@cruxy/cli 1.11.1 → 1.11.3

package/dist/tools/file/write-file.js

@@ -2,11 +2,18 @@ import { promises as fs } from "node:fs";
 import path from "node:path";
 import { z } from "zod";
 import { resolveToolPath } from "./paths.js";
+import { changedSince, snapshotFile } from "./snapshot.js";
 /** How many leading lines of new content the approval preview shows. */
 const PREVIEW_LINES = 20;
 /**
  * Create or overwrite a file within the project root. Gated on `ctx.approve`
  * before anything is written.
+ *
+ * The target is snapshotted before approval — its current bytes, or its
+ * absence — and the write is refused if that state has moved by the time the
+ * write is about to happen (P1 — see `snapshot.ts`). This tool used to have
+ * no read at all: an "overwrite" approved against one version of a file would
+ * land on whatever version was there by the time the user pressed `y`.
  */
 export const writeFileTool = {
     name: "write_file",
@@ -25,11 +32,19 @@ export const writeFileTool = {
         catch (err) {
             return { ok: false, error: err.message };
         }
-        // Does the target already exist? Drives create-vs-overwrite in the preview.
-        const exists = await fs
-            .access(abs)
-            .then(() => true)
-            .catch(() => false);
+        // Does the target already exist? Drives create-vs-overwrite in the preview,
+        // and its bytes (or absence) are the state the approval is granted against.
+        let approvedState;
+        try {
+            approvedState = await snapshotFile(abs);
+        }
+        catch (err) {
+            return {
+                ok: false,
+                error: `cannot read ${input.path}: ${err.message}`,
+            };
+        }
+        const exists = approvedState.kind === "present";
         // First N lines of the new content, with a count of what's omitted.
         const allLines = input.content.split("\n");
         const lines = allLines.slice(0, PREVIEW_LINES);
@@ -46,6 +61,17 @@ export const writeFileTool = {
                 error: decision.feedback ?? `write to ${input.path} denied`,
             };
         }
+        // A create approved against "no file here" must not overwrite a file that
+        // appeared during the wait; an overwrite approved against one version must
+        // not land on another (P1).
+        const moved = await changedSince(abs, approvedState, input.path);
+        if (moved) {
+            // Told to the model as the error, and recorded for the user (P2
+            // verification): a file in their tree was written to by something else
+            // while they were being asked to approve a change to it.
+            ctx.verification?.record({ kind: "external-change", ...moved });
+            return { ok: false, error: moved.message };
+        }
         try {
             await fs.mkdir(path.dirname(abs), { recursive: true });
             await fs.writeFile(abs, input.content, "utf8");

