s*(https?:\/\/\S+)/)?.[1];
+  const serviceUrl = serviceUrlRaw != null ? canonicalServiceUrl(serviceUrlRaw) : void 0;
   const userIdRaw = rest.match(/user_id:\s*(\d+)/)?.[1];
   const email = rest.match(/email:\s*(\S+)/)?.[1];
   return {
@@ -14865,7 +14898,7 @@ function encodeRemoteKey(remote) {
 function serializeCredential(remote, rec) {
   const key = encodeRemoteKey(remote);
   const out2 = [key ? `${key} token: ${rec.token}` : `token: ${rec.token}`];
-  if (rec.serviceUrl) out2.push(`service_url: ${rec.serviceUrl}`);
+  if (rec.serviceUrl) out2.push(`service_url: ${canonicalServiceUrl(rec.serviceUrl)}`);
   if (rec.userId != null) out2.push(`user_id: ${rec.userId}`);
   if (rec.email) out2.push(`email: ${rec.email}`);
   return out2.join(" ");
@@ -14938,7 +14971,7 @@ async function removeSupersededUserCredentials(loginServiceUrl, loginUserId) {
   let removed = 0;
   for (const line2 of content.split("\n")) {
     const parsed = parseCredentialLine(line2);
-    const superseded = parsed !== null && parsed.remote !== "" && parsed.rec.userId === loginUserId && (!parsed.rec.serviceUrl || parsed.rec.serviceUrl === loginServiceUrl);
+    const superseded = parsed !== null && parsed.remote !== "" && parsed.rec.userId === loginUserId && (!parsed.rec.serviceUrl || sameServiceUrl(parsed.rec.serviceUrl, loginServiceUrl));
     if (superseded) {
       removed++;
       continue;
@@ -14990,9 +15023,10 @@ function parseLocalCredentialFile(content) {
   const tokenMatch = content.match(/token:\s*((?:gate_|verity_)[a-f0-9]+)/);
   if (!tokenMatch) return null;
   const userIdMatch = content.match(/^user_id:\s*(\d+)/m);
+  const serviceUrl = content.match(/service_url:\s*(https?:\/\/\S+)/)?.[1];
   return {
     token: tokenMatch[1],
-    serviceUrl: content.match(/service_url:\s*(https?:\/\/\S+)/)?.[1],
+    serviceUrl: serviceUrl != null ? canonicalServiceUrl(serviceUrl) : void 0,
     userId: userIdMatch ? Number(userIdMatch[1]) : void 0,
     email: content.match(/^email:\s*(\S+)/m)?.[1]
   };
@@ -15306,15 +15340,7 @@ async function checkTokenPin(token, targetUrl) {
   if (!stored.serviceUrl) return { attach: false, reason: "unpinnable" };
   return normalizeUrl(stored.serviceUrl) === normalizeUrl(targetUrl) ? { attach: true } : { attach: false, reason: "mismatch", mintedFor: stored.serviceUrl };
 }
-function normalizeUrl(raw) {
-  const trimmed = raw.trim().replace(/\/+$/, "");
-  try {
-    const u = new URL(trimmed);
-    return `${u.protocol}//${u.host.toLowerCase()}${u.pathname.replace(/\/+$/, "")}`;
-  } catch {
-    return trimmed.toLowerCase();
-  }
-}
+var normalizeUrl = normalizeServiceUrl;
 function pinRefusalMessage(verdict, targetUrl) {
   if (verdict.reason === "unpinnable") {
     return `Refusing to send your Verity login to ${targetUrl}: this machine's credential does not record which service issued it, so it cannot be verified. Run "verity login" to re-issue it.`;
@@ -15325,7 +15351,7 @@ function pinRefusalMessage(verdict, targetUrl) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.35.3" : "dev";
+    return true ? "0.35.5" : "dev";
   } catch {
     return "dev";
   }
@@ -15530,7 +15556,7 @@ async function serviceUrlFromVerityMd() {
     const line2 = content.split("\n").find((l) => /\*{0,2}(?:url|service)\*{0,2}\s*:/i.test(l));
     if (line2) {
       const urlMatch = line2.match(/https:\/\/[^\s]+/);
-      if (urlMatch) return urlMatch[0];
+      if (urlMatch) return canonicalServiceUrl(urlMatch[0]);
     }
   } catch {
   }
@@ -18048,6 +18074,124 @@ function describeRemote(found) {
   return `version ${found.standard.version}, pushed${who} on ${when}${also}`;
 }
 
+// src/lib/json-file.ts
+var import_promises3 = require("node:fs/promises");
+var import_node_path12 = require("node:path");
+function jsonSemanticEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) {
+    return a === b;
+  }
+  const aIsArr = Array.isArray(a);
+  const bIsArr = Array.isArray(b);
+  if (aIsArr || bIsArr) {
+    if (!aIsArr || !bIsArr || a.length !== b.length) return false;
+    for (let i2 = 0; i2 < a.length; i2++) {
+      if (!jsonSemanticEqual(a[i2], b[i2])) return false;
+    }
+    return true;
+  }
+  const ao = a;
+  const bo = b;
+  const aKeys = Object.keys(ao).filter((k) => ao[k] !== void 0);
+  const bKeys = Object.keys(bo).filter((k) => bo[k] !== void 0);
+  if (aKeys.length !== bKeys.length) return false;
+  for (const k of aKeys) {
+    if (bo[k] === void 0) return false;
+    if (!jsonSemanticEqual(ao[k], bo[k])) return false;
+  }
+  return true;
+}
+function detectJsonIndent(raw) {
+  const m = raw.match(/\n([ \t]+)\S/);
+  return m ? m[1] : 2;
+}
+async function writeJsonFilePreservingStyle(file, value) {
+  let currentRaw = null;
+  try {
+    currentRaw = await (0, import_promises3.readFile)(file, "utf-8");
+  } catch {
+    currentRaw = null;
+  }
+  if (currentRaw !== null) {
+    try {
+      if (jsonSemanticEqual(JSON.parse(currentRaw), value)) return false;
+    } catch {
+    }
+  }
+  const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
+  const next = JSON.stringify(value, null, indent) + "\n";
+  if (next === currentRaw) return false;
+  await (0, import_promises3.mkdir)((0, import_node_path12.dirname)(file), { recursive: true });
+  await (0, import_promises3.writeFile)(file, next);
+  return true;
+}
+
+// src/lib/setup-state.ts
+var SETUP_STATE_FILE = `${VERITY_DIR}/setup.json`;
+var MOMENTS = ["stop", "pre-commit", "pre-push"];
+var INTENSITIES = ["lightweight", "balanced", "thorough"];
+var TELEMETRY = ["enabled", "declined", "deferred"];
+var VERSION = /^[0-9A-Za-z.+-]{1,32}$/;
+var stamp = (v) => typeof v === "string" && v.length > 0 && v.length <= 64;
+function setupStateFrom(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+  const r = raw;
+  if (r.version !== 1) return null;
+  const out2 = { version: 1 };
+  if (INTENSITIES.includes(r.intensity)) out2.intensity = r.intensity;
+  if (Array.isArray(r.moments) && r.moments.every((m) => MOMENTS.includes(m))) {
+    out2.moments = [...new Set(r.moments)];
+  }
+  if (TELEMETRY.includes(r.telemetry)) out2.telemetry = r.telemetry;
+  if (Number.isSafeInteger(r.declinedStandardVersion) && r.declinedStandardVersion >= 1) {
+    out2.declinedStandardVersion = r.declinedStandardVersion;
+  }
+  if (Number.isSafeInteger(r.standardVersion) && r.standardVersion >= 1) {
+    out2.standardVersion = r.standardVersion;
+  }
+  const init2 = r.init;
+  if (init2 && typeof init2 === "object" && stamp(init2.completed_at) && typeof init2.cli_version === "string" && VERSION.test(init2.cli_version)) {
+    out2.init = { completed_at: init2.completed_at, cli_version: init2.cli_version };
+  }
+  const plugin = r.pluginSetup;
+  if (plugin && typeof plugin === "object" && typeof plugin.version === "string" && VERSION.test(plugin.version) && stamp(plugin.completed_at)) {
+    out2.pluginSetup = { version: plugin.version, completed_at: plugin.completed_at };
+  }
+  if (r.wiring === "project") out2.wiring = "project";
+  return out2;
+}
+var MAX_SETUP_BYTES = 64 * 1024;
+function readSetupText() {
+  const read2 = readRegularFileInRoot(repoRoot(), SETUP_STATE_FILE, MAX_SETUP_BYTES);
+  return read2.ok ? read2.content : null;
+}
+async function readSetupState() {
+  const raw = readSetupText();
+  if (raw === null) return null;
+  try {
+    return setupStateFrom(JSON.parse(raw));
+  } catch {
+    return null;
+  }
+}
+async function writeSetupState(patch) {
+  const current = await readSetupState() ?? { version: 1 };
+  const next = { ...current, ...patch, version: 1 };
+  const raw = readSetupText();
+  if (raw !== null) {
+    try {
+      if (jsonSemanticEqual(JSON.parse(raw), next)) return next;
+    } catch {
+    }
+  }
+  const text3 = JSON.stringify(next, null, raw !== null ? detectJsonIndent(raw) : 2) + "\n";
+  if (!replaceInRoot(projectPath(VERITY_DIR), "setup.json", text3)) {
+    throw new Error(`Could not write ${SETUP_STATE_FILE}: it is a link, or ${VERITY_DIR} is not a folder of this repository`);
+  }
+  return next;
+}
+
 // src/lib/catalogue-conversion.ts
 var PACK_ID2 = /^[a-z][a-z0-9-]{0,39}$/;
 var MAX_PACKS2 = 12;
@@ -18078,6 +18222,12 @@ function count(v) {
 }
 
