@codacy/verity-cli 0.35.4 → 0.35.5

package/bin/verity.js

@@ -15351,7 +15351,7 @@ function pinRefusalMessage(verdict, targetUrl) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.35.4" : "dev";
+    return true ? "0.35.5" : "dev";
   } catch {
     return "dev";
   }
@@ -19369,26 +19369,43 @@ function readProjectConfig() {
       cfg = { ...rest, turn_review_refused: refused2 };
     }
   }
+  if (cfg.formal === "off" && cfg.path) {
+    const refused2 = repoControlledRefusal(cfg.path);
+    if (refused2 === "unverified") {
+      cfg = { ...cfg, formal_off_unverified: true };
+    } else if (refused2) {
+      const { formal: _dropped, ...rest } = cfg;
+      cfg = { ...rest, formal_off_refused: refused2 };
+    }
+  }
   return cfg;
 }
-function turnReviewRefusalMessage(reason) {
+function formalOffUnverifiedNote() {
+  return 'off-unverified: .verity/config.json says "off" and git could not confirm that the repository does not control it, so the "off" is kept and the formal check does not run';
+}
+function formalOffRefusalMessage(reason) {
   switch (reason) {
     case "tracked":
-      return '.verity/config.json is tracked in git, so its turn_review "off" is ignored (a repository cannot switch the review off) \u2014 untrack it with: git rm --cached .verity/config.json';
+      return '.verity/config.json is tracked in git, so its formal "off" is ignored (a repository cannot switch formal verification off). To make your "off" count, untrack the file: git rm --cached .verity/config.json';
     case "symlink":
-      return '.verity/config.json is reached through a symlink, so its turn_review "off" is ignored';
-    case "unverified":
-      return 'could not confirm with git that .verity/config.json is untracked, so its turn_review "off" is ignored';
+      return '.verity/config.json is reached through a symlink, so its formal "off" is ignored';
   }
 }
-function formalRefusalMessage(reason) {
+function formalSetting(cfg, env = process.env) {
+  const fromEnv = env.VERITY_GIT_MOMENT_FORMAL;
+  if (fromEnv === "off" || fromEnv === "push") return { state: fromEnv, source: "env" };
+  if (cfg.formal === "off") return { state: "off", source: "config" };
+  if (cfg.formal === "push") return { state: "push", source: "config" };
+  return { state: "push", source: "default" };
+}
+function turnReviewRefusalMessage(reason) {
   switch (reason) {
     case "tracked":
-      return ".verity/config.json is tracked in git, so its formal setting is ignored (a repository cannot switch formal verification on) \u2014 untrack it with: git rm --cached .verity/config.json";
+      return '.verity/config.json is tracked in git, so its turn_review "off" is ignored (a repository cannot switch the review off) \u2014 untrack it with: git rm --cached .verity/config.json';
     case "symlink":
-      return ".verity/config.json is reached through a symlink, so its formal setting is ignored";
+      return '.verity/config.json is reached through a symlink, so its turn_review "off" is ignored';
     case "unverified":
-      return "could not confirm with git that .verity/config.json is untracked, so its formal setting is ignored";
+      return 'could not confirm with git that .verity/config.json is untracked, so its turn_review "off" is ignored';
   }
 }
 function writeProjectConfig(patch) {
@@ -26603,11 +26620,15 @@ function registerConfigCommands(program2) {
     }
     printInfo(pluginMode ? "It applies from the next turn." : "It applies from the next Claude Code session (Claude Code reads hooks when a session starts).");
   });
-  config.command("formal [state]").description('Get or set formal verification at push: "push" or "off" (needs Lean \u2014 verity lean status)').action((state) => {
+  config.command("formal [state]").description('Get or set formal verification at push: "push" (the default) or "off" (needs Lean \u2014 verity lean status)').action((state) => {
     if (state === void 0) {
       const cfg = readProjectConfig();
-      process.stdout.write((cfg.formal === "push" ? "push" : "off") + "\n");
-      if (cfg.formal_refused) printWarn(formalRefusalMessage(cfg.formal_refused));
+      const setting = formalSetting(cfg);
+      process.stdout.write(setting.state + "\n");
+      if (cfg.formal_off_refused && setting.source === "default") printWarn(formalOffRefusalMessage(cfg.formal_off_refused));
+      else if (setting.source === "default") printInfo("On by default. To turn it off for this checkout, run: verity config formal off");
+      if (setting.source === "env") printInfo("Set by VERITY_GIT_MOMENT_FORMAL in this environment");
+      if (cfg.formal_off_unverified && setting.source === "config") printWarn(formalOffUnverifiedNote());
       return;
     }
     if (state !== "push" && state !== "off") {
@@ -26615,13 +26636,18 @@ function registerConfigCommands(program2) {
       process.exit(1);
     }
     writeProjectConfig({ formal: state === "push" ? "push" : "off" });
-    const refused2 = state === "push" ? readProjectConfig().formal_refused : void 0;
-    if (refused2) {
-      printWarn(`Formal verification at push: still off \u2014 ${formalRefusalMessage(refused2)}`);
+    const after = readProjectConfig();
+    const offRefused = state === "off" && formalSetting(after).state === "push" ? after.formal_off_refused : void 0;
+    if (offRefused) {
+      printWarn(`Formal verification at push: still on \u2014 ${formalOffRefusalMessage(offRefused)}`);
       return;
     }
-    printInfo(state === "push" ? "Formal verification at push: on for this checkout (Lean must be installed \u2014 verity lean status)" : "Formal verification at push: off");
+    printInfo(state === "push" ? "Formal verification at push: on for this checkout (Lean must be installed \u2014 verity lean status)" : "Formal verification at push: off for this checkout");
     if (state === "push") printInfo("The phase runs with your Verity login (a push without one is skipped and says so: not-logged-in)");
+    const env = process.env.VERITY_GIT_MOMENT_FORMAL;
+    if ((env === "off" || env === "push") && env !== state) {
+      printWarn(`VERITY_GIT_MOMENT_FORMAL=${env} in this environment overrides the file while it is set`);
+    }
   });
   config.command("verbose [state]").description('Get or set the line Verity prints when a turn has nothing new to review: "on" or "off" (the default)').action((state) => {
     if (state === void 0) {
@@ -29780,11 +29806,11 @@ async function readStopHookStdin() {
   return new Promise((resolve10) => {
     const chunks = [];
     let size = 0;
-    let settled = false;
+    let settled2 = false;
     let timer;
     const settle = (result) => {
-      if (settled) return;
-      settled = true;
+      if (settled2) return;
+      settled2 = true;
       if (timer) clearTimeout(timer);
       process.stdin.off("data", onData);
       process.stdin.off("end", onEnd);
@@ -37129,7 +37155,7 @@ function runAsync(tc, cwd, args2, timeoutMs) {
     let stdout = "";
     let stderr = "";
     let timedOut = false;
-    let settled = false;
+    let settled2 = false;
     const kill = () => {
       try {
         if (posix && child.pid) process.kill(-child.pid, "SIGKILL");
@@ -37148,8 +37174,8 @@ function runAsync(tc, cwd, args2, timeoutMs) {
       if (stderr.length < MAX) stderr += d.toString("utf-8");
     });
     const finish = (ok, message) => {
-      if (settled) return;
-      settled = true;
+      if (settled2) return;
+      settled2 = true;
       clearTimeout(timer);
       if (ok) resolve10({ ok: true, stdout, stderr: "", durationMs: Date.now() - started, timedOut: false });
       else resolve10({ ok: false, stdout, stderr: stderr || message || "", durationMs: Date.now() - started, timedOut });
@@ -37658,16 +37684,138 @@ function resumeInterruptedInstall(opts) {
   return shouldStartBackgroundInstall({ formal: opts.formal, env, free: opts.free }).start && startBackgroundInstall({ cli: opts.cli, env, run: opts.run });
 }
 
+// src/lib/prove/formal-default.ts
+var import_node_fs64 = require("node:fs");
+var import_node_path52 = require("node:path");
+var NOTICE_MARKER = ".formal-default-notice";
+var LEAN_MARKER = ".formal-lean-checked";
+function markerPath3(name2) {
+  return (0, import_node_path52.join)(verityHome(), name2);
+}
+function writeMarker(name2, now) {
+  try {
+    (0, import_node_fs64.mkdirSync)(verityHome(), { recursive: true, mode: 448 });
+    (0, import_node_fs64.writeFileSync)(markerPath3(name2), now.toISOString() + "\n");
+  } catch {
+  }
+}
+function formalDefaultNoticeDue() {
+  return !(0, import_node_fs64.existsSync)(markerPath3(NOTICE_MARKER));
+}
+function recordFormalDefaultNotice(now = /* @__PURE__ */ new Date()) {
+  writeMarker(NOTICE_MARKER, now);
+}
+var BLOCKED_LINES = {
+  "opted-out": () => "VERITY_NO_LEAN=1 is set, so Verity does not download Lean 4. Without Lean 4, a push skips the formal check.",
+  ci: () => "This is a CI environment, so Verity does not download Lean 4 (VERITY_LEAN=1 allows it). Without Lean 4, a push skips the formal check.",
+  disk: (detail2) => `Lean 4 needs more disk space${detail2 ? ` (${detail2})` : ""}. Until Lean 4 is installed, a push skips the formal check. Free some space, then run: verity lean install`,
+  "no-release": () => "Lean 4 has no release for this machine, so a push skips the formal check."
+};
+function leanLine(lean) {
+  switch (lean.kind) {
+    case "started":
+      return "Lean 4 (about 800 MB) is downloading in the background. To see the progress, run: verity lean status";
+    case "downloading":
+      return "Lean 4 is downloading in the background. To see the progress, run: verity lean status";
+    case "failed":
+      return "The Lean 4 download could not start. Until Lean 4 is installed, a push skips the formal check. To install it, run: verity lean install";
+    case "previous-failed":
+      return "The last Lean 4 download failed. Until Lean 4 is installed, a push skips the formal check. To try again, run: verity lean install";
+    case "blocked":
+      return BLOCKED_LINES[lean.why](lean.detail);
+    case "installed":
+    case "unknown":
+      return null;
+  }
+}
+function formalDefaultUserMessage(lean, offRefused) {
+  const aboutLean = leanLine(lean);
+  return [
+    ...offRefused ? [`Verity: ${formalOffRefusalMessage(offRefused)}`] : [],
+    "Verity: formal verification at push is now on by default.",
+    "At a push, Verity can check a small Lean model of the riskiest changed function and replay a counterexample on the real code. For the replay, the source of that function goes to the Verity service.",
+    "Only a reproduced bug can block a push.",
+    ...aboutLean ? [aboutLean] : [],
+    "To turn it off for this project, run: verity config formal off"
+  ].join("\n");
+}
+var AGENT_LINE = "Formal verification at push is on by default in this project. At a push, Verity can model one changed function in Lean, so a push can take longer. A block from it means that the counterexample was reproduced on the real code. If the user wants it off, the command is `verity config formal off`.";
+function settled(lean) {
+  return lean.kind === "installed" || lean.kind === "blocked" && lean.why === "no-release";
+}
+var LEAN_RECHECK_MS = 7 * 24 * 60 * 60 * 1e3;
+function settledRecently(now) {
+  try {
+    const at = Date.parse((0, import_node_fs64.readFileSync)(markerPath3(LEAN_MARKER), "utf-8").trim());
+    return Number.isFinite(at) && now.getTime() - at >= 0 && now.getTime() - at < LEAN_RECHECK_MS;
+  } catch {
+    return false;
+  }
+}
+function leanAtStart(opts, now, probeAgain) {
+  const { env } = opts;
+  if (env.VERITY_NO_LEAN === "1") return { kind: "blocked", why: "opted-out" };
+  if (env.CI && env.VERITY_LEAN !== "1") return { kind: "blocked", why: "ci" };
+  const state = readInstallState(env);
+  if (state?.state === "failed") return { kind: "previous-failed" };
+  if (state?.state === "done") return { kind: "installed" };
+  if (state?.state === "running") return installRunning(env) ? { kind: "downloading" } : { kind: "unknown" };
+  if (!probeAgain && settledRecently(now)) return { kind: "unknown" };
+  const lean = probeAndStart(opts);
+  if (settled(lean)) writeMarker(LEAN_MARKER, now);
+  return lean;
+}
+function probeAndStart(opts) {
+  const { env } = opts;
+  const d = shouldStartBackgroundInstall({ formal: "push", env, free: opts.free });
+  if (d.start) {
+    const started = startBackgroundInstall({ cli: opts.cli, env, ...opts.run ? { run: opts.run } : {} });
+    return started ? { kind: "started" } : { kind: "failed" };
+  }
+  switch (d.why) {
+    case "installed":
+      return { kind: "installed" };
+    case "running":
+      return { kind: "downloading" };
+    case "opted-out":
+    case "ci":
+    case "no-release":
+      return { kind: "blocked", why: d.why };
+    case "disk":
+      return { kind: "blocked", why: "disk", ...d.detail ? { detail: d.detail } : {} };
+    case "formal-off":
+      return { kind: "unknown" };
+  }
+}
+function formalAtSessionStart(opts) {
+  const env = opts.env ?? process.env;
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const none = { userMsg: null, agentLine: null, leanStarted: false };
+  const setting = formalSetting(opts.cfg, env);
+  if (setting.state !== "push") return none;
+  const noticeDue = setting.source === "default" && formalDefaultNoticeDue();
+  let lean;
+  try {
+    lean = leanAtStart({ cli: opts.cli, env, ...opts.free !== void 0 ? { free: opts.free } : {}, ...opts.run ? { run: opts.run } : {} }, now, noticeDue);
+  } catch (err2) {
+    lean = { kind: "failed" };
+    logEvent("formal_default_lean_failed", { error: String(err2?.message ?? err2).slice(0, 200) });
+  }
+  const leanStarted = lean.kind === "started";
+  if (!noticeDue) return { ...none, leanStarted };
+  return { userMsg: formalDefaultUserMessage(lean, opts.cfg.formal_off_refused), agentLine: AGENT_LINE, leanStarted };
+}
+
 // src/commands/baseline.ts
-var import_node_fs66 = require("node:fs");
-var import_node_path54 = require("node:path");
+var import_node_fs67 = require("node:fs");
+var import_node_path55 = require("node:path");
 
