@codyswann/lisa 2.180.1 → 2.182.0

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/skills/phaser-build-deploy/SKILL.md

@@ -31,7 +31,10 @@ export default defineConfig({
     terserOptions: { compress: { passes: 2, drop_console: true }, format: { comments: false } },
     rollupOptions: {
       output: {
-        manualChunks: { phaser: ["phaser"] },          // engine in its own long-lived chunk
+        // Vite 8's rolldown bundler requires the FUNCTION form (the object form
+        // `{ phaser: ["phaser"] }` throws "manualChunks is not a function").
+        manualChunks: id =>
+          id.includes("node_modules/phaser") ? "phaser" : undefined,
         entryFileNames: "assets/[name]-[hash].js",      // content hash on everything
         chunkFileNames: "assets/[name]-[hash].js",
         assetFileNames: "assets/[name]-[hash][extname]",
@@ -41,9 +44,11 @@ export default defineConfig({
 });
 ```
 
-`manualChunks: { phaser: ["phaser"] }` is the single highest-value line: Phaser is
-hundreds of KB and rarely changes, so isolating it means a gameplay tweak only
-busts the small app chunk. Two-pass terser squeezes meaningfully more than one.
+The `manualChunks` function is the single highest-value line: Phaser is hundreds
+of KB and rarely changes, so isolating it means a gameplay tweak only busts the
+small app chunk. Use the **function** form — Vite 8 ships the rolldown bundler,
+which requires it (the classic object form throws `manualChunks is not a
+function`). Two-pass terser squeezes meaningfully more than one.
 
 ## Asset hashing and immutable caching
 

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/skills/phaser-build-deploy/SKILL.md

@@ -31,7 +31,10 @@ export default defineConfig({
     terserOptions: { compress: { passes: 2, drop_console: true }, format: { comments: false } },
     rollupOptions: {
       output: {
-        manualChunks: { phaser: ["phaser"] },          // engine in its own long-lived chunk
+        // Vite 8's rolldown bundler requires the FUNCTION form (the object form
+        // `{ phaser: ["phaser"] }` throws "manualChunks is not a function").
+        manualChunks: id =>
+          id.includes("node_modules/phaser") ? "phaser" : undefined,
         entryFileNames: "assets/[name]-[hash].js",      // content hash on everything
         chunkFileNames: "assets/[name]-[hash].js",
         assetFileNames: "assets/[name]-[hash][extname]",
@@ -41,9 +44,11 @@ export default defineConfig({
 });
 ```
 
-`manualChunks: { phaser: ["phaser"] }` is the single highest-value line: Phaser is
-hundreds of KB and rarely changes, so isolating it means a gameplay tweak only
-busts the small app chunk. Two-pass terser squeezes meaningfully more than one.
+The `manualChunks` function is the single highest-value line: Phaser is hundreds
+of KB and rarely changes, so isolating it means a gameplay tweak only busts the
+small app chunk. Use the **function** form — Vite 8 ships the rolldown bundler,
+which requires it (the classic object form throws `manualChunks is not a
+function`). Two-pass terser squeezes meaningfully more than one.
 
 ## Asset hashing and immutable caching
 

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/skills/phaser-build-deploy/SKILL.md

@@ -31,7 +31,10 @@ export default defineConfig({
     terserOptions: { compress: { passes: 2, drop_console: true }, format: { comments: false } },
     rollupOptions: {
       output: {
-        manualChunks: { phaser: ["phaser"] },          // engine in its own long-lived chunk
+        // Vite 8's rolldown bundler requires the FUNCTION form (the object form
+        // `{ phaser: ["phaser"] }` throws "manualChunks is not a function").
+        manualChunks: id =>
+          id.includes("node_modules/phaser") ? "phaser" : undefined,
         entryFileNames: "assets/[name]-[hash].js",      // content hash on everything
         chunkFileNames: "assets/[name]-[hash].js",
         assetFileNames: "assets/[name]-[hash][extname]",
@@ -41,9 +44,11 @@ export default defineConfig({
 });
 ```
 
-`manualChunks: { phaser: ["phaser"] }` is the single highest-value line: Phaser is
-hundreds of KB and rarely changes, so isolating it means a gameplay tweak only
-busts the small app chunk. Two-pass terser squeezes meaningfully more than one.
+The `manualChunks` function is the single highest-value line: Phaser is hundreds
+of KB and rarely changes, so isolating it means a gameplay tweak only busts the
+small app chunk. Use the **function** form — Vite 8 ships the rolldown bundler,
+which requires it (the classic object form throws `manualChunks is not a
+function`). Two-pass terser squeezes meaningfully more than one.
 
 ## Asset hashing and immutable caching
 

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/skills/phaser-build-deploy/SKILL.md

@@ -31,7 +31,10 @@ export default defineConfig({
     terserOptions: { compress: { passes: 2, drop_console: true }, format: { comments: false } },
     rollupOptions: {
       output: {
-        manualChunks: { phaser: ["phaser"] },          // engine in its own long-lived chunk
+        // Vite 8's rolldown bundler requires the FUNCTION form (the object form
+        // `{ phaser: ["phaser"] }` throws "manualChunks is not a function").
+        manualChunks: id =>
+          id.includes("node_modules/phaser") ? "phaser" : undefined,
         entryFileNames: "assets/[name]-[hash].js",      // content hash on everything
         chunkFileNames: "assets/[name]-[hash].js",
         assetFileNames: "assets/[name]-[hash][extname]",
@@ -41,9 +44,11 @@ export default defineConfig({
 });
 ```
 
-`manualChunks: { phaser: ["phaser"] }` is the single highest-value line: Phaser is
-hundreds of KB and rarely changes, so isolating it means a gameplay tweak only
-busts the small app chunk. Two-pass terser squeezes meaningfully more than one.
+The `manualChunks` function is the single highest-value line: Phaser is hundreds
+of KB and rarely changes, so isolating it means a gameplay tweak only busts the
+small app chunk. Use the **function** form — Vite 8 ships the rolldown bundler,
+which requires it (the classic object form throws `manualChunks is not a
+function`). Two-pass terser squeezes meaningfully more than one.
 
 ## Asset hashing and immutable caching
 

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.180.1",
+  "version": "2.182.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/rules/eager/verification.md

@@ -4,12 +4,18 @@
 
 **Verification is using the resulting software the way a user would** — interacting with the UI, calling the API, running the CLI, observing behavior. Tests pass in isolation; verification proves the system works as a whole.
 
+**Verification IS UAT** (User Acceptance Testing) — the same single gate, not two concepts. "Use the software as a user, against the acceptance criteria" *is* UAT. Everything below makes that one process concrete: a committed evidence artifact, a codified check that re-runs in CI, and a per-change requirement.
+
 ## Mandatory
 
 - **Never claim success without runtime evidence.** "The code looks correct" is not evidence.
 - **If all you did was run tests, typecheck, and lint — you have NOT verified.**
 - **Before starting implementation, state your verification plan** — how you will USE the resulting software to prove it works. A plan that only lists `test`/`typecheck`/`lint` commands is not a plan. Do not begin until confirmed.
 - **After verifying empirically, codify it as a regression test** via the `codify-verification` skill — Playwright for UI, integration test for API/DB/auth, benchmark for performance. Codification is mandatory for every verification type except PR/Documentation/Deploy and Investigate-Only spikes.
+- **The codified proof re-runs in CI.** Codified runtime verification lives where the project's e2e/Playwright tests live (`tests/e2e/**`) and runs as a required CI check for types with verification enforced — so the proof re-runs on every PR, not once by hand.
+- **Commit the evidence.** Write a durable artifact to `evidence/<ticket>/` — the acceptance criteria with per-criterion pass/fail + note, the observed state, screenshots/recording, and a `verdict.json`. The transient `.lisa/verification-status.json` is the session gate; `evidence/<ticket>/` is the committed proof.
+- **Per-change verification is mandatory.** Every `feat`/`fix` adds or extends a verification (e2e) spec mapped to its acceptance criteria. The only exception is a genuinely non-behavioral change explicitly marked with the **logged** `verification-exempt` label — never a silent skip.
+- **Drive the playthrough with `/lisa:product-walkthrough`** (it walks the live product through a real browser); each project type plugs in its own drive mechanism (e.g. a Phaser game is driven through Playwright + an in-game verification test bridge that seeds RNG, reads state, injects input, and steps frames).
 - **Every PR must include reviewer replay steps** — the exact human steps to use the software and confirm the change works. Not test commands. If a reviewer can't reproduce from the PR description alone, the PR is incomplete.
 - **Exhaust credential sources before deferring runtime verification** — check project e2e / Playwright config and fixtures first, then `.lisa.config.local.json` / environment variables, then documented ticket credentials such as `Sign-in Required`.
 - **Never mark required runtime verification done on artifact-only evidence** — if credentials are genuinely unavailable after all sources are checked, post the blocker, transition the item to the configured blocked state, apply the configured `needs-human` / `human-review` label, and label the evidence as `artifact-only / verification deferred`.

package/plugins/src/base/rules/reference/verification.md

@@ -135,4 +135,51 @@ Evidence and summaries must explicitly distinguish `verified empirically` from `
 
 ---
 
+## Making verification concrete (UAT)
+
+Verification **is** UAT — one gate, not two. This section makes the single
+verification process concrete so "an agent actually exercised the running
+software against the acceptance criteria" is durable and re-checkable, not a
+one-off claim. It builds on the **Per-Work-Unit Evidence Contract** above (the
+`[EVIDENCE: name]` manifest), adding three concrete requirements:
+
+**1. The codified proof re-runs in CI.** After local verification passes,
+`codify-verification` encodes it where the project's e2e/Playwright tests live
+(`tests/e2e/**`). That suite runs in CI (the existing e2e/Playwright job); for a
+project type with verification **enforced**, it is a required check — so the proof
+re-runs on every PR instead of being proven once by hand.
+
+**2. Evidence is committed to the repo.** The named artifacts from the work
+unit's evidence manifest are committed under `evidence/<ticket>/` (in addition to
+any tracker attachment), so the proof lives with the code and is reviewable in the
+PR:
+
+```
+evidence/<ticket>/
+  verdict.json       # acceptance criteria + per-criterion pass/fail + note,
+                     # overall verdict, ticket, commit, lisaVersion, agent, stampedAt
+  state.json         # observed runtime state asserted against
+  screenshots/*.png  # downscaled, capped; key frames of the playthrough
+```
+
+`evidence/**` is ignored by lint/format/knip/coverage — it is proof, not source.
+
+**3. Per-change verification is enforced.** Every `feat`/`fix` adds or extends a
+verification (e2e) spec mapped to its acceptance criteria. CI's
+`verification-coverage` check requires that delta. The sole exception is a
+genuinely non-behavioral change carrying the **logged** `verification-exempt`
+label — the check prints why it was exempted; it is never a silent skip.
+
+**Playthrough driver.** `/lisa:product-walkthrough` is the shared driver (it walks
+the live product through a real browser). Each project type supplies its own drive
+mechanism: a Phaser game is driven through Playwright + an in-game verification
+test bridge (seed RNG, read state, inject semantic input, step frames); API types
+drive HTTP against a running service; etc.
+
+**Rollout.** Enforcement is per-type and flag-gated (the `verify_enforced`
+workflow input, default off) so a type without a drive mechanism is never wedged.
+Phaser is the first enforced type.
+
+---
+
 For the full verification lifecycle (classify, check tooling, plan, execute, loop), surfaces, escalation protocol, and proof artifact requirements, see the `verification-lifecycle` skill loaded by the `verification-specialist` agent.

package/plugins/src/base/skills/codify-verification/SKILL.md

@@ -88,6 +88,16 @@ For Playwright UI tests specifically:
 - Capture a trace or screenshot only if the project's existing tests do; do not invent a new artifact convention
 - Mirror the project's existing config for base URL, retries, and test isolation
 
+**Concrete verification (UAT) contract.** Verification *is* UAT — codifying it is
+how the playthrough becomes durable. For a runtime/behavioral `feat`/`fix`: place
+the codified test where the project's e2e/Playwright tests live (`tests/e2e/**`)
+so CI re-runs it, and commit the evidence artifact to `evidence/<ticket>/`
+(`verdict.json` + state + screenshots). For a Phaser game, drive the canvas
+through the in-game verification test bridge (seed RNG, read state, inject input,
+step frames) with deterministic rendering. CI's `verification-coverage` check
+requires a verification-spec delta on every behavioral change. See the
+`reference/verification.md` "Making verification concrete (UAT)" section.
+
 ### 4. Run the test in isolation
 
 Run only the new test, using whatever per-test invocation the project supports:

package/plugins/src/phaser/skills/phaser-build-deploy/SKILL.md

@@ -31,7 +31,10 @@ export default defineConfig({
     terserOptions: { compress: { passes: 2, drop_console: true }, format: { comments: false } },
     rollupOptions: {
       output: {
-        manualChunks: { phaser: ["phaser"] },          // engine in its own long-lived chunk
+        // Vite 8's rolldown bundler requires the FUNCTION form (the object form
+        // `{ phaser: ["phaser"] }` throws "manualChunks is not a function").
+        manualChunks: id =>
+          id.includes("node_modules/phaser") ? "phaser" : undefined,
         entryFileNames: "assets/[name]-[hash].js",      // content hash on everything
         chunkFileNames: "assets/[name]-[hash].js",
         assetFileNames: "assets/[name]-[hash][extname]",
@@ -41,9 +44,11 @@ export default defineConfig({
 });
 ```
 
-`manualChunks: { phaser: ["phaser"] }` is the single highest-value line: Phaser is
-hundreds of KB and rarely changes, so isolating it means a gameplay tweak only
-busts the small app chunk. Two-pass terser squeezes meaningfully more than one.
+The `manualChunks` function is the single highest-value line: Phaser is hundreds
+of KB and rarely changes, so isolating it means a gameplay tweak only busts the
+small app chunk. Use the **function** form — Vite 8 ships the rolldown bundler,
+which requires it (the classic object form throws `manualChunks is not a
+function`). Two-pass terser squeezes meaningfully more than one.
 
 ## Asset hashing and immutable caching
 

package/tsconfig/phaser.json

@@ -2,8 +2,8 @@
   "extends": "./typescript.json",
   "compilerOptions": {
     "lib": ["ES2022", "DOM", "DOM.Iterable"],
-    "rootDir": ".",
-    "outDir": "dist",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
     "resolveJsonModule": true,
     "allowJs": false,
     "skipLibCheck": true,

package/typescript/copy-overwrite/scripts/check-verification-coverage.mjs

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+/**
+ * check-verification-coverage — per-change verification (UAT) gate.
+ *
+ * Verification IS UAT — one gate, not two. This fails a feat/fix change that
+ * ships no verification-spec delta (the project's e2e/Playwright tests, where
+ * `codify-verification` lands the codified playthrough), so every behavioral
+ * change carries an acceptance test an agent's verification produced. A genuinely
+ * non-behavioral change may carry the `verification-exempt` label, which this
+ * check honors but LOGS (never a silent skip).
+ *
+ * Inputs (all via env, CI-friendly):
+ *   VERIFY_BASE_SHA      diff base (else falls back to `origin/<VERIFY_BASE_REF|main>...HEAD`)
+ *   VERIFY_HEAD_SHA      diff head (default HEAD)
+ *   VERIFY_BASE_REF      base branch for the fallback range (default main)
+ *   VERIFY_CHANGE_TYPES  comma list of conventional-commit types in the change
+ *                        (e.g. "feat,chore"); if empty, derived from commit subjects
+ *   VERIFY_LABELS        comma list of PR labels (for `verification-exempt`)
+ *
+ * Exit 0 = satisfied / exempt / not-required. Exit 1 = required but missing.
+ * @module scripts/check-verification-coverage
+ */
+import { execSync } from "node:child_process";
+import { pathToFileURL } from "node:url";
+
+const BEHAVIORAL_TYPES = new Set(["feat", "fix"]);
+const EXEMPT_LABEL = "verification-exempt";
+// A verification spec lives in a top-level e2e/ dir, a nested tests/e2e/ tree,
+// or a tests/verification/ tree — NOT an arbitrary path that merely contains an
+// "e2e" segment (e.g. src/e2e/helpers.ts must not satisfy the gate).
+const VERIFICATION_PATH = /^e2e\/|(^|\/)tests\/(e2e|verification)\//;
+
+/**
+ * Pure decision: is a verification-spec delta required, and is it satisfied?
+ * @param {object} input - Evaluation input
+ * @param {string[]} input.changedFiles - Paths changed in the range
+ * @param {string[]} input.changeTypes - Conventional-commit types present
+ * @param {string[]} input.labels - PR labels
+ * @returns {{required: boolean, ok: boolean, exempt?: boolean, reason: string}} Verdict
+ */
+export function evaluateVerificationCoverage({
+  changedFiles,
+  changeTypes,
+  labels,
+}) {
+  const isBehavioral = changeTypes.some(type => BEHAVIORAL_TYPES.has(type));
+  const isExempt = labels.includes(EXEMPT_LABEL);
+  const hasDelta = changedFiles.some(file => VERIFICATION_PATH.test(file));
+
+  if (!isBehavioral) {
+    return {
+      required: false,
+      ok: true,
+      reason: "No feat/fix change — a verification-spec delta is not required.",
+    };
+  }
+  if (isExempt) {
+    return {
+      required: true,
+      ok: true,
+      exempt: true,
+      reason: `Behavioral change exempted by the '${EXEMPT_LABEL}' label.`,
+    };
+  }
+  if (hasDelta) {
+    return {
+      required: true,
+      ok: true,
+      reason: "Behavioral change ships a verification (e2e) spec delta.",
+    };
+  }
+  return {
+    required: true,
+    ok: false,
+    reason: `Behavioral change (feat/fix) ships NO verification (e2e) spec and is not labeled '${EXEMPT_LABEL}'.`,
+  };
+}
+
+/**
+ * Gather the change context from git + env.
+ * @returns {{changedFiles: string[], changeTypes: string[], labels: string[]}} Context
+ */
+function gatherContext() {
+  const head = process.env.VERIFY_HEAD_SHA || "HEAD";
+  const baseRef = process.env.VERIFY_BASE_REF || "main";
+  const base = process.env.VERIFY_BASE_SHA || `origin/${baseRef}`;
+  // Three-dot diff = the PR's "files changed" (merge-base), matching GitHub.
+  // Two-dot log = the commits the PR introduces (not both tips).
+  const diffRange = `${base}...${head}`;
+  const logRange = `${base}..${head}`;
+
+  const runGit = (cmd, fallback) => {
+    try {
+      return execSync(cmd, { encoding: "utf8" });
+    } catch {
+      return fallback;
+    }
+  };
+
+  const changedFiles = runGit(`git diff --name-only ${diffRange}`, "")
+    .split("\n")
+    .map(line => line.trim())
+    .filter(Boolean);
+
+  const fromEnv = (process.env.VERIFY_CHANGE_TYPES || "")
+    .split(",")
+    .map(value => value.trim().toLowerCase())
+    .filter(Boolean);
+  const fromCommits = fromEnv.length
+    ? []
+    : runGit(`git log --format=%s ${logRange}`, "")
+        .split("\n")
+        .map(subject => {
+          const match = subject.match(/^(\w+)[(!:]/);
+          return match ? match[1].toLowerCase() : null;
+        })
+        .filter(Boolean);
+  const changeTypes = [...new Set([...fromEnv, ...fromCommits])];
+
+  const labels = (process.env.VERIFY_LABELS || "")
+    .split(",")
+    .map(value => value.trim())
+    .filter(Boolean);
+
+  return { changedFiles, changeTypes, labels };
+}
+
+/**
+ * CLI entry: evaluate and exit non-zero when a required verification delta is missing.
+ * @returns {void}
+ */
+function main() {
+  const context = gatherContext();
+  const result = evaluateVerificationCoverage(context);
+  console.log(
+    `[verification-coverage] types=[${context.changeTypes.join(
+      ","
+    )}] labels=[${context.labels.join(",")}]`
+  );
+  console.log(`[verification-coverage] ${result.reason}`);
+  if (result.exempt) {
+    console.log(
+      "[verification-coverage] EXEMPT (logged): proceeding without a verification delta for a declared non-behavioral change."
+    );
+  }
+  if (!result.ok) {
+    console.error(`[verification-coverage] FAIL: ${result.reason}`);
+    process.exit(1);
+  }
+  console.log("[verification-coverage] OK");
+}
+
+// Run only when invoked directly — importing for tests must have no side effects.
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  main();
+}