 // src/lib/push-setup.ts
+function latestFromConflict(result) {
+  const err2 = result.errorBody?.error;
+  const raw = err2 && typeof err2 === "object" ? err2.latest_version : void 0;
+  const n2 = typeof raw === "string" && /^[1-9][0-9]*$/.test(raw) ? Number(raw) : typeof raw === "number" ? raw : NaN;
+  return Number.isSafeInteger(n2) && n2 >= 1 ? n2 : null;
+}
 async function pushStandard(globals, opts = {}) {
   const lines = [];
   const token = await resolveToken(globals.token);
@@ -18113,11 +18263,15 @@ async function pushStandard(globals, opts = {}) {
       if (result.ok) {
         standardVersion = result.data.version;
         lines.push(`Standard pushed to Verity (v${result.data.version}) \u2713`);
+        if (Number.isSafeInteger(standardVersion) && standardVersion >= 1) {
+          await writeSetupState({ standardVersion }).catch(() => {
+          });
+        }
         const converted = conversionLine(result.data);
         if (converted) lines.push(converted);
       } else if (opts.expectedLatest !== void 0 && result.http_status === 409 && result.error.startsWith("STANDARD_EXISTS")) {
         lines.push("The service has a Standard now that this run did not see, so nothing was pushed over it.");
-        return { lines, standardVersion: null, conflict: true };
+        return { lines, standardVersion: null, conflict: true, latest: latestFromConflict(result) };
       } else {
         lines.push(`Could not push the Standard: ${terminalText(result.error, 300)} \u2014 run "verity standard push" later.`);
       }
@@ -18285,7 +18439,7 @@ async function finishSplitLogin(opts) {
   if (read2.status === "invalid") fail2("invalid", `the pending sign-in is unusable (${read2.reason}) \u2014 run "verity login --start" again`, true);
   if (read2.status === "expired") fail2("expired", 'the code expired before it was approved \u2014 run "verity login --start" again', true);
   const pending = read2.record;
-  if (pending.service_url !== opts.serviceUrl) {
+  if (!sameServiceUrl(pending.service_url, opts.serviceUrl)) {
     fail2(
       "service_changed",
       `the sign-in was started for ${pending.service_url}, but this machine now resolves ${opts.serviceUrl} \u2014 run "verity login --start" again`,
@@ -18646,61 +18800,6 @@ function registerLogoutCommand(program2) {
 // src/lib/hooks.ts
 var import_promises4 = require("node:fs/promises");
 var import_node_path13 = require("node:path");
-
-// src/lib/json-file.ts
-var import_promises3 = require("node:fs/promises");
-var import_node_path12 = require("node:path");
-function jsonSemanticEqual(a, b) {
-  if (a === b) return true;
-  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) {
-    return a === b;
-  }
-  const aIsArr = Array.isArray(a);
-  const bIsArr = Array.isArray(b);
-  if (aIsArr || bIsArr) {
-    if (!aIsArr || !bIsArr || a.length !== b.length) return false;
-    for (let i2 = 0; i2 < a.length; i2++) {
-      if (!jsonSemanticEqual(a[i2], b[i2])) return false;
-    }
-    return true;
-  }
-  const ao = a;
-  const bo = b;
-  const aKeys = Object.keys(ao).filter((k) => ao[k] !== void 0);
-  const bKeys = Object.keys(bo).filter((k) => bo[k] !== void 0);
-  if (aKeys.length !== bKeys.length) return false;
-  for (const k of aKeys) {
-    if (bo[k] === void 0) return false;
-    if (!jsonSemanticEqual(ao[k], bo[k])) return false;
-  }
-  return true;
-}
-function detectJsonIndent(raw) {
-  const m = raw.match(/\n([ \t]+)\S/);
-  return m ? m[1] : 2;
-}
-async function writeJsonFilePreservingStyle(file, value) {
-  let currentRaw = null;
-  try {
-    currentRaw = await (0, import_promises3.readFile)(file, "utf-8");
-  } catch {
-    currentRaw = null;
-  }
-  if (currentRaw !== null) {
-    try {
-      if (jsonSemanticEqual(JSON.parse(currentRaw), value)) return false;
-    } catch {
-    }
-  }
-  const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
-  const next = JSON.stringify(value, null, indent) + "\n";
-  if (next === currentRaw) return false;
-  await (0, import_promises3.mkdir)((0, import_node_path12.dirname)(file), { recursive: true });
-  await (0, import_promises3.writeFile)(file, next);
-  return true;
-}
-
-// src/lib/hooks.ts
 var VERITY_STOP_HOOK = {
   type: "command",
   command: "verity analyze",
@@ -19270,26 +19369,43 @@ function readProjectConfig() {
       cfg = { ...rest, turn_review_refused: refused2 };
     }
   }
+  if (cfg.formal === "off" && cfg.path) {
+    const refused2 = repoControlledRefusal(cfg.path);
+    if (refused2 === "unverified") {
+      cfg = { ...cfg, formal_off_unverified: true };
+    } else if (refused2) {
+      const { formal: _dropped, ...rest } = cfg;
+      cfg = { ...rest, formal_off_refused: refused2 };
+    }
+  }
   return cfg;
 }
-function turnReviewRefusalMessage(reason) {
+function formalOffUnverifiedNote() {
+  return 'off-unverified: .verity/config.json says "off" and git could not confirm that the repository does not control it, so the "off" is kept and the formal check does not run';
+}
+function formalOffRefusalMessage(reason) {
   switch (reason) {
     case "tracked":
-      return '.verity/config.json is tracked in git, so its turn_review "off" is ignored (a repository cannot switch the review off) \u2014 untrack it with: git rm --cached .verity/config.json';
+      return '.verity/config.json is tracked in git, so its formal "off" is ignored (a repository cannot switch formal verification off). To make your "off" count, untrack the file: git rm --cached .verity/config.json';
     case "symlink":
-      return '.verity/config.json is reached through a symlink, so its turn_review "off" is ignored';
-    case "unverified":
-      return 'could not confirm with git that .verity/config.json is untracked, so its turn_review "off" is ignored';
+      return '.verity/config.json is reached through a symlink, so its formal "off" is ignored';
   }
 }
-function formalRefusalMessage(reason) {
+function formalSetting(cfg, env = process.env) {
+  const fromEnv = env.VERITY_GIT_MOMENT_FORMAL;
+  if (fromEnv === "off" || fromEnv === "push") return { state: fromEnv, source: "env" };
+  if (cfg.formal === "off") return { state: "off", source: "config" };
+  if (cfg.formal === "push") return { state: "push", source: "config" };
+  return { state: "push", source: "default" };
+}
+function turnReviewRefusalMessage(reason) {
   switch (reason) {
     case "tracked":
-      return ".verity/config.json is tracked in git, so its formal setting is ignored (a repository cannot switch formal verification on) \u2014 untrack it with: git rm --cached .verity/config.json";
+      return '.verity/config.json is tracked in git, so its turn_review "off" is ignored (a repository cannot switch the review off) \u2014 untrack it with: git rm --cached .verity/config.json';
     case "symlink":
-      return ".verity/config.json is reached through a symlink, so its formal setting is ignored";
+      return '.verity/config.json is reached through a symlink, so its turn_review "off" is ignored';
     case "unverified":
-      return "could not confirm with git that .verity/config.json is untracked, so its formal setting is ignored";
+      return 'could not confirm with git that .verity/config.json is untracked, so its turn_review "off" is ignored';
   }
 }
 function writeProjectConfig(patch) {
@@ -21094,13 +21210,15 @@ var import_node_child_process9 = require("node:child_process");
 var import_node_fs24 = require("node:fs");
 var VERITY_GITIGNORE_MARKER = "# Verity \u2014 machine-local state.";
 var SETTINGS_LOCAL_IGNORE_ENTRY = ".claude/settings.local.json";
+var BLOCK_COMMENT = [
+  "# Verity \u2014 machine-local state. Everything in .verity/ is ignored. The Standard",
+  "# is held by the Verity service (verity standard pull writes it here), and the",
+  "# knowledge graph under .verity/memory/ is rebuilt from it. Committing either",
+  "# puts generated files in every diff and pull request."
+];
 var VERITY_GITIGNORE_BLOCK = [
-  "# Verity \u2014 machine-local state. Everything in .verity/ is ignored except the",
-  "# shared standard, which is meant to be committed. The knowledge graph under",
-  "# .verity/memory/ is machine-local too: the service rebuilds it, and committing",
-  "# it puts generated notes in every diff and pull request.",
+  ...BLOCK_COMMENT,
   ".verity/*",
-  "!.verity/standard.yaml",
   SETTINGS_LOCAL_IGNORE_ENTRY,
   ""
 ].join("\n");
@@ -21125,9 +21243,11 @@ var SUPERSEDED_MEMORY_LINES = /* @__PURE__ */ new Set([
   ".verity/memory/log.md",
   SUPERSEDED_COMMENT
 ]);
-function isIgnored3(path) {
+var SUPERSEDED_STANDARD_LINE = "!.verity/standard.yaml";
+var OLD_COMMENT_LINES = /* @__PURE__ */ new Set([SUPERSEDED_COMMENT, ...MEMORY_COMMENT]);
+function isIgnored3(path, opts = {}) {
   try {
-    (0, import_node_child_process9.execSync)(`git check-ignore -q -- "${path}"`, { stdio: "pipe" });
+    (0, import_node_child_process9.execSync)(`git check-ignore -q ${opts.noIndex ? "--no-index " : ""}-- "${path}"`, { stdio: "pipe" });
     return true;
   } catch (err2) {
     return err2.status === 1 ? false : null;
@@ -21135,10 +21255,9 @@ function isIgnored3(path) {
 }
 function semanticsHold() {
   const snapshot = isIgnored3(".verity/.snapshot/__probe__");
-  const standard = isIgnored3(".verity/standard.yaml");
   const futureState = isIgnored3(".verity/.__probe-future-state__");
-  if (snapshot === null || standard === null || futureState === null) return null;
-  return snapshot === true && futureState === true && standard === false;
+  if (snapshot === null || futureState === null) return null;
+  return snapshot === true && futureState === true;
 }
 function memoryPosture() {
   const ignored = isIgnored3(".verity/memory/domain/__probe__.md");
@@ -21155,6 +21274,22 @@ function committedMemoryFiles() {
     return [];
   }
 }
+var STANDARD_PATH = ".verity/standard.yaml";
+function standardPosture() {
+  const ignored = isIgnored3(STANDARD_PATH, { noIndex: true });
+  if (ignored === null) return "unknown";
+  return ignored ? "ignored" : "committable";
+}
+function committedStandardFile() {
+  try {
+    return (0, import_node_child_process9.execSync)(`git ls-files -z -- ${STANDARD_PATH}`, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).split("\0").filter(Boolean).length > 0;
+  } catch {
+    return false;
+  }
+}
 var OPT_OUT_COMMENT_LINES = /* @__PURE__ */ new Set([
   MEMORY_OPT_OUT_MARKER,
   '# Remove these three lines (or run "verity memory untrack") to stop tracking it.'
@@ -21172,6 +21307,19 @@ function fenceMemoryLines(lines) {
   }
   return out2;
 }
+function fenceStandardLines(lines) {
+  const out2 = [];
+  for (const line2 of lines) {
+    const trimmed = line2.trim();
+    if (trimmed.startsWith(VERITY_GITIGNORE_MARKER) && trimmed !== BLOCK_COMMENT[0]) {
+      out2.push(...BLOCK_COMMENT);
+      continue;
+    }
+    if (trimmed === SUPERSEDED_STANDARD_LINE || OLD_COMMENT_LINES.has(trimmed)) continue;
+    out2.push(line2);
+  }
+  return out2;
+}
 function ensureVerityGitignore() {
   let content = "";
   try {
@@ -21183,9 +21331,11 @@ function ensureVerityGitignore() {
   const lines = content.split("\n");
   const needsRepair = lines.some((l) => BREAKING_ENTRIES.has(l.trim()));
   const hasSupersededMemory = hasMarker && !optedOut && lines.some((l) => SUPERSEDED_MEMORY_LINES.has(l.trim()));
+  const hasSupersededStandard = hasMarker && lines.some((l) => l.trim() === SUPERSEDED_STANDARD_LINE);
   const memoryIsCommitted = hasSupersededMemory && committedMemoryFiles().length > 0;
+  const standardIsCommitted = hasSupersededStandard && committedStandardFile();
   const verified = (result) => semanticsHold() === false ? "conflict" : result;
-  if (hasMarker && !needsRepair && !hasSupersededMemory) return verified("covered");
+  if (hasMarker && !needsRepair && !hasSupersededMemory && !hasSupersededStandard) return verified("covered");
   if (!hasMarker && !needsRepair) {
     if (semanticsHold() === true) return "covered";
   }
@@ -21194,6 +21344,9 @@ function ensureVerityGitignore() {
     if (needsRepair) {
       next = next.map((l) => BREAKING_ENTRIES.has(l.trim()) ? ".verity/*" : l);
     }
+    if (hasSupersededStandard && !standardIsCommitted) {
+      next = fenceStandardLines(next);
+    }
     if (hasSupersededMemory && !memoryIsCommitted) {
       next = fenceMemoryLines(next);
     }
@@ -21204,7 +21357,7 @@ function ensureVerityGitignore() {
     }
     if (text3 !== content) (0, import_node_fs24.writeFileSync)(".gitignore", text3);
     return verified(
-      memoryIsCommitted ? "memory-tracked" : hasSupersededMemory ? "memory-fenced" : needsRepair ? "repaired" : "added"
+      memoryIsCommitted ? "memory-tracked" : standardIsCommitted ? "standard-tracked" : hasSupersededMemory ? "memory-fenced" : hasSupersededStandard ? "standard-fenced" : needsRepair ? "repaired" : "added"
     );
   } catch {
     return "failed";
@@ -21219,7 +21372,7 @@ function untrackMemory() {
     return "failed";
   }
 }
-function writeFencedBlock() {
+function writeFencedBlock(fence) {
   let content = "";
   try {
     content = (0, import_node_fs24.readFileSync)(".gitignore", "utf-8");
@@ -21227,7 +21380,8 @@ function writeFencedBlock() {
   }
   const hasMarker = content.includes(VERITY_GITIGNORE_MARKER);
   let lines = content.split("\n").map((l) => BREAKING_ENTRIES.has(l.trim()) ? ".verity/*" : l);
-  lines = fenceMemoryLines(lines);
+  if (fence.standard) lines = fenceStandardLines(lines);
+  if (fence.memory) lines = fenceMemoryLines(lines);
   let text3 = lines.join("\n");
   if (!hasMarker) {
     const sep7 = text3 === "" ? "" : text3.endsWith("\n") ? "\n" : "\n\n";
@@ -21254,7 +21408,7 @@ function fenceMemory() {
     } catch {
     }
   };
-  if (!writeFencedBlock()) return { untracked: 0, ok: false };
+  if (!writeFencedBlock({ memory: true })) return { untracked: 0, ok: false };
   if (memoryPosture() !== "ignored") {
     restore();
     return { untracked: 0, ok: false };
@@ -21266,6 +21420,34 @@ function fenceMemory() {
   }
   return { untracked: tracked, ok: true };
 }
+function untrackStandard() {
+  let original = null;
+  try {
+    original = (0, import_node_fs24.readFileSync)(".gitignore", "utf-8");
+  } catch {
+    original = null;
+  }
+  const restore = () => {
+    try {
+      if (original === null) (0, import_node_fs24.rmSync)(".gitignore", { force: true });
+      else (0, import_node_fs24.writeFileSync)(".gitignore", original);
+    } catch {
+    }
+  };
+  if (!writeFencedBlock({ standard: true })) return { ok: false, why: "gitignore" };
+  if (standardPosture() !== "ignored") {
+    restore();
+    return { ok: false, why: "still-committable" };
+  }
+  if (!committedStandardFile()) return { ok: true, untracked: false };
+  try {
+    (0, import_node_child_process9.execSync)(`git rm --cached --quiet -- ${STANDARD_PATH}`, { stdio: "pipe" });
+    return { ok: true, untracked: true };
+  } catch {
+    restore();
+    return { ok: false, why: "index" };
+  }
+}
 function memoryOptOut() {
   try {
     return (0, import_node_fs24.readFileSync)(".gitignore", "utf-8").includes(MEMORY_OPT_OUT_MARKER);
@@ -21295,18 +21477,23 @@ function committedVerityState() {
   } catch {
     return [];
   }
-  return out2.split("\0").filter(Boolean).filter((p) => p !== ".verity/standard.yaml" && !p.startsWith(".verity/memory/"));
+  return out2.split("\0").filter(Boolean).filter((p) => p !== STANDARD_PATH && !p.startsWith(".verity/memory/"));
 }
 function untrackVerityState() {
   const tracked = committedVerityState();
   if (tracked.length === 0) return "none";
+  const standardWasTracked = committedStandardFile();
   try {
     (0, import_node_child_process9.execSync)("git rm -r --cached --quiet -- .verity", { stdio: "pipe" });
-    const keeps = [".verity/standard.yaml"];
-    if (memoryPosture() === "committable") keeps.push(".verity/memory");
-    for (const keep of keeps) {
+    if (standardWasTracked) {
+      try {
+        (0, import_node_child_process9.execSync)(`git add -f -- ${STANDARD_PATH}`, { stdio: "pipe" });
+      } catch {
+      }
+    }
+    if (memoryPosture() === "committable") {
       try {
-        (0, import_node_child_process9.execSync)(`git add -- "${keep}"`, { stdio: "pipe" });
+        (0, import_node_child_process9.execSync)("git add -- .verity/memory", { stdio: "pipe" });
       } catch {
       }
     }
@@ -21827,8 +22014,13 @@ var CLAUDE_MD_PROSE = [
   "  `verity standard generate`. It works only for a project with no Standard on the",
   "  service. It writes `.verity/repo-profile.json` and sends nothing without consent.",
   "  Show the user that file. Run the command again with `--yes` only after they agree.",
-  "- The rules themselves: edit `.verity/standard.yaml`, then run `verity standard push`."
+  "- The rules themselves: run `verity standard pull` first (the file here can be behind",
+  "  the team's), edit `.verity/standard.yaml`, then run `verity standard push`."
 ].join("\n");
+var CLAUDE_MD_PROSE_PRE_PULL = CLAUDE_MD_PROSE.replace(
+  /- The rules themselves: run `verity standard pull` first \(the file here can be behind\n  the team's\), edit `\.verity\/standard\.yaml`, then run `verity standard push`\.$/,
+  "- The rules themselves: edit `.verity/standard.yaml`, then run `verity standard push`."
+);
 var CLAUDE_MD_PROSE_PRE_VERBOSE = [
   "## Project Memory",
   "",
@@ -22466,6 +22658,7 @@ function stripKnownProse(interior) {
   const trimmed = interior.replace(/^\n+/, "");
   for (const prose of [
     CLAUDE_MD_PROSE,
+    CLAUDE_MD_PROSE_PRE_PULL,
     CLAUDE_MD_PROSE_PRE_VERBOSE,
     CLAUDE_MD_PROSE_PRE_SETTINGS,
     CLAUDE_MD_PROSE_PRE_STDIN,
@@ -25531,6 +25724,8 @@ async function generateStandard(opts) {
   } catch (err2) {
     return { status: "failed", reason: `the Standard is on the service (v${version}) but could not be written here: ${terminalText(err2.message, 200)}` };
   }
+  await writeSetupState({ standardVersion: version }).catch(() => {
+  });
   return {
     status: "created",
     version,
@@ -25711,68 +25906,6 @@ async function runGenerate(globals, opts) {
 var import_node_fs37 = require("node:fs");
 var import_yaml6 = __toESM2(require_dist());
 