 // src/lib/skew-notice.ts
-var import_node_fs64 = require("node:fs");
-var import_node_path52 = require("node:path");
+var import_node_fs65 = require("node:fs");
+var import_node_path53 = require("node:path");
 var MARKER2 = ".skew-notice.json";
-function markerPath3() {
-  return (0, import_node_path52.join)(verityHome(), MARKER2);
+function markerPath4() {
+  return (0, import_node_path53.join)(verityHome(), MARKER2);
 }
 function today(now) {
   const y = now.getFullYear();
@@ -37677,7 +37825,7 @@ function today(now) {
 }
 function skewNoticeDue(skew, now = /* @__PURE__ */ new Date()) {
   try {
-    const seen = JSON.parse((0, import_node_fs64.readFileSync)(markerPath3(), "utf-8"));
+    const seen = JSON.parse((0, import_node_fs65.readFileSync)(markerPath4(), "utf-8"));
     return !(seen.global === skew.global && seen.hooks === skew.hooks && seen.day === today(now));
   } catch {
     return true;
@@ -37685,15 +37833,15 @@ function skewNoticeDue(skew, now = /* @__PURE__ */ new Date()) {
 }
 function recordSkewNotice(skew, now = /* @__PURE__ */ new Date()) {
   try {
-    (0, import_node_fs64.mkdirSync)(verityHome(), { recursive: true, mode: 448 });
-    (0, import_node_fs64.writeFileSync)(markerPath3(), JSON.stringify({ global: skew.global, hooks: skew.hooks, day: today(now) }) + "\n");
+    (0, import_node_fs65.mkdirSync)(verityHome(), { recursive: true, mode: 448 });
+    (0, import_node_fs65.writeFileSync)(markerPath4(), JSON.stringify({ global: skew.global, hooks: skew.hooks, day: today(now) }) + "\n");
   } catch {
   }
 }
 
 // src/lib/project-skills.ts
-var import_node_fs65 = require("node:fs");
-var import_node_path53 = require("node:path");
+var import_node_fs66 = require("node:fs");
+var import_node_path54 = require("node:path");
 var PROJECT_SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -37719,14 +37867,14 @@ var LEGACY_SKILL_NAMES = [
 var ALL = [...PROJECT_SKILL_NAMES, ...LEGACY_SKILL_NAMES];
 function staleProjectSkills() {
   const root = projectPath(".claude/skills");
-  if (!(0, import_node_fs65.existsSync)(root)) return [];
-  return ALL.filter((name2) => (0, import_node_fs65.existsSync)((0, import_node_path53.join)(root, name2)));
+  if (!(0, import_node_fs66.existsSync)(root)) return [];
+  return ALL.filter((name2) => (0, import_node_fs66.existsSync)((0, import_node_path54.join)(root, name2)));
 }
 function removeProjectSkills() {
   const root = projectPath(".claude/skills");
   const removed = [];
   for (const name2 of staleProjectSkills()) {
-    (0, import_node_fs65.rmSync)((0, import_node_path53.join)(root, name2), { recursive: true, force: true });
+    (0, import_node_fs66.rmSync)((0, import_node_path54.join)(root, name2), { recursive: true, force: true });
     removed.push(name2);
   }
   return removed;
@@ -37761,7 +37909,7 @@ function registerBaselineCommands(program2) {
       const loginWarning = "Until they have, do not send them to run `verity login` in a terminal: that runs the global one, which can sign this machine in to a different server.";
       const skewNote = !skew ? null : skewLoud ? `Before anything else, including /verity:init's questions, tell the user their global \`verity\` is ${skew.global}, the hooks run ${skew.hooks}, and \`${skew.remedy}\` fixes it. ${loginWarning}` : `The user's global \`verity\` is ${skew.global} and the hooks run ${skew.hooks}; \`${skew.remedy}\` fixes it. They were already told today, so do not repeat it unprompted \u2014 mention it only where it matters, such as before suggesting a \`verity\` command for their terminal. ${loginWarning}`;
       if (!verityConfigured()) {
-        if (isMachineStore((0, import_node_path54.join)(repoRoot(), VERITY_DIR))) process.exit(0);
+        if (isMachineStore((0, import_node_path55.join)(repoRoot(), VERITY_DIR))) process.exit(0);
         const how = isPluginInvocation() ? "Tell the user to run /verity:init \u2014 they type it; you cannot invoke it." : "Tell the user to run `verity init` in their terminal.";
         const lines = [
           `Verity is installed but this project is not set up yet, so the quality gate will not review anything here. ${how}`
@@ -37795,17 +37943,20 @@ function registerBaselineCommands(program2) {
       let memoryMsg = null;
       let memoryAgentLine = null;
       const memoryNotice = projectPath(`${VERITY_DIR}/.memory-fence-notice`);
-      if (realStart && !(0, import_node_fs66.existsSync)(memoryNotice)) {
+      if (realStart && !(0, import_node_fs67.existsSync)(memoryNotice)) {
         const trackedGraph = memoryOptOut() ? 0 : committedMemoryFiles().length;
         if (trackedGraph > 0) {
           memoryMsg = `Verity: this project commits its knowledge base (${trackedGraph} files under .verity/memory/), so Verity's generated notes show up in every diff and pull request. Run \`verity memory untrack\` to keep them on disk but out of git, or \`verity memory track\` to keep committing them on purpose.`;
           memoryAgentLine = `This project has ${trackedGraph} knowledge-graph files tracked in git under .verity/memory/. As of Verity 0.32.6 the graph is machine-local by default \u2014 it is rebuilt from the service, and committing it puts generated notes in every pull request. If the user wants that stopped, run \`verity memory untrack\` for them: it keeps every file on disk and stages their removal from the index, so they only need to commit \u2014 and their teammates' working copies will vanish on the next pull and re-sync from the service, which is expected. If they would rather keep committing it, \`verity memory track\` records that and nothing will offer again.`;
           try {
-            (0, import_node_fs66.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
+            (0, import_node_fs67.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
           } catch {
           }
         }
       }
+      const formalStart = realStart ? formalAtSessionStart({ cli: process.argv[1], cfg: readProjectConfig() }) : null;
+      const formalMsg = formalStart?.userMsg ?? null;
+      const formalAgentLine = formalStart?.agentLine ?? null;
       if (isPluginInvocation() && realStart) {
         const installed2 = activePluginVersion();
         const state = await readSetupState().catch(() => null);
@@ -37829,10 +37980,11 @@ function registerBaselineCommands(program2) {
           }
         }
         if (memoryAgentLine) notices.push(memoryAgentLine);
+        if (formalAgentLine) notices.push(formalAgentLine);
         if (notices.length > 0 || skewMsg) {
           process.stdout.write(
             JSON.stringify({
-              ...userMsg || skewMsg || memoryMsg ? { systemMessage: [skewMsg, userMsg, memoryMsg].filter(Boolean).join("\n") } : {},
+              ...userMsg || skewMsg || memoryMsg || formalMsg ? { systemMessage: [skewMsg, userMsg, memoryMsg, formalMsg].filter(Boolean).join("\n") } : {},
               hookSpecificOutput: {
                 hookEventName: "SessionStart",
                 additionalContext: notices.join("\n")
@@ -37840,17 +37992,20 @@ function registerBaselineCommands(program2) {
             }) + "\n"
           );
           if (skew && skewMsg) recordSkewNotice(skew);
+          if (formalMsg) recordFormalDefaultNotice();
         }
-      } else if (memoryMsg) {
+      } else if (memoryMsg || formalMsg) {
+        const agentLines = [memoryAgentLine, formalAgentLine].filter(Boolean).join("\n");
         process.stdout.write(
           JSON.stringify({
-            systemMessage: memoryMsg,
+            systemMessage: [memoryMsg, formalMsg].filter(Boolean).join("\n"),
             hookSpecificOutput: {
               hookEventName: "SessionStart",
-              ...memoryAgentLine ? { additionalContext: memoryAgentLine } : {}
+              ...agentLines ? { additionalContext: agentLines } : {}
             }
           }) + "\n"
         );
+        if (formalMsg) recordFormalDefaultNotice();
       }
       if (deferredToPlugin("baseline capture", session ?? null)) {
         process.exit(0);
@@ -37858,7 +38013,7 @@ function registerBaselineCommands(program2) {
       const authForScope = await resolveToken(program2.opts().token);
       const scopeToken = authForScope.ok ? authForScope.data.token : void 0;
       if (authForScope.ok && pullsAtSessionStart(authForScope.data, source2)) spawnBackgroundPull();
-      if (source2 !== "compact") resumeInterruptedInstall({ cli: process.argv[1], formal: readProjectConfig().formal });
+      if (source2 !== "compact") resumeInterruptedInstall({ cli: process.argv[1], formal: formalSetting(readProjectConfig()).state });
       const scopeSession = session;
       const result = captureBaseline({ sessionId: sessionScopeKey(scopeToken, scopeSession), source: source2 });
       logEvent("baseline_capture", {
@@ -37904,31 +38059,31 @@ function hookSource(value) {
 }
 