package/dist/tools/registry.js

@@ -2,7 +2,7 @@ import { zodToJsonSchema } from "zod-to-json-schema";
 import { listFilesTool } from "./list-files.js";
 import { gitStatusTool } from "./git-status.js";
 import { readFileTool, writeFileTool, editFileTool, applyPatchTool, globTool, grepFilesTool, } from "./file/index.js";
-import { runCommandTool } from "./shell/index.js";
+import { makeRunCommandTool, runCommandTool, } from "./shell/index.js";
 import { makeRunTestsTool, } from "../testing/run-tests-tool.js";
 import { searchCodebaseTool } from "./search-codebase.js";
 import { listSkillsTool } from "./list-skills.js";
@@ -54,20 +54,51 @@ function toInputSchema(schema) {
     delete json.$ref;
     return json;
 }
-/** Build the default registry with every built-in tool registered. */
+/**
+ * Build the default registry with every always-on built-in registered.
+ *
+ * `tools` is the config block of the same name (P4). Its two keys —
+ * `fileEdit` and `shell` — were declared in the C.0 scaffold and, until P4,
+ * consumed by NOTHING: a user could set `tools.shell: false`, `cruxy config
+ * list` would show it, and `run_command` would register regardless. Deleting
+ * them was the other option and is ruled out by `initConfig`, which writes the
+ * full defaults into every generated config: the schema is `.strict()`, so a
+ * removed key would stop every `cruxy init`-generated config from loading on
+ * upgrade — a compat break for everyone, not the #296 kind that bites only
+ * whoever wrote the key. So the keys now mean what their names say:
+ *
+ *  - `fileEdit: false` withholds the three tools that write files through the
+ *    U.3 gate — `write_file`, `edit_file`, `apply_patch`. Reads stay.
+ *  - `shell: false` withholds the two that execute commands — `run_command`
+ *    and `run_tests` (the test runner is a shell command with a parser on it,
+ *    and "no shell" that still ran `pnpm test` would be a setting that lies).
+ *    `create_pull_request` runs git through its own approval and is not a
+ *    shell for the model; it stays.
+ *
+ * Both default to `true`, so a config that never mentions them — every config
+ * today — gets the same registry it always did. Omitted → both on.
+ */
 export function buildDefaultRegistry(opts = {}) {
+    const fileEdit = opts.tools?.fileEdit ?? true;
+    const shell = opts.tools?.shell ?? true;
     const registry = new ToolRegistry();
     registry.register(listFilesTool);
     registry.register(readFileTool);
-    registry.register(writeFileTool);
-    registry.register(editFileTool);
-    registry.register(applyPatchTool);
+    if (fileEdit) {
+        registry.register(writeFileTool);
+        registry.register(editFileTool);
+        registry.register(applyPatchTool);
+    }
     registry.register(globTool);
     registry.register(grepFilesTool);
     registry.register(gitStatusTool);
-    registry.register(runCommandTool);
-    // A fresh tool per registry — its iteration budget (C.13) is session-scoped.
-    registry.register(makeRunTestsTool(opts.onTestResult ? { onResult: opts.onTestResult } : {}));
+    if (shell) {
+        registry.register(opts.onCommandResult
+            ? makeRunCommandTool({ onResult: opts.onCommandResult })
+            : runCommandTool);
+        // A fresh tool per registry — its iteration budget (C.13) is session-scoped.
+        registry.register(makeRunTestsTool(opts.onTestResult ? { onResult: opts.onTestResult } : {}));
+    }
     registry.register(searchCodebaseTool);
     registry.register(listSkillsTool);
     registry.register(loadSkillTool);

package/dist/tools/schema-depth.js

@@ -1,10 +1,17 @@
 /**
- * The provider's tool-schema depth bound, and the counter that measures against
- * it. ONE home for both, because there are two consumers that must agree: the
- * CI gate on our own built-ins (`schema-depth.test.ts`) and the runtime bound on
- * third-party MCP schemas (`../mcp/bounds.ts`). A counter that disagreed with
- * the bound, or two copies of either drifting apart, would mean a schema that
- * passes here and dies on the wire.
+ * The gateway's three tool-schema bounds — depth, bytes, nodes — and the
+ * counters that measure against them. ONE home for all of it, because there
+ * are two consumers that must agree: the CI gate on our own built-ins
+ * (`schema-depth.test.ts`) and the runtime bound on third-party MCP schemas
+ * (`../mcp/bounds.ts`). A counter that disagreed with its bound, or two copies
+ * of either drifting apart, would mean a schema that passes here and dies on
+ * the wire.
+ *
+ * Until P4 only depth was mirrored. The gateway has always applied all three
+ * to every tool's `parameters` (cruxy-ai/api `internal/httpx/chat_tools.go`,
+ * `validateToolParameters`), from the same constants its structured-output
+ * validator uses, and a rejection names which one (`bound`: `bytes` | `depth`
+ * | `nodes`). Two of the three were caught by nothing here.
  */
 /**
  * Nesting depth of the JSON Schema we put on the wire, counted the way the
@@ -83,3 +90,69 @@ export function schemaDepth(node) {
  * `depth >= MAX_SCHEMA_DEPTH`.
  */
 export const MAX_SCHEMA_DEPTH = 8;
+/**
+ * The gateway's byte bound on ONE tool's `parameters`, as serialized on the
+ * wire. Mirrors `maxSchemaBytes` (128 KiB) in cruxy-ai/api
+ * `internal/httpx/structured.go`, applied per tool by `validateToolParameters`
+ * as `len(raw) > maxSchemaBytes` — so, unlike {@link MAX_SCHEMA_DEPTH}, this
+ * bound is INCLUSIVE: a schema is safe AT the limit and dies one byte past it.
+ *
+ * NOT OURS TO CHOOSE, same as depth: raising it here moves the failure from CI
+ * to every user's terminal, and a rejection carrying `bound: "bytes"` with a
+ * `limit` that disagrees with this number means THIS number is stale. If a
+ * schema cannot fit, the schema changes. Every built-in is two orders of
+ * magnitude under it today (the largest, `spawn_subagents`, is ~1.2 KB); the
+ * bound is here so that stays a fact CI checks rather than one someone
+ * remembers.
+ *
+ * The MCP path is covered twice over: `mcp.maxSchemaBytes` has a config
+ * ceiling of 64 KiB (`config/schema.ts`, #237), half this limit, and a test
+ * pins that the ceiling stays under the mirror — so no MCP schema that loads
+ * from config can reach the gateway's byte bound at all.
+ */
+export const MAX_SCHEMA_BYTES = 128 * 1024;
+/**
+ * The gateway's node bound on ONE tool's `parameters`: the number of
+ * containers (objects and arrays) in the schema. Mirrors `maxSchemaNodes`
+ * (400) in cruxy-ai/api `internal/httpx/structured.go`, applied per tool by
+ * `boundJSON` as `nodes > maxSchemaNodes` — INCLUSIVE, like bytes: safe at
+ * 400, dead at 401. {@link schemaNodes} counts exactly what `boundJSON`
+ * counts. Same provenance rule: a sanity ceiling that mirrors the gateway,
+ * never raised to make a schema fit. Flatten instead.
+ *
+ * Small and wide is the shape this catches that neither of the others does:
+ * a flat object with 400 string properties is 3 levels deep and a few KB, and
+ * the gateway refuses it.
+ */
+export const MAX_SCHEMA_NODES = 400;
+/**
+ * Container count of a JSON tree, counted the way the gateway's `boundJSON`
+ * counts it: every object and every array is one node, scalars are not. So
+ * `{}` is 1, `{a: {}}` is 2, `{a: [{}, {}]}` is 4. Iterative for the same
+ * reason {@link schemaDepth} is — the MCP path can hand this a hostile input.
+ */
+export function schemaNodes(node) {
+    const isContainer = (n) => Array.isArray(n) || (typeof n === "object" && n !== null);
+    if (!isContainer(node))
+        return 0;
+    let count = 0;
+    const pending = [node];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        count++;
+        const children = Array.isArray(current)
+            ? current
+            : Object.values(current);
+        for (const child of children)
+            if (isContainer(child))
+                pending.push(child);
+    }
+    return count;
+}
+/**
+ * Bytes of a schema as it goes on the wire: compact `JSON.stringify`, UTF-8 —
+ * which is what the SDK serializes and the gateway measures with `len(raw)`.
+ */
+export function schemaBytes(node) {
+    return Buffer.byteLength(JSON.stringify(node) ?? "", "utf8");
+}

package/dist/tools/shell/exec.js

@@ -33,6 +33,7 @@ export function execShell(command, ctx) {
  * throw coded errors from `sandbox.exec` and propagate — never caught here). */
 async function runSandboxed(command, ctx) {
     const { timeoutMs, maxOutputBytes } = ctx.config.shell;
+    const startedAt = Date.now();
     const result = await ctx.sandbox.exec(command, {
         cwd: ctx.cwd,
         timeoutMs,
@@ -45,11 +46,13 @@ async function runSandboxed(command, ctx) {
         signal: null,
         output: result.output,
         truncated: result.outputTruncated,
+        durationMs: Date.now() - startedAt,
     };
 }
 /** Spawn the command on the host, capture bounded output, enforce the timeout. */
 function runBounded(command, ctx) {
     const { timeoutMs, maxOutputBytes } = ctx.config.shell;
+    const startedAt = Date.now();
     return new Promise((resolve) => {
         // `spawnShell` routes through the resolved shell (POSIX default shell, Git
         // Bash, or PowerShell — see resolve-shell.ts) as the head of a killable tree
@@ -96,6 +99,7 @@ function runBounded(command, ctx) {
                 signal: null,
                 output: "",
                 truncated,
+                durationMs: Date.now() - startedAt,
             });
         }, timeoutMs);
         // External cancellation (C.33): a cancelled sibling's in-flight command is
@@ -114,6 +118,7 @@ function runBounded(command, ctx) {
                 signal: "SIGKILL",
                 output: Buffer.concat(chunks).toString("utf8"),
                 truncated,
+                durationMs: Date.now() - startedAt,
             });
         }
         if (abortSignal?.aborted) {
@@ -136,6 +141,7 @@ function runBounded(command, ctx) {
                 output: "",
                 truncated: false,
                 spawnError: err.message,
+                durationMs: Date.now() - startedAt,
             });
         });
         child.on("close", (code, closeSignal) => {
@@ -150,6 +156,7 @@ function runBounded(command, ctx) {
                 signal: closeSignal ?? null,
                 output: Buffer.concat(chunks).toString("utf8"),
                 truncated,
+                durationMs: Date.now() - startedAt,
             });
         });
     });

package/dist/tools/shell/run-command.js

@@ -9,27 +9,51 @@ import { runGatedShell } from "./exec.js";
  * C.19 hook runner — the single, un-bypassable shell path); this tool only maps
  * the structured result back onto its `ToolResult` framing.
  */
-export const runCommandTool = {
-    name: "run_command",
-    description: "Run a shell command in the project root and return its exit code, stdout, and stderr. Use this for builds, tests, linters, and git. Prefer the dedicated file tools (read_file/write_file/edit_file) over shelling out to cat/sed/echo for inspecting or editing files. A non-zero exit is still returned so you can react to the failure output.",
-    parameters: z.object({
-        command: z
-            .string()
-            .describe("The shell command to run (executed via the system shell)."),
-    }),
-    async execute(input, ctx) {
-        // A thrown CRUXY_E_APPROVAL_REQUIRED (non-interactive) / sandbox coded error
-        // propagates from runGatedShell — do not catch (fail loud).
-        const outcome = await runGatedShell(input.command, ctx);
-        if (!outcome.approved) {
-            return {
-                ok: false,
-                error: outcome.rejection ?? "command denied by the user",
-            };
-        }
-        return mapExecResult(outcome.exec, ctx);
-    },
-};
+/** Build the `run_command` tool. `deps.onResult` is the record's seam. */
+export function makeRunCommandTool(deps = {}) {
+    return {
+        name: "run_command",
+        description: "Run a shell command in the project root and return its exit code, stdout, and stderr. Use this for builds, tests, linters, and git. Prefer the dedicated file tools (read_file/write_file/edit_file) over shelling out to cat/sed/echo for inspecting or editing files. A non-zero exit is still returned so you can react to the failure output.",
+        parameters: z.object({
+            command: z
+                .string()
+                .describe("The shell command to run (executed via the system shell)."),
+        }),
+        async execute(input, ctx) {
+            // A thrown CRUXY_E_APPROVAL_REQUIRED (non-interactive) / sandbox coded error
+            // propagates from runGatedShell — do not catch (fail loud).
+            const outcome = await runGatedShell(input.command, ctx);
+            if (!outcome.approved) {
+                return {
+                    ok: false,
+                    error: outcome.rejection ?? "command denied by the user",
+                };
+            }
+            const exec = outcome.exec;
+            // Report from the same object the model's string is built from — and only
+            // when something ran. A spawn error never started, so there is no run.
+            if (exec.spawnError === undefined) {
+                try {
+                    deps.onResult?.({
+                        command: input.command,
+                        exitCode: exec.exitCode,
+                        timedOut: exec.timedOut,
+                        durationMs: exec.durationMs,
+                        outputTruncated: exec.truncated,
+                        substrate: ctx.sandbox ? "sandbox" : "host",
+                    });
+                }
+                catch {
+                    // A recording problem is not a command problem.
+                }
+            }
+            return mapExecResult(exec, ctx);
+        },
+    };
+}
+/** The default instance — no observer. Registries that record build their own
+ * via {@link makeRunCommandTool}; everything else is byte-identical. */
+export const runCommandTool = makeRunCommandTool();
 /**
  * Map a {@link ShellExecResult} onto the tool's `ToolResult` — the same "exit
  * code N" framing, truncation note, and timeout / spawn-error messages as

package/dist/utils/process-owner.js

@@ -0,0 +1,107 @@
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+/** The token when the platform lookup failed: liveness falls back to pid-only. */
+export const UNKNOWN_TOKEN = "unknown";
+/** The start-time token for `pid`, or {@link UNKNOWN_TOKEN} when unobtainable. */
+export function startToken(pid) {
+    try {
+        if (process.platform === "linux")
+            return linuxToken(pid);
+        if (process.platform === "darwin")
+            return darwinToken(pid);
+        if (process.platform === "win32")
+            return win32Token(pid);
+    }
+    catch {
+        // fall through — the platform said no; degrade to pid-only
+    }
+    return UNKNOWN_TOKEN;
+}
+/** This process's own stamp. Computed once — a process's identity never changes. */
+export function selfStamp() {
+    if (!self) {
+        self = {
+            pid: process.pid,
+            token: startToken(process.pid),
+            startedAt: new Date(Date.now() - process.uptime() * 1000).toISOString(),
+        };
+    }
+    return self;
+}
+let self;
+/** Whether a process with `pid` exists (EPERM counts: it exists, just not ours). */
+export function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === "EPERM";
+    }
+}
+/**
+ * Classify a stamp against the live process table. Order matters: `self` is
+ * decided by pid AND token, so a stamp our own pid inherited from a crashed
+ * predecessor (pid recycled onto us) still reads as stale.
+ */
+export function describeOwner(stamp) {
+    const me = selfStamp();
+    if (stamp.pid === me.pid) {
+        return stamp.token === me.token ? "self" : "stale";
+    }
+    if (!pidAlive(stamp.pid))
+        return "stale";
+    // Alive by pid. If both sides have a real token and they differ, the pid was
+    // recycled. An unknown token on either side cannot prove that, so the stamp
+    // is treated as live — the documented pid-only degradation.
+    if (stamp.token === UNKNOWN_TOKEN)
+        return "live";
+    const now = startToken(stamp.pid);
+    if (now === UNKNOWN_TOKEN)
+        return "live";
+    return now === stamp.token ? "live" : "stale";
+}
+// ── platform lookups ──────────────────────────────────────────────────────────
+function linuxToken(pid) {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    // The comm field is parenthesised and may itself contain spaces or parens;
+    // everything after the LAST `)` is the fixed-position numeric tail, in which
+    // starttime is the 20th entry (field 22 of the whole line).
+    const tail = stat
+        .slice(stat.lastIndexOf(")") + 2)
+        .trim()
+        .split(/\s+/);
+    const starttime = tail[19];
+    if (!starttime)
+        throw new Error("unexpected /proc stat shape");
+    let boot = "";
+    try {
+        boot = readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
+    }
+    catch {
+        // Older kernels / locked-down containers: the token is still per-boot in
+        // practice (ticks since boot), just not provably so across reboots.
+    }
+    return `linux:${boot}:${starttime}`;
+}
+function darwinToken(pid) {
+    const out = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 2000,
+    }).trim();
+    if (out === "")
+        throw new Error("no such process");
+    return `darwin:${out.replace(/\s+/g, " ")}`;
+}
+function win32Token(pid) {
+    const out = execFileSync("powershell", [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        `(Get-Process -Id ${pid} -ErrorAction Stop).StartTime.ToString('o')`,
+    ], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 }).trim();
+    if (out === "")
+        throw new Error("no such process");
+    return `win32:${out}`;
+}

package/dist/vcs/generate.js

@@ -1,3 +1,4 @@
+import { verificationMarkdown } from "../verification/view.js";
 /**
  * Turn a diff + session context into the PR publish content (C.15): a
  * conventional-commit subject, a structured body, a branch name, and the PR
@@ -8,6 +9,14 @@
  *
  * Secrets never leave: the diff is redacted before the LLM sees it, and the
  * generated bodies are redacted again (defense-in-depth).
+ *
+ * The `## Verification` section is the record's, on BOTH paths (P2
+ * verification). The model is handed a diff; it has no way to know what ran,
+ * and asking it to write that section produced the same manufactured claim
+ * cli#309 removed from the fallback body, one layer up. So the prompt no
+ * longer asks for it, `finalize` drops one the model writes anyway, and the
+ * section that does appear is built here from `GenerateInput.verification` —
+ * the runs that actually executed, with their exit codes and timestamps.
  */
 /** Conventional-commit types accepted by `@commitlint/config-conventional`. */
 export const CONVENTIONAL_TYPES = [
@@ -183,11 +192,19 @@ export async function generateWithLlm(provider, input, opts = {}) {
 /** Shared final assembly: normalize the subject, redact bodies, pick a branch. */
 function finalize(rawSubject, rawBody, input, extra = {}) {
     const commitSubject = normalizeSubject(rawSubject, input.scopes);
-    const body = redactSecrets((rawBody ?? extra.prBody ?? "").trim() ||
-        assembleBody({
-            what: rawSubject || commitSubject,
-            verification: "`pnpm -r typecheck && pnpm lint && pnpm -r test`",
-        }));
+    // The body's prose is the caller's or the model's; its `## Verification`
+    // section is the record's. Any such section in the supplied body is dropped
+    // first — the deterministic guarantee, same posture as `normalizeSubject`:
+    // the prompt says not to write one, and this holds even if the model slips.
+    // When no body was supplied, the fallback carries ONLY what is known: the
+    // subject. (It used to add a Verification section naming a typecheck + lint
+    // + test command on every PR, whether or not anything ran — cli#309.) Then
+    // the record's section is appended, when there is a record: a body that
+    // names what ran comes only from something that knows what ran, and a
+    // missing section is the honest shape for missing evidence.
+    const prose = stripVerificationSection((rawBody ?? extra.prBody ?? "").trim()) ||
+        assembleBody({ what: rawSubject || commitSubject });
+    const body = redactSecrets(withRecordedVerification(prose, input.verification));
     const commitBody = redactSecrets((extra.commitBody ?? rawBody ?? "").trim());
     const branchName = input.currentBranch ??
         sanitizeBranch(extra.branchName) ??
@@ -200,6 +217,31 @@ function finalize(rawSubject, rawBody, input, extra = {}) {
         prBody: body,
     };
 }
+/**
+ * Drop a `## Verification` section — its heading through the line before the
+ * next `## ` heading, or the end — from a markdown body. Only the H2 shape the
+ * prompt itself describes is recognised; nothing else in the prose is touched.
+ */
+export function stripVerificationSection(markdown) {
+    const out = [];
+    let dropping = false;
+    for (const line of markdown.split("\n")) {
+        if (/^##\s/.test(line))
+            dropping = /^##\s+verification\b/i.test(line);
+        if (!dropping)
+            out.push(line);
+    }
+    return out.join("\n").trim();
+}
+/** Append the record's `## Verification` section, when there is a record. */
+function withRecordedVerification(body, verification) {
+    if (!verification)
+        return body;
+    const md = verificationMarkdown(verification.runs, {
+        ...(verification.from ? { from: verification.from } : {}),
+    });
+    return md === null ? body : `${body}\n\n## Verification\n\n${md}`;
+}
 /** Accept a model-proposed branch only if it's a plausible ref; else null. */
 function sanitizeBranch(name) {
     if (!name)
@@ -251,7 +293,7 @@ function buildSystemPrompt(input) {
     if (input.scopes.length > 0) {
         lines.push(`- If you use a scope, it must be one of: ${input.scopes.join(", ")}.`);
     }
-    lines.push("", "prBody: GitHub-flavored markdown with sections '## What changed', '## Why', '## Verification'.", "branchName: short kebab-case `type/slug`, no spaces.", "Never include secrets, tokens, or credentials in any field.");
+    lines.push("", "prBody: GitHub-flavored markdown with sections '## What changed' and '## Why'.", "Do NOT write a '## Verification' section, and do not state what was run, tested, built, or checked anywhere in prBody or commitBody:", "you have the diff, not the record of what executed. That section is appended afterwards from cruxy's record of the commands that actually ran, and one you write is dropped.", "branchName: short kebab-case `type/slug`, no spaces.", "Never include secrets, tokens, or credentials in any field.");
     if (input.skillBody) {
         lines.push("", "Repository commit conventions (authoritative):", input.skillBody);
     }

package/dist/verification/index.js

@@ -0,0 +1,15 @@
+/**
+ * The verification record (P2 verification): evidence of what ran and how it
+ * exited, keyed to the turn it ran in. Evidence, not enforcement — see
+ * `types.ts` for why that decision stands.
+ *
+ *  - `types.ts`  — the record shapes and the honesty rules;
+ *  - `ledger.ts` — the in-memory side a live session's surfaces read;
+ *  - `view.ts`   — the one formatter every surface shares.
+ *
+ * The durable side is the session log (`session/types.ts`: `verification` and
+ * `external-change` events), written from the same call as the ledger.
+ */
+export * from "./types.js";
+export * from "./ledger.js";
+export * from "./view.js";

package/dist/verification/ledger.js

@@ -0,0 +1,99 @@
+import { MAX_FAILURE_NAMES, } from "./types.js";
+/**
+ * The in-memory side of the verification record — what the surfaces of a LIVE
+ * session read. The durable side is the session log, reached through `sink`.
+ *
+ * The split mirrors `Session.lastRun` against the usage store: the process
+ * keeps the few facts its own surfaces ask for (this turn's runs for the
+ * one-shot summary, the last run for `/status`), and the log keeps everything
+ * for as long as the session survives retention. Neither re-derives from the
+ * other; both are written from the same call.
+ *
+ * ONE LEDGER PER SESSION, shared by every tool instance and every subagent
+ * the session drives. A subagent's test run is still a run that happened in
+ * this turn, and a fan-out's refused write is still a file that moved.
+ */
+export class VerificationLedger {
+    deps;
+    last;
+    /** Runs recorded this session, oldest first, bounded (see `SESSION_CAP`). */
+    runs = [];
+    turnRuns = [];
+    turnChanges = [];
+    constructor(deps = {}) {
+        this.deps = deps;
+    }
+    /**
+     * A new user turn begins: this turn's lists start empty. The session-wide
+     * facts (`lastVerification`, `sessionRuns`) are untouched — a run from an
+     * earlier turn is still the last thing that ran.
+     */
+    beginTurn() {
+        this.turnRuns = [];
+        this.turnChanges = [];
+    }
+    /**
+     * Record one observation: stamp it, keep it, and hand it to the sink.
+     *
+     * The sink is wrapped because a recording problem is not a test-run problem.
+     * The run already happened and its result is on its way to the model; a
+     * session log that cannot write must degrade to "not saved", never fail the
+     * tool call that produced the fact.
+     */
+    record(obs) {
+        const at = this.deps.now?.() ?? new Date().toISOString();
+        if (obs.kind === "verification") {
+            const rec = {
+                ...withoutKind(obs),
+                failureNames: obs.failureNames.slice(0, MAX_FAILURE_NAMES),
+                at,
+            };
+            this.last = rec;
+            this.turnRuns.push(rec);
+            this.runs.push(rec);
+            if (this.runs.length > SESSION_CAP)
+                this.runs.shift();
+        }
+        else {
+            this.turnChanges.push({ ...withoutKind(obs), at });
+        }
+        try {
+            this.deps.sink?.(obs);
+        }
+        catch {
+            // Persistence is not allowed to fail the run it is recording.
+        }
+    }
+    /**
+     * Adopt the last run a resumed session's log recorded, so `/status` after
+     * `--resume` shows it rather than "none this session". Absent when the log
+     * pre-dates the record — absence is "not recorded", never "did not happen".
+     */
+    seed(last) {
+        if (!last)
+            return;
+        this.last = last;
+        this.runs = [last];
+    }
+    /** The most recent run that executed, this session (or seeded on resume). */
+    get lastVerification() {
+        return this.last;
+    }
+    /** Every run recorded this session, oldest first, bounded. */
+    sessionRuns() {
+        return this.runs;
+    }
+    /** What THIS turn recorded — the one-shot summary's unit. */
+    turn() {
+        return { verifications: this.turnRuns, externalChanges: this.turnChanges };
+    }
+}
+/** Most runs kept in memory per session. The log keeps the rest. */
+export const SESSION_CAP = 50;
+/** The observation minus its discriminant — the record is what happened, and
+ * `kind` was only ever the routing tag. */
+function withoutKind(obs) {
+    const copy = { ...obs };
+    delete copy.kind;
+    return copy;
+}