-// src/lib/setup-state.ts
-var SETUP_STATE_FILE = `${VERITY_DIR}/setup.json`;
-var MOMENTS = ["stop", "pre-commit", "pre-push"];
-var INTENSITIES = ["lightweight", "balanced", "thorough"];
-var TELEMETRY = ["enabled", "declined", "deferred"];
-var VERSION = /^[0-9A-Za-z.+-]{1,32}$/;
-var stamp = (v) => typeof v === "string" && v.length > 0 && v.length <= 64;
-function setupStateFrom(raw) {
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
-  const r = raw;
-  if (r.version !== 1) return null;
-  const out2 = { version: 1 };
-  if (INTENSITIES.includes(r.intensity)) out2.intensity = r.intensity;
-  if (Array.isArray(r.moments) && r.moments.every((m) => MOMENTS.includes(m))) {
-    out2.moments = [...new Set(r.moments)];
-  }
-  if (TELEMETRY.includes(r.telemetry)) out2.telemetry = r.telemetry;
-  if (Number.isSafeInteger(r.declinedStandardVersion) && r.declinedStandardVersion >= 1) {
-    out2.declinedStandardVersion = r.declinedStandardVersion;
-  }
-  const init2 = r.init;
-  if (init2 && typeof init2 === "object" && stamp(init2.completed_at) && typeof init2.cli_version === "string" && VERSION.test(init2.cli_version)) {
-    out2.init = { completed_at: init2.completed_at, cli_version: init2.cli_version };
-  }
-  const plugin = r.pluginSetup;
-  if (plugin && typeof plugin === "object" && typeof plugin.version === "string" && VERSION.test(plugin.version) && stamp(plugin.completed_at)) {
-    out2.pluginSetup = { version: plugin.version, completed_at: plugin.completed_at };
-  }
-  if (r.wiring === "project") out2.wiring = "project";
-  return out2;
-}
-var MAX_SETUP_BYTES = 64 * 1024;
-function readSetupText() {
-  const read2 = readRegularFileInRoot(repoRoot(), SETUP_STATE_FILE, MAX_SETUP_BYTES);
-  return read2.ok ? read2.content : null;
-}
-async function readSetupState() {
-  const raw = readSetupText();
-  if (raw === null) return null;
-  try {
-    return setupStateFrom(JSON.parse(raw));
-  } catch {
-    return null;
-  }
-}
-async function writeSetupState(patch) {
-  const current = await readSetupState() ?? { version: 1 };
-  const next = { ...current, ...patch, version: 1 };
-  const raw = readSetupText();
-  if (raw !== null) {
-    try {
-      if (jsonSemanticEqual(JSON.parse(raw), next)) return next;
-    } catch {
-    }
-  }
-  const text3 = JSON.stringify(next, null, raw !== null ? detectJsonIndent(raw) : 2) + "\n";
-  if (!replaceInRoot(projectPath(VERITY_DIR), "setup.json", text3)) {
-    throw new Error(`Could not write ${SETUP_STATE_FILE}: it is a link, or ${VERITY_DIR} is not a folder of this repository`);
-  }
-  return next;
-}
-
 // src/commands/init/rules.ts
 async function projectLabel(token, serviceUrl, verbose) {
   try {
@@ -25917,6 +26050,8 @@ async function pullStandard(globals, opts = {}) {
     } catch {
     }
     if (local && typeof local === "object" && !Array.isArray(local) && sameStandard(local, remote.standard.content)) {
+      await writeSetupState({ standardVersion: version, declinedStandardVersion: void 0 }).catch(() => {
+      });
       return { status: "same", version };
     }
     try {
@@ -25927,7 +26062,7 @@ async function pullStandard(globals, opts = {}) {
   }
   try {
     const outcome = await adoptRemoteSetup(remote, { serviceUrl: url.data, projectId, expectStandard: readBytes });
-    await writeSetupState({ declinedStandardVersion: void 0 }).catch(() => {
+    await writeSetupState({ standardVersion: version, declinedStandardVersion: void 0 }).catch(() => {
     });
     return { status: "pulled", version, backup, notes: outcome.notes };
   } catch (err2) {
@@ -26146,8 +26281,13 @@ function registerStandardCommands(program2) {
     for (const path of result.written) printInfo(`  ${terminalText(path, 200)} \u2713`);
     for (const note of result.notes) printWarn(`  ${terminalText(note, 300)}`);
     if (opts.push) {
-      const pushed = await pushStandard(globals);
+      const token = await resolveToken(globals.token);
+      const expected = token.ok && urlResult.ok ? await expectedLatestForPush(globals, token.data.token, urlResult.data) : void 0;
+      const pushed = await pushStandard(globals, expected !== void 0 ? { expectedLatest: expected } : {});
       for (const line2 of pushed.lines) printInfo(`  ${terminalText(line2, 600)}`);
+      if (pushed.conflict) {
+        printWarn(`  The team's Standard is v${pushed.latest ?? "?"} now. Run verity standard pull to use it here, or verity standard push --force to replace it with this file.`);
+      }
       if (pushed.standardVersion !== null) {
         await correctVerityMdVersion({
           standard: result.standard,
@@ -26161,7 +26301,7 @@ function registerStandardCommands(program2) {
   standard.command("generate").description("Have Verity write project-specific rules from a profile of this repository (asks before sending it)").option("--yes", `Send the profile without asking (you have read ${PROFILE_FILE})`).option("--status", "Print whether the service writes project rules for this project: on, off, unsupported or unknown. Sends nothing.").action((opts) => runGenerate(program2.opts(), opts));
   standard.command("pull").description("Write the team's Standard on the service into .verity/standard.yaml (keeps a copy of yours)").action(() => runPull(program2.opts()));
   standard.command("catalogue [pack]").description("What each review pack holds: every pack, or the rules of one (core, api, data, \u2026)").option("--json", "Print the catalogue as JSON").action((pack, opts) => runCatalogue(program2.opts(), pack, opts));
-  standard.command("push").description("Upload the project Standard to the service").option("--file <path>", "Path to standard YAML file", STANDARD_FILE).option("--created-by <name>", "Who created this version", "claude-code").action(async (opts) => {
+  standard.command("push").description("Upload the project Standard to the service, as the next version after the one this machine last saw").option("--file <path>", "Path to standard YAML file", STANDARD_FILE).option("--created-by <name>", "Who created this version", "claude-code").option("--force", "Upload even when the team's Standard moved since this machine last pulled or pushed it").action(async (opts) => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
     if (!tokenResult.ok) {
@@ -26184,19 +26324,33 @@ function registerStandardCommands(program2) {
       process.exit(1);
     }
     if (upload.warning) printWarn(terminalText(upload.warning, 600));
+    const expected = opts.force ? void 0 : await expectedLatestForPush(globals, tokenResult.data.token, urlResult.data);
     const result = await apiRequest({
       method: "POST",
       path: "/standards",
       serviceUrl: urlResult.data,
       token: tokenResult.data.token,
-      body: { content: upload.content, created_by: upload.createdBy },
+      body: {
+        content: upload.content,
+        created_by: upload.createdBy,
+        ...expected !== void 0 ? { expected_latest: expected } : {}
+      },
       verbose: globals.verbose
     });
     if (!result.ok) {
+      if (expected !== void 0 && result.http_status === 409 && result.error.startsWith("STANDARD_EXISTS")) {
+        const latest = latestFromConflict(result);
+        printError(latest !== null ? `The team's Standard is v${latest} now${expected !== null ? `, and this machine last saw v${expected}` : ", and this machine saw none"}. Nothing was pushed. Run "verity standard pull" first (it keeps a copy of your file), put your changes into the pulled file, then push again. To replace v${latest} with this file as it is: verity standard push --force` : `The service has no Standard for this project, but this machine last saw v${expected}. Nothing was pushed. To share this file as v1: verity standard push --force`);
+        process.exit(1);
+      }
       printError(terminalText(result.error, 300));
       process.exit(1);
     }
     printInfo(`Standard uploaded (version ${versionText(result.data.version)})`);
+    if (Number.isSafeInteger(result.data.version) && result.data.version >= 1) {
+      await writeSetupState({ standardVersion: result.data.version }).catch(() => {
+      });
+    }
     const converted = conversionLine(result.data);
     if (converted) {
       printInfo(converted);
@@ -26204,6 +26358,7 @@ function registerStandardCommands(program2) {
     }
     printJson(result.data);
   });
+  standard.command("untrack").description(`Stop tracking ${STANDARD_FILE} in git: Verity keeps it on each machine, and reviews read the service`).action(() => runUntrack());
   standard.command("get").description("Get the current Standard from the service").option("--version <n>", "Specific version number").option("--resolved", "Show it as a review reads it: the catalogue packs in `extends` expanded into patterns").action(async (opts) => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
@@ -26278,6 +26433,32 @@ function registerStandardCommands(program2) {
 function versionText(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? String(value) : "?";
 }
+async function expectedLatestForPush(globals, token, serviceUrl) {
+  const state = await readSetupState();
+  if (state?.standardVersion !== void 0) return state.standardVersion;
+  const remote = await fetchRemoteSetup({ token, serviceUrl, verbose: globals.verbose });
+  if (remote.status === "found") {
+    printInfo(`This machine had no record of the team's Standard. It is v${remote.standard.version} on the service, and this push replaces it.`);
+    return remote.standard.version;
+  }
+  if (remote.status === "none") return null;
+  printWarn(`Could not read the team's Standard from the service (${terminalText(remote.reason, 200)}), so this push is not conditional on it.`);
+  return void 0;
+}
+function runUntrack() {
+  const wasTracked = committedStandardFile();
+  const result = untrackStandard();
+  if (!result.ok) {
+    printError(result.why === "gitignore" ? "Could not write .gitignore. Nothing changed." : result.why === "still-committable" ? `Git still lets ${STANDARD_FILE} be committed after the .gitignore change, so nothing was untracked and .gitignore is as it was. A nested .gitignore re-includes it: check with git check-ignore -v --no-index ${STANDARD_FILE}` : `Could not remove ${STANDARD_FILE} from the git index. .gitignore is as it was.`);
+    process.exit(1);
+  }
+  if (!wasTracked) {
+    printInfo(`${STANDARD_FILE} is not tracked in git. Git ignores it from here on; nothing else changed.`);
+    return;
+  }
+  printInfo(`Untracked ${STANDARD_FILE} (staged). The file stays on disk here. Commit to finish.`);
+  printInfo("Teammates lose the file on their next pull: `verity standard pull` (or `verity init`) writes the team's Standard back for them. Reviews read the Standard on the service, so none is affected.");
+}
 var UPLOAD_MAX_BYTES = 512 * 1024;
 function readUploadFile(file) {
   const root = realOrSelf(repoRoot());
@@ -26439,11 +26620,15 @@ function registerConfigCommands(program2) {
     }
     printInfo(pluginMode ? "It applies from the next turn." : "It applies from the next Claude Code session (Claude Code reads hooks when a session starts).");
   });
-  config.command("formal [state]").description('Get or set formal verification at push: "push" or "off" (needs Lean \u2014 verity lean status)').action((state) => {
+  config.command("formal [state]").description('Get or set formal verification at push: "push" (the default) or "off" (needs Lean \u2014 verity lean status)').action((state) => {
     if (state === void 0) {
       const cfg = readProjectConfig();
-      process.stdout.write((cfg.formal === "push" ? "push" : "off") + "\n");
-      if (cfg.formal_refused) printWarn(formalRefusalMessage(cfg.formal_refused));
+      const setting = formalSetting(cfg);
+      process.stdout.write(setting.state + "\n");
+      if (cfg.formal_off_refused && setting.source === "default") printWarn(formalOffRefusalMessage(cfg.formal_off_refused));
+      else if (setting.source === "default") printInfo("On by default. To turn it off for this checkout, run: verity config formal off");
+      if (setting.source === "env") printInfo("Set by VERITY_GIT_MOMENT_FORMAL in this environment");
+      if (cfg.formal_off_unverified && setting.source === "config") printWarn(formalOffUnverifiedNote());
       return;
     }
     if (state !== "push" && state !== "off") {
@@ -26451,13 +26636,18 @@ function registerConfigCommands(program2) {
       process.exit(1);
     }
     writeProjectConfig({ formal: state === "push" ? "push" : "off" });
-    const refused2 = state === "push" ? readProjectConfig().formal_refused : void 0;
-    if (refused2) {
-      printWarn(`Formal verification at push: still off \u2014 ${formalRefusalMessage(refused2)}`);
+    const after = readProjectConfig();
+    const offRefused = state === "off" && formalSetting(after).state === "push" ? after.formal_off_refused : void 0;
+    if (offRefused) {
+      printWarn(`Formal verification at push: still on \u2014 ${formalOffRefusalMessage(offRefused)}`);
       return;
     }
-    printInfo(state === "push" ? "Formal verification at push: on for this checkout (Lean must be installed \u2014 verity lean status)" : "Formal verification at push: off");
+    printInfo(state === "push" ? "Formal verification at push: on for this checkout (Lean must be installed \u2014 verity lean status)" : "Formal verification at push: off for this checkout");
     if (state === "push") printInfo("The phase runs with your Verity login (a push without one is skipped and says so: not-logged-in)");
+    const env = process.env.VERITY_GIT_MOMENT_FORMAL;
+    if ((env === "off" || env === "push") && env !== state) {
+      printWarn(`VERITY_GIT_MOMENT_FORMAL=${env} in this environment overrides the file while it is set`);
+    }
   });
   config.command("verbose [state]").description('Get or set the line Verity prints when a turn has nothing new to review: "on" or "off" (the default)').action((state) => {
     if (state === void 0) {
@@ -29616,11 +29806,11 @@ async function readStopHookStdin() {
   return new Promise((resolve10) => {
     const chunks = [];
     let size = 0;
-    let settled = false;
+    let settled2 = false;
     let timer;
     const settle = (result) => {
-      if (settled) return;
-      settled = true;
+      if (settled2) return;
+      settled2 = true;
       if (timer) clearTimeout(timer);
       process.stdin.off("data", onData);
       process.stdin.off("end", onEnd);
@@ -34352,15 +34542,23 @@ function renderNodeMarkdown(candidate, nodeId, createdAt) {
   ].join("\n");
   return fm;
 }
-async function runSeed(opts) {
-  if (!(0, import_node_fs53.existsSync)(STANDARD_FILE)) {
-    return { created: 0, existing: 0, failed: 0, skipped: "no_standard", candidates: [] };
+async function standardForSeed(opts) {
+  if ((0, import_node_fs53.existsSync)(STANDARD_FILE)) {
+    const raw = readRepoFile(STANDARD_FILE);
+    if (raw === null) return null;
+    try {
+      const parsed = (0, import_yaml9.parse)(raw);
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    } catch {
+      return null;
+    }
   }
-  let standardDoc;
-  try {
-    const raw = await (0, import_promises11.readFile)(STANDARD_FILE, "utf-8");
-    standardDoc = (0, import_yaml9.parse)(raw);
-  } catch {
+  const remote = await fetchRemoteSetup({ serviceUrl: opts.serviceUrl, token: opts.token, verbose: opts.verbose });
+  return remote.status === "found" ? remote.standard.content : null;
+}
+async function runSeed(opts) {
+  const standardDoc = await standardForSeed(opts);
+  if (standardDoc === null) {
     return { created: 0, existing: 0, failed: 0, skipped: "no_standard", candidates: [] };
   }
   const knowledgeSpec = standardDoc.knowledge_spec ?? {};
@@ -34487,9 +34685,8 @@ async function memoryManifest(run4) {
   try {
     await ensureMemoryDir();
     const seedMarker = (0, import_node_path43.join)(VERITY_DIR, ".seeded");
-    const hasStandard = (0, import_node_fs54.existsSync)(STANDARD_FILE);
     const alreadyTried = (0, import_node_fs54.existsSync)(seedMarker);
-    if (hasStandard && !alreadyTried) {
+    if (!alreadyTried) {
       const preManifest = await buildManifest();
       if (preManifest.nodes.length === 0) {
         try {
@@ -36958,7 +37155,7 @@ function runAsync(tc, cwd, args2, timeoutMs) {
     let stdout = "";
     let stderr = "";
     let timedOut = false;
-    let settled = false;
+    let settled2 = false;
     const kill = () => {
       try {
         if (posix && child.pid) process.kill(-child.pid, "SIGKILL");
@@ -36977,8 +37174,8 @@ function runAsync(tc, cwd, args2, timeoutMs) {
       if (stderr.length < MAX) stderr += d.toString("utf-8");
     });
     const finish = (ok, message) => {
-      if (settled) return;
-      settled = true;
+      if (settled2) return;
+      settled2 = true;
       clearTimeout(timer);
       if (ok) resolve10({ ok: true, stdout, stderr: "", durationMs: Date.now() - started, timedOut: false });
       else resolve10({ ok: false, stdout, stderr: stderr || message || "", durationMs: Date.now() - started, timedOut });
@@ -37487,16 +37684,138 @@ function resumeInterruptedInstall(opts) {
   return shouldStartBackgroundInstall({ formal: opts.formal, env, free: opts.free }).start && startBackgroundInstall({ cli: opts.cli, env, run: opts.run });
 }
 
+// src/lib/prove/formal-default.ts
+var import_node_fs64 = require("node:fs");
+var import_node_path52 = require("node:path");
+var NOTICE_MARKER = ".formal-default-notice";
+var LEAN_MARKER = ".formal-lean-checked";
+function markerPath3(name2) {
+  return (0, import_node_path52.join)(verityHome(), name2);
+}
+function writeMarker(name2, now) {
+  try {
+    (0, import_node_fs64.mkdirSync)(verityHome(), { recursive: true, mode: 448 });
+    (0, import_node_fs64.writeFileSync)(markerPath3(name2), now.toISOString() + "\n");
+  } catch {
+  }
+}
+function formalDefaultNoticeDue() {
+  return !(0, import_node_fs64.existsSync)(markerPath3(NOTICE_MARKER));
+}
+function recordFormalDefaultNotice(now = /* @__PURE__ */ new Date()) {
+  writeMarker(NOTICE_MARKER, now);
+}
+var BLOCKED_LINES = {
+  "opted-out": () => "VERITY_NO_LEAN=1 is set, so Verity does not download Lean 4. Without Lean 4, a push skips the formal check.",
+  ci: () => "This is a CI environment, so Verity does not download Lean 4 (VERITY_LEAN=1 allows it). Without Lean 4, a push skips the formal check.",
+  disk: (detail2) => `Lean 4 needs more disk space${detail2 ? ` (${detail2})` : ""}. Until Lean 4 is installed, a push skips the formal check. Free some space, then run: verity lean install`,
+  "no-release": () => "Lean 4 has no release for this machine, so a push skips the formal check."
+};
+function leanLine(lean) {
+  switch (lean.kind) {
+    case "started":
+      return "Lean 4 (about 800 MB) is downloading in the background. To see the progress, run: verity lean status";
+    case "downloading":
+      return "Lean 4 is downloading in the background. To see the progress, run: verity lean status";
+    case "failed":
+      return "The Lean 4 download could not start. Until Lean 4 is installed, a push skips the formal check. To install it, run: verity lean install";
+    case "previous-failed":
+      return "The last Lean 4 download failed. Until Lean 4 is installed, a push skips the formal check. To try again, run: verity lean install";
+    case "blocked":
+      return BLOCKED_LINES[lean.why](lean.detail);
+    case "installed":
+    case "unknown":
+      return null;
+  }
+}
+function formalDefaultUserMessage(lean, offRefused) {
+  const aboutLean = leanLine(lean);
+  return [
+    ...offRefused ? [`Verity: ${formalOffRefusalMessage(offRefused)}`] : [],
+    "Verity: formal verification at push is now on by default.",
+    "At a push, Verity can check a small Lean model of the riskiest changed function and replay a counterexample on the real code. For the replay, the source of that function goes to the Verity service.",
+    "Only a reproduced bug can block a push.",
+    ...aboutLean ? [aboutLean] : [],
+    "To turn it off for this project, run: verity config formal off"
+  ].join("\n");
+}
+var AGENT_LINE = "Formal verification at push is on by default in this project. At a push, Verity can model one changed function in Lean, so a push can take longer. A block from it means that the counterexample was reproduced on the real code. If the user wants it off, the command is `verity config formal off`.";
+function settled(lean) {
+  return lean.kind === "installed" || lean.kind === "blocked" && lean.why === "no-release";
+}
+var LEAN_RECHECK_MS = 7 * 24 * 60 * 60 * 1e3;
+function settledRecently(now) {
+  try {
+    const at = Date.parse((0, import_node_fs64.readFileSync)(markerPath3(LEAN_MARKER), "utf-8").trim());
+    return Number.isFinite(at) && now.getTime() - at >= 0 && now.getTime() - at < LEAN_RECHECK_MS;
+  } catch {
+    return false;
+  }
+}
+function leanAtStart(opts, now, probeAgain) {
+  const { env } = opts;
+  if (env.VERITY_NO_LEAN === "1") return { kind: "blocked", why: "opted-out" };
+  if (env.CI && env.VERITY_LEAN !== "1") return { kind: "blocked", why: "ci" };
+  const state = readInstallState(env);
+  if (state?.state === "failed") return { kind: "previous-failed" };
+  if (state?.state === "done") return { kind: "installed" };
+  if (state?.state === "running") return installRunning(env) ? { kind: "downloading" } : { kind: "unknown" };
+  if (!probeAgain && settledRecently(now)) return { kind: "unknown" };
+  const lean = probeAndStart(opts);
+  if (settled(lean)) writeMarker(LEAN_MARKER, now);
+  return lean;
+}
+function probeAndStart(opts) {
+  const { env } = opts;
+  const d = shouldStartBackgroundInstall({ formal: "push", env, free: opts.free });
+  if (d.start) {
+    const started = startBackgroundInstall({ cli: opts.cli, env, ...opts.run ? { run: opts.run } : {} });
+    return started ? { kind: "started" } : { kind: "failed" };
+  }
+  switch (d.why) {
+    case "installed":
+      return { kind: "installed" };
+    case "running":
+      return { kind: "downloading" };
+    case "opted-out":
+    case "ci":
+    case "no-release":
+      return { kind: "blocked", why: d.why };
+    case "disk":
+      return { kind: "blocked", why: "disk", ...d.detail ? { detail: d.detail } : {} };
+    case "formal-off":
+      return { kind: "unknown" };
+  }
+}
+function formalAtSessionStart(opts) {
+  const env = opts.env ?? process.env;
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const none = { userMsg: null, agentLine: null, leanStarted: false };
+  const setting = formalSetting(opts.cfg, env);
+  if (setting.state !== "push") return none;
+  const noticeDue = setting.source === "default" && formalDefaultNoticeDue();
+  let lean;
+  try {
+    lean = leanAtStart({ cli: opts.cli, env, ...opts.free !== void 0 ? { free: opts.free } : {}, ...opts.run ? { run: opts.run } : {} }, now, noticeDue);
+  } catch (err2) {
+    lean = { kind: "failed" };
+    logEvent("formal_default_lean_failed", { error: String(err2?.message ?? err2).slice(0, 200) });
+  }
+  const leanStarted = lean.kind === "started";
+  if (!noticeDue) return { ...none, leanStarted };
+  return { userMsg: formalDefaultUserMessage(lean, opts.cfg.formal_off_refused), agentLine: AGENT_LINE, leanStarted };
+}
+
 // src/commands/baseline.ts
-var import_node_fs66 = require("node:fs");
-var import_node_path54 = require("node:path");
+var import_node_fs67 = require("node:fs");
+var import_node_path55 = require("node:path");
 
 // src/lib/skew-notice.ts
-var import_node_fs64 = require("node:fs");
-var import_node_path52 = require("node:path");
+var import_node_fs65 = require("node:fs");
+var import_node_path53 = require("node:path");
 var MARKER2 = ".skew-notice.json";
-function markerPath3() {
-  return (0, import_node_path52.join)(verityHome(), MARKER2);
+function markerPath4() {
+  return (0, import_node_path53.join)(verityHome(), MARKER2);
 }
 function today(now) {
   const y = now.getFullYear();
@@ -37506,7 +37825,7 @@ function today(now) {
 }
 function skewNoticeDue(skew, now = /* @__PURE__ */ new Date()) {
   try {
-    const seen = JSON.parse((0, import_node_fs64.readFileSync)(markerPath3(), "utf-8"));
+    const seen = JSON.parse((0, import_node_fs65.readFileSync)(markerPath4(), "utf-8"));
     return !(seen.global === skew.global && seen.hooks === skew.hooks && seen.day === today(now));
   } catch {
     return true;
@@ -37514,15 +37833,15 @@ function skewNoticeDue(skew, now = /* @__PURE__ */ new Date()) {
 }
 function recordSkewNotice(skew, now = /* @__PURE__ */ new Date()) {
   try {
-    (0, import_node_fs64.mkdirSync)(verityHome(), { recursive: true, mode: 448 });
-    (0, import_node_fs64.writeFileSync)(markerPath3(), JSON.stringify({ global: skew.global, hooks: skew.hooks, day: today(now) }) + "\n");
+    (0, import_node_fs65.mkdirSync)(verityHome(), { recursive: true, mode: 448 });
+    (0, import_node_fs65.writeFileSync)(markerPath4(), JSON.stringify({ global: skew.global, hooks: skew.hooks, day: today(now) }) + "\n");
   } catch {
   }
 }
 
 // src/lib/project-skills.ts
-var import_node_fs65 = require("node:fs");
-var import_node_path53 = require("node:path");
+var import_node_fs66 = require("node:fs");
+var import_node_path54 = require("node:path");
 var PROJECT_SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -37548,14 +37867,14 @@ var LEGACY_SKILL_NAMES = [
 var ALL = [...PROJECT_SKILL_NAMES, ...LEGACY_SKILL_NAMES];
 function staleProjectSkills() {
   const root = projectPath(".claude/skills");
-  if (!(0, import_node_fs65.existsSync)(root)) return [];
-  return ALL.filter((name2) => (0, import_node_fs65.existsSync)((0, import_node_path53.join)(root, name2)));
+  if (!(0, import_node_fs66.existsSync)(root)) return [];
+  return ALL.filter((name2) => (0, import_node_fs66.existsSync)((0, import_node_path54.join)(root, name2)));
 }
 function removeProjectSkills() {
   const root = projectPath(".claude/skills");
   const removed = [];
   for (const name2 of staleProjectSkills()) {
-    (0, import_node_fs65.rmSync)((0, import_node_path53.join)(root, name2), { recursive: true, force: true });
+    (0, import_node_fs66.rmSync)((0, import_node_path54.join)(root, name2), { recursive: true, force: true });
     removed.push(name2);
   }
   return removed;
@@ -37590,7 +37909,7 @@ function registerBaselineCommands(program2) {
       const loginWarning = "Until they have, do not send them to run `verity login` in a terminal: that runs the global one, which can sign this machine in to a different server.";
       const skewNote = !skew ? null : skewLoud ? `Before anything else, including /verity:init's questions, tell the user their global \`verity\` is ${skew.global}, the hooks run ${skew.hooks}, and \`${skew.remedy}\` fixes it. ${loginWarning}` : `The user's global \`verity\` is ${skew.global} and the hooks run ${skew.hooks}; \`${skew.remedy}\` fixes it. They were already told today, so do not repeat it unprompted \u2014 mention it only where it matters, such as before suggesting a \`verity\` command for their terminal. ${loginWarning}`;
       if (!verityConfigured()) {
-        if (isMachineStore((0, import_node_path54.join)(repoRoot(), VERITY_DIR))) process.exit(0);
+        if (isMachineStore((0, import_node_path55.join)(repoRoot(), VERITY_DIR))) process.exit(0);
         const how = isPluginInvocation() ? "Tell the user to run /verity:init \u2014 they type it; you cannot invoke it." : "Tell the user to run `verity init` in their terminal.";
         const lines = [
           `Verity is installed but this project is not set up yet, so the quality gate will not review anything here. ${how}`
@@ -37624,17 +37943,20 @@ function registerBaselineCommands(program2) {
       let memoryMsg = null;
       let memoryAgentLine = null;
       const memoryNotice = projectPath(`${VERITY_DIR}/.memory-fence-notice`);
-      if (realStart && !(0, import_node_fs66.existsSync)(memoryNotice)) {
+      if (realStart && !(0, import_node_fs67.existsSync)(memoryNotice)) {
         const trackedGraph = memoryOptOut() ? 0 : committedMemoryFiles().length;
         if (trackedGraph > 0) {
           memoryMsg = `Verity: this project commits its knowledge base (${trackedGraph} files under .verity/memory/), so Verity's generated notes show up in every diff and pull request. Run \`verity memory untrack\` to keep them on disk but out of git, or \`verity memory track\` to keep committing them on purpose.`;
           memoryAgentLine = `This project has ${trackedGraph} knowledge-graph files tracked in git under .verity/memory/. As of Verity 0.32.6 the graph is machine-local by default \u2014 it is rebuilt from the service, and committing it puts generated notes in every pull request. If the user wants that stopped, run \`verity memory untrack\` for them: it keeps every file on disk and stages their removal from the index, so they only need to commit \u2014 and their teammates' working copies will vanish on the next pull and re-sync from the service, which is expected. If they would rather keep committing it, \`verity memory track\` records that and nothing will offer again.`;
           try {
-            (0, import_node_fs66.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
+            (0, import_node_fs67.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
           } catch {
           }
         }
       }
+      const formalStart = realStart ? formalAtSessionStart({ cli: process.argv[1], cfg: readProjectConfig() }) : null;
+      const formalMsg = formalStart?.userMsg ?? null;
+      const formalAgentLine = formalStart?.agentLine ?? null;
       if (isPluginInvocation() && realStart) {
         const installed2 = activePluginVersion();
         const state = await readSetupState().catch(() => null);
@@ -37658,10 +37980,11 @@ function registerBaselineCommands(program2) {
           }
         }
         if (memoryAgentLine) notices.push(memoryAgentLine);
+        if (formalAgentLine) notices.push(formalAgentLine);
         if (notices.length > 0 || skewMsg) {
           process.stdout.write(
             JSON.stringify({
-              ...userMsg || skewMsg || memoryMsg ? { systemMessage: [skewMsg, userMsg, memoryMsg].filter(Boolean).join("\n") } : {},
+              ...userMsg || skewMsg || memoryMsg || formalMsg ? { systemMessage: [skewMsg, userMsg, memoryMsg, formalMsg].filter(Boolean).join("\n") } : {},
               hookSpecificOutput: {
                 hookEventName: "SessionStart",
                 additionalContext: notices.join("\n")
@@ -37669,17 +37992,20 @@ function registerBaselineCommands(program2) {
             }) + "\n"
           );
           if (skew && skewMsg) recordSkewNotice(skew);
+          if (formalMsg) recordFormalDefaultNotice();
         }
-      } else if (memoryMsg) {
+      } else if (memoryMsg || formalMsg) {
+        const agentLines = [memoryAgentLine, formalAgentLine].filter(Boolean).join("\n");
         process.stdout.write(
           JSON.stringify({
-            systemMessage: memoryMsg,
+            systemMessage: [memoryMsg, formalMsg].filter(Boolean).join("\n"),
             hookSpecificOutput: {
               hookEventName: "SessionStart",
-              ...memoryAgentLine ? { additionalContext: memoryAgentLine } : {}
+              ...agentLines ? { additionalContext: agentLines } : {}
             }
           }) + "\n"
         );
+        if (formalMsg) recordFormalDefaultNotice();
       }
       if (deferredToPlugin("baseline capture", session ?? null)) {
         process.exit(0);
@@ -37687,7 +38013,7 @@ function registerBaselineCommands(program2) {
       const authForScope = await resolveToken(program2.opts().token);
       const scopeToken = authForScope.ok ? authForScope.data.token : void 0;
       if (authForScope.ok && pullsAtSessionStart(authForScope.data, source2)) spawnBackgroundPull();
-      if (source2 !== "compact") resumeInterruptedInstall({ cli: process.argv[1], formal: readProjectConfig().formal });
+      if (source2 !== "compact") resumeInterruptedInstall({ cli: process.argv[1], formal: formalSetting(readProjectConfig()).state });
       const scopeSession = session;
       const result = captureBaseline({ sessionId: sessionScopeKey(scopeToken, scopeSession), source: source2 });
       logEvent("baseline_capture", {
@@ -37733,31 +38059,31 @@ function hookSource(value) {
 }
 
 // src/commands/review.ts
-var import_node_fs67 = require("node:fs");
-var import_node_path55 = require("node:path");
+var import_node_fs68 = require("node:fs");
+var import_node_path56 = require("node:path");
 function containReviewPaths(paths, base) {
   const kept = [];
   const refused2 = [];
   for (const raw of paths) {
-    const candidate = (0, import_node_path55.isAbsolute)(raw) ? relativeForm(base, raw) : raw;
+    const candidate = (0, import_node_path56.isAbsolute)(raw) ? relativeForm(base, raw) : raw;
     if (candidate === "" || resolveInside(base, candidate) === null) refused2.push(raw);
     else kept.push(candidate);
   }
   return { kept, refused: refused2 };
 }
 function relativeForm(base, abs) {
-  const lexical = (0, import_node_path55.relative)(base, abs);
-  if (!(lexical === ".." || lexical.startsWith(`..${import_node_path55.sep}`) || (0, import_node_path55.isAbsolute)(lexical))) return lexical;
+  const lexical = (0, import_node_path56.relative)(base, abs);
+  if (!(lexical === ".." || lexical.startsWith(`..${import_node_path56.sep}`) || (0, import_node_path56.isAbsolute)(lexical))) return lexical;
   try {
-    let dir = (0, import_node_path55.dirname)(abs);
-    let rest = (0, import_node_path55.basename)(abs);
-    while (!(0, import_node_fs67.existsSync)(dir)) {
-      const up = (0, import_node_path55.dirname)(dir);
+    let dir = (0, import_node_path56.dirname)(abs);
+    let rest = (0, import_node_path56.basename)(abs);
+    while (!(0, import_node_fs68.existsSync)(dir)) {
+      const up = (0, import_node_path56.dirname)(dir);
       if (up === dir) return lexical;
-      rest = (0, import_node_path55.join)((0, import_node_path55.basename)(dir), rest);
+      rest = (0, import_node_path56.join)((0, import_node_path56.basename)(dir), rest);
       dir = up;
     }
-    return (0, import_node_path55.relative)((0, import_node_fs67.realpathSync)(base), (0, import_node_path55.join)((0, import_node_fs67.realpathSync)(dir), rest));
+    return (0, import_node_path56.relative)((0, import_node_fs68.realpathSync)(base), (0, import_node_path56.join)((0, import_node_fs68.realpathSync)(dir), rest));
   } catch {
     return lexical;
   }
@@ -37796,7 +38122,7 @@ async function runReview(opts, globals) {
   const changedFiles = changed.kept;
   const analyzable = filterAnalyzable(allFiles);
   const securityFiles = filterSecurity(allFiles);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs67.existsSync)(f) || resolveFile(f) !== null);
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs68.existsSync)(f) || resolveFile(f) !== null);
   const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
@@ -37867,12 +38193,12 @@ async function runReview(opts, globals) {
 }
 
 // src/commands/guard.ts
-var import_node_fs69 = require("node:fs");
-var import_node_path58 = require("node:path");
+var import_node_fs70 = require("node:fs");
+var import_node_path59 = require("node:path");
 
 // src/lib/vendored.ts
-var import_node_fs68 = require("node:fs");
-var import_node_path56 = require("node:path");
+var import_node_fs69 = require("node:fs");
+var import_node_path57 = require("node:path");
 var INSTALLED_SKILL = /^\.claude\/skills\/(verity-[a-z0-9-]+)\/(.+)$/;
 function dataDirOrNull() {
   try {
@@ -37887,7 +38213,7 @@ function shippedSkillFile(path, dataDir = dataDirOrNull()) {
   const [, skill, rel] = m;
   if (rel.split("/").some((seg) => seg === ".." || seg === ".")) return null;
   try {
-    return (0, import_node_fs68.readFileSync)((0, import_node_path56.join)(dataDir, "skills", skill, rel), "utf8");
+    return (0, import_node_fs69.readFileSync)((0, import_node_path57.join)(dataDir, "skills", skill, rel), "utf8");
   } catch {
     return null;
   }
@@ -37926,10 +38252,10 @@ function summarizeFindings(response) {
     return out2;
   });
 }
-function finishOneShot(settled) {
-  if (!settled) return { status: "pending" };
-  if (!settled.ok) return { status: "failed" };
-  const r = settled.response;
+function finishOneShot(settled2) {
+  if (!settled2) return { status: "pending" };
+  if (!settled2.ok) return { status: "failed" };
+  const r = settled2.response;
   return {
     status: "arrived",
     ...typeof r.agent_attestation === "string" ? { attestation: r.agent_attestation } : {},
@@ -37940,13 +38266,13 @@ function finishOneShot(settled) {
 async function runAgentReview(options) {
   const now = options.now ?? Date.now;
   const remaining = () => options.deadlineMs - (now() - options.startedAt);
-  let settled = null;
+  let settled2 = null;
   const oneShotDone = options.oneShot.then(
     (outcome) => {
-      settled = outcome;
+      settled2 = outcome;
     },
     () => {
-      settled = { ok: false };
+      settled2 = { ok: false };
     }
   );
   if (remaining() < MIN_AGENT_START_MS) return { kind: "skipped", reason: "not enough time left after prep" };
@@ -37968,7 +38294,7 @@ async function runAgentReview(options) {
     if (turn >= MAX_TURNS || remaining() < MIN_TURN_MS) break;
     const results = await options.executeTools(calls);
     let oneShot;
-    const current = settled;
+    const current = settled2;
     if (current && sentOneShot === "pending") {
       oneShot = current.ok ? { status: "arrived", findings: summarizeFindings(current.response) } : { status: "failed" };
       sentOneShot = oneShot.status;
@@ -37983,13 +38309,13 @@ async function runAgentReview(options) {
     calls = next.data.calls ?? [];
     done = next.data.done;
   }
-  if (!settled) {
+  if (!settled2) {
     const wait = Math.max(0, remaining() - FINISH_TIMEOUT_MS);
     await Promise.race([oneShotDone, new Promise((resolve10) => setTimeout(resolve10, wait))]);
   }
   const finished = await options.http.post(
     "/agent-review/finish",
-    { state, session_id: options.sessionId, one_shot: finishOneShot(settled) },
+    { state, session_id: options.sessionId, one_shot: finishOneShot(settled2) },
     FINISH_TIMEOUT_MS
   );
   if (!finished.ok) {
@@ -38016,7 +38342,7 @@ function effortProfile(root, env = process.env) {
 }
 
 // src/lib/prove/auto.ts
-var import_node_path57 = require("node:path");
+var import_node_path58 = require("node:path");
 var import_node_crypto21 = require("node:crypto");
 
 // src/lib/prove/grounding.ts
@@ -40244,7 +40570,7 @@ async function runFormalPhase(input) {
     modelName = gen.name;
     const rel = `${AUTO_MODELS_DIR}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path57.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path58.join)(root, rel);
     progress.model = { name: gen.name, file: rel, rounds: round };
     progress.step = "check";
     report = await deps.check(root, abs);
@@ -40393,7 +40719,7 @@ async function runFormalPhase(input) {
   return done({
     status: "checked",
     target,
-    model: { name: modelName, file: (0, import_node_path57.relative)(root, (0, import_node_path57.join)(root, modelFile)), rounds },
+    model: { name: modelName, file: (0, import_node_path58.relative)(root, (0, import_node_path58.join)(root, modelFile)), rounds },
     properties: report.properties,
     findings
   });
@@ -40470,7 +40796,7 @@ async function generateAndCheck(root, req, opts) {
     }
     const rel = `${dir}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path57.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path58.join)(root, rel);
     const report = await opts.deps.check(root, abs);
     const abstracts = report.header?.abstracts ?? [];
     const stray = abstracts.find((a) => !headerFiles.has(a.file)) ?? (abstracts[0] && abstracts[0].file !== req.file ? abstracts[0] : void 0);
@@ -40879,7 +41205,7 @@ var WRITERS_BUDGET_MS = 1500;
 var EXCERPT_MAX_LINES2 = 30;
 var VENDORED_READ_MAX_BYTES = 256 * 1024;
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path58.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path59.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
   return new Promise((resolve10) => {
@@ -40887,11 +41213,11 @@ function readPreToolUseStdin() {
       if (process.stdin.isTTY) return resolve10(empty);
       const chunks = [];
       let timer;
-      let settled = false;
+      let settled2 = false;
       const onData = (c) => chunks.push(c);
       const settle = (value) => {
-        if (settled) return;
-        settled = true;
+        if (settled2) return;
+        settled2 = true;
         if (timer) clearTimeout(timer);
         process.stdin.removeListener("data", onData);
         process.stdin.removeListener("end", onEnd);
@@ -40924,7 +41250,7 @@ function readPreToolUseStdin() {
 }
 function readIterMap() {
   try {
-    const raw = JSON.parse((0, import_node_fs69.readFileSync)(GUARD_ITER_FILE, "utf-8"));
+    const raw = JSON.parse((0, import_node_fs70.readFileSync)(GUARD_ITER_FILE, "utf-8"));
     if (raw && typeof raw === "object") {
       if (typeof raw.moment === "string" && typeof raw.count === "number") {
         return { [raw.moment]: raw.count };
@@ -40944,10 +41270,10 @@ function readIter(moment) {
 }
 function writeIter(moment, count2) {
   try {
-    (0, import_node_fs69.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs70.mkdirSync)(VERITY_DIR, { recursive: true });
     const map = readIterMap();
     map[moment] = count2;
-    (0, import_node_fs69.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+    (0, import_node_fs70.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
   } catch {
   }
 }
@@ -40957,10 +41283,10 @@ function resetIter(moment) {
     if (!(moment in map)) return;
     delete map[moment];
     if (Object.keys(map).length === 0) {
-      if ((0, import_node_fs69.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs69.unlinkSync)(GUARD_ITER_FILE);
+      if ((0, import_node_fs70.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs70.unlinkSync)(GUARD_ITER_FILE);
     } else {
-      (0, import_node_fs69.mkdirSync)(VERITY_DIR, { recursive: true });
-      (0, import_node_fs69.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+      (0, import_node_fs70.mkdirSync)(VERITY_DIR, { recursive: true });
+      (0, import_node_fs70.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
     }
   } catch {
   }
@@ -41037,7 +41363,7 @@ function ofThisChange(response, sentFiles) {
 function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedIntent, coverageTelemetry) {
   const analyzable = filterAnalyzable(files);
   const securityFiles = filterSecurity(files);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs69.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs70.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
   const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const trigger = moment === "pre-commit" ? "hook:pre-commit" : "hook:pre-push";
   const requestBody2 = {
@@ -41210,11 +41536,14 @@ function startAgentReview(input) {
   };
   return run4().catch((err2) => ({ kind: "failed", reason: String(err2?.message ?? err2) }));
 }
+function formalOffUnverifiedLine(moment, config) {
+  if (moment !== "pre-push" || !config.formal_off_unverified) return "";
+  const setting = formalSetting(config);
+  return setting.state === "off" && setting.source === "config" ? `formal: skipped (${formalOffUnverifiedNote()})` : "";
+}
 function startFormalPhase(input) {
   if (input.moment !== "pre-push") return null;
-  const env = process.env.VERITY_GIT_MOMENT_FORMAL;
-  if (env === "off") return null;
-  if (env !== "push" && readProjectConfig().formal !== "push") return null;
+  if (formalSetting(input.config).state !== "push") return null;
   const profile = effortProfile(input.root);
   const deadlineAt = input.hookStartedAt + profile.pushDeadlineMs - 1e4;
   const ig = loadVerityIgnore();
@@ -41420,7 +41749,8 @@ async function runGuard(opts, globals) {
     requestBody: requestBody2,
     oneShot
   });
-  const formal = startFormalPhase({ moment, files, root: frame.worktreeRoot, hookStartedAt, frame, range, auth: { serviceUrl: urlResult.data, token: tokenResult.data.token } });
+  const projectConfig = moment === "pre-push" ? readProjectConfig() : null;
+  const formal = projectConfig ? startFormalPhase({ moment, files, root: frame.worktreeRoot, hookStartedAt, frame, range, auth: { serviceUrl: urlResult.data, token: tokenResult.data.token }, config: projectConfig }) : null;
   const result = await oneShot;
   const agentOutcome = agent ? await agent : null;
   const formalOutcome = formal ? await formal : null;
@@ -41472,7 +41802,7 @@ async function runGuard(opts, globals) {
   const link2 = viewUrl ? ` \u2014 ${viewUrl}` : "";
   const covLine = `${coverageSummary(coverage)} in ${reviewSecs}s`;
   const agentLine = describeAgentOutcome(agentOutcome);
-  const formalLine = describeFormalOutcome(formalOutcome);
+  const formalLine = describeFormalOutcome(formalOutcome) || (projectConfig ? formalOffUnverifiedLine(moment, projectConfig) : "");
   const covDetail = [coverageBlock(coverage), agentLine, formalLine].filter(Boolean).join("\n  ");
   const witnessed = [...codeDelta.files.map((f) => f.path), ...agentVerdict?.witnessed_files ?? []];
   mergeFormalFindings(response, formalOutcome, files);
@@ -41713,7 +42043,7 @@ function registerIgnoreCommand(program2) {
 