 // src/commands/review.ts
-var import_node_fs67 = require("node:fs");
-var import_node_path55 = require("node:path");
+var import_node_fs68 = require("node:fs");
+var import_node_path56 = require("node:path");
 function containReviewPaths(paths, base) {
   const kept = [];
   const refused2 = [];
   for (const raw of paths) {
-    const candidate = (0, import_node_path55.isAbsolute)(raw) ? relativeForm(base, raw) : raw;
+    const candidate = (0, import_node_path56.isAbsolute)(raw) ? relativeForm(base, raw) : raw;
     if (candidate === "" || resolveInside(base, candidate) === null) refused2.push(raw);
     else kept.push(candidate);
   }
   return { kept, refused: refused2 };
 }
 function relativeForm(base, abs) {
-  const lexical = (0, import_node_path55.relative)(base, abs);
-  if (!(lexical === ".." || lexical.startsWith(`..${import_node_path55.sep}`) || (0, import_node_path55.isAbsolute)(lexical))) return lexical;
+  const lexical = (0, import_node_path56.relative)(base, abs);
+  if (!(lexical === ".." || lexical.startsWith(`..${import_node_path56.sep}`) || (0, import_node_path56.isAbsolute)(lexical))) return lexical;
   try {
-    let dir = (0, import_node_path55.dirname)(abs);
-    let rest = (0, import_node_path55.basename)(abs);
-    while (!(0, import_node_fs67.existsSync)(dir)) {
-      const up = (0, import_node_path55.dirname)(dir);
+    let dir = (0, import_node_path56.dirname)(abs);
+    let rest = (0, import_node_path56.basename)(abs);
+    while (!(0, import_node_fs68.existsSync)(dir)) {
+      const up = (0, import_node_path56.dirname)(dir);
       if (up === dir) return lexical;
-      rest = (0, import_node_path55.join)((0, import_node_path55.basename)(dir), rest);
+      rest = (0, import_node_path56.join)((0, import_node_path56.basename)(dir), rest);
       dir = up;
     }
-    return (0, import_node_path55.relative)((0, import_node_fs67.realpathSync)(base), (0, import_node_path55.join)((0, import_node_fs67.realpathSync)(dir), rest));
+    return (0, import_node_path56.relative)((0, import_node_fs68.realpathSync)(base), (0, import_node_path56.join)((0, import_node_fs68.realpathSync)(dir), rest));
   } catch {
     return lexical;
   }
@@ -37967,7 +38122,7 @@ async function runReview(opts, globals) {
   const changedFiles = changed.kept;
   const analyzable = filterAnalyzable(allFiles);
   const securityFiles = filterSecurity(allFiles);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs67.existsSync)(f) || resolveFile(f) !== null);
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs68.existsSync)(f) || resolveFile(f) !== null);
   const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
@@ -38038,12 +38193,12 @@ async function runReview(opts, globals) {
 }
 
 // src/commands/guard.ts
-var import_node_fs69 = require("node:fs");
-var import_node_path58 = require("node:path");
+var import_node_fs70 = require("node:fs");
+var import_node_path59 = require("node:path");
 
 // src/lib/vendored.ts
-var import_node_fs68 = require("node:fs");
-var import_node_path56 = require("node:path");
+var import_node_fs69 = require("node:fs");
+var import_node_path57 = require("node:path");
 var INSTALLED_SKILL = /^\.claude\/skills\/(verity-[a-z0-9-]+)\/(.+)$/;
 function dataDirOrNull() {
   try {
@@ -38058,7 +38213,7 @@ function shippedSkillFile(path, dataDir = dataDirOrNull()) {
   const [, skill, rel] = m;
   if (rel.split("/").some((seg) => seg === ".." || seg === ".")) return null;
   try {
-    return (0, import_node_fs68.readFileSync)((0, import_node_path56.join)(dataDir, "skills", skill, rel), "utf8");
+    return (0, import_node_fs69.readFileSync)((0, import_node_path57.join)(dataDir, "skills", skill, rel), "utf8");
   } catch {
     return null;
   }
@@ -38097,10 +38252,10 @@ function summarizeFindings(response) {
     return out2;
   });
 }
-function finishOneShot(settled) {
-  if (!settled) return { status: "pending" };
-  if (!settled.ok) return { status: "failed" };
-  const r = settled.response;
+function finishOneShot(settled2) {
+  if (!settled2) return { status: "pending" };
+  if (!settled2.ok) return { status: "failed" };
+  const r = settled2.response;
   return {
     status: "arrived",
     ...typeof r.agent_attestation === "string" ? { attestation: r.agent_attestation } : {},
@@ -38111,13 +38266,13 @@ function finishOneShot(settled) {
 async function runAgentReview(options) {
   const now = options.now ?? Date.now;
   const remaining = () => options.deadlineMs - (now() - options.startedAt);
-  let settled = null;
+  let settled2 = null;
   const oneShotDone = options.oneShot.then(
     (outcome) => {
-      settled = outcome;
+      settled2 = outcome;
     },
     () => {
-      settled = { ok: false };
+      settled2 = { ok: false };
     }
   );
   if (remaining() < MIN_AGENT_START_MS) return { kind: "skipped", reason: "not enough time left after prep" };
@@ -38139,7 +38294,7 @@ async function runAgentReview(options) {
     if (turn >= MAX_TURNS || remaining() < MIN_TURN_MS) break;
     const results = await options.executeTools(calls);
     let oneShot;
-    const current = settled;
+    const current = settled2;
     if (current && sentOneShot === "pending") {
       oneShot = current.ok ? { status: "arrived", findings: summarizeFindings(current.response) } : { status: "failed" };
       sentOneShot = oneShot.status;
@@ -38154,13 +38309,13 @@ async function runAgentReview(options) {
     calls = next.data.calls ?? [];
     done = next.data.done;
   }
-  if (!settled) {
+  if (!settled2) {
     const wait = Math.max(0, remaining() - FINISH_TIMEOUT_MS);
     await Promise.race([oneShotDone, new Promise((resolve10) => setTimeout(resolve10, wait))]);
   }
   const finished = await options.http.post(
     "/agent-review/finish",
-    { state, session_id: options.sessionId, one_shot: finishOneShot(settled) },
+    { state, session_id: options.sessionId, one_shot: finishOneShot(settled2) },
     FINISH_TIMEOUT_MS
   );
   if (!finished.ok) {
@@ -38187,7 +38342,7 @@ function effortProfile(root, env = process.env) {
 }
 
 // src/lib/prove/auto.ts
-var import_node_path57 = require("node:path");
+var import_node_path58 = require("node:path");
 var import_node_crypto21 = require("node:crypto");
 
 // src/lib/prove/grounding.ts
@@ -40415,7 +40570,7 @@ async function runFormalPhase(input) {
     modelName = gen.name;
     const rel = `${AUTO_MODELS_DIR}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path57.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path58.join)(root, rel);
     progress.model = { name: gen.name, file: rel, rounds: round };
     progress.step = "check";
     report = await deps.check(root, abs);
@@ -40564,7 +40719,7 @@ async function runFormalPhase(input) {
   return done({
     status: "checked",
     target,
-    model: { name: modelName, file: (0, import_node_path57.relative)(root, (0, import_node_path57.join)(root, modelFile)), rounds },
+    model: { name: modelName, file: (0, import_node_path58.relative)(root, (0, import_node_path58.join)(root, modelFile)), rounds },
     properties: report.properties,
     findings
   });
@@ -40641,7 +40796,7 @@ async function generateAndCheck(root, req, opts) {
     }
     const rel = `${dir}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path57.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path58.join)(root, rel);
     const report = await opts.deps.check(root, abs);
     const abstracts = report.header?.abstracts ?? [];
     const stray = abstracts.find((a) => !headerFiles.has(a.file)) ?? (abstracts[0] && abstracts[0].file !== req.file ? abstracts[0] : void 0);
@@ -41050,7 +41205,7 @@ var WRITERS_BUDGET_MS = 1500;
 var EXCERPT_MAX_LINES2 = 30;
 var VENDORED_READ_MAX_BYTES = 256 * 1024;
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path58.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path59.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
   return new Promise((resolve10) => {
@@ -41058,11 +41213,11 @@ function readPreToolUseStdin() {
       if (process.stdin.isTTY) return resolve10(empty);
       const chunks = [];
       let timer;
-      let settled = false;
+      let settled2 = false;
       const onData = (c) => chunks.push(c);
       const settle = (value) => {
-        if (settled) return;
-        settled = true;
+        if (settled2) return;
+        settled2 = true;
         if (timer) clearTimeout(timer);
         process.stdin.removeListener("data", onData);
         process.stdin.removeListener("end", onEnd);
@@ -41095,7 +41250,7 @@ function readPreToolUseStdin() {
 }
 function readIterMap() {
   try {
-    const raw = JSON.parse((0, import_node_fs69.readFileSync)(GUARD_ITER_FILE, "utf-8"));
+    const raw = JSON.parse((0, import_node_fs70.readFileSync)(GUARD_ITER_FILE, "utf-8"));
     if (raw && typeof raw === "object") {
       if (typeof raw.moment === "string" && typeof raw.count === "number") {
         return { [raw.moment]: raw.count };
@@ -41115,10 +41270,10 @@ function readIter(moment) {
 }
 function writeIter(moment, count2) {
   try {
-    (0, import_node_fs69.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs70.mkdirSync)(VERITY_DIR, { recursive: true });
     const map = readIterMap();
     map[moment] = count2;
-    (0, import_node_fs69.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+    (0, import_node_fs70.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
   } catch {
   }
 }
@@ -41128,10 +41283,10 @@ function resetIter(moment) {
     if (!(moment in map)) return;
     delete map[moment];
     if (Object.keys(map).length === 0) {
-      if ((0, import_node_fs69.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs69.unlinkSync)(GUARD_ITER_FILE);
+      if ((0, import_node_fs70.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs70.unlinkSync)(GUARD_ITER_FILE);
     } else {
-      (0, import_node_fs69.mkdirSync)(VERITY_DIR, { recursive: true });
-      (0, import_node_fs69.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+      (0, import_node_fs70.mkdirSync)(VERITY_DIR, { recursive: true });
+      (0, import_node_fs70.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
     }
   } catch {
   }
@@ -41208,7 +41363,7 @@ function ofThisChange(response, sentFiles) {
 function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedIntent, coverageTelemetry) {
   const analyzable = filterAnalyzable(files);
   const securityFiles = filterSecurity(files);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs69.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs70.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
   const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const trigger = moment === "pre-commit" ? "hook:pre-commit" : "hook:pre-push";
   const requestBody2 = {
@@ -41381,11 +41536,14 @@ function startAgentReview(input) {
   };
   return run4().catch((err2) => ({ kind: "failed", reason: String(err2?.message ?? err2) }));
 }
+function formalOffUnverifiedLine(moment, config) {
+  if (moment !== "pre-push" || !config.formal_off_unverified) return "";
+  const setting = formalSetting(config);
+  return setting.state === "off" && setting.source === "config" ? `formal: skipped (${formalOffUnverifiedNote()})` : "";
+}
 function startFormalPhase(input) {
   if (input.moment !== "pre-push") return null;
-  const env = process.env.VERITY_GIT_MOMENT_FORMAL;
-  if (env === "off") return null;
-  if (env !== "push" && readProjectConfig().formal !== "push") return null;
+  if (formalSetting(input.config).state !== "push") return null;
   const profile = effortProfile(input.root);
   const deadlineAt = input.hookStartedAt + profile.pushDeadlineMs - 1e4;
   const ig = loadVerityIgnore();
@@ -41591,7 +41749,8 @@ async function runGuard(opts, globals) {
     requestBody: requestBody2,
     oneShot
   });
-  const formal = startFormalPhase({ moment, files, root: frame.worktreeRoot, hookStartedAt, frame, range, auth: { serviceUrl: urlResult.data, token: tokenResult.data.token } });
+  const projectConfig = moment === "pre-push" ? readProjectConfig() : null;
+  const formal = projectConfig ? startFormalPhase({ moment, files, root: frame.worktreeRoot, hookStartedAt, frame, range, auth: { serviceUrl: urlResult.data, token: tokenResult.data.token }, config: projectConfig }) : null;
   const result = await oneShot;
   const agentOutcome = agent ? await agent : null;
   const formalOutcome = formal ? await formal : null;
@@ -41643,7 +41802,7 @@ async function runGuard(opts, globals) {
   const link2 = viewUrl ? ` \u2014 ${viewUrl}` : "";
   const covLine = `${coverageSummary(coverage)} in ${reviewSecs}s`;
   const agentLine = describeAgentOutcome(agentOutcome);
-  const formalLine = describeFormalOutcome(formalOutcome);
+  const formalLine = describeFormalOutcome(formalOutcome) || (projectConfig ? formalOffUnverifiedLine(moment, projectConfig) : "");
   const covDetail = [coverageBlock(coverage), agentLine, formalLine].filter(Boolean).join("\n  ");
   const witnessed = [...codeDelta.files.map((f) => f.path), ...agentVerdict?.witnessed_files ?? []];
   mergeFormalFindings(response, formalOutcome, files);
@@ -41884,7 +42043,7 @@ function registerIgnoreCommand(program2) {
 
 // src/commands/waive.ts
 var import_node_crypto23 = require("node:crypto");
-var import_node_fs70 = require("node:fs");
+var import_node_fs71 = require("node:fs");
 function registerWaiveCommand(program2) {
   program2.command("waive <pattern-id>").description("Record an accepted-risk disposition for an open finding (voids when the file changes)").option("--file <path>", "File the finding is anchored to, REPO-RELATIVE (recommended \u2014 narrows the waive)").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action(async (patternId, opts) => {
     const globals = program2.opts();
@@ -41913,7 +42072,7 @@ function registerWaiveCommand(program2) {
     if (opts.file) {
       body2.file = opts.file;
       try {
-        body2.file_sha256 = (0, import_node_crypto23.createHash)("sha256").update((0, import_node_fs70.readFileSync)(opts.file)).digest("hex");
+        body2.file_sha256 = (0, import_node_crypto23.createHash)("sha256").update((0, import_node_fs71.readFileSync)(opts.file)).digest("hex");
       } catch {
         printError(`Cannot read ${opts.file} \u2014 run from the repo root, or omit --file to waive by pattern.`);
         process.exit(1);
@@ -41939,15 +42098,15 @@ function registerWaiveCommand(program2) {
 
 // src/commands/init/index.ts
 var import_node_os15 = require("node:os");
-var import_node_fs79 = require("node:fs");
+var import_node_fs80 = require("node:fs");
 var import_promises17 = require("node:fs/promises");
-var import_node_path68 = require("node:path");
+var import_node_path69 = require("node:path");
 
 // src/lib/init-changes.ts
 var import_node_crypto24 = require("node:crypto");
-var import_node_fs71 = require("node:fs");
+var import_node_fs72 = require("node:fs");
 var import_node_os12 = require("node:os");
-var import_node_path59 = require("node:path");
+var import_node_path60 = require("node:path");
 var REPO_FILES = [
   ".gitignore",
   "CLAUDE.md",
@@ -41962,7 +42121,7 @@ var SKILLS_DIR = ".claude/skills";
 var MAX_HASH_BYTES = 2 * 1024 * 1024;
 var MAX_TREE_ENTRIES = 2e3;
 function userSettingsDir(env) {
-  return env.CLAUDE_CONFIG_DIR || (0, import_node_path59.join)(env.HOME || (0, import_node_os12.homedir)(), ".claude");
+  return env.CLAUDE_CONFIG_DIR || (0, import_node_path60.join)(env.HOME || (0, import_node_os12.homedir)(), ".claude");
 }
 function fingerprint(root, rel) {
   const opened = openRegularInRoot(root, rel);
@@ -41970,7 +42129,7 @@ function fingerprint(root, rel) {
     if (opened.reason === "missing") return null;
     if (opened.reason === "symlink") {
       try {
-        return `link:${(0, import_node_fs71.readlinkSync)((0, import_node_path59.join)(root, rel))}`;
+        return `link:${(0, import_node_fs72.readlinkSync)((0, import_node_path60.join)(root, rel))}`;
       } catch {
         return "link";
       }
@@ -41989,7 +42148,7 @@ function fingerprint(root, rel) {
 }
 function treeFingerprint(root, dirRel) {
   try {
-    if (!(0, import_node_fs71.lstatSync)((0, import_node_path59.join)(root, dirRel)).isDirectory()) return fingerprint(root, dirRel);
+    if (!(0, import_node_fs72.lstatSync)((0, import_node_path60.join)(root, dirRel)).isDirectory()) return fingerprint(root, dirRel);
   } catch {
     return null;
   }
@@ -41997,7 +42156,7 @@ function treeFingerprint(root, dirRel) {
   const walk2 = (rel) => {
     let names2;
     try {
-      names2 = (0, import_node_fs71.readdirSync)((0, import_node_path59.join)(root, rel)).sort();
+      names2 = (0, import_node_fs72.readdirSync)((0, import_node_path60.join)(root, rel)).sort();
     } catch {
       return;
     }
@@ -42006,7 +42165,7 @@ function treeFingerprint(root, dirRel) {
       const relPath = `${rel}/${name2}`;
       let st;
       try {
-        st = (0, import_node_fs71.lstatSync)((0, import_node_path59.join)(root, relPath));
+        st = (0, import_node_fs72.lstatSync)((0, import_node_path60.join)(root, relPath));
       } catch {
         continue;
       }
@@ -42030,8 +42189,8 @@ function changedSince(before, after) {
 
 // src/lib/init-trace.ts
 var import_node_crypto25 = require("node:crypto");
-var import_node_fs72 = require("node:fs");
-var import_node_path60 = require("node:path");
+var import_node_fs73 = require("node:fs");
+var import_node_path61 = require("node:path");
 var INIT_STEPS = [
   "started",
   "prerequisites",
@@ -42077,9 +42236,9 @@ function traceDisabled(env = process.env) {
 }
 var PENDING_NAME = "init-trace.json";
 var MAX_PENDING_BYTES = 64 * 1024;
-var verityHome2 = () => (0, import_node_path60.join)(process.env.HOME ?? "", ".verity");
+var verityHome2 = () => (0, import_node_path61.join)(process.env.HOME ?? "", ".verity");
 function pendingTracePath() {
-  return (0, import_node_path60.join)(verityHome2(), PENDING_NAME);
+  return (0, import_node_path61.join)(verityHome2(), PENDING_NAME);
 }
 var RUN_ID = /^[0-9a-f]{16}$/;
 var CLI_VERSION = /^[0-9A-Za-z.+-]{1,40}$/;
@@ -42137,10 +42296,10 @@ function writePending(runs) {
   try {
     const kept = runs.filter((r) => r.events.length > 0).slice(-MAX_PENDING_RUNS);
     if (kept.length === 0) {
-      (0, import_node_fs72.rmSync)(pendingTracePath(), { force: true });
+      (0, import_node_fs73.rmSync)(pendingTracePath(), { force: true });
       return;
     }
-    (0, import_node_fs72.mkdirSync)(verityHome2(), { recursive: true });
+    (0, import_node_fs73.mkdirSync)(verityHome2(), { recursive: true });
     if (!replaceInRoot(verityHome2(), PENDING_NAME, JSON.stringify(kept))) {
       logEvent("init_trace_save_refused", {});
     }
@@ -42852,8 +43011,8 @@ var Rail = class {
 };
 
 // src/commands/init/ui.ts
-var import_node_fs73 = require("node:fs");
-var import_node_path61 = require("node:path");
+var import_node_fs74 = require("node:fs");
+var import_node_path62 = require("node:path");
 var import_node_os13 = require("node:os");
 var import_node_child_process18 = require("node:child_process");
 function createInitUi(opts) {
@@ -42873,10 +43032,10 @@ function installInterrupt(ui) {
 }
 var SEEN_FILE = ".init-seen";
 function firstInitOnMachine(home = process.env.HOME || (0, import_node_os13.homedir)()) {
-  return !(0, import_node_fs73.existsSync)((0, import_node_path61.join)(home, ".verity", SEEN_FILE));
+  return !(0, import_node_fs74.existsSync)((0, import_node_path62.join)(home, ".verity", SEEN_FILE));
 }
 function markInitSeen(home = process.env.HOME || (0, import_node_os13.homedir)()) {
-  replaceInRoot((0, import_node_path61.join)(home, ".verity"), SEEN_FILE, `${(/* @__PURE__ */ new Date()).toISOString()}
+  replaceInRoot((0, import_node_path62.join)(home, ".verity"), SEEN_FILE, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
 }
 function repoLabel() {
@@ -42886,12 +43045,12 @@ function repoLabel() {
     if (parsed) return terminalText(`${parsed.owner}/${parsed.repo}`, 120);
   } catch {
   }
-  return terminalText((0, import_node_path61.basename)(repoRoot()), 120);
+  return terminalText((0, import_node_path62.basename)(repoRoot()), 120);
 }
 
 // src/lib/prereqs.ts
 var import_node_child_process19 = require("node:child_process");
-var import_node_fs74 = require("node:fs");
+var import_node_fs75 = require("node:fs");
 var MIN_NODE_MAJOR = 20;
 function which(bin) {
   return whichSync(bin, { real: false });
@@ -42959,7 +43118,7 @@ function checkAnalysisCli(opts = {}) {
 }
 function sameFile(a, b) {
   try {
-    return (0, import_node_fs74.realpathSync)(a) === (0, import_node_fs74.realpathSync)(b);
+    return (0, import_node_fs75.realpathSync)(a) === (0, import_node_fs75.realpathSync)(b);
   } catch {
     return false;
   }
@@ -43019,12 +43178,12 @@ async function checkPrereqs(opts = {}) {
 }
 
 // src/lib/telemetry-local.ts
-var import_node_path63 = require("node:path");
+var import_node_path64 = require("node:path");
 
 // src/lib/telemetry-settings.ts
 var import_promises14 = require("node:fs/promises");
 var import_node_os14 = require("node:os");
-var import_node_path62 = require("node:path");
+var import_node_path63 = require("node:path");
 var SETTINGS_LOCAL_FILE2 = ".claude/settings.local.json";
 var OTEL_HEADERS_HELPER_CMD = "verity telemetry headers";
 var LEGACY_HEADER_KEY = "OTEL_EXPORTER_OTLP_HEADERS";
@@ -43035,10 +43194,10 @@ var OTLP_ENDPOINT_KEYS = [
   "OTEL_EXPORTER_OTLP_LOGS_ENDPOINT"
 ];
 function claudeConfigDir2() {
-  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path62.join)((0, import_node_os14.homedir)(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path63.join)((0, import_node_os14.homedir)(), ".claude");
 }
 function userSettingsPath() {
-  return (0, import_node_path62.join)(claudeConfigDir2(), "settings.json");
+  return (0, import_node_path63.join)(claudeConfigDir2(), "settings.json");
 }
 function deriveOtlpEndpoint(serviceUrl) {
   return serviceUrl.replace(/\/+$/, "").replace(/\/v1$/, "") + "/v1/otlp";
@@ -43159,7 +43318,7 @@ async function healLocalTelemetry(root = repoRoot()) {
   if (settings.env && Object.keys(env).length === 0) delete settings.env;
   if (plan.helper) delete settings.otelHeadersHelper;
   const next = nextLocalBytes(local.raw, settings);
-  if (next !== null && !replaceInRoot((0, import_node_path63.join)(root, ".claude"), "settings.local.json", next)) {
+  if (next !== null && !replaceInRoot((0, import_node_path64.join)(root, ".claude"), "settings.local.json", next)) {
     return { removed: [] };
   }
   return { removed: [...plan.envKeys, ...plan.helper ? ["otelHeadersHelper"] : []] };
@@ -43167,8 +43326,8 @@ async function healLocalTelemetry(root = repoRoot()) {
 
 // src/lib/telemetry-gate.ts
 var import_node_child_process20 = require("node:child_process");
-var import_node_fs75 = require("node:fs");
-var import_node_path64 = require("node:path");
+var import_node_fs76 = require("node:fs");
+var import_node_path65 = require("node:path");
 var PROJECT_MARKERS = ["setup.json", "config.json"];
 function writtenOnThisMachine(root, rel) {
   const r = (0, import_node_child_process20.spawnSync)("git", hardenedGitArgv(["ls-files", "--error-unmatch", "--", rel]), {
@@ -43185,10 +43344,10 @@ function writtenOnThisMachine(root, rel) {
 function isTelemetryProject() {
   for (const root of [repoRoot(), mainWorktreeRoot()]) {
     if (!root) continue;
-    const dir = (0, import_node_path64.join)(root, VERITY_DIR);
+    const dir = (0, import_node_path65.join)(root, VERITY_DIR);
     if (isMachineStore(dir)) continue;
     for (const marker of PROJECT_MARKERS) {
-      if ((0, import_node_fs75.existsSync)((0, import_node_path64.join)(dir, marker)) && writtenOnThisMachine(root, `${VERITY_DIR}/${marker}`)) return true;
+      if ((0, import_node_fs76.existsSync)((0, import_node_path65.join)(dir, marker)) && writtenOnThisMachine(root, `${VERITY_DIR}/${marker}`)) return true;
     }
   }
   return false;
@@ -43453,7 +43612,7 @@ function signInDetail(outcome) {
 }
 function formalDefault(previous, opts = {}) {
   const cfg = readProjectConfig();
-  if (previous?.init?.completed_at || opts.setUpBefore || cfg.formal !== void 0 || cfg.formal_refused) return false;
+  if (previous?.init?.completed_at || opts.setUpBefore || cfg.formal !== void 0 || cfg.formal_refused || cfg.formal_off_refused) return false;
   writeProjectConfig({ formal: "push" });
   return true;
 }
@@ -43464,9 +43623,13 @@ function sayFormalOn(ui) {
 }
 function backgroundStep(ui, opts) {
   const { rail } = ui;
-  const formal = readProjectConfig().formal;
-  const said = opts.formalNew === true && formal === "push";
-  if (said) sayFormalOn(ui);
+  const setting = formalSetting(readProjectConfig());
+  const formal = setting.state;
+  const said = formal === "push" && (opts.formalNew === true || setting.source === "default" && formalDefaultNoticeDue());
+  if (said) {
+    sayFormalOn(ui);
+    recordFormalDefaultNotice();
+  }
   const lean = shouldStartBackgroundInstall({ formal });
   const leanStarted = lean.start && startBackgroundInstall({ cli: opts.cli });
   const trivy = startTrivyPrewarm();
@@ -43597,7 +43760,9 @@ async function scaffoldStep(ui, given = {}) {
     rail.line(`Could not update CLAUDE.md: ${terminalText(err2.message, 300)}`, "warn");
   }
   const cfg = readProjectConfig();
-  if (cfg.formal_refused) rail.line(`Formal verification: off \u2014 ${formalRefusalMessage(cfg.formal_refused)}`, "warn");
+  if (cfg.formal_off_refused && formalSetting(cfg).state === "push") {
+    rail.line(`Formal verification: on \u2014 ${formalOffRefusalMessage(cfg.formal_off_refused)}`, "warn");
+  }
   rail.settle();
 }
 async function askUntrackState(ui, tracked) {
@@ -43635,9 +43800,9 @@ function retireCodacyConfig(ui) {
 }
 
 // src/commands/init/wiring.ts
-var import_node_fs76 = require("node:fs");
+var import_node_fs77 = require("node:fs");
 var import_promises16 = require("node:fs/promises");
-var import_node_path65 = require("node:path");
+var import_node_path66 = require("node:path");
 var DEFAULT_MOMENTS = ["stop", "pre-commit", "pre-push"];
 async function momentsFromInstalledHooks() {
   const status = await checkAllVerityHooks();
@@ -43710,12 +43875,12 @@ var SKILLS = [
 ];
 function resolveDataDir2() {
   const candidates2 = [
-    (0, import_node_path65.join)(__dirname, "..", "data"),
-    (0, import_node_path65.join)(__dirname, "..", "..", "data"),
-    (0, import_node_path65.join)(process.cwd(), "cli", "data")
+    (0, import_node_path66.join)(__dirname, "..", "data"),
+    (0, import_node_path66.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path66.join)(process.cwd(), "cli", "data")
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs76.existsSync)((0, import_node_path65.join)(candidate, "skills"))) return candidate;
+    if ((0, import_node_fs77.existsSync)((0, import_node_path66.join)(candidate, "skills"))) return candidate;
   }
   throw new Error("Could not find Verity skill data. Reinstall: npm install -g @codacy/verity-cli");
 }
@@ -43723,9 +43888,9 @@ async function skillIsCurrent(src, dest) {
   const list2 = (dir) => {
     const out2 = [];
     const walk2 = (d, prefix) => {
-      for (const e of (0, import_node_fs76.readdirSync)(d, { withFileTypes: true })) {
+      for (const e of (0, import_node_fs77.readdirSync)(d, { withFileTypes: true })) {
         const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk2((0, import_node_path65.join)(d, e.name), rel);
+        if (e.isDirectory()) walk2((0, import_node_path66.join)(d, e.name), rel);
         else if (e.isFile()) out2.push(rel);
       }
     };
@@ -43736,7 +43901,7 @@ async function skillIsCurrent(src, dest) {
     const shipped = list2(src);
     if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
     for (const rel of shipped) {
-      if (await (0, import_promises16.readFile)((0, import_node_path65.join)(src, rel), "utf-8") !== await (0, import_promises16.readFile)((0, import_node_path65.join)(dest, rel), "utf-8")) return false;
+      if (await (0, import_promises16.readFile)((0, import_node_path66.join)(src, rel), "utf-8") !== await (0, import_promises16.readFile)((0, import_node_path66.join)(dest, rel), "utf-8")) return false;
     }
     return true;
   } catch {
@@ -43744,16 +43909,16 @@ async function skillIsCurrent(src, dest) {
   }
 }
 async function installSkills(force) {
-  const source2 = (0, import_node_path65.join)(resolveDataDir2(), "skills");
+  const source2 = (0, import_node_path66.join)(resolveDataDir2(), "skills");
   const missing = [];
   for (const skill of SKILLS) {
-    const src = (0, import_node_path65.join)(source2, skill);
-    const dest = (0, import_node_path65.join)(".claude/skills", skill);
-    if (!(0, import_node_fs76.existsSync)(src)) {
+    const src = (0, import_node_path66.join)(source2, skill);
+    const dest = (0, import_node_path66.join)(".claude/skills", skill);
+    if (!(0, import_node_fs77.existsSync)(src)) {
       missing.push(skill);
       continue;
     }
-    if ((0, import_node_fs76.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) continue;
+    if ((0, import_node_fs77.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) continue;
     await (0, import_promises16.mkdir)(dest, { recursive: true });
     await (0, import_promises16.cp)(src, dest, { recursive: true, force: true });
   }
@@ -43793,8 +43958,8 @@ async function hooksStep(ui, ctx) {
 }
 
 // src/commands/init/standard.ts
-var import_node_fs77 = require("node:fs");
-var import_node_path66 = require("node:path");
+var import_node_fs78 = require("node:fs");
+var import_node_path67 = require("node:path");
 var import_yaml10 = __toESM2(require_dist());
 
 // src/lib/catalogue-client.ts
@@ -43985,9 +44150,9 @@ function localStandard() {
 function removeLocalStandard() {
   const path = projectPath(STANDARD_FILE);
   try {
-    const folder = (0, import_node_fs77.lstatSync)((0, import_node_path66.dirname)(path));
+    const folder = (0, import_node_fs78.lstatSync)((0, import_node_path67.dirname)(path));
     if (!folder.isDirectory() || folder.isSymbolicLink()) return;
-    if ((0, import_node_fs77.lstatSync)(path).isFile()) (0, import_node_fs77.unlinkSync)(path);
+    if ((0, import_node_fs78.lstatSync)(path).isFile()) (0, import_node_fs78.unlinkSync)(path);
   } catch {
   }
 }
@@ -44001,7 +44166,7 @@ function setLocalStandardAside(now = /* @__PURE__ */ new Date(), remove = remove
     return { ok: false, message: `Could not keep a copy of ${STANDARD_FILE} (${terminalText(err2 instanceof Error ? err2.message : String(err2), 200)}), so it was not set aside.` };
   }
   remove();
-  if ((0, import_node_fs77.existsSync)(projectPath(STANDARD_FILE))) return { ok: false, message: `Could not remove ${STANDARD_FILE} after copying it to ${path}.` };
+  if ((0, import_node_fs78.existsSync)(projectPath(STANDARD_FILE))) return { ok: false, message: `Could not remove ${STANDARD_FILE} after copying it to ${path}.` };
   return { ok: true, path };
 }
 async function standardStep(ui, ctx) {
@@ -44063,7 +44228,7 @@ async function standardStep(ui, ctx) {
     rail.line(team2.status === "none" ? `There is no Standard on the service either, so reviews have no rules. Fix ${STANDARD_FILE}, or delete it, then run verity init again.` : team2.status === "unavailable" ? `The Verity service did not answer (${terminalText(team2.reason, 200)}), so no Standard is confirmed. Fix ${STANDARD_FILE}, then run verity init again.` : team2.status === "denied" && refusalOutcome(team2.code) === "denied" ? `Verity has no access to this repository (${terminalText(team2.reason, 200)}). Fix ${STANDARD_FILE}, give the Verity GitHub App access, then run verity login and verity init.` : team2.status === "denied" ? `The Verity service did not accept your sign-in (${terminalText(team2.reason, 200)}). Fix ${STANDARD_FILE}, then run verity login and verity init.` : `No Standard on the service was looked up. Fix ${STANDARD_FILE}, or sign in, then run verity init again.`);
     return end({ source: "none", version: null, profile: notAsked });
   };
-  if (ctx.standard === "new" && (0, import_node_fs77.lstatSync)(projectPath(STANDARD_FILE), { throwIfNoEntry: false })) {
+  if (ctx.standard === "new" && (0, import_node_fs78.lstatSync)(projectPath(STANDARD_FILE), { throwIfNoEntry: false })) {
     const aside = setLocalStandardAside();
     if (!aside.ok) {
       rail.warn("Could not set your Standard aside for a new one");
@@ -44140,7 +44305,7 @@ async function standardStep(ui, ctx) {
     await keptHints();
     return end({ source: "kept", version, profile: notAsked });
   };
-  if ((0, import_node_fs77.existsSync)(projectPath(STANDARD_FILE))) {
+  if ((0, import_node_fs78.existsSync)(projectPath(STANDARD_FILE))) {
     const local = localStandard();
     if (!local.ok) return unusableHere(local.problem);
     return keptHere(local.content);
@@ -44266,8 +44431,8 @@ function sayChanged(ui, before) {
 }
 
 // src/commands/migrate.ts
-var import_node_fs78 = require("node:fs");
-var import_node_path67 = require("node:path");
+var import_node_fs79 = require("node:fs");
+var import_node_path68 = require("node:path");
 var import_node_child_process22 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
@@ -44331,12 +44496,12 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path67.join)(root, ".gate");
-  const verityDir = (0, import_node_path67.join)(root, ".verity");
-  if ((0, import_node_fs78.existsSync)(gateDir) && !(0, import_node_fs78.existsSync)(verityDir)) {
+  const gateDir = (0, import_node_path68.join)(root, ".gate");
+  const verityDir = (0, import_node_path68.join)(root, ".verity");
+  if ((0, import_node_fs79.existsSync)(gateDir) && !(0, import_node_fs79.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if ((0, import_node_fs78.existsSync)(gateDir) && (0, import_node_fs78.existsSync)(verityDir)) {
+  if ((0, import_node_fs79.existsSync)(gateDir) && (0, import_node_fs79.existsSync)(verityDir)) {
     return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
   return false;
@@ -44357,13 +44522,13 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
     }
   }
   if (moved) {
-    if ((0, import_node_fs78.existsSync)(gateDir)) {
+    if ((0, import_node_fs79.existsSync)(gateDir)) {
       const carried = carryLegacyContents(gateDir, verityDir);
       if (carried > 0) {
         actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
       }
       try {
-        (0, import_node_fs78.rmSync)(gateDir, { recursive: true, force: true });
+        (0, import_node_fs79.rmSync)(gateDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -44379,18 +44544,18 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
     actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
   try {
-    (0, import_node_fs78.rmSync)(gateDir, { recursive: true, force: true });
+    (0, import_node_fs79.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
   }
   return carried > 0;
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path67.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path67.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs78.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs78.existsSync)(verityCreds)) {
-    (0, import_node_fs78.mkdirSync)((0, import_node_path67.join)(home, ".verity"), { recursive: true });
+  const gateCreds = (0, import_node_path68.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path68.join)(home, ".verity", "credentials");
+  if (!(0, import_node_fs79.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs79.existsSync)(verityCreds)) {
+    (0, import_node_fs79.mkdirSync)((0, import_node_path68.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -44412,8 +44577,8 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path67.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs78.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  const claudeMd = (0, import_node_path68.join)(root, "CLAUDE.md");
+  const hadLegacyBlock = (0, import_node_fs79.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
     await ensureClaudeMdPointer(root);
@@ -44423,9 +44588,9 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path67.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path67.join)(root, "VERITY.md");
-  if (!(0, import_node_fs78.existsSync)(gateMd) || (0, import_node_fs78.existsSync)(verityMd)) return;
+  const gateMd = (0, import_node_path68.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path68.join)(root, "VERITY.md");
+  if (!(0, import_node_fs79.existsSync)(gateMd) || (0, import_node_fs79.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
@@ -44437,7 +44602,7 @@ function migrateStandardFile(root, actions) {
   if (!moved) moveFile(gateMd, verityMd);
   const content = readFileSyncSafe(verityMd);
   const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs78.writeFileSync)(verityMd, refreshed);
+  if (refreshed !== content) (0, import_node_fs79.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateLocalTelemetry(root, actions) {
@@ -44481,14 +44646,14 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
   }
   if (toAppend.length > 0) {
     const sep7 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs78.writeFileSync)(verityCreds, verityContent + sep7 + toAppend.join("\n") + "\n");
+    (0, import_node_fs79.writeFileSync)(verityCreds, verityContent + sep7 + toAppend.join("\n") + "\n");
   }
-  (0, import_node_fs78.rmSync)(gateCreds, { force: true });
+  (0, import_node_fs79.rmSync)(gateCreds, { force: true });
   return toAppend.length;
 }
 function readFileSyncSafe(path) {
   try {
-    return (0, import_node_fs78.readFileSync)(path, "utf-8");
+    return (0, import_node_fs79.readFileSync)(path, "utf-8");
   } catch {
     return "";
   }
@@ -44503,20 +44668,20 @@ function hasStagedChanges(root) {
 }
 function moveDir(from, to) {
   try {
-    (0, import_node_fs78.renameSync)(from, to);
+    (0, import_node_fs79.renameSync)(from, to);
   } catch (err2) {
     if (err2.code !== "EXDEV") throw err2;
-    (0, import_node_fs78.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs78.rmSync)(from, { recursive: true, force: true });
+    (0, import_node_fs79.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs79.rmSync)(from, { recursive: true, force: true });
   }
 }
 function moveFile(from, to) {
   try {
-    (0, import_node_fs78.renameSync)(from, to);
+    (0, import_node_fs79.renameSync)(from, to);
   } catch (err2) {
     if (err2.code !== "EXDEV") throw err2;
-    (0, import_node_fs78.cpSync)(from, to);
-    (0, import_node_fs78.rmSync)(from, { force: true });
+    (0, import_node_fs79.cpSync)(from, to);
+    (0, import_node_fs79.rmSync)(from, { force: true });
   }
 }
 function carryLegacyContents(gateDir, verityDir) {
@@ -44525,12 +44690,12 @@ function carryLegacyContents(gateDir, verityDir) {
   const walk2 = (relDir) => {
     let entries;
     try {
-      entries = (0, import_node_fs78.readdirSync)((0, import_node_path67.join)(gateDir, relDir), { withFileTypes: true });
+      entries = (0, import_node_fs79.readdirSync)((0, import_node_path68.join)(gateDir, relDir), { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const rel = relDir ? (0, import_node_path67.join)(relDir, entry.name) : entry.name;
+      const rel = relDir ? (0, import_node_path68.join)(relDir, entry.name) : entry.name;
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         walk2(rel);
@@ -44540,7 +44705,7 @@ function carryLegacyContents(gateDir, verityDir) {
       const opened = openRegularInRoot(gateDir, rel);
       if (!opened.ok) continue;
       try {
-        (0, import_node_fs78.writeFileSync)((0, import_node_path67.join)(verityDir, rel), readOpened(opened.fd, opened.size), { flag: "wx", mode: 384 });
+        (0, import_node_fs79.writeFileSync)((0, import_node_path68.join)(verityDir, rel), readOpened(opened.fd, opened.size), { flag: "wx", mode: 384 });
         copied++;
       } catch {
       }
@@ -44550,19 +44715,19 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 function hasLegacyStandard(root = repoRoot()) {
-  if (!isRealDir((0, import_node_path67.join)(root, ".gate"))) return false;
+  if (!isRealDir((0, import_node_path68.join)(root, ".gate"))) return false;
   try {
-    if (!(0, import_node_fs78.lstatSync)((0, import_node_path67.join)(root, ".gate", "standard.yaml")).isFile()) return false;
+    if (!(0, import_node_fs79.lstatSync)((0, import_node_path68.join)(root, ".gate", "standard.yaml")).isFile()) return false;
   } catch {
     return false;
   }
-  const verityDir = (0, import_node_path67.join)(root, ".verity");
+  const verityDir = (0, import_node_path68.join)(root, ".verity");
   if (pathEntryExists(verityDir) && !isRealDir(verityDir)) return false;
-  return !pathEntryExists((0, import_node_path67.join)(verityDir, "standard.yaml"));
+  return !pathEntryExists((0, import_node_path68.join)(verityDir, "standard.yaml"));
 }
 function pathEntryExists(path) {
   try {
-    (0, import_node_fs78.lstatSync)(path);
+    (0, import_node_fs79.lstatSync)(path);
     return true;
   } catch {
     return false;
@@ -44570,7 +44735,7 @@ function pathEntryExists(path) {
 }
 function isRealDir(path) {
   try {
-    const st = (0, import_node_fs78.lstatSync)(path);
+    const st = (0, import_node_fs79.lstatSync)(path);
     return st.isDirectory() && !st.isSymbolicLink();
   } catch {
     return false;
@@ -44579,9 +44744,9 @@ function isRealDir(path) {
 function ensureRealDirs(root, relDir) {
   let current = root;
   for (const segment of relDir.split(/[\\/]/).filter(Boolean)) {
-    current = (0, import_node_path67.join)(current, segment);
+    current = (0, import_node_path68.join)(current, segment);
     try {
-      (0, import_node_fs78.mkdirSync)(current);
+      (0, import_node_fs79.mkdirSync)(current);
     } catch (e) {
       if (e.code !== "EEXIST") return false;
     }
@@ -44590,23 +44755,23 @@ function ensureRealDirs(root, relDir) {
   return true;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path67.join)(root, ".gate");
-  const verityDir = (0, import_node_path67.join)(root, ".verity");
-  if ((0, import_node_fs78.existsSync)(gateDir) && !(0, import_node_fs78.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs78.existsSync)(gateDir) && (0, import_node_fs78.existsSync)(verityDir)) {
-    if ((0, import_node_fs78.existsSync)((0, import_node_path67.join)(gateDir, "credentials")) && !(0, import_node_fs78.existsSync)((0, import_node_path67.join)(verityDir, "credentials"))) {
+  const gateDir = (0, import_node_path68.join)(root, ".gate");
+  const verityDir = (0, import_node_path68.join)(root, ".verity");
+  if ((0, import_node_fs79.existsSync)(gateDir) && !(0, import_node_fs79.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs79.existsSync)(gateDir) && (0, import_node_fs79.existsSync)(verityDir)) {
+    if ((0, import_node_fs79.existsSync)((0, import_node_path68.join)(gateDir, "credentials")) && !(0, import_node_fs79.existsSync)((0, import_node_path68.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs78.existsSync)((0, import_node_path67.join)(gateDir, "memory")) && !(0, import_node_fs78.existsSync)((0, import_node_path67.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs79.existsSync)((0, import_node_path68.join)(gateDir, "memory")) && !(0, import_node_fs79.existsSync)((0, import_node_path68.join)(verityDir, "memory"))) {
       return true;
     }
     if (hasLegacyStandard(root)) return true;
   }
-  const claudeMd = (0, import_node_path67.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs78.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+  const claudeMd = (0, import_node_path68.join)(root, "CLAUDE.md");
+  if ((0, import_node_fs79.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs78.existsSync)((0, import_node_path67.join)(root, "GATE.md")) && !(0, import_node_fs78.existsSync)((0, import_node_path67.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs79.existsSync)((0, import_node_path68.join)(root, "GATE.md")) && !(0, import_node_fs79.existsSync)((0, import_node_path68.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -44846,7 +45011,7 @@ async function recordAnswers(ui, momentIds, telemetry, completed) {
       moments: momentIds,
       ...telemetry ? { telemetry } : {},
       // A failed run also clears an earlier stamp: "done" describes this checkout now.
-      init: completed ? { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.4" : "dev" } : void 0
+      init: completed ? { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.5" : "dev" } : void 0
     });
   } catch (err2) {
     ui.rail.line(`Could not record the setup answers: ${terminalText(err2.message, 200)}`, "warn");
@@ -44899,7 +45064,7 @@ async function runInit(program2, opts) {
   const defaultsOnly = (opts.yes ?? false) || !interactive();
   const { givenMoments, givenTelemetry, profileAnswer, standardAnswer } = parseInitFlags(opts);
   const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-  if (!projectMarkers.some((m) => (0, import_node_fs79.existsSync)(m))) {
+  if (!projectMarkers.some((m) => (0, import_node_fs80.existsSync)(m))) {
     printError('No project detected in the current directory. Run "verity init" from your project root.');
     process.exit(1);
   }
@@ -44927,10 +45092,10 @@ async function runInit(program2, opts) {
     trace.mark("prerequisites", "ok");
     await scaffoldStep(ui, { untrackMemory: opts.untrackMemory === true, untrackStandard: opts.untrackStandard === true, untrackState: opts.untrackState === true });
     trace.mark("scaffold", "ok");
-    await (0, import_promises17.mkdir)((0, import_node_path68.join)((0, import_node_os15.homedir)(), ".verity"), { recursive: true });
+    await (0, import_promises17.mkdir)((0, import_node_path69.join)((0, import_node_os15.homedir)(), ".verity"), { recursive: true });
     await repoStep(ui, detectProject());
     const previous = await readSetupState();
-    const setUpBefore = (0, import_node_fs79.existsSync)(projectPath(STANDARD_FILE));
+    const setUpBefore = (0, import_node_fs80.existsSync)(projectPath(STANDARD_FILE));
     const answers = await askSetupQuestions(defaultsOnly, previous, { moments: givenMoments, telemetry: givenTelemetry });
     trace.mark("questions", "ok", givenMoments || givenTelemetry !== void 0 || profileAnswer || standardAnswer ? "asked" : "defaults");
     const plan = planMoments(answers.moments, { given: givenMoments !== void 0, defaultsOnly });
@@ -44980,7 +45145,7 @@ function registerInitCommand(program2) {
 }
 
 // src/commands/doctor.ts
-var import_node_fs80 = require("node:fs");
+var import_node_fs81 = require("node:fs");
 var LEGACY_STANDARD_FILE = ".gate/standard.yaml";
 async function buildReport() {
   const prereqs = await checkPrereqs({ install: false });
@@ -44990,11 +45155,11 @@ async function buildReport() {
   const provenance = cliProvenance();
   const telemetry = await checkTelemetry();
   const artifacts = {
-    standard: (0, import_node_fs80.existsSync)(projectPath(STANDARD_FILE)),
+    standard: (0, import_node_fs81.existsSync)(projectPath(STANDARD_FILE)),
     // The migration's own answer, not a bare existsSync: /verity:init skips a
     // question on this, so it must be true only when init will carry the file.
     legacyStandard: hasLegacyStandard(repoRoot()),
-    verityMd: (0, import_node_fs80.existsSync)(projectPath(VERITY_MD_FILE))
+    verityMd: (0, import_node_fs81.existsSync)(projectPath(VERITY_MD_FILE))
   };
   const next = [];
   for (const c of prereqs.checks) {
@@ -45134,11 +45299,14 @@ function registerDoctorCommand(program2) {
     printInfo(`  Git-moment gate: ${report.hooks.guardOn.length ? report.hooks.guardOn.join(", ") : "off"}`);
     {
       const cfg = readProjectConfig();
-      const formal = cfg.formal === "push";
+      const setting = formalSetting(cfg);
+      const formal = setting.state === "push";
       const tc = formal ? findToolchain() : null;
       const lean = tc ? "\u2713" : installProgressLine() ?? "MISSING \u2014 verity lean install";
-      printInfo(`  Formal verification (push): ${formal ? `on, Lean ${lean} (ranking, model writing and replay run on the Verity service with your login)` : "off"}`);
-      if (cfg.formal_refused) printWarn(`    ${formalRefusalMessage(cfg.formal_refused)}`);
+      const how = setting.source === "default" ? " by default" : setting.source === "env" ? " (VERITY_GIT_MOMENT_FORMAL)" : "";
+      printInfo(`  Formal verification (push): ${formal ? `on${how}, Lean ${lean} (ranking, model writing and replay run on the Verity service with your login)` : `off${how}`}`);
+      if (cfg.formal_off_refused && formal) printWarn(`    ${formalOffRefusalMessage(cfg.formal_off_refused)}`);
+      if (cfg.formal_off_unverified && !formal && setting.source === "config") printWarn(`    ${formalOffUnverifiedNote()}`);
     }
     printInfo(`  Infra (intent/baseline/compact/session-end): ${[report.hooks.intent, report.hooks.baseline, report.hooks.compact, report.hooks.sessionEnd].filter(Boolean).length}/4`);
     printInfo(
@@ -45164,8 +45332,8 @@ function registerDoctorCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-var import_node_fs81 = require("node:fs");
-var import_node_path69 = require("node:path");
+var import_node_fs82 = require("node:fs");
+var import_node_path70 = require("node:path");
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("Remove Verity from this project (skills, hooks, .verity/, VERITY.md)").option("--dry-run", "Show what would be removed without doing it").option("--purge-global", "Also remove ~/.verity/ (deletes saved tokens \u2014 reconnect requires re-registration)").option("--keep-verity-md", "Keep the project root VERITY.md file").action(async (opts) => {
     const dryRun = opts.dryRun ?? false;
@@ -45174,11 +45342,11 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name2 of PROJECT_SKILL_NAMES) {
-      const dir = (0, import_node_path69.join)(skillsRoot, name2);
-      if ((0, import_node_fs81.existsSync)(dir)) {
+      const dir = (0, import_node_path70.join)(skillsRoot, name2);
+      if ((0, import_node_fs82.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name2}/`,
-          apply: () => (0, import_node_fs81.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs82.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -45192,24 +45360,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs81.existsSync)(verityDir)) {
+    if ((0, import_node_fs82.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs81.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs82.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs81.existsSync)(verityMd)) {
+      if ((0, import_node_fs82.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs81.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs82.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs81.existsSync)(path) && (0, import_node_fs81.statSync)(path).isDirectory() && (0, import_node_fs81.readdirSync)(path).length === 0) {
-        (0, import_node_fs81.rmdirSync)(path);
+      if ((0, import_node_fs82.existsSync)(path) && (0, import_node_fs82.statSync)(path).isDirectory() && (0, import_node_fs82.readdirSync)(path).length === 0) {
+        (0, import_node_fs82.rmdirSync)(path);
       }
     };
     actions.push({
@@ -45220,11 +45388,11 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path69.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs81.existsSync)(globalVerityDir)) {
+    const globalVerityDir = (0, import_node_path70.join)(home, ".verity");
+    if (purgeGlobal && (0, import_node_fs82.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs81.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs82.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -45443,8 +45611,8 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs82 = require("node:fs");
-var import_node_path70 = require("node:path");
+var import_node_fs83 = require("node:fs");
+var import_node_path71 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -45484,18 +45652,18 @@ function registerResetCommand(program2) {
       } catch {
       }
     }
-    const purged = purgeVerityDir((0, import_node_path70.basename)(CACHE_DIR), (name2) => name2.startsWith("pending-"));
+    const purged = purgeVerityDir((0, import_node_path71.basename)(CACHE_DIR), (name2) => name2.startsWith("pending-"));
     if (purged === null) printError(`Did not purge ${CACHE_DIR}: it is not a directory inside ${VERITY_DIR}.`);
     const stateDir2 = projectPath(VERITY_DIR);
     const filesToClear = [
-      (0, import_node_path70.basename)(INTENT_FILE),
-      (0, import_node_path70.basename)(HASH_FILE),
-      (0, import_node_path70.basename)(BASELINE_SHA_FILE),
+      (0, import_node_path71.basename)(INTENT_FILE),
+      (0, import_node_path71.basename)(HASH_FILE),
+      (0, import_node_path71.basename)(BASELINE_SHA_FILE),
       ".iteration-count",
       ".last-analysis"
     ];
     for (const name2 of filesToClear) {
-      if (lstatOrNull((0, import_node_path70.join)(stateDir2, name2)) && !replaceInRoot(stateDir2, name2, "")) {
+      if (lstatOrNull((0, import_node_path71.join)(stateDir2, name2)) && !replaceInRoot(stateDir2, name2, "")) {
         printError(`Did not clear ${VERITY_DIR}/${name2}: it is not a regular file inside ${VERITY_DIR}.`);
       }
     }
@@ -45510,29 +45678,29 @@ function registerResetCommand(program2) {
 }
 function lstatOrNull(path) {
   try {
-    return (0, import_node_fs82.lstatSync)(path);
+    return (0, import_node_fs83.lstatSync)(path);
   } catch {
     return null;
   }
 }
 function purgeVerityDir(child, select) {
   const verityDir = projectPath(VERITY_DIR);
-  const dir = (0, import_node_path70.join)(verityDir, child);
+  const dir = (0, import_node_path71.join)(verityDir, child);
   const parent = lstatOrNull(verityDir);
   const st = lstatOrNull(dir);
   if (!st) return 0;
   if (!parent || parent.isSymbolicLink() || !parent.isDirectory()) return null;
   if (st.isSymbolicLink() || !st.isDirectory()) return null;
   try {
-    if ((0, import_node_fs82.realpathSync)(dir) !== (0, import_node_path70.join)((0, import_node_fs82.realpathSync)(verityDir), child)) return null;
+    if ((0, import_node_fs83.realpathSync)(dir) !== (0, import_node_path71.join)((0, import_node_fs83.realpathSync)(verityDir), child)) return null;
   } catch {
     return null;
   }
   let removed = 0;
-  for (const entry of (0, import_node_fs82.readdirSync)(dir, { withFileTypes: true })) {
+  for (const entry of (0, import_node_fs83.readdirSync)(dir, { withFileTypes: true })) {
     if (entry.isDirectory() || !select(entry.name)) continue;
     try {
-      (0, import_node_fs82.unlinkSync)((0, import_node_path70.join)(dir, entry.name));
+      (0, import_node_fs83.unlinkSync)((0, import_node_path71.join)(dir, entry.name));
       removed++;
     } catch {
     }
@@ -45541,7 +45709,7 @@ function purgeVerityDir(child, select) {
 }
 
 // src/commands/reflect.ts
-var import_node_fs83 = require("node:fs");
+var import_node_fs84 = require("node:fs");
 
 // src/lib/reflection-globs.ts
 var MAX_GLOBS = 6;
@@ -45579,7 +45747,7 @@ async function writeNodeToDisk(args2) {
       { treePaths: listTrackedFiles(), recordBaseline: false }
     );
     if (written === 0) return false;
-    return (0, import_node_fs83.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
+    return (0, import_node_fs84.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
   } catch {
     return false;
   }
@@ -46016,7 +46184,7 @@ function registerRunCommand(program2) {
 }
 
 // src/commands/telemetry.ts
-var import_node_fs84 = require("node:fs");
+var import_node_fs85 = require("node:fs");
 var SCOPE = "every Claude Code session on this machine";
 function declineHeaders(why) {
   process.stderr.write(`Verity telemetry is off here: ${why} Nothing is exported from this session.
@@ -46024,7 +46192,7 @@ function declineHeaders(why) {
   process.exitCode = 1;
 }
 async function recordTelemetryChoice(choice) {
-  if (!(0, import_node_fs84.existsSync)(projectPath(SETUP_STATE_FILE))) return;
+  if (!(0, import_node_fs85.existsSync)(projectPath(SETUP_STATE_FILE))) return;
   try {
     if ((await readSetupState())?.telemetry === choice) return;
     await writeSetupState({ telemetry: choice });
@@ -46132,12 +46300,12 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/commands/prove.ts
-var import_node_fs86 = require("node:fs");
-var import_node_path72 = require("node:path");
+var import_node_fs87 = require("node:fs");
+var import_node_path73 = require("node:path");
 
 // src/lib/prove/on-demand-run.ts
-var import_node_fs85 = require("node:fs");
-var import_node_path71 = require("node:path");
+var import_node_fs86 = require("node:fs");
+var import_node_path72 = require("node:path");
 var ON_DEMAND_RUN = `${PROOFS_DIR}/.results/.formal-run.json`;
 var ON_DEMAND_RUN_REUSE_MS = 18 * 6e4;
 function isLocalState2(root) {
@@ -46159,7 +46327,7 @@ function forgetOnDemandRun(root) {
   setFormalRun(null);
   if (!isLocalState2(root)) return;
   try {
-    (0, import_node_fs85.unlinkSync)((0, import_node_path71.join)(root, ON_DEMAND_RUN));
+    (0, import_node_fs86.unlinkSync)((0, import_node_path72.join)(root, ON_DEMAND_RUN));
   } catch {
   }
 }
@@ -46336,7 +46504,7 @@ function registerProveCommand(program2) {
       process.exit(2);
     }
     const limit = Math.max(1, Math.min(50, Number(opts.limit) || 10));
-    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path72.relative)(root, (0, import_node_path72.resolve)(p)) || ".") });
+    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path73.relative)(root, (0, import_node_path73.resolve)(p)) || ".") });
     if (opts.hint && paths.length === 0) {
       const hit = hintMatches(root, opts.hint);
       if (hit.files.length > 0) {
@@ -46390,7 +46558,7 @@ function registerProveCommand(program2) {
   });
   prove.command("check [model]").description("Elaborate a model (or every model) with the local Lean toolchain and report each property").option("--timeout <ms>", "Per-model timeout in ms", "120000").option("--json", "Machine-readable output").action((model, opts) => {
     const root = repoRoot();
-    if (!(0, import_node_fs86.existsSync)((0, import_node_path72.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs87.existsSync)((0, import_node_path73.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -46414,7 +46582,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
     const reports = [];
     for (const f of files) {
       const report = checkModel(tc, root, f, { timeoutMs: Math.max(1e3, Number(opts.timeout) || 12e4) });
-      report.file = (0, import_node_path72.relative)(root, f);
+      report.file = (0, import_node_path73.relative)(root, f);
       reports.push(report);
       try {
         writeResult(root, report);
@@ -46452,7 +46620,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
       printError("Not logged in \u2014 replays run on the Verity service. Run `verity login` first.");
       process.exit(2);
     }
-    if (!(0, import_node_fs86.existsSync)((0, import_node_path72.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs87.existsSync)((0, import_node_path73.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -46491,7 +46659,7 @@ ${report.error ?? ""}`);
         process.exit(2);
       }
     }
-    const modelSource = readRegularFileInRoot(root, (0, import_node_path72.relative)(root, file), 512 * 1024);
+    const modelSource = readRegularFileInRoot(root, (0, import_node_path73.relative)(root, file), 512 * 1024);
     if (!opts.json) printInfo(`replaying ${targets.length} counterexample(s) of ${model} in network-less containers (${Math.min(targets.length, REPLAY_CONCURRENCY)} at a time)\u2026`);
     const outcomes = await mapPool(targets, REPLAY_CONCURRENCY, async (p) => {
       const brief = buildReplayBrief(root, report, p, modelSource.ok ? modelSource.content : "");
@@ -46512,7 +46680,7 @@ ${report.error ?? ""}`);
   });
   prove.command("auto [files...]").description("The formal phase the pre-push guard runs: select one risky symbol among changed files, generate a model, check it, replay counterexamples (default files: the commits ahead of upstream)").option("--deadline <ms>", "Budget for the whole phase", "170000").option("--json", "Machine-readable output").action(async (paths, opts) => {
     const root = repoRoot();
-    let files = paths.map((p) => (0, import_node_path72.relative)(root, (0, import_node_path72.resolve)(p)));
+    let files = paths.map((p) => (0, import_node_path73.relative)(root, (0, import_node_path73.resolve)(p)));
     if (files.length === 0) {
       const ahead = runGitSync(root, ["diff", "--name-only", "@{upstream}...HEAD"]);
       const fallback = ahead.ok ? ahead : runGitSync(root, ["diff", "--name-only", "HEAD~1..HEAD"]);
@@ -46586,7 +46754,7 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
     let revise;
     if (opts.revise) {
       const existing = resolveModelFile(root, opts.revise);
-      const src = existing ? readRegularFileInRoot(root, (0, import_node_path72.relative)(root, existing), 64 * 1024) : null;
+      const src = existing ? readRegularFileInRoot(root, (0, import_node_path73.relative)(root, existing), 64 * 1024) : null;
       if (!src || !src.ok || !opts.note) {
         printError("--revise needs an existing model under Models/ and --note - with what the replay showed on stdin");
         process.exit(2);
@@ -46635,8 +46803,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("waive <file>").description("Dismiss the remembered formal finding(s) on a file for its current bytes \u2014 the accepted-risk path for a formal block").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action((file, opts) => {
     const root = repoRoot();
-    const rel0 = (0, import_node_path72.relative)(root, (0, import_node_path72.isAbsolute)(file) ? file : (0, import_node_path72.join)(root, file)).replace(/\\/g, "/");
-    const rel = rel0.startsWith("..") || (0, import_node_path72.isAbsolute)(rel0) ? null : rel0;
+    const rel0 = (0, import_node_path73.relative)(root, (0, import_node_path73.isAbsolute)(file) ? file : (0, import_node_path73.join)(root, file)).replace(/\\/g, "/");
+    const rel = rel0.startsWith("..") || (0, import_node_path73.isAbsolute)(rel0) ? null : rel0;
     if (!rel) {
       printError(`${file} is not inside this repository`);
       process.exit(2);
@@ -46652,8 +46820,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("hash <file>").description("Print the sha256 of a file, for a model header (Verity.model \u2026 sha256). Path is REPO-relative, as in the header").action((file) => {
     const root = repoRoot();
-    const rel = (0, import_node_path72.relative)(root, (0, import_node_path72.isAbsolute)(file) ? file : (0, import_node_path72.join)(root, file));
-    const digest = rel.startsWith("..") || (0, import_node_path72.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
+    const rel = (0, import_node_path73.relative)(root, (0, import_node_path73.isAbsolute)(file) ? file : (0, import_node_path73.join)(root, file));
+    const digest = rel.startsWith("..") || (0, import_node_path73.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
     if (!digest) {
       printError(`Cannot hash ${file}: it must be a regular file inside this repository (not a symlink)`);
       process.exit(2);
@@ -46687,10 +46855,10 @@ function refreshScaffold(root) {
 }
 
 // src/commands/lean.ts
-var import_node_fs87 = require("node:fs");
+var import_node_fs88 = require("node:fs");
 var import_node_child_process24 = require("node:child_process");
 var import_node_os16 = require("node:os");
-var import_node_path73 = require("node:path");
+var import_node_path74 = require("node:path");
 function registerLeanCommand(program2) {
   const lean = program2.command("lean").description("The Lean 4 toolchain formal verification needs (managed download, pinned by this CLI)");
   lean.command("status").option("--json", "Machine-readable output").description("Which toolchain would run, and whether it matches the pinned version").action((opts) => {
@@ -46709,7 +46877,7 @@ function registerLeanCommand(program2) {
     const bg = readInstallState();
     const background = bg ? { ...bg, running: bg.state === "running" && installRunning() } : null;
     if (opts.json) {
-      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs87.existsSync)((0, import_node_path73.join)(managed, "bin")), asset: leanAssetName(), background });
+      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs88.existsSync)((0, import_node_path74.join)(managed, "bin")), asset: leanAssetName(), background });
       return;
     }
     printInfo(`pinned: ${LEAN_TOOLCHAIN}`);
@@ -46730,7 +46898,7 @@ function registerLeanCommand(program2) {
       process.exit(2);
     }
     const dir = pinnedVersionDir();
-    if ((0, import_node_fs87.existsSync)((0, import_node_path73.join)(dir, "bin", "lake")) && !opts.force) {
+    if ((0, import_node_fs88.existsSync)((0, import_node_path74.join)(dir, "bin", "lake")) && !opts.force) {
       printInfo(`already installed at ${dir}`);
       return;
     }
@@ -46766,20 +46934,20 @@ function registerLeanCommand(program2) {
   });
   lean.command("remove").description("Delete the Verity-managed toolchain for the pinned version").action(() => {
     const dir = pinnedVersionDir();
-    if (!(0, import_node_fs87.existsSync)(dir)) {
+    if (!(0, import_node_fs88.existsSync)(dir)) {
       printInfo("nothing to remove");
       return;
     }
-    (0, import_node_fs87.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs88.rmSync)(dir, { recursive: true, force: true });
     printInfo(`removed ${dir}`);
   });
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.35.4").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.35.5").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
   const isTelemetryHelper = actionCommand.name() === "headers" && actionCommand.parent?.name() === "telemetry";
   if (!isTelemetryHelper) {
-    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.4");
+    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.5");
   }
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {