@cruxy/cli 1.11.2 → 1.11.4

package/dist/tools/file/write-file.js

@@ -65,8 +65,13 @@ export const writeFileTool = {
         // appeared during the wait; an overwrite approved against one version must
         // not land on another (P1).
         const moved = await changedSince(abs, approvedState, input.path);
-        if (moved)
-            return { ok: false, error: moved };
+        if (moved) {
+            // Told to the model as the error, and recorded for the user (P2
+            // verification): a file in their tree was written to by something else
+            // while they were being asked to approve a change to it.
+            ctx.verification?.record({ kind: "external-change", ...moved });
+            return { ok: false, error: moved.message };
+        }
         try {
             await fs.mkdir(path.dirname(abs), { recursive: true });
             await fs.writeFile(abs, input.content, "utf8");

package/dist/tools/registry.js

@@ -2,7 +2,7 @@ import { zodToJsonSchema } from "zod-to-json-schema";
 import { listFilesTool } from "./list-files.js";
 import { gitStatusTool } from "./git-status.js";
 import { readFileTool, writeFileTool, editFileTool, applyPatchTool, globTool, grepFilesTool, } from "./file/index.js";
-import { runCommandTool } from "./shell/index.js";
+import { makeRunCommandTool, runCommandTool, } from "./shell/index.js";
 import { makeRunTestsTool, } from "../testing/run-tests-tool.js";
 import { searchCodebaseTool } from "./search-codebase.js";
 import { listSkillsTool } from "./list-skills.js";
@@ -54,20 +54,51 @@ function toInputSchema(schema) {
     delete json.$ref;
     return json;
 }
-/** Build the default registry with every built-in tool registered. */
+/**
+ * Build the default registry with every always-on built-in registered.
+ *
+ * `tools` is the config block of the same name (P4). Its two keys —
+ * `fileEdit` and `shell` — were declared in the C.0 scaffold and, until P4,
+ * consumed by NOTHING: a user could set `tools.shell: false`, `cruxy config
+ * list` would show it, and `run_command` would register regardless. Deleting
+ * them was the other option and is ruled out by `initConfig`, which writes the
+ * full defaults into every generated config: the schema is `.strict()`, so a
+ * removed key would stop every `cruxy init`-generated config from loading on
+ * upgrade — a compat break for everyone, not the #296 kind that bites only
+ * whoever wrote the key. So the keys now mean what their names say:
+ *
+ *  - `fileEdit: false` withholds the three tools that write files through the
+ *    U.3 gate — `write_file`, `edit_file`, `apply_patch`. Reads stay.
+ *  - `shell: false` withholds the two that execute commands — `run_command`
+ *    and `run_tests` (the test runner is a shell command with a parser on it,
+ *    and "no shell" that still ran `pnpm test` would be a setting that lies).
+ *    `create_pull_request` runs git through its own approval and is not a
+ *    shell for the model; it stays.
+ *
+ * Both default to `true`, so a config that never mentions them — every config
+ * today — gets the same registry it always did. Omitted → both on.
+ */
 export function buildDefaultRegistry(opts = {}) {
+    const fileEdit = opts.tools?.fileEdit ?? true;
+    const shell = opts.tools?.shell ?? true;
     const registry = new ToolRegistry();
     registry.register(listFilesTool);
     registry.register(readFileTool);
-    registry.register(writeFileTool);
-    registry.register(editFileTool);
-    registry.register(applyPatchTool);
+    if (fileEdit) {
+        registry.register(writeFileTool);
+        registry.register(editFileTool);
+        registry.register(applyPatchTool);
+    }
     registry.register(globTool);
     registry.register(grepFilesTool);
     registry.register(gitStatusTool);
-    registry.register(runCommandTool);
-    // A fresh tool per registry — its iteration budget (C.13) is session-scoped.
-    registry.register(makeRunTestsTool(opts.onTestResult ? { onResult: opts.onTestResult } : {}));
+    if (shell) {
+        registry.register(opts.onCommandResult
+            ? makeRunCommandTool({ onResult: opts.onCommandResult })
+            : runCommandTool);
+        // A fresh tool per registry — its iteration budget (C.13) is session-scoped.
+        registry.register(makeRunTestsTool(opts.onTestResult ? { onResult: opts.onTestResult } : {}));
+    }
     registry.register(searchCodebaseTool);
     registry.register(listSkillsTool);
     registry.register(loadSkillTool);

package/dist/tools/schema-depth.js

@@ -1,10 +1,17 @@
 /**
- * The provider's tool-schema depth bound, and the counter that measures against
- * it. ONE home for both, because there are two consumers that must agree: the
- * CI gate on our own built-ins (`schema-depth.test.ts`) and the runtime bound on
- * third-party MCP schemas (`../mcp/bounds.ts`). A counter that disagreed with
- * the bound, or two copies of either drifting apart, would mean a schema that
- * passes here and dies on the wire.
+ * The gateway's three tool-schema bounds — depth, bytes, nodes — and the
+ * counters that measure against them. ONE home for all of it, because there
+ * are two consumers that must agree: the CI gate on our own built-ins
+ * (`schema-depth.test.ts`) and the runtime bound on third-party MCP schemas
+ * (`../mcp/bounds.ts`). A counter that disagreed with its bound, or two copies
+ * of either drifting apart, would mean a schema that passes here and dies on
+ * the wire.
+ *
+ * Until P4 only depth was mirrored. The gateway has always applied all three
+ * to every tool's `parameters` (cruxy-ai/api `internal/httpx/chat_tools.go`,
+ * `validateToolParameters`), from the same constants its structured-output
+ * validator uses, and a rejection names which one (`bound`: `bytes` | `depth`
+ * | `nodes`). Two of the three were caught by nothing here.
  */
 /**
  * Nesting depth of the JSON Schema we put on the wire, counted the way the
@@ -83,3 +90,69 @@ export function schemaDepth(node) {
  * `depth >= MAX_SCHEMA_DEPTH`.
  */
 export const MAX_SCHEMA_DEPTH = 8;
+/**
+ * The gateway's byte bound on ONE tool's `parameters`, as serialized on the
+ * wire. Mirrors `maxSchemaBytes` (128 KiB) in cruxy-ai/api
+ * `internal/httpx/structured.go`, applied per tool by `validateToolParameters`
+ * as `len(raw) > maxSchemaBytes` — so, unlike {@link MAX_SCHEMA_DEPTH}, this
+ * bound is INCLUSIVE: a schema is safe AT the limit and dies one byte past it.
+ *
+ * NOT OURS TO CHOOSE, same as depth: raising it here moves the failure from CI
+ * to every user's terminal, and a rejection carrying `bound: "bytes"` with a
+ * `limit` that disagrees with this number means THIS number is stale. If a
+ * schema cannot fit, the schema changes. Every built-in is two orders of
+ * magnitude under it today (the largest, `spawn_subagents`, is ~1.2 KB); the
+ * bound is here so that stays a fact CI checks rather than one someone
+ * remembers.
+ *
+ * The MCP path is covered twice over: `mcp.maxSchemaBytes` has a config
+ * ceiling of 64 KiB (`config/schema.ts`, #237), half this limit, and a test
+ * pins that the ceiling stays under the mirror — so no MCP schema that loads
+ * from config can reach the gateway's byte bound at all.
+ */
+export const MAX_SCHEMA_BYTES = 128 * 1024;
+/**
+ * The gateway's node bound on ONE tool's `parameters`: the number of
+ * containers (objects and arrays) in the schema. Mirrors `maxSchemaNodes`
+ * (400) in cruxy-ai/api `internal/httpx/structured.go`, applied per tool by
+ * `boundJSON` as `nodes > maxSchemaNodes` — INCLUSIVE, like bytes: safe at
+ * 400, dead at 401. {@link schemaNodes} counts exactly what `boundJSON`
+ * counts. Same provenance rule: a sanity ceiling that mirrors the gateway,
+ * never raised to make a schema fit. Flatten instead.
+ *
+ * Small and wide is the shape this catches that neither of the others does:
+ * a flat object with 400 string properties is 3 levels deep and a few KB, and
+ * the gateway refuses it.
+ */
+export const MAX_SCHEMA_NODES = 400;
+/**
+ * Container count of a JSON tree, counted the way the gateway's `boundJSON`
+ * counts it: every object and every array is one node, scalars are not. So
+ * `{}` is 1, `{a: {}}` is 2, `{a: [{}, {}]}` is 4. Iterative for the same
+ * reason {@link schemaDepth} is — the MCP path can hand this a hostile input.
+ */
+export function schemaNodes(node) {
+    const isContainer = (n) => Array.isArray(n) || (typeof n === "object" && n !== null);
+    if (!isContainer(node))
+        return 0;
+    let count = 0;
+    const pending = [node];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        count++;
+        const children = Array.isArray(current)
+            ? current
+            : Object.values(current);
+        for (const child of children)
+            if (isContainer(child))
+                pending.push(child);
+    }
+    return count;
+}
+/**
+ * Bytes of a schema as it goes on the wire: compact `JSON.stringify`, UTF-8 —
+ * which is what the SDK serializes and the gateway measures with `len(raw)`.
+ */
+export function schemaBytes(node) {
+    return Buffer.byteLength(JSON.stringify(node) ?? "", "utf8");
+}

package/dist/tools/shell/exec.js

@@ -33,6 +33,7 @@ export function execShell(command, ctx) {
  * throw coded errors from `sandbox.exec` and propagate — never caught here). */
 async function runSandboxed(command, ctx) {
     const { timeoutMs, maxOutputBytes } = ctx.config.shell;
+    const startedAt = Date.now();
     const result = await ctx.sandbox.exec(command, {
         cwd: ctx.cwd,
         timeoutMs,
@@ -45,11 +46,13 @@ async function runSandboxed(command, ctx) {
         signal: null,
         output: result.output,
         truncated: result.outputTruncated,
+        durationMs: Date.now() - startedAt,
     };
 }
 /** Spawn the command on the host, capture bounded output, enforce the timeout. */
 function runBounded(command, ctx) {
     const { timeoutMs, maxOutputBytes } = ctx.config.shell;
+    const startedAt = Date.now();
     return new Promise((resolve) => {
         // `spawnShell` routes through the resolved shell (POSIX default shell, Git
         // Bash, or PowerShell — see resolve-shell.ts) as the head of a killable tree
@@ -96,6 +99,7 @@ function runBounded(command, ctx) {
                 signal: null,
                 output: "",
                 truncated,
+                durationMs: Date.now() - startedAt,
             });
         }, timeoutMs);
         // External cancellation (C.33): a cancelled sibling's in-flight command is
@@ -114,6 +118,7 @@ function runBounded(command, ctx) {
                 signal: "SIGKILL",
                 output: Buffer.concat(chunks).toString("utf8"),
                 truncated,
+                durationMs: Date.now() - startedAt,
             });
         }
         if (abortSignal?.aborted) {
@@ -136,6 +141,7 @@ function runBounded(command, ctx) {
                 output: "",
                 truncated: false,
                 spawnError: err.message,
+                durationMs: Date.now() - startedAt,
             });
         });
         child.on("close", (code, closeSignal) => {
@@ -150,6 +156,7 @@ function runBounded(command, ctx) {
                 signal: closeSignal ?? null,
                 output: Buffer.concat(chunks).toString("utf8"),
                 truncated,
+                durationMs: Date.now() - startedAt,
             });
         });
     });

package/dist/tools/shell/run-command.js

@@ -9,27 +9,51 @@ import { runGatedShell } from "./exec.js";
  * C.19 hook runner — the single, un-bypassable shell path); this tool only maps
  * the structured result back onto its `ToolResult` framing.
  */
-export const runCommandTool = {
-    name: "run_command",
-    description: "Run a shell command in the project root and return its exit code, stdout, and stderr. Use this for builds, tests, linters, and git. Prefer the dedicated file tools (read_file/write_file/edit_file) over shelling out to cat/sed/echo for inspecting or editing files. A non-zero exit is still returned so you can react to the failure output.",
-    parameters: z.object({
-        command: z
-            .string()
-            .describe("The shell command to run (executed via the system shell)."),
-    }),
-    async execute(input, ctx) {
-        // A thrown CRUXY_E_APPROVAL_REQUIRED (non-interactive) / sandbox coded error
-        // propagates from runGatedShell — do not catch (fail loud).
-        const outcome = await runGatedShell(input.command, ctx);
-        if (!outcome.approved) {
-            return {
-                ok: false,
-                error: outcome.rejection ?? "command denied by the user",
-            };
-        }
-        return mapExecResult(outcome.exec, ctx);
-    },
-};
+/** Build the `run_command` tool. `deps.onResult` is the record's seam. */
+export function makeRunCommandTool(deps = {}) {
+    return {
+        name: "run_command",
+        description: "Run a shell command in the project root and return its exit code, stdout, and stderr. Use this for builds, tests, linters, and git. Prefer the dedicated file tools (read_file/write_file/edit_file) over shelling out to cat/sed/echo for inspecting or editing files. A non-zero exit is still returned so you can react to the failure output.",
+        parameters: z.object({
+            command: z
+                .string()
+                .describe("The shell command to run (executed via the system shell)."),
+        }),
+        async execute(input, ctx) {
+            // A thrown CRUXY_E_APPROVAL_REQUIRED (non-interactive) / sandbox coded error
+            // propagates from runGatedShell — do not catch (fail loud).
+            const outcome = await runGatedShell(input.command, ctx);
+            if (!outcome.approved) {
+                return {
+                    ok: false,
+                    error: outcome.rejection ?? "command denied by the user",
+                };
+            }
+            const exec = outcome.exec;
+            // Report from the same object the model's string is built from — and only
+            // when something ran. A spawn error never started, so there is no run.
+            if (exec.spawnError === undefined) {
+                try {
+                    deps.onResult?.({
+                        command: input.command,
+                        exitCode: exec.exitCode,
+                        timedOut: exec.timedOut,
+                        durationMs: exec.durationMs,
+                        outputTruncated: exec.truncated,
+                        substrate: ctx.sandbox ? "sandbox" : "host",
+                    });
+                }
+                catch {
+                    // A recording problem is not a command problem.
+                }
+            }
+            return mapExecResult(exec, ctx);
+        },
+    };
+}
+/** The default instance — no observer. Registries that record build their own
+ * via {@link makeRunCommandTool}; everything else is byte-identical. */
+export const runCommandTool = makeRunCommandTool();
 /**
  * Map a {@link ShellExecResult} onto the tool's `ToolResult` — the same "exit
  * code N" framing, truncation note, and timeout / spawn-error messages as

package/dist/tui/renderer.js

@@ -219,14 +219,21 @@ export class TuiRenderer {
     /**
      * Saved sessions shown in the sidebar (P2), and which one is running.
      *
-     * Populated only by {@link setSessions}, never at construction. The running
-     * session has to be listed, and its meta line does not exist until the
-     * session log is open — which happens after the renderer is built. A
-     * constructor argument could therefore only ever carry the list from BEFORE
-     * this run, i.e. a sidebar missing the very session the user is in.
+     * Populated by {@link setSessions} or by the probe {@link attachSessions}
+     * installs, never at construction: the list is read from disk, the renderer
+     * is built before the session log exists, and a constructor argument could
+     * only ever carry the tree from BEFORE this run.
+     *
+     * THE LIST IS RE-READ AFTER EVERY TURN (cli#300). It used to be read once at
+     * startup, and since a fresh session's meta line is buffered until its first
+     * turn (#257), that one read could never include the session the user was
+     * in — the row the active id exists to mark. Re-probing on `endTurn`, the
+     * same trigger the git cache and the views use, is what lets it appear.
      */
     sessions = [];
     activeSessionId;
+    /** Re-reads the session tree; installed by {@link attachSessions}. */
+    sessionsProbe;
     constructor(caps, out, opts = {}) {
         this.caps = caps;
         this.out = out;
@@ -573,9 +580,9 @@ export class TuiRenderer {
     }
     // ── app-owned surfaces ────────────────────────────────────────────────────
     /**
-     * Replace the sidebar's session list (P2). Called once the session log is
-     * open, so the running session is itself listed; a live refresh later (P3)
-     * is the same call.
+     * Replace the sidebar's session list (P2) with one the caller already holds.
+     * The primitive {@link attachSessions} and {@link refreshSessions} both land
+     * on; a caller with no probe to install (tests, a static list) uses it alone.
      */
     setSessions(sessions, activeSessionId) {
         if (this.closed)
@@ -584,6 +591,46 @@ export class TuiRenderer {
         this.activeSessionId = activeSessionId;
         this.schedulePaint();
     }
+    /**
+     * Install the probe that reads the session tree, and read it once now
+     * (cli#300). From here on {@link endTurn} re-runs it, so the list follows the
+     * tree as this and other cruxys write to it — and so the running session
+     * shows up the moment its first turn puts it on disk.
+     *
+     * THE PROBE NEVER RUNS ON THE PAINT PATH. It reads one meta line per file
+     * for at most ten files, which is cheap, and cheap is not the discipline:
+     * `viewModel` reads `this.sessions` and nothing else, exactly as it reads
+     * the git cache's last answer rather than running `git status`. A paint
+     * that touched the disk would do so on every streaming frame.
+     */
+    attachSessions(probe, activeSessionId) {
+        if (this.closed)
+            return;
+        this.sessionsProbe = probe;
+        this.activeSessionId = activeSessionId;
+        this.refreshSessions();
+    }
+    /**
+     * Re-read the session tree through the installed probe, off the paint path,
+     * and repaint if it answered. A probe that throws leaves the last list
+     * standing: the sidebar is a status surface, and a transient read error must
+     * never blank it or take the shell down. No probe → nothing to do, and the
+     * list set by {@link setSessions} stays as it was.
+     */
+    refreshSessions() {
+        const probe = this.sessionsProbe;
+        if (probe === undefined || this.closed)
+            return;
+        let sessions;
+        try {
+            sessions = probe();
+        }
+        catch {
+            return;
+        }
+        this.sessions = sessions;
+        this.schedulePaint();
+    }
     /** Set the input line's rendered text (prompt + buffer + caret). */
     setInput(line) {
         if (this.closed)
@@ -865,6 +912,10 @@ export class TuiRenderer {
         this.refreshGit();
         this.refreshLimits();
         this.refreshViews();
+        // AFTER the turn's final paint, like the three above: the frame that
+        // closes the turn is composed from state already in hand, and the tree
+        // read lands in the next scheduled paint rather than delaying this one.
+        this.refreshSessions();
     }
     /**
      * REPAINT the headroom panel once the turn's reading lands (P9) — no longer

package/dist/vcs/generate.js

@@ -1,3 +1,4 @@
+import { verificationMarkdown } from "../verification/view.js";
 /**
  * Turn a diff + session context into the PR publish content (C.15): a
  * conventional-commit subject, a structured body, a branch name, and the PR
@@ -8,6 +9,14 @@
  *
  * Secrets never leave: the diff is redacted before the LLM sees it, and the
  * generated bodies are redacted again (defense-in-depth).
+ *
+ * The `## Verification` section is the record's, on BOTH paths (P2
+ * verification). The model is handed a diff; it has no way to know what ran,
+ * and asking it to write that section produced the same manufactured claim
+ * cli#309 removed from the fallback body, one layer up. So the prompt no
+ * longer asks for it, `finalize` drops one the model writes anyway, and the
+ * section that does appear is built here from `GenerateInput.verification` —
+ * the runs that actually executed, with their exit codes and timestamps.
  */
 /** Conventional-commit types accepted by `@commitlint/config-conventional`. */
 export const CONVENTIONAL_TYPES = [
@@ -183,11 +192,19 @@ export async function generateWithLlm(provider, input, opts = {}) {
 /** Shared final assembly: normalize the subject, redact bodies, pick a branch. */
 function finalize(rawSubject, rawBody, input, extra = {}) {
     const commitSubject = normalizeSubject(rawSubject, input.scopes);
-    const body = redactSecrets((rawBody ?? extra.prBody ?? "").trim() ||
-        assembleBody({
-            what: rawSubject || commitSubject,
-            verification: "`pnpm -r typecheck && pnpm lint && pnpm -r test`",
-        }));
+    // The body's prose is the caller's or the model's; its `## Verification`
+    // section is the record's. Any such section in the supplied body is dropped
+    // first — the deterministic guarantee, same posture as `normalizeSubject`:
+    // the prompt says not to write one, and this holds even if the model slips.
+    // When no body was supplied, the fallback carries ONLY what is known: the
+    // subject. (It used to add a Verification section naming a typecheck + lint
+    // + test command on every PR, whether or not anything ran — cli#309.) Then
+    // the record's section is appended, when there is a record: a body that
+    // names what ran comes only from something that knows what ran, and a
+    // missing section is the honest shape for missing evidence.
+    const prose = stripVerificationSection((rawBody ?? extra.prBody ?? "").trim()) ||
+        assembleBody({ what: rawSubject || commitSubject });
+    const body = redactSecrets(withRecordedVerification(prose, input.verification));
     const commitBody = redactSecrets((extra.commitBody ?? rawBody ?? "").trim());
     const branchName = input.currentBranch ??
         sanitizeBranch(extra.branchName) ??
@@ -200,6 +217,31 @@ function finalize(rawSubject, rawBody, input, extra = {}) {
         prBody: body,
     };
 }
+/**
+ * Drop a `## Verification` section — its heading through the line before the
+ * next `## ` heading, or the end — from a markdown body. Only the H2 shape the
+ * prompt itself describes is recognised; nothing else in the prose is touched.
+ */
+export function stripVerificationSection(markdown) {
+    const out = [];
+    let dropping = false;
+    for (const line of markdown.split("\n")) {
+        if (/^##\s/.test(line))
+            dropping = /^##\s+verification\b/i.test(line);
+        if (!dropping)
+            out.push(line);
+    }
+    return out.join("\n").trim();
+}
+/** Append the record's `## Verification` section, when there is a record. */
+function withRecordedVerification(body, verification) {
+    if (!verification)
+        return body;
+    const md = verificationMarkdown(verification.runs, {
+        ...(verification.from ? { from: verification.from } : {}),
+    });
+    return md === null ? body : `${body}\n\n## Verification\n\n${md}`;
+}
 /** Accept a model-proposed branch only if it's a plausible ref; else null. */
 function sanitizeBranch(name) {
     if (!name)
@@ -251,7 +293,7 @@ function buildSystemPrompt(input) {
     if (input.scopes.length > 0) {
         lines.push(`- If you use a scope, it must be one of: ${input.scopes.join(", ")}.`);
     }
-    lines.push("", "prBody: GitHub-flavored markdown with sections '## What changed', '## Why', '## Verification'.", "branchName: short kebab-case `type/slug`, no spaces.", "Never include secrets, tokens, or credentials in any field.");
+    lines.push("", "prBody: GitHub-flavored markdown with sections '## What changed' and '## Why'.", "Do NOT write a '## Verification' section, and do not state what was run, tested, built, or checked anywhere in prBody or commitBody:", "you have the diff, not the record of what executed. That section is appended afterwards from cruxy's record of the commands that actually ran, and one you write is dropped.", "branchName: short kebab-case `type/slug`, no spaces.", "Never include secrets, tokens, or credentials in any field.");
     if (input.skillBody) {
         lines.push("", "Repository commit conventions (authoritative):", input.skillBody);
     }

package/dist/verification/index.js

@@ -0,0 +1,15 @@
+/**
+ * The verification record (P2 verification): evidence of what ran and how it
+ * exited, keyed to the turn it ran in. Evidence, not enforcement — see
+ * `types.ts` for why that decision stands.
+ *
+ *  - `types.ts`  — the record shapes and the honesty rules;
+ *  - `ledger.ts` — the in-memory side a live session's surfaces read;
+ *  - `view.ts`   — the one formatter every surface shares.
+ *
+ * The durable side is the session log (`session/types.ts`: `verification` and
+ * `external-change` events), written from the same call as the ledger.
+ */
+export * from "./types.js";
+export * from "./ledger.js";
+export * from "./view.js";

package/dist/verification/ledger.js

@@ -0,0 +1,99 @@
+import { MAX_FAILURE_NAMES, } from "./types.js";
+/**
+ * The in-memory side of the verification record — what the surfaces of a LIVE
+ * session read. The durable side is the session log, reached through `sink`.
+ *
+ * The split mirrors `Session.lastRun` against the usage store: the process
+ * keeps the few facts its own surfaces ask for (this turn's runs for the
+ * one-shot summary, the last run for `/status`), and the log keeps everything
+ * for as long as the session survives retention. Neither re-derives from the
+ * other; both are written from the same call.
+ *
+ * ONE LEDGER PER SESSION, shared by every tool instance and every subagent
+ * the session drives. A subagent's test run is still a run that happened in
+ * this turn, and a fan-out's refused write is still a file that moved.
+ */
+export class VerificationLedger {
+    deps;
+    last;
+    /** Runs recorded this session, oldest first, bounded (see `SESSION_CAP`). */
+    runs = [];
+    turnRuns = [];
+    turnChanges = [];
+    constructor(deps = {}) {
+        this.deps = deps;
+    }
+    /**
+     * A new user turn begins: this turn's lists start empty. The session-wide
+     * facts (`lastVerification`, `sessionRuns`) are untouched — a run from an
+     * earlier turn is still the last thing that ran.
+     */
+    beginTurn() {
+        this.turnRuns = [];
+        this.turnChanges = [];
+    }
+    /**
+     * Record one observation: stamp it, keep it, and hand it to the sink.
+     *
+     * The sink is wrapped because a recording problem is not a test-run problem.
+     * The run already happened and its result is on its way to the model; a
+     * session log that cannot write must degrade to "not saved", never fail the
+     * tool call that produced the fact.
+     */
+    record(obs) {
+        const at = this.deps.now?.() ?? new Date().toISOString();
+        if (obs.kind === "verification") {
+            const rec = {
+                ...withoutKind(obs),
+                failureNames: obs.failureNames.slice(0, MAX_FAILURE_NAMES),
+                at,
+            };
+            this.last = rec;
+            this.turnRuns.push(rec);
+            this.runs.push(rec);
+            if (this.runs.length > SESSION_CAP)
+                this.runs.shift();
+        }
+        else {
+            this.turnChanges.push({ ...withoutKind(obs), at });
+        }
+        try {
+            this.deps.sink?.(obs);
+        }
+        catch {
+            // Persistence is not allowed to fail the run it is recording.
+        }
+    }
+    /**
+     * Adopt the last run a resumed session's log recorded, so `/status` after
+     * `--resume` shows it rather than "none this session". Absent when the log
+     * pre-dates the record — absence is "not recorded", never "did not happen".
+     */
+    seed(last) {
+        if (!last)
+            return;
+        this.last = last;
+        this.runs = [last];
+    }
+    /** The most recent run that executed, this session (or seeded on resume). */
+    get lastVerification() {
+        return this.last;
+    }
+    /** Every run recorded this session, oldest first, bounded. */
+    sessionRuns() {
+        return this.runs;
+    }
+    /** What THIS turn recorded — the one-shot summary's unit. */
+    turn() {
+        return { verifications: this.turnRuns, externalChanges: this.turnChanges };
+    }
+}
+/** Most runs kept in memory per session. The log keeps the rest. */
+export const SESSION_CAP = 50;
+/** The observation minus its discriminant — the record is what happened, and
+ * `kind` was only ever the routing tag. */
+function withoutKind(obs) {
+    const copy = { ...obs };
+    delete copy.kind;
+    return copy;
+}

package/dist/verification/types.js

@@ -0,0 +1,26 @@
+/**
+ * The verification record (P2 verification): what ran, and how it exited.
+ *
+ * The loop's only completion criterion is "the model emitted no tool calls"
+ * (`agent/loop.ts`). Nothing checks that tests ran, a build passed, or a diff
+ * was reviewed, and the system prompt's instruction to verify is exactly that:
+ * an instruction. This module makes the absence VISIBLE without making the
+ * presence MANDATORY — C.13 shipped voluntary verification and delegated the
+ * iteration to the ordinary loop, and that decision stands. Three reasons it
+ * is not reversed here:
+ *
+ *  - `run_tests`' failing-run breaker latches for the turn after
+ *    `test.maxIterations` runs, so a turn that MUST end green could never end.
+ *  - A project with no test command has no defensible verdict: the coded
+ *    not-found error already tells the model to ask the user, not to guess.
+ *  - Enforcement changes the one-shot exit contract — "completed but
+ *    unverified" would be a new stop kind, and CI reads that exit code today.
+ *
+ * So this is EVIDENCE: a record of each run that actually executed, keyed to
+ * the turn it ran in, read back by the surfaces a user checks afterwards. What
+ * it never does is INFER. `passed` is the exit code and nothing else; nothing
+ * here decides that a command was "a build" or "the tests" from its text. The
+ * record says what ran and how it exited; the reader judges.
+ */
+/** Most failure names kept per record — an index, not a transcript. */
+export const MAX_FAILURE_NAMES = 5;