 // src/commands/waive.ts
 var import_node_crypto23 = require("node:crypto");
-var import_node_fs70 = require("node:fs");
+var import_node_fs71 = require("node:fs");
 function registerWaiveCommand(program2) {
   program2.command("waive <pattern-id>").description("Record an accepted-risk disposition for an open finding (voids when the file changes)").option("--file <path>", "File the finding is anchored to, REPO-RELATIVE (recommended \u2014 narrows the waive)").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action(async (patternId, opts) => {
     const globals = program2.opts();
@@ -41742,7 +42072,7 @@ function registerWaiveCommand(program2) {
     if (opts.file) {
       body2.file = opts.file;
       try {
-        body2.file_sha256 = (0, import_node_crypto23.createHash)("sha256").update((0, import_node_fs70.readFileSync)(opts.file)).digest("hex");
+        body2.file_sha256 = (0, import_node_crypto23.createHash)("sha256").update((0, import_node_fs71.readFileSync)(opts.file)).digest("hex");
       } catch {
         printError(`Cannot read ${opts.file} \u2014 run from the repo root, or omit --file to waive by pattern.`);
         process.exit(1);
@@ -41768,15 +42098,15 @@ function registerWaiveCommand(program2) {
 
 // src/commands/init/index.ts
 var import_node_os15 = require("node:os");
-var import_node_fs79 = require("node:fs");
+var import_node_fs80 = require("node:fs");
 var import_promises17 = require("node:fs/promises");
-var import_node_path68 = require("node:path");
+var import_node_path69 = require("node:path");
 
 // src/lib/init-changes.ts
 var import_node_crypto24 = require("node:crypto");
-var import_node_fs71 = require("node:fs");
+var import_node_fs72 = require("node:fs");
 var import_node_os12 = require("node:os");
-var import_node_path59 = require("node:path");
+var import_node_path60 = require("node:path");
 var REPO_FILES = [
   ".gitignore",
   "CLAUDE.md",
@@ -41791,7 +42121,7 @@ var SKILLS_DIR = ".claude/skills";
 var MAX_HASH_BYTES = 2 * 1024 * 1024;
 var MAX_TREE_ENTRIES = 2e3;
 function userSettingsDir(env) {
-  return env.CLAUDE_CONFIG_DIR || (0, import_node_path59.join)(env.HOME || (0, import_node_os12.homedir)(), ".claude");
+  return env.CLAUDE_CONFIG_DIR || (0, import_node_path60.join)(env.HOME || (0, import_node_os12.homedir)(), ".claude");
 }
 function fingerprint(root, rel) {
   const opened = openRegularInRoot(root, rel);
@@ -41799,7 +42129,7 @@ function fingerprint(root, rel) {
     if (opened.reason === "missing") return null;
     if (opened.reason === "symlink") {
       try {
-        return `link:${(0, import_node_fs71.readlinkSync)((0, import_node_path59.join)(root, rel))}`;
+        return `link:${(0, import_node_fs72.readlinkSync)((0, import_node_path60.join)(root, rel))}`;
       } catch {
         return "link";
       }
@@ -41818,7 +42148,7 @@ function fingerprint(root, rel) {
 }
 function treeFingerprint(root, dirRel) {
   try {
-    if (!(0, import_node_fs71.lstatSync)((0, import_node_path59.join)(root, dirRel)).isDirectory()) return fingerprint(root, dirRel);
+    if (!(0, import_node_fs72.lstatSync)((0, import_node_path60.join)(root, dirRel)).isDirectory()) return fingerprint(root, dirRel);
   } catch {
     return null;
   }
@@ -41826,7 +42156,7 @@ function treeFingerprint(root, dirRel) {
   const walk2 = (rel) => {
     let names2;
     try {
-      names2 = (0, import_node_fs71.readdirSync)((0, import_node_path59.join)(root, rel)).sort();
+      names2 = (0, import_node_fs72.readdirSync)((0, import_node_path60.join)(root, rel)).sort();
     } catch {
       return;
     }
@@ -41835,7 +42165,7 @@ function treeFingerprint(root, dirRel) {
       const relPath = `${rel}/${name2}`;
       let st;
       try {
-        st = (0, import_node_fs71.lstatSync)((0, import_node_path59.join)(root, relPath));
+        st = (0, import_node_fs72.lstatSync)((0, import_node_path60.join)(root, relPath));
       } catch {
         continue;
       }
@@ -41859,8 +42189,8 @@ function changedSince(before, after) {
 
 // src/lib/init-trace.ts
 var import_node_crypto25 = require("node:crypto");
-var import_node_fs72 = require("node:fs");
-var import_node_path60 = require("node:path");
+var import_node_fs73 = require("node:fs");
+var import_node_path61 = require("node:path");
 var INIT_STEPS = [
   "started",
   "prerequisites",
@@ -41906,9 +42236,9 @@ function traceDisabled(env = process.env) {
 }
 var PENDING_NAME = "init-trace.json";
 var MAX_PENDING_BYTES = 64 * 1024;
-var verityHome2 = () => (0, import_node_path60.join)(process.env.HOME ?? "", ".verity");
+var verityHome2 = () => (0, import_node_path61.join)(process.env.HOME ?? "", ".verity");
 function pendingTracePath() {
-  return (0, import_node_path60.join)(verityHome2(), PENDING_NAME);
+  return (0, import_node_path61.join)(verityHome2(), PENDING_NAME);
 }
 var RUN_ID = /^[0-9a-f]{16}$/;
 var CLI_VERSION = /^[0-9A-Za-z.+-]{1,40}$/;
@@ -41966,10 +42296,10 @@ function writePending(runs) {
   try {
     const kept = runs.filter((r) => r.events.length > 0).slice(-MAX_PENDING_RUNS);
     if (kept.length === 0) {
-      (0, import_node_fs72.rmSync)(pendingTracePath(), { force: true });
+      (0, import_node_fs73.rmSync)(pendingTracePath(), { force: true });
       return;
     }
-    (0, import_node_fs72.mkdirSync)(verityHome2(), { recursive: true });
+    (0, import_node_fs73.mkdirSync)(verityHome2(), { recursive: true });
     if (!replaceInRoot(verityHome2(), PENDING_NAME, JSON.stringify(kept))) {
       logEvent("init_trace_save_refused", {});
     }
@@ -42681,8 +43011,8 @@ var Rail = class {
 };
 
 // src/commands/init/ui.ts
-var import_node_fs73 = require("node:fs");
-var import_node_path61 = require("node:path");
+var import_node_fs74 = require("node:fs");
+var import_node_path62 = require("node:path");
 var import_node_os13 = require("node:os");
 var import_node_child_process18 = require("node:child_process");
 function createInitUi(opts) {
@@ -42702,10 +43032,10 @@ function installInterrupt(ui) {
 }
 var SEEN_FILE = ".init-seen";
 function firstInitOnMachine(home = process.env.HOME || (0, import_node_os13.homedir)()) {
-  return !(0, import_node_fs73.existsSync)((0, import_node_path61.join)(home, ".verity", SEEN_FILE));
+  return !(0, import_node_fs74.existsSync)((0, import_node_path62.join)(home, ".verity", SEEN_FILE));
 }
 function markInitSeen(home = process.env.HOME || (0, import_node_os13.homedir)()) {
-  replaceInRoot((0, import_node_path61.join)(home, ".verity"), SEEN_FILE, `${(/* @__PURE__ */ new Date()).toISOString()}
+  replaceInRoot((0, import_node_path62.join)(home, ".verity"), SEEN_FILE, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
 }
 function repoLabel() {
@@ -42715,12 +43045,12 @@ function repoLabel() {
     if (parsed) return terminalText(`${parsed.owner}/${parsed.repo}`, 120);
   } catch {
   }
-  return terminalText((0, import_node_path61.basename)(repoRoot()), 120);
+  return terminalText((0, import_node_path62.basename)(repoRoot()), 120);
 }
 
 // src/lib/prereqs.ts
 var import_node_child_process19 = require("node:child_process");
-var import_node_fs74 = require("node:fs");
+var import_node_fs75 = require("node:fs");
 var MIN_NODE_MAJOR = 20;
 function which(bin) {
   return whichSync(bin, { real: false });
@@ -42788,7 +43118,7 @@ function checkAnalysisCli(opts = {}) {
 }
 function sameFile(a, b) {
   try {
-    return (0, import_node_fs74.realpathSync)(a) === (0, import_node_fs74.realpathSync)(b);
+    return (0, import_node_fs75.realpathSync)(a) === (0, import_node_fs75.realpathSync)(b);
   } catch {
     return false;
   }
@@ -42848,12 +43178,12 @@ async function checkPrereqs(opts = {}) {
 }
 
 // src/lib/telemetry-local.ts
-var import_node_path63 = require("node:path");
+var import_node_path64 = require("node:path");
 
 // src/lib/telemetry-settings.ts
 var import_promises14 = require("node:fs/promises");
 var import_node_os14 = require("node:os");
-var import_node_path62 = require("node:path");
+var import_node_path63 = require("node:path");
 var SETTINGS_LOCAL_FILE2 = ".claude/settings.local.json";
 var OTEL_HEADERS_HELPER_CMD = "verity telemetry headers";
 var LEGACY_HEADER_KEY = "OTEL_EXPORTER_OTLP_HEADERS";
@@ -42864,10 +43194,10 @@ var OTLP_ENDPOINT_KEYS = [
   "OTEL_EXPORTER_OTLP_LOGS_ENDPOINT"
 ];
 function claudeConfigDir2() {
-  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path62.join)((0, import_node_os14.homedir)(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path63.join)((0, import_node_os14.homedir)(), ".claude");
 }
 function userSettingsPath() {
-  return (0, import_node_path62.join)(claudeConfigDir2(), "settings.json");
+  return (0, import_node_path63.join)(claudeConfigDir2(), "settings.json");
 }
 function deriveOtlpEndpoint(serviceUrl) {
   return serviceUrl.replace(/\/+$/, "").replace(/\/v1$/, "") + "/v1/otlp";
@@ -42988,7 +43318,7 @@ async function healLocalTelemetry(root = repoRoot()) {
   if (settings.env && Object.keys(env).length === 0) delete settings.env;
   if (plan.helper) delete settings.otelHeadersHelper;
   const next = nextLocalBytes(local.raw, settings);
-  if (next !== null && !replaceInRoot((0, import_node_path63.join)(root, ".claude"), "settings.local.json", next)) {
+  if (next !== null && !replaceInRoot((0, import_node_path64.join)(root, ".claude"), "settings.local.json", next)) {
     return { removed: [] };
   }
   return { removed: [...plan.envKeys, ...plan.helper ? ["otelHeadersHelper"] : []] };
@@ -42996,8 +43326,8 @@ async function healLocalTelemetry(root = repoRoot()) {
 
 // src/lib/telemetry-gate.ts
 var import_node_child_process20 = require("node:child_process");
-var import_node_fs75 = require("node:fs");
-var import_node_path64 = require("node:path");
+var import_node_fs76 = require("node:fs");
+var import_node_path65 = require("node:path");
 var PROJECT_MARKERS = ["setup.json", "config.json"];
 function writtenOnThisMachine(root, rel) {
   const r = (0, import_node_child_process20.spawnSync)("git", hardenedGitArgv(["ls-files", "--error-unmatch", "--", rel]), {
@@ -43014,10 +43344,10 @@ function writtenOnThisMachine(root, rel) {
 function isTelemetryProject() {
   for (const root of [repoRoot(), mainWorktreeRoot()]) {
     if (!root) continue;
-    const dir = (0, import_node_path64.join)(root, VERITY_DIR);
+    const dir = (0, import_node_path65.join)(root, VERITY_DIR);
     if (isMachineStore(dir)) continue;
     for (const marker of PROJECT_MARKERS) {
-      if ((0, import_node_fs75.existsSync)((0, import_node_path64.join)(dir, marker)) && writtenOnThisMachine(root, `${VERITY_DIR}/${marker}`)) return true;
+      if ((0, import_node_fs76.existsSync)((0, import_node_path65.join)(dir, marker)) && writtenOnThisMachine(root, `${VERITY_DIR}/${marker}`)) return true;
     }
   }
   return false;
@@ -43282,7 +43612,7 @@ function signInDetail(outcome) {
 }
 function formalDefault(previous, opts = {}) {
   const cfg = readProjectConfig();
-  if (previous?.init?.completed_at || opts.setUpBefore || cfg.formal !== void 0 || cfg.formal_refused) return false;
+  if (previous?.init?.completed_at || opts.setUpBefore || cfg.formal !== void 0 || cfg.formal_refused || cfg.formal_off_refused) return false;
   writeProjectConfig({ formal: "push" });
   return true;
 }
@@ -43293,9 +43623,13 @@ function sayFormalOn(ui) {
 }
 function backgroundStep(ui, opts) {
   const { rail } = ui;
-  const formal = readProjectConfig().formal;
-  const said = opts.formalNew === true && formal === "push";
-  if (said) sayFormalOn(ui);
+  const setting = formalSetting(readProjectConfig());
+  const formal = setting.state;
+  const said = formal === "push" && (opts.formalNew === true || setting.source === "default" && formalDefaultNoticeDue());
+  if (said) {
+    sayFormalOn(ui);
+    recordFormalDefaultNotice();
+  }
   const lean = shouldStartBackgroundInstall({ formal });
   const leanStarted = lean.start && startBackgroundInstall({ cli: opts.cli });
   const trivy = startTrivyPrewarm();
@@ -43382,8 +43716,8 @@ async function scaffoldStep(ui, given = {}) {
     rail.warn(".gitignore: could not write the Verity block");
     rail.line("Add it by hand: .verity/ holds copies of analyzed files, including any secret the gate flagged.");
   } else if (ignore === "conflict") {
-    rail.warn(".gitignore: git still ignores .verity/standard.yaml");
-    rail.line("A global or nested .gitignore covers it, so the Standard cannot be committed. Check: git check-ignore -v .verity/standard.yaml");
+    rail.warn(".gitignore: git does not ignore the files under .verity/");
+    rail.line("A nested .gitignore re-includes them, so copies of analyzed files, including any secret the gate flagged, can be committed. Check: git check-ignore -v .verity/.snapshot/x");
   } else if (ignore === "memory-tracked") {
     rail.warn("This project commits its knowledge graph");
   }
@@ -43398,15 +43732,25 @@ async function scaffoldStep(ui, given = {}) {
       rail.line("They show up in every diff. Stop with: verity memory untrack (or keep them on purpose: verity memory track)");
     }
   }
+  if (committedStandardFile()) {
+    if (given.untrackStandard) {
+      const result = untrackStandard();
+      if (result.ok) rail.line(`Untracked ${STANDARD_FILE} (staged). Commit to finish. Teammates get it back with: verity standard pull`);
+      else rail.line(`Could not untrack ${STANDARD_FILE}. Run: verity standard untrack`, "warn");
+    } else {
+      rail.warn(`${STANDARD_FILE} is tracked in git`);
+      rail.line("Verity keeps it on each machine now, and reviews read the Standard on the service. Stop tracking it with: verity standard untrack");
+    }
+  }
   const tracked = committedVerityState();
   if (tracked.length > 0) {
     if (given.untrackState || ui.asking && await askUntrackState(ui, tracked)) {
       const result = untrackVerityState();
       if (result === "untracked") rail.line("Untracked the Verity state files (staged). Commit to finish.");
-      else if (result === "failed") rail.line("Could not untrack them. Run: git rm -r --cached .verity && git add .verity/standard.yaml", "warn");
+      else if (result === "failed") rail.line("Could not untrack them. Run: verity init --untrack-state", "warn");
     } else {
       rail.warn(`${tracked.length} Verity state file(s) are tracked in git`);
-      rail.line(`For example ${terminalText(tracked[0], 200)}. Fix: git rm -r --cached .verity && git add .verity/standard.yaml`);
+      rail.line(`For example ${terminalText(tracked[0], 200)}. Fix: verity init --untrack-state`);
     }
   }
   retireCodacyConfig(ui);
@@ -43416,7 +43760,9 @@ async function scaffoldStep(ui, given = {}) {
     rail.line(`Could not update CLAUDE.md: ${terminalText(err2.message, 300)}`, "warn");
   }
   const cfg = readProjectConfig();
-  if (cfg.formal_refused) rail.line(`Formal verification: off \u2014 ${formalRefusalMessage(cfg.formal_refused)}`, "warn");
+  if (cfg.formal_off_refused && formalSetting(cfg).state === "push") {
+    rail.line(`Formal verification: on \u2014 ${formalOffRefusalMessage(cfg.formal_off_refused)}`, "warn");
+  }
   rail.settle();
 }
 async function askUntrackState(ui, tracked) {
@@ -43454,9 +43800,9 @@ function retireCodacyConfig(ui) {
 }
 
 // src/commands/init/wiring.ts
-var import_node_fs76 = require("node:fs");
+var import_node_fs77 = require("node:fs");
 var import_promises16 = require("node:fs/promises");
-var import_node_path65 = require("node:path");
+var import_node_path66 = require("node:path");
 var DEFAULT_MOMENTS = ["stop", "pre-commit", "pre-push"];
 async function momentsFromInstalledHooks() {
   const status = await checkAllVerityHooks();
@@ -43529,12 +43875,12 @@ var SKILLS = [
 ];
 function resolveDataDir2() {
   const candidates2 = [
-    (0, import_node_path65.join)(__dirname, "..", "data"),
-    (0, import_node_path65.join)(__dirname, "..", "..", "data"),
-    (0, import_node_path65.join)(process.cwd(), "cli", "data")
+    (0, import_node_path66.join)(__dirname, "..", "data"),
+    (0, import_node_path66.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path66.join)(process.cwd(), "cli", "data")
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs76.existsSync)((0, import_node_path65.join)(candidate, "skills"))) return candidate;
+    if ((0, import_node_fs77.existsSync)((0, import_node_path66.join)(candidate, "skills"))) return candidate;
   }
   throw new Error("Could not find Verity skill data. Reinstall: npm install -g @codacy/verity-cli");
 }
@@ -43542,9 +43888,9 @@ async function skillIsCurrent(src, dest) {
   const list2 = (dir) => {
     const out2 = [];
     const walk2 = (d, prefix) => {
-      for (const e of (0, import_node_fs76.readdirSync)(d, { withFileTypes: true })) {
+      for (const e of (0, import_node_fs77.readdirSync)(d, { withFileTypes: true })) {
         const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk2((0, import_node_path65.join)(d, e.name), rel);
+        if (e.isDirectory()) walk2((0, import_node_path66.join)(d, e.name), rel);
         else if (e.isFile()) out2.push(rel);
       }
     };
@@ -43555,7 +43901,7 @@ async function skillIsCurrent(src, dest) {
     const shipped = list2(src);
     if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
     for (const rel of shipped) {
-      if (await (0, import_promises16.readFile)((0, import_node_path65.join)(src, rel), "utf-8") !== await (0, import_promises16.readFile)((0, import_node_path65.join)(dest, rel), "utf-8")) return false;
+      if (await (0, import_promises16.readFile)((0, import_node_path66.join)(src, rel), "utf-8") !== await (0, import_promises16.readFile)((0, import_node_path66.join)(dest, rel), "utf-8")) return false;
     }
     return true;
   } catch {
@@ -43563,16 +43909,16 @@ async function skillIsCurrent(src, dest) {
   }
 }
 async function installSkills(force) {
-  const source2 = (0, import_node_path65.join)(resolveDataDir2(), "skills");
+  const source2 = (0, import_node_path66.join)(resolveDataDir2(), "skills");
   const missing = [];
   for (const skill of SKILLS) {
-    const src = (0, import_node_path65.join)(source2, skill);
-    const dest = (0, import_node_path65.join)(".claude/skills", skill);
-    if (!(0, import_node_fs76.existsSync)(src)) {
+    const src = (0, import_node_path66.join)(source2, skill);
+    const dest = (0, import_node_path66.join)(".claude/skills", skill);
+    if (!(0, import_node_fs77.existsSync)(src)) {
       missing.push(skill);
       continue;
     }
-    if ((0, import_node_fs76.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) continue;
+    if ((0, import_node_fs77.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) continue;
     await (0, import_promises16.mkdir)(dest, { recursive: true });
     await (0, import_promises16.cp)(src, dest, { recursive: true, force: true });
   }
@@ -43612,8 +43958,8 @@ async function hooksStep(ui, ctx) {
 }
 
 // src/commands/init/standard.ts
-var import_node_fs77 = require("node:fs");
-var import_node_path66 = require("node:path");
+var import_node_fs78 = require("node:fs");
+var import_node_path67 = require("node:path");
 var import_yaml10 = __toESM2(require_dist());
 
 // src/lib/catalogue-client.ts
@@ -43686,10 +44032,8 @@ async function writeTeamStandard(team, opts) {
       serviceUrl: url.data,
       projectId: await projectLabel(token.data.token, url.data, opts.globals.verbose)
     });
-    if (opts.previous?.declinedStandardVersion != null) {
-      await writeSetupState({ declinedStandardVersion: void 0 }).catch(() => {
-      });
-    }
+    await writeSetupState({ standardVersion: found.standard.version, declinedStandardVersion: void 0 }).catch(() => {
+    });
     return { status: "adopted", version: found.standard.version, summary: describeRemote(found), notes: outcome.notes };
   } catch (err2) {
     return { status: "write-failed", reason: terminalText(err2.message, 300) };
@@ -43710,6 +44054,17 @@ async function askTeamChoice(ui, team) {
   rail.collapse();
   return k === "n" ? "new" : "use";
 }
+async function askKeepOrPull(ui, team) {
+  const { rail, screen } = ui;
+  rail.active(`${STANDARD_FILE} differs from your team's Standard`);
+  rail.line(`On the service: ${describeRemote(team.found)}. Reviews use that one.`);
+  rail.line(`Use it here too (a copy of your file is kept), or keep your file and share it over the team's later: verity standard push`);
+  rail.gap();
+  rail.keys([["Enter", "use the team's"], ["k", "keep yours"]]);
+  const k = await screen.key(["enter", "k"], "enter", { freshMs: 300 });
+  rail.collapse();
+  return k === "k" ? "keep" : "use";
+}
 function sayAdopted(ui, team) {
   ui.rail.done(`Using your team's Standard v${team.version}`);
   ui.rail.line(terminalText(team.summary, 300));
@@ -43778,26 +44133,26 @@ async function deriveFromCatalogue(ui, globals, plan, expectedLatest) {
     return { ok: false, version: null };
   }
 }
-function localStandardProblem() {
+function localStandard() {
   const raw = readRepoFile(STANDARD_FILE);
-  if (raw === null) return `${STANDARD_FILE} is a link, not a regular file, or larger than 512 KB.`;
+  if (raw === null) return { ok: false, problem: `${STANDARD_FILE} is a link, not a regular file, or larger than 512 KB.` };
   let parsed;
   try {
     parsed = (0, import_yaml10.parse)(raw);
   } catch (err2) {
-    return `${STANDARD_FILE} is not valid YAML: ${terminalText(err2 instanceof Error ? err2.message : String(err2), 200)}`;
+    return { ok: false, problem: `${STANDARD_FILE} is not valid YAML: ${terminalText(err2 instanceof Error ? err2.message : String(err2), 200)}` };
   }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return `${STANDARD_FILE} holds no Standard.`;
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return { ok: false, problem: `${STANDARD_FILE} holds no Standard.` };
   const valid = validateStandardContent(parsed);
-  if (!valid.ok) return `${STANDARD_FILE} is not a Standard the service accepts: ${terminalText(valid.error, 200)}`;
-  return null;
+  if (!valid.ok) return { ok: false, problem: `${STANDARD_FILE} is not a Standard the service accepts: ${terminalText(valid.error, 200)}` };
+  return { ok: true, content: parsed };
 }
 function removeLocalStandard() {
   const path = projectPath(STANDARD_FILE);
   try {
-    const folder = (0, import_node_fs77.lstatSync)((0, import_node_path66.dirname)(path));
+    const folder = (0, import_node_fs78.lstatSync)((0, import_node_path67.dirname)(path));
     if (!folder.isDirectory() || folder.isSymbolicLink()) return;
-    if ((0, import_node_fs77.lstatSync)(path).isFile()) (0, import_node_fs77.unlinkSync)(path);
+    if ((0, import_node_fs78.lstatSync)(path).isFile()) (0, import_node_fs78.unlinkSync)(path);
   } catch {
   }
 }
@@ -43811,7 +44166,7 @@ function setLocalStandardAside(now = /* @__PURE__ */ new Date(), remove = remove
     return { ok: false, message: `Could not keep a copy of ${STANDARD_FILE} (${terminalText(err2 instanceof Error ? err2.message : String(err2), 200)}), so it was not set aside.` };
   }
   remove();
-  if ((0, import_node_fs77.existsSync)(projectPath(STANDARD_FILE))) return { ok: false, message: `Could not remove ${STANDARD_FILE} after copying it to ${path}.` };
+  if ((0, import_node_fs78.existsSync)(projectPath(STANDARD_FILE))) return { ok: false, message: `Could not remove ${STANDARD_FILE} after copying it to ${path}.` };
   return { ok: true, path };
 }
 async function standardStep(ui, ctx) {
@@ -43873,7 +44228,7 @@ async function standardStep(ui, ctx) {
     rail.line(team2.status === "none" ? `There is no Standard on the service either, so reviews have no rules. Fix ${STANDARD_FILE}, or delete it, then run verity init again.` : team2.status === "unavailable" ? `The Verity service did not answer (${terminalText(team2.reason, 200)}), so no Standard is confirmed. Fix ${STANDARD_FILE}, then run verity init again.` : team2.status === "denied" && refusalOutcome(team2.code) === "denied" ? `Verity has no access to this repository (${terminalText(team2.reason, 200)}). Fix ${STANDARD_FILE}, give the Verity GitHub App access, then run verity login and verity init.` : team2.status === "denied" ? `The Verity service did not accept your sign-in (${terminalText(team2.reason, 200)}). Fix ${STANDARD_FILE}, then run verity login and verity init.` : `No Standard on the service was looked up. Fix ${STANDARD_FILE}, or sign in, then run verity init again.`);
     return end({ source: "none", version: null, profile: notAsked });
   };
-  if (ctx.standard === "new" && (0, import_node_fs77.lstatSync)(projectPath(STANDARD_FILE), { throwIfNoEntry: false })) {
+  if (ctx.standard === "new" && (0, import_node_fs78.lstatSync)(projectPath(STANDARD_FILE), { throwIfNoEntry: false })) {
     const aside = setLocalStandardAside();
     if (!aside.ok) {
       rail.warn("Could not set your Standard aside for a new one");
@@ -43883,26 +44238,77 @@ async function standardStep(ui, ctx) {
     }
     rail.done(`Set your Standard aside ${s.gray}\xB7 a copy is in ${aside.path}${s.reset}`);
   }
-  if ((0, import_node_fs77.existsSync)(projectPath(STANDARD_FILE))) {
-    const problem = localStandardProblem();
-    if (problem !== null) return unusableHere(problem);
-    const sync = await pushLocalStandardIfMissing(ctx.globals);
-    rail.done("Kept your Standard");
-    rail.line(`${STANDARD_FILE} is already here, so this run leaves it as it is. Edit it there, then share the change: verity standard push`);
+  const keptHints = async () => {
     if (!usesReviewPacks()) {
       rail.line("It does not use review packs. To move it to packs and keep your rules: verity standard push. To build a new one: verity init --standard new", "muted");
     }
-    if (sync.status === "pushed") {
-      rail.line(sync.version !== null ? `It was only on this machine. It is shared now as v${sync.version}.` : "It is only on this machine:", sync.version !== null ? "muted" : "warn");
-      for (const line2 of sync.lines) if (!line2.startsWith("Standard pushed")) rail.line(terminalText(line2, 600), "warn");
+    if (!hasProjectRules() && await rulesOn(ctx.globals)) {
+      rail.line("It has no project rules yet. Add them from a repo profile: verity standard generate");
+    }
+  };
+  const keptHere = async (local) => {
+    const team2 = await lookUpTeamStandard(ctx);
+    if (team2.status === "found" || team2.status === "declined-before") {
+      if (sameStandard(local, team2.found.standard.content)) {
+        rail.done(`Kept your Standard ${s.gray}\xB7 it is the team's v${team2.version}${s.reset}`);
+        rail.line(`Edit it in ${STANDARD_FILE}, then share the change: verity standard push`);
+        await writeSetupState({ standardVersion: team2.version }).catch(() => {
+        });
+        await keptHints();
+        return end({ source: "kept", version: team2.version, profile: notAsked });
+      }
+      const choice = ctx.standard === "use" ? "use" : team2.status === "declined-before" ? "keep" : ui.asking ? await askKeepOrPull(ui, team2) : "use";
+      if (choice === "use") {
+        const pulled = await pullStandard(ctx.globals);
+        if (pulled.status === "pulled" || pulled.status === "same") {
+          rail.done(`Using your team's Standard v${pulled.version}`);
+          rail.line(terminalText(describeRemote(team2.found), 300));
+          if (pulled.status === "pulled" && pulled.backup) rail.line(`Your file is kept as ${pulled.backup}`, "muted");
+          rail.line(`Edit it in ${STANDARD_FILE}, then share the change: verity standard push`);
+          if (pulled.status === "pulled") for (const note of pulled.notes) rail.line(terminalText(note, 300), "warn");
+          return end({ source: "adopted", version: pulled.version, profile: notAsked });
+        }
+        rail.warn("Could not write the team's Standard here");
+        rail.line(pulled.status === "failed" ? terminalText(pulled.message, 300) : `${STANDARD_FILE} changed while this ran.`);
+        rail.line(`Reviews use the team's Standard v${team2.version} on the service. To write it here: verity standard pull`);
+        return end({ source: "kept", version: team2.version, profile: notAsked });
+      }
+      rail.done(`Kept your Standard ${s.gray}\xB7 it differs from the team's v${team2.version}${s.reset}`);
+      rail.line(team2.status === "declined-before" ? `This project turned down the team's Standard v${team2.version} before, so this run keeps yours. Reviews use the team's.` : "Reviews use the team's Standard on the service.");
+      rail.line(`To share yours over the team's: verity standard push. To use the team's here: verity standard pull`);
+      await writeSetupState({ standardVersion: team2.version }).catch(() => {
+      });
+      await keptHints();
+      return end({ source: "kept", version: team2.version, profile: notAsked });
+    }
+    rail.done("Kept your Standard");
+    rail.line(`${STANDARD_FILE} is already here, so this run leaves it as it is. Edit it there, then share the change: verity standard push`);
+    let version = null;
+    if (team2.status === "none") {
+      const pushed = await pushStandard(ctx.globals, { expectedLatest: null });
+      if (pushed.conflict) {
+        rail.line("Someone shared a Standard for this repository while this ran. Reviews use theirs; to compare with yours, run verity init again, or verity standard pull.", "warn");
+      } else if (pushed.standardVersion !== null) {
+        version = pushed.standardVersion;
+        rail.line(`It was only on this machine. It is shared now as v${version}.`, "muted");
+      } else {
+        rail.line("It is only on this machine:", "warn");
+      }
+      for (const line2 of pushed.lines) if (!line2.startsWith("Standard pushed")) rail.line(terminalText(line2, 600), "warn");
     }
-    if (sync.status === "skipped" && sync.reason === "unavailable") {
+    if (team2.status === "unavailable") {
       rail.line(`It could not be shared: the Verity service did not answer. It is shared at the first review once the service answers, or now with: verity standard push`, "warn");
     }
-    if (!hasProjectRules() && await rulesOn(ctx.globals)) {
-      rail.line("It has no project rules yet. Add them from a repo profile: verity standard generate");
+    if (team2.status === "denied") {
+      rail.line(`It could not be compared with the team's: ${terminalText(team2.reason, 300)}`, "warn");
     }
-    return end({ source: "kept", version: sync.status === "pushed" ? sync.version : null, profile: notAsked });
+    await keptHints();
+    return end({ source: "kept", version, profile: notAsked });
+  };
+  if ((0, import_node_fs78.existsSync)(projectPath(STANDARD_FILE))) {
+    const local = localStandard();
+    if (!local.ok) return unusableHere(local.problem);
+    return keptHere(local.content);
   }
   const team = await lookUpTeamStandard(ctx);
   let replaces;
@@ -44025,8 +44431,8 @@ function sayChanged(ui, before) {
 }
 
 // src/commands/migrate.ts
-var import_node_fs78 = require("node:fs");
-var import_node_path67 = require("node:path");
+var import_node_fs79 = require("node:fs");
+var import_node_path68 = require("node:path");
 var import_node_child_process22 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
@@ -44090,12 +44496,12 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path67.join)(root, ".gate");
-  const verityDir = (0, import_node_path67.join)(root, ".verity");
-  if ((0, import_node_fs78.existsSync)(gateDir) && !(0, import_node_fs78.existsSync)(verityDir)) {
+  const gateDir = (0, import_node_path68.join)(root, ".gate");
+  const verityDir = (0, import_node_path68.join)(root, ".verity");
+  if ((0, import_node_fs79.existsSync)(gateDir) && !(0, import_node_fs79.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if ((0, import_node_fs78.existsSync)(gateDir) && (0, import_node_fs78.existsSync)(verityDir)) {
+  if ((0, import_node_fs79.existsSync)(gateDir) && (0, import_node_fs79.existsSync)(verityDir)) {
     return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
   return false;
@@ -44116,13 +44522,13 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
     }
   }
   if (moved) {
-    if ((0, import_node_fs78.existsSync)(gateDir)) {
+    if ((0, import_node_fs79.existsSync)(gateDir)) {
       const carried = carryLegacyContents(gateDir, verityDir);
       if (carried > 0) {
         actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
       }
       try {
-        (0, import_node_fs78.rmSync)(gateDir, { recursive: true, force: true });
+        (0, import_node_fs79.rmSync)(gateDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -44138,18 +44544,18 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
     actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
   try {
-    (0, import_node_fs78.rmSync)(gateDir, { recursive: true, force: true });
+    (0, import_node_fs79.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
   }
   return carried > 0;
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path67.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path67.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs78.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs78.existsSync)(verityCreds)) {
-    (0, import_node_fs78.mkdirSync)((0, import_node_path67.join)(home, ".verity"), { recursive: true });
+  const gateCreds = (0, import_node_path68.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path68.join)(home, ".verity", "credentials");
+  if (!(0, import_node_fs79.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs79.existsSync)(verityCreds)) {
+    (0, import_node_fs79.mkdirSync)((0, import_node_path68.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -44171,8 +44577,8 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path67.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs78.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  const claudeMd = (0, import_node_path68.join)(root, "CLAUDE.md");
+  const hadLegacyBlock = (0, import_node_fs79.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
     await ensureClaudeMdPointer(root);
@@ -44182,9 +44588,9 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path67.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path67.join)(root, "VERITY.md");
-  if (!(0, import_node_fs78.existsSync)(gateMd) || (0, import_node_fs78.existsSync)(verityMd)) return;
+  const gateMd = (0, import_node_path68.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path68.join)(root, "VERITY.md");
+  if (!(0, import_node_fs79.existsSync)(gateMd) || (0, import_node_fs79.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
@@ -44196,7 +44602,7 @@ function migrateStandardFile(root, actions) {
   if (!moved) moveFile(gateMd, verityMd);
   const content = readFileSyncSafe(verityMd);
   const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs78.writeFileSync)(verityMd, refreshed);
+  if (refreshed !== content) (0, import_node_fs79.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateLocalTelemetry(root, actions) {
@@ -44240,14 +44646,14 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
   }
   if (toAppend.length > 0) {
     const sep7 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs78.writeFileSync)(verityCreds, verityContent + sep7 + toAppend.join("\n") + "\n");
+    (0, import_node_fs79.writeFileSync)(verityCreds, verityContent + sep7 + toAppend.join("\n") + "\n");
   }
-  (0, import_node_fs78.rmSync)(gateCreds, { force: true });
+  (0, import_node_fs79.rmSync)(gateCreds, { force: true });
   return toAppend.length;
 }
 function readFileSyncSafe(path) {
   try {
-    return (0, import_node_fs78.readFileSync)(path, "utf-8");
+    return (0, import_node_fs79.readFileSync)(path, "utf-8");
   } catch {
     return "";
   }
@@ -44262,20 +44668,20 @@ function hasStagedChanges(root) {
 }
 function moveDir(from, to) {
   try {
-    (0, import_node_fs78.renameSync)(from, to);
+    (0, import_node_fs79.renameSync)(from, to);
   } catch (err2) {
     if (err2.code !== "EXDEV") throw err2;
-    (0, import_node_fs78.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs78.rmSync)(from, { recursive: true, force: true });
+    (0, import_node_fs79.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs79.rmSync)(from, { recursive: true, force: true });
   }
 }
 function moveFile(from, to) {
   try {
-    (0, import_node_fs78.renameSync)(from, to);
+    (0, import_node_fs79.renameSync)(from, to);
   } catch (err2) {
     if (err2.code !== "EXDEV") throw err2;
-    (0, import_node_fs78.cpSync)(from, to);
-    (0, import_node_fs78.rmSync)(from, { force: true });
+    (0, import_node_fs79.cpSync)(from, to);
+    (0, import_node_fs79.rmSync)(from, { force: true });
   }
 }
 function carryLegacyContents(gateDir, verityDir) {
@@ -44284,12 +44690,12 @@ function carryLegacyContents(gateDir, verityDir) {
   const walk2 = (relDir) => {
     let entries;
     try {
-      entries = (0, import_node_fs78.readdirSync)((0, import_node_path67.join)(gateDir, relDir), { withFileTypes: true });
+      entries = (0, import_node_fs79.readdirSync)((0, import_node_path68.join)(gateDir, relDir), { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const rel = relDir ? (0, import_node_path67.join)(relDir, entry.name) : entry.name;
+      const rel = relDir ? (0, import_node_path68.join)(relDir, entry.name) : entry.name;
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         walk2(rel);
@@ -44299,7 +44705,7 @@ function carryLegacyContents(gateDir, verityDir) {
       const opened = openRegularInRoot(gateDir, rel);
       if (!opened.ok) continue;
       try {
-        (0, import_node_fs78.writeFileSync)((0, import_node_path67.join)(verityDir, rel), readOpened(opened.fd, opened.size), { flag: "wx", mode: 384 });
+        (0, import_node_fs79.writeFileSync)((0, import_node_path68.join)(verityDir, rel), readOpened(opened.fd, opened.size), { flag: "wx", mode: 384 });
         copied++;
       } catch {
       }
@@ -44309,19 +44715,19 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 function hasLegacyStandard(root = repoRoot()) {
-  if (!isRealDir((0, import_node_path67.join)(root, ".gate"))) return false;
+  if (!isRealDir((0, import_node_path68.join)(root, ".gate"))) return false;
   try {
-    if (!(0, import_node_fs78.lstatSync)((0, import_node_path67.join)(root, ".gate", "standard.yaml")).isFile()) return false;
+    if (!(0, import_node_fs79.lstatSync)((0, import_node_path68.join)(root, ".gate", "standard.yaml")).isFile()) return false;
   } catch {
     return false;
   }
-  const verityDir = (0, import_node_path67.join)(root, ".verity");
+  const verityDir = (0, import_node_path68.join)(root, ".verity");
   if (pathEntryExists(verityDir) && !isRealDir(verityDir)) return false;
-  return !pathEntryExists((0, import_node_path67.join)(verityDir, "standard.yaml"));
+  return !pathEntryExists((0, import_node_path68.join)(verityDir, "standard.yaml"));
 }
 function pathEntryExists(path) {
   try {
-    (0, import_node_fs78.lstatSync)(path);
+    (0, import_node_fs79.lstatSync)(path);
     return true;
   } catch {
     return false;
@@ -44329,7 +44735,7 @@ function pathEntryExists(path) {
 }
 function isRealDir(path) {
   try {
-    const st = (0, import_node_fs78.lstatSync)(path);
+    const st = (0, import_node_fs79.lstatSync)(path);
     return st.isDirectory() && !st.isSymbolicLink();
   } catch {
     return false;
@@ -44338,9 +44744,9 @@ function isRealDir(path) {
 function ensureRealDirs(root, relDir) {
   let current = root;
   for (const segment of relDir.split(/[\\/]/).filter(Boolean)) {
-    current = (0, import_node_path67.join)(current, segment);
+    current = (0, import_node_path68.join)(current, segment);
     try {
-      (0, import_node_fs78.mkdirSync)(current);
+      (0, import_node_fs79.mkdirSync)(current);
     } catch (e) {
       if (e.code !== "EEXIST") return false;
     }
@@ -44349,23 +44755,23 @@ function ensureRealDirs(root, relDir) {
   return true;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path67.join)(root, ".gate");
-  const verityDir = (0, import_node_path67.join)(root, ".verity");
-  if ((0, import_node_fs78.existsSync)(gateDir) && !(0, import_node_fs78.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs78.existsSync)(gateDir) && (0, import_node_fs78.existsSync)(verityDir)) {
-    if ((0, import_node_fs78.existsSync)((0, import_node_path67.join)(gateDir, "credentials")) && !(0, import_node_fs78.existsSync)((0, import_node_path67.join)(verityDir, "credentials"))) {
+  const gateDir = (0, import_node_path68.join)(root, ".gate");
+  const verityDir = (0, import_node_path68.join)(root, ".verity");
+  if ((0, import_node_fs79.existsSync)(gateDir) && !(0, import_node_fs79.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs79.existsSync)(gateDir) && (0, import_node_fs79.existsSync)(verityDir)) {
+    if ((0, import_node_fs79.existsSync)((0, import_node_path68.join)(gateDir, "credentials")) && !(0, import_node_fs79.existsSync)((0, import_node_path68.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs78.existsSync)((0, import_node_path67.join)(gateDir, "memory")) && !(0, import_node_fs78.existsSync)((0, import_node_path67.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs79.existsSync)((0, import_node_path68.join)(gateDir, "memory")) && !(0, import_node_fs79.existsSync)((0, import_node_path68.join)(verityDir, "memory"))) {
       return true;
     }
     if (hasLegacyStandard(root)) return true;
   }
-  const claudeMd = (0, import_node_path67.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs78.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+  const claudeMd = (0, import_node_path68.join)(root, "CLAUDE.md");
+  if ((0, import_node_fs79.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs78.existsSync)((0, import_node_path67.join)(root, "GATE.md")) && !(0, import_node_fs78.existsSync)((0, import_node_path67.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs79.existsSync)((0, import_node_path68.join)(root, "GATE.md")) && !(0, import_node_fs79.existsSync)((0, import_node_path68.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -44605,7 +45011,7 @@ async function recordAnswers(ui, momentIds, telemetry, completed) {
       moments: momentIds,
       ...telemetry ? { telemetry } : {},
       // A failed run also clears an earlier stamp: "done" describes this checkout now.
-      init: completed ? { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.3" : "dev" } : void 0
+      init: completed ? { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.5" : "dev" } : void 0
     });
   } catch (err2) {
     ui.rail.line(`Could not record the setup answers: ${terminalText(err2.message, 200)}`, "warn");
@@ -44658,7 +45064,7 @@ async function runInit(program2, opts) {
   const defaultsOnly = (opts.yes ?? false) || !interactive();
   const { givenMoments, givenTelemetry, profileAnswer, standardAnswer } = parseInitFlags(opts);
   const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-  if (!projectMarkers.some((m) => (0, import_node_fs79.existsSync)(m))) {
+  if (!projectMarkers.some((m) => (0, import_node_fs80.existsSync)(m))) {
     printError('No project detected in the current directory. Run "verity init" from your project root.');
     process.exit(1);
   }
@@ -44684,12 +45090,12 @@ async function runInit(program2, opts) {
       process.exit(1);
     }
     trace.mark("prerequisites", "ok");
-    await scaffoldStep(ui, { untrackMemory: opts.untrackMemory === true, untrackState: opts.untrackState === true });
+    await scaffoldStep(ui, { untrackMemory: opts.untrackMemory === true, untrackStandard: opts.untrackStandard === true, untrackState: opts.untrackState === true });
     trace.mark("scaffold", "ok");
-    await (0, import_promises17.mkdir)((0, import_node_path68.join)((0, import_node_os15.homedir)(), ".verity"), { recursive: true });
+    await (0, import_promises17.mkdir)((0, import_node_path69.join)((0, import_node_os15.homedir)(), ".verity"), { recursive: true });
     await repoStep(ui, detectProject());
     const previous = await readSetupState();
-    const setUpBefore = (0, import_node_fs79.existsSync)(projectPath(STANDARD_FILE));
+    const setUpBefore = (0, import_node_fs80.existsSync)(projectPath(STANDARD_FILE));
     const answers = await askSetupQuestions(defaultsOnly, previous, { moments: givenMoments, telemetry: givenTelemetry });
     trace.mark("questions", "ok", givenMoments || givenTelemetry !== void 0 || profileAnswer || standardAnswer ? "asked" : "defaults");
     const plan = planMoments(answers.moments, { given: givenMoments !== void 0, defaultsOnly });
@@ -44735,11 +45141,11 @@ async function runInit(program2, opts) {
   }
 }
 function registerInitCommand(program2) {
-  program2.command("init").alias("setup").description("Set up Verity in this project: sign in, telemetry, and the Standard; every other choice is a stated default").option("--force", "Reinstall the skills even when they are up to date (hooks are always reconciled)").option("-y, --yes", "Ask nothing: skip sign-in unless already signed in, and send the profile only with --profile send").option("--profile <send|skip>", "Answer the repo-profile question without asking (the plugin asks in the session)").option("--standard <use|new>", "When the team already has a Standard: use it, or create a new one (the plugin asks in the session; unattended runs use it)").option("--no-setup", "Ignored: init no longer hands off to /verity-setup (kept for old scripts)").option("--plugin-mode", "The Claude Code plugin owns the skills and hooks: install neither, and remove any this project already has").option("--no-plugin", "Ignore any Claude Code plugin here and wire this project's own skills and hooks").option("--no-adopt", "Don't use this repository's Standard from the service; build a new one").option("--moments <list>", 'Set when Verity reviews without the default: stop,pre-commit,pre-push \u2014 or "none"').option("--intensity <level>", "Ignored: static analysis is Trivy only (kept so older plugin skills keep working)").option("--telemetry <on|off>", "Answer the telemetry question without asking: send cost & usage from this machine, or not").option("--untrack-memory", "Stop tracking the knowledge graph in git (init does not ask)").option("--untrack-state", "Untrack committed Verity state without asking (a terminal run asks when it finds some)").action((opts) => runInit(program2, opts));
+  program2.command("init").alias("setup").description("Set up Verity in this project: sign in, telemetry, and the Standard; every other choice is a stated default").option("--force", "Reinstall the skills even when they are up to date (hooks are always reconciled)").option("-y, --yes", "Ask nothing: skip sign-in unless already signed in, and send the profile only with --profile send").option("--profile <send|skip>", "Answer the repo-profile question without asking (the plugin asks in the session)").option("--standard <use|new>", "When the team already has a Standard: use it, or create a new one (the plugin asks in the session; unattended runs use it)").option("--no-setup", "Ignored: init no longer hands off to /verity-setup (kept for old scripts)").option("--plugin-mode", "The Claude Code plugin owns the skills and hooks: install neither, and remove any this project already has").option("--no-plugin", "Ignore any Claude Code plugin here and wire this project's own skills and hooks").option("--no-adopt", "Don't use this repository's Standard from the service; build a new one").option("--moments <list>", 'Set when Verity reviews without the default: stop,pre-commit,pre-push \u2014 or "none"').option("--intensity <level>", "Ignored: static analysis is Trivy only (kept so older plugin skills keep working)").option("--telemetry <on|off>", "Answer the telemetry question without asking: send cost & usage from this machine, or not").option("--untrack-memory", "Stop tracking the knowledge graph in git (init does not ask)").option("--untrack-standard", "Stop tracking .verity/standard.yaml in git: Verity keeps it on each machine (init does not ask)").option("--untrack-state", "Untrack committed Verity state without asking (a terminal run asks when it finds some)").action((opts) => runInit(program2, opts));
 }
 
 // src/commands/doctor.ts
-var import_node_fs80 = require("node:fs");
+var import_node_fs81 = require("node:fs");
 var LEGACY_STANDARD_FILE = ".gate/standard.yaml";
 async function buildReport() {
   const prereqs = await checkPrereqs({ install: false });
@@ -44749,11 +45155,11 @@ async function buildReport() {
   const provenance = cliProvenance();
   const telemetry = await checkTelemetry();
   const artifacts = {
-    standard: (0, import_node_fs80.existsSync)(projectPath(STANDARD_FILE)),
+    standard: (0, import_node_fs81.existsSync)(projectPath(STANDARD_FILE)),
     // The migration's own answer, not a bare existsSync: /verity:init skips a
     // question on this, so it must be true only when init will carry the file.
     legacyStandard: hasLegacyStandard(repoRoot()),
-    verityMd: (0, import_node_fs80.existsSync)(projectPath(VERITY_MD_FILE))
+    verityMd: (0, import_node_fs81.existsSync)(projectPath(VERITY_MD_FILE))
   };
   const next = [];
   for (const c of prereqs.checks) {
@@ -44764,17 +45170,23 @@ async function buildReport() {
   if (legacyOnly) {
     next.push(`Run "verity init" \u2014 it moves the old GATE.md install, with its Standard (${LEGACY_STANDARD_FILE}), to .verity/.`);
   }
+  const standard = { tracked: committedStandardFile(), version: state?.standardVersion ?? null };
   const missing = [
     !artifacts.standard && !legacyOnly && ".verity/standard.yaml",
     !artifacts.verityMd && !legacyOnly && "VERITY.md"
   ].filter((x) => !!x);
-  if (missing.length === 2) {
-    next.push('Run "verity standard synthesize --push" \u2014 it derives the Standard and VERITY.md from this codebase.');
+  if (!artifacts.standard && !legacyOnly) {
+    next.push(standard.version !== null ? `Run "verity standard pull" \u2014 the team's Standard (v${standard.version}) is on the service, and this machine has no copy of it.` : `Run "verity init" \u2014 it writes the team's Standard from the service, or builds one when the team has none.`);
   } else if (missing.length > 0) {
     next.push(
       `Missing ${missing.join(" and ")}. Run "verity standard synthesize --force" to regenerate \u2014 note that replaces the Standard.`
     );
   }
+  if (standard.tracked) {
+    next.push(
+      '.verity/standard.yaml is tracked in git. Verity keeps it on each machine now, and reviews read the Standard on the service. Run "verity standard untrack" to stop tracking it (the file stays on disk; teammates get it back with "verity standard pull").'
+    );
+  }
   const noAnalysisMoment = !hooks.stop && hooks.guardOn.length === 0;
   const configRead = readProjectConfig();
   if (configRead.refused) next.push(configRefusalMessage(configRead.refused));
@@ -44852,6 +45264,7 @@ async function buildReport() {
     artifacts,
     memory: memory2,
     trackedState,
+    standard,
     next
   };
 }
@@ -44886,11 +45299,14 @@ function registerDoctorCommand(program2) {
     printInfo(`  Git-moment gate: ${report.hooks.guardOn.length ? report.hooks.guardOn.join(", ") : "off"}`);
     {
       const cfg = readProjectConfig();
-      const formal = cfg.formal === "push";
+      const setting = formalSetting(cfg);
+      const formal = setting.state === "push";
       const tc = formal ? findToolchain() : null;
       const lean = tc ? "\u2713" : installProgressLine() ?? "MISSING \u2014 verity lean install";
-      printInfo(`  Formal verification (push): ${formal ? `on, Lean ${lean} (ranking, model writing and replay run on the Verity service with your login)` : "off"}`);
-      if (cfg.formal_refused) printWarn(`    ${formalRefusalMessage(cfg.formal_refused)}`);
+      const how = setting.source === "default" ? " by default" : setting.source === "env" ? " (VERITY_GIT_MOMENT_FORMAL)" : "";
+      printInfo(`  Formal verification (push): ${formal ? `on${how}, Lean ${lean} (ranking, model writing and replay run on the Verity service with your login)` : `off${how}`}`);
+      if (cfg.formal_off_refused && formal) printWarn(`    ${formalOffRefusalMessage(cfg.formal_off_refused)}`);
+      if (cfg.formal_off_unverified && !formal && setting.source === "config") printWarn(`    ${formalOffUnverifiedNote()}`);
     }
     printInfo(`  Infra (intent/baseline/compact/session-end): ${[report.hooks.intent, report.hooks.baseline, report.hooks.compact, report.hooks.sessionEnd].filter(Boolean).length}/4`);
     printInfo(
@@ -44899,7 +45315,7 @@ function registerDoctorCommand(program2) {
     if (process.platform === "win32") printWarn(WINDOWS_STATIC_NOTE);
     else printInfo("Static analysis: Trivy (dependencies, malicious packages, secrets)");
     printInfo("Artifacts:");
-    printInfo(`  .verity/standard.yaml: ${report.artifacts.standard ? "\u2713" : report.artifacts.legacyStandard ? `not yet (an old GATE.md Standard is at ${LEGACY_STANDARD_FILE}; verity init moves it)` : "missing"}`);
+    printInfo(`  .verity/standard.yaml: ${report.artifacts.standard ? report.standard.tracked ? "\u2713 (tracked in git \u2014 Verity keeps it machine-local now: verity standard untrack)" : "\u2713" : report.artifacts.legacyStandard ? `not yet (an old GATE.md Standard is at ${LEGACY_STANDARD_FILE}; verity init moves it)` : report.standard.version !== null ? `not on this machine (the team's v${report.standard.version} is on the service: verity standard pull)` : "missing"}`);
     printInfo(`  VERITY.md: ${report.artifacts.verityMd ? "\u2713" : "missing"}`);
     printInfo(
       `  .verity/memory/: ${report.memory.trackedFiles > 0 ? `${report.memory.trackedFiles} file(s) tracked in git \u2014 they appear in every diff` : report.memory.posture === "ignored" ? "machine-local \u2713" : "not tracked"}`
@@ -44916,8 +45332,8 @@ function registerDoctorCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-var import_node_fs81 = require("node:fs");
-var import_node_path69 = require("node:path");
+var import_node_fs82 = require("node:fs");
+var import_node_path70 = require("node:path");
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("Remove Verity from this project (skills, hooks, .verity/, VERITY.md)").option("--dry-run", "Show what would be removed without doing it").option("--purge-global", "Also remove ~/.verity/ (deletes saved tokens \u2014 reconnect requires re-registration)").option("--keep-verity-md", "Keep the project root VERITY.md file").action(async (opts) => {
     const dryRun = opts.dryRun ?? false;
@@ -44926,11 +45342,11 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name2 of PROJECT_SKILL_NAMES) {
-      const dir = (0, import_node_path69.join)(skillsRoot, name2);
-      if ((0, import_node_fs81.existsSync)(dir)) {
+      const dir = (0, import_node_path70.join)(skillsRoot, name2);
+      if ((0, import_node_fs82.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name2}/`,
-          apply: () => (0, import_node_fs81.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs82.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -44944,24 +45360,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs81.existsSync)(verityDir)) {
+    if ((0, import_node_fs82.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs81.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs82.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs81.existsSync)(verityMd)) {
+      if ((0, import_node_fs82.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs81.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs82.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs81.existsSync)(path) && (0, import_node_fs81.statSync)(path).isDirectory() && (0, import_node_fs81.readdirSync)(path).length === 0) {
-        (0, import_node_fs81.rmdirSync)(path);
+      if ((0, import_node_fs82.existsSync)(path) && (0, import_node_fs82.statSync)(path).isDirectory() && (0, import_node_fs82.readdirSync)(path).length === 0) {
+        (0, import_node_fs82.rmdirSync)(path);
       }
     };
     actions.push({
@@ -44972,11 +45388,11 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path69.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs81.existsSync)(globalVerityDir)) {
+    const globalVerityDir = (0, import_node_path70.join)(home, ".verity");
+    if (purgeGlobal && (0, import_node_fs82.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs81.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs82.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -45195,8 +45611,8 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs82 = require("node:fs");
-var import_node_path70 = require("node:path");
+var import_node_fs83 = require("node:fs");
+var import_node_path71 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -45236,18 +45652,18 @@ function registerResetCommand(program2) {
       } catch {
       }
     }
-    const purged = purgeVerityDir((0, import_node_path70.basename)(CACHE_DIR), (name2) => name2.startsWith("pending-"));
+    const purged = purgeVerityDir((0, import_node_path71.basename)(CACHE_DIR), (name2) => name2.startsWith("pending-"));
     if (purged === null) printError(`Did not purge ${CACHE_DIR}: it is not a directory inside ${VERITY_DIR}.`);
     const stateDir2 = projectPath(VERITY_DIR);
     const filesToClear = [
-      (0, import_node_path70.basename)(INTENT_FILE),
-      (0, import_node_path70.basename)(HASH_FILE),
-      (0, import_node_path70.basename)(BASELINE_SHA_FILE),
+      (0, import_node_path71.basename)(INTENT_FILE),
+      (0, import_node_path71.basename)(HASH_FILE),
+      (0, import_node_path71.basename)(BASELINE_SHA_FILE),
       ".iteration-count",
       ".last-analysis"
     ];
     for (const name2 of filesToClear) {
-      if (lstatOrNull((0, import_node_path70.join)(stateDir2, name2)) && !replaceInRoot(stateDir2, name2, "")) {
+      if (lstatOrNull((0, import_node_path71.join)(stateDir2, name2)) && !replaceInRoot(stateDir2, name2, "")) {
         printError(`Did not clear ${VERITY_DIR}/${name2}: it is not a regular file inside ${VERITY_DIR}.`);
       }
     }
@@ -45262,29 +45678,29 @@ function registerResetCommand(program2) {
 }
 function lstatOrNull(path) {
   try {
-    return (0, import_node_fs82.lstatSync)(path);
+    return (0, import_node_fs83.lstatSync)(path);
   } catch {
     return null;
   }
 }
 function purgeVerityDir(child, select) {
   const verityDir = projectPath(VERITY_DIR);
-  const dir = (0, import_node_path70.join)(verityDir, child);
+  const dir = (0, import_node_path71.join)(verityDir, child);
   const parent = lstatOrNull(verityDir);
   const st = lstatOrNull(dir);
   if (!st) return 0;
   if (!parent || parent.isSymbolicLink() || !parent.isDirectory()) return null;
   if (st.isSymbolicLink() || !st.isDirectory()) return null;
   try {
-    if ((0, import_node_fs82.realpathSync)(dir) !== (0, import_node_path70.join)((0, import_node_fs82.realpathSync)(verityDir), child)) return null;
+    if ((0, import_node_fs83.realpathSync)(dir) !== (0, import_node_path71.join)((0, import_node_fs83.realpathSync)(verityDir), child)) return null;
   } catch {
     return null;
   }
   let removed = 0;
-  for (const entry of (0, import_node_fs82.readdirSync)(dir, { withFileTypes: true })) {
+  for (const entry of (0, import_node_fs83.readdirSync)(dir, { withFileTypes: true })) {
     if (entry.isDirectory() || !select(entry.name)) continue;
     try {
-      (0, import_node_fs82.unlinkSync)((0, import_node_path70.join)(dir, entry.name));
+      (0, import_node_fs83.unlinkSync)((0, import_node_path71.join)(dir, entry.name));
       removed++;
     } catch {
     }
@@ -45293,7 +45709,7 @@ function purgeVerityDir(child, select) {
 }
 
 // src/commands/reflect.ts
-var import_node_fs83 = require("node:fs");
+var import_node_fs84 = require("node:fs");
 
 // src/lib/reflection-globs.ts
 var MAX_GLOBS = 6;
@@ -45331,7 +45747,7 @@ async function writeNodeToDisk(args2) {
       { treePaths: listTrackedFiles(), recordBaseline: false }
     );
     if (written === 0) return false;
-    return (0, import_node_fs83.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
+    return (0, import_node_fs84.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
   } catch {
     return false;
   }
@@ -45768,7 +46184,7 @@ function registerRunCommand(program2) {
 }
 
 // src/commands/telemetry.ts
-var import_node_fs84 = require("node:fs");
+var import_node_fs85 = require("node:fs");
 var SCOPE = "every Claude Code session on this machine";
 function declineHeaders(why) {
   process.stderr.write(`Verity telemetry is off here: ${why} Nothing is exported from this session.
@@ -45776,7 +46192,7 @@ function declineHeaders(why) {
   process.exitCode = 1;
 }
 async function recordTelemetryChoice(choice) {
-  if (!(0, import_node_fs84.existsSync)(projectPath(SETUP_STATE_FILE))) return;
+  if (!(0, import_node_fs85.existsSync)(projectPath(SETUP_STATE_FILE))) return;
   try {
     if ((await readSetupState())?.telemetry === choice) return;
     await writeSetupState({ telemetry: choice });
@@ -45884,12 +46300,12 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/commands/prove.ts
-var import_node_fs86 = require("node:fs");
-var import_node_path72 = require("node:path");
+var import_node_fs87 = require("node:fs");
+var import_node_path73 = require("node:path");
 
 // src/lib/prove/on-demand-run.ts
-var import_node_fs85 = require("node:fs");
-var import_node_path71 = require("node:path");
+var import_node_fs86 = require("node:fs");
+var import_node_path72 = require("node:path");
 var ON_DEMAND_RUN = `${PROOFS_DIR}/.results/.formal-run.json`;
 var ON_DEMAND_RUN_REUSE_MS = 18 * 6e4;
 function isLocalState2(root) {
@@ -45911,7 +46327,7 @@ function forgetOnDemandRun(root) {
   setFormalRun(null);
   if (!isLocalState2(root)) return;
   try {
-    (0, import_node_fs85.unlinkSync)((0, import_node_path71.join)(root, ON_DEMAND_RUN));
+    (0, import_node_fs86.unlinkSync)((0, import_node_path72.join)(root, ON_DEMAND_RUN));
   } catch {
   }
 }
@@ -46088,7 +46504,7 @@ function registerProveCommand(program2) {
       process.exit(2);
     }
     const limit = Math.max(1, Math.min(50, Number(opts.limit) || 10));
-    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path72.relative)(root, (0, import_node_path72.resolve)(p)) || ".") });
+    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path73.relative)(root, (0, import_node_path73.resolve)(p)) || ".") });
     if (opts.hint && paths.length === 0) {
       const hit = hintMatches(root, opts.hint);
       if (hit.files.length > 0) {
@@ -46142,7 +46558,7 @@ function registerProveCommand(program2) {
   });
   prove.command("check [model]").description("Elaborate a model (or every model) with the local Lean toolchain and report each property").option("--timeout <ms>", "Per-model timeout in ms", "120000").option("--json", "Machine-readable output").action((model, opts) => {
     const root = repoRoot();
-    if (!(0, import_node_fs86.existsSync)((0, import_node_path72.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs87.existsSync)((0, import_node_path73.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -46166,7 +46582,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
     const reports = [];
     for (const f of files) {
       const report = checkModel(tc, root, f, { timeoutMs: Math.max(1e3, Number(opts.timeout) || 12e4) });
-      report.file = (0, import_node_path72.relative)(root, f);
+      report.file = (0, import_node_path73.relative)(root, f);
       reports.push(report);
       try {
         writeResult(root, report);
@@ -46204,7 +46620,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
       printError("Not logged in \u2014 replays run on the Verity service. Run `verity login` first.");
       process.exit(2);
     }
-    if (!(0, import_node_fs86.existsSync)((0, import_node_path72.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs87.existsSync)((0, import_node_path73.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -46243,7 +46659,7 @@ ${report.error ?? ""}`);
         process.exit(2);
       }
     }
-    const modelSource = readRegularFileInRoot(root, (0, import_node_path72.relative)(root, file), 512 * 1024);
+    const modelSource = readRegularFileInRoot(root, (0, import_node_path73.relative)(root, file), 512 * 1024);
     if (!opts.json) printInfo(`replaying ${targets.length} counterexample(s) of ${model} in network-less containers (${Math.min(targets.length, REPLAY_CONCURRENCY)} at a time)\u2026`);
     const outcomes = await mapPool(targets, REPLAY_CONCURRENCY, async (p) => {
       const brief = buildReplayBrief(root, report, p, modelSource.ok ? modelSource.content : "");
@@ -46264,7 +46680,7 @@ ${report.error ?? ""}`);
   });
   prove.command("auto [files...]").description("The formal phase the pre-push guard runs: select one risky symbol among changed files, generate a model, check it, replay counterexamples (default files: the commits ahead of upstream)").option("--deadline <ms>", "Budget for the whole phase", "170000").option("--json", "Machine-readable output").action(async (paths, opts) => {
     const root = repoRoot();
-    let files = paths.map((p) => (0, import_node_path72.relative)(root, (0, import_node_path72.resolve)(p)));
+    let files = paths.map((p) => (0, import_node_path73.relative)(root, (0, import_node_path73.resolve)(p)));
     if (files.length === 0) {
       const ahead = runGitSync(root, ["diff", "--name-only", "@{upstream}...HEAD"]);
       const fallback = ahead.ok ? ahead : runGitSync(root, ["diff", "--name-only", "HEAD~1..HEAD"]);
@@ -46338,7 +46754,7 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
     let revise;
     if (opts.revise) {
       const existing = resolveModelFile(root, opts.revise);
-      const src = existing ? readRegularFileInRoot(root, (0, import_node_path72.relative)(root, existing), 64 * 1024) : null;
+      const src = existing ? readRegularFileInRoot(root, (0, import_node_path73.relative)(root, existing), 64 * 1024) : null;
       if (!src || !src.ok || !opts.note) {
         printError("--revise needs an existing model under Models/ and --note - with what the replay showed on stdin");
         process.exit(2);
@@ -46387,8 +46803,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("waive <file>").description("Dismiss the remembered formal finding(s) on a file for its current bytes \u2014 the accepted-risk path for a formal block").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action((file, opts) => {
     const root = repoRoot();
-    const rel0 = (0, import_node_path72.relative)(root, (0, import_node_path72.isAbsolute)(file) ? file : (0, import_node_path72.join)(root, file)).replace(/\\/g, "/");
-    const rel = rel0.startsWith("..") || (0, import_node_path72.isAbsolute)(rel0) ? null : rel0;
+    const rel0 = (0, import_node_path73.relative)(root, (0, import_node_path73.isAbsolute)(file) ? file : (0, import_node_path73.join)(root, file)).replace(/\\/g, "/");
+    const rel = rel0.startsWith("..") || (0, import_node_path73.isAbsolute)(rel0) ? null : rel0;
     if (!rel) {
       printError(`${file} is not inside this repository`);
       process.exit(2);
@@ -46404,8 +46820,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("hash <file>").description("Print the sha256 of a file, for a model header (Verity.model \u2026 sha256). Path is REPO-relative, as in the header").action((file) => {
     const root = repoRoot();
-    const rel = (0, import_node_path72.relative)(root, (0, import_node_path72.isAbsolute)(file) ? file : (0, import_node_path72.join)(root, file));
-    const digest = rel.startsWith("..") || (0, import_node_path72.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
+    const rel = (0, import_node_path73.relative)(root, (0, import_node_path73.isAbsolute)(file) ? file : (0, import_node_path73.join)(root, file));
+    const digest = rel.startsWith("..") || (0, import_node_path73.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
     if (!digest) {
       printError(`Cannot hash ${file}: it must be a regular file inside this repository (not a symlink)`);
       process.exit(2);
@@ -46439,10 +46855,10 @@ function refreshScaffold(root) {
 }
 
 // src/commands/lean.ts
-var import_node_fs87 = require("node:fs");
+var import_node_fs88 = require("node:fs");
 var import_node_child_process24 = require("node:child_process");
 var import_node_os16 = require("node:os");
-var import_node_path73 = require("node:path");
+var import_node_path74 = require("node:path");
 function registerLeanCommand(program2) {
   const lean = program2.command("lean").description("The Lean 4 toolchain formal verification needs (managed download, pinned by this CLI)");
   lean.command("status").option("--json", "Machine-readable output").description("Which toolchain would run, and whether it matches the pinned version").action((opts) => {
@@ -46461,7 +46877,7 @@ function registerLeanCommand(program2) {
     const bg = readInstallState();
     const background = bg ? { ...bg, running: bg.state === "running" && installRunning() } : null;
     if (opts.json) {
-      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs87.existsSync)((0, import_node_path73.join)(managed, "bin")), asset: leanAssetName(), background });
+      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs88.existsSync)((0, import_node_path74.join)(managed, "bin")), asset: leanAssetName(), background });
       return;
     }
     printInfo(`pinned: ${LEAN_TOOLCHAIN}`);
@@ -46482,7 +46898,7 @@ function registerLeanCommand(program2) {
       process.exit(2);
     }
     const dir = pinnedVersionDir();
-    if ((0, import_node_fs87.existsSync)((0, import_node_path73.join)(dir, "bin", "lake")) && !opts.force) {
+    if ((0, import_node_fs88.existsSync)((0, import_node_path74.join)(dir, "bin", "lake")) && !opts.force) {
       printInfo(`already installed at ${dir}`);
       return;
     }
@@ -46518,20 +46934,20 @@ function registerLeanCommand(program2) {
   });
   lean.command("remove").description("Delete the Verity-managed toolchain for the pinned version").action(() => {
     const dir = pinnedVersionDir();
-    if (!(0, import_node_fs87.existsSync)(dir)) {
+    if (!(0, import_node_fs88.existsSync)(dir)) {
       printInfo("nothing to remove");
       return;
     }
-    (0, import_node_fs87.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs88.rmSync)(dir, { recursive: true, force: true });
     printInfo(`removed ${dir}`);
   });
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.35.3").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.35.5").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
   const isTelemetryHelper = actionCommand.name() === "headers" && actionCommand.parent?.name() === "telemetry";
   if (!isTelemetryHelper) {
-    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.3");
+    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.5");
   }
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {