@geonosis/verify 1.0.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,165 @@
+# `@geonosis/verify`
+
+One gate runner. Tiers of shell steps, run serially, recorded as a JSON gate report a hook can read.
+
+A repo's gate is already a list of commands — it lives in a `verify` script, a CI job, and an
+engineer's muscle memory, and the three drift. This runs the list from one place and writes down
+what happened, so the Stop hook, CI and the ledger are all reading the same run rather than each
+re-deciding what "green" meant.
+
+## Install
+
+```bash
+pnpm add -D @geonosis/verify        # bun add -d, npm i -D
+```
+
+## `--prove` is the first thing to run after installing
+
+```bash
+geonosis-verify --prove
+```
+
+It writes a temp config with one passing step and one that exits 3, runs the real binary over it in
+a throwaway directory, and checks that the failure reached the report, that the right step is named
+with the right exit code, and that the process exited 1:
+
+```
+PROVEN — a planted "exit 3" step reached the report and exited 1
+```
+
+A runner that reports green is worth nothing until it has been watched going red on purpose. It
+touches nothing in the repo it is run from, so it is safe at any time.
+
+## Config
+
+`geonosis.json` in the directory you run it from:
+
+```jsonc
+{
+  "verify": {
+    "fast": ["pnpm typecheck", "pnpm lint", "pnpm test:unit", "pnpm ratchet --tier fast"],
+    "full": ["fast", "pnpm build", "pnpm test:integration", "pnpm format:check"]
+  }
+}
+```
+
+A step whose text is another tier's NAME is that tier, inlined in place, however deep it goes. A
+cycle is refused by the path it went round rather than discovered as a stack overflow.
+
+**There is no default tier and there never will be one.** A default that happened to match one
+repo's script names would run the wrong commands everywhere else and still report green. No
+`geonosis.json`, no `verify` object, or an unknown tier is refused by name.
+
+## Running it
+
+```bash
+geonosis-verify fast
+geonosis-verify full --report .geonosis/full.json
+geonosis-verify full --exclusive --exclusive-timeout 900
+```
+
+```
+  ok    fast/1  pnpm typecheck (2140 ms)
+  FAIL  fast/2  pnpm lint (1830 ms)
+  skip  fast/3  pnpm test:unit (0 ms)
+verify FAIL — fast — /repo/.geonosis/gate-report.json
+```
+
+| Exit | What it means |
+| --- | --- |
+| `0` | every step passed AND the report was written |
+| `1` | a step failed |
+| `2` | refused — no config, no `verify`, an unknown tier, an option we do not implement — **or the report could not be written** |
+
+The last one is the one worth arguing about: a gate that cannot record has not passed. Exit 0 on a
+green run whose report never landed would hand the caller a pass they cannot go back and read.
+
+## The report
+
+`.geonosis/gate-report.json`, unless `--report` says otherwise:
+
+```jsonc
+{
+  "tier": "full",
+  "startedAt": "2026-08-30T10:00:00.000Z",
+  "finishedAt": "2026-08-30T10:00:04.500Z",
+  "ok": false,
+  "steps": [
+    { "id": "fast/1", "command": "pnpm typecheck", "ok": true, "exitCode": 0, "ms": 2140, "tail": "…" },
+    { "id": "fast/2", "command": "pnpm lint", "ok": false, "exitCode": 1, "ms": 1830, "tail": "…" },
+    { "id": "full/1", "command": "pnpm build", "ok": false, "exitCode": -1, "ms": 0, "tail": "", "skipped": true }
+  ]
+}
+```
+
+- **`id` is `<tier>/<n>`, numbered within the tier that DECLARED the step** — not within the run. An
+  inlined step keeps its own tier, so `fast/2` is the same command whether the operator ran `fast`
+  or ran `full`. Numbering per run would renumber every fast step the moment `full` grew one in
+  front of it, and an id that moves is an id nothing can compare against yesterday's report.
+- **The run stops at the first red, and the rest are still written down**, as `skipped` with
+  `exitCode: -1`. A report that silently lost the tail of the tier reads as a shorter, greener tier.
+- **`tail` is the last 40 lines of stdout and stderr, interleaved**, with the colour codes taken
+  out. The shell folds the two streams, so they stay in the order they were written; concatenating
+  two captured buffers would not.
+- Each step runs in a **subshell**. `<step> 2>&1` binds the redirect to the last command of the step
+  only, so `echo boom >&2; exit 3` would lose "boom" entirely — and a gate whose report is missing
+  the error line is a gate nobody can act on.
+
+## `stats` — the first-try pass rate
+
+Not a gate; the KPI a law diet is judged by. The Stop hook records every turn-end it gated in
+`.geonosis/stop-turns.json`, one bucket per day, and this reads it back:
+
+```bash
+geonosis-verify stats
+geonosis-verify stats --since 2026-09-07     # that window, and everything before it
+geonosis-verify stats --json
+```
+
+```
+first-try pass rate — the share of turn-ends whose fast tier was green
+  before          61 turns ·     18 blocked · 70.5 % first try
+  2026-09-07+     58 turns ·      6 blocked · 89.7 % first try
+```
+
+A turn whose fast tier was green on the first run is a turn where the code was written the way the
+gates accept without being told twice. A blocked turn is a correction loop. `--since` gives the two
+windows a before/after needs, from one command and one instrument — the procedure is
+[`docs/law-diet.md`](../../docs/law-diet.md).
+
+Three refusals, all of them the same refusal: **an empty record is not a perfect score.** A repo
+where the hook has never run says "no turns recorded" and gives no rate; a record that will not parse
+is an error, not zero turns; and a turn the hook never gated (`stop_hook_active`, where the gate does
+not run at all) is not counted, because there was no first try to have.
+
+The sibling `stop-blocks.json` cannot answer this and is not asked to. It is the block cap's working
+memory, and a green turn deletes its own row from it.
+
+## `--exclusive`
+
+Takes the machine-wide lock `@geonosis/ratchet` owns, through that package's published entry, so a
+verify and a ratchet on one laptop serialise against each other rather than each against itself.
+Three sessions each starting a full gate is how a 25-minute run becomes two hours and produces
+failures that are about the load and not the code.
+
+The lock is taken only AFTER every refusal has been decided: a run that waits half an hour for the
+machine and then finds the tier was misspelled has held it against two other sessions for nothing.
+`--exclusive-timeout <seconds>` bounds the wait (default 1800) and says who it is waiting for.
+
+## Programmatic use
+
+```ts
+import { loadVerifyConfig, resolveTier, runSteps, shellRun, writeReport } from '@geonosis/verify'
+
+const steps = resolveTier(loadVerifyConfig(cwd), 'fast')
+const report = runSteps({ run: shellRun(cwd), steps, tier: 'fast' })
+writeReport(cwd, '.geonosis/gate-report.json', report)
+```
+
+## What this cannot see about itself
+
+- **It does not know whether your steps measure anything.** `verify` reports what your commands
+  exited with; whether `pnpm lint` was pointed at the right directory is between you and the
+  ratchet's `--prove`.
+- **`.geonosis/` is runner-owned.** The `geonosis` Claude Code plugin refuses agent writes there
+  (D-007) — the scored agent never writes the scoreboard. Nothing in this package enforces that.

package/bin/geonosis-verify.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+// Committed, so `pnpm install` can link the bin on a fresh clone — before `pnpm build` has
+// produced dist/. A bin that only exists after a build is a bin that is missing when you need it.
+import '../dist/cli.js'

package/dist/chunk-4HXX3SXM.js

@@ -0,0 +1,249 @@
+// src/config.ts
+import { existsSync, readFileSync } from "fs";
+import { resolve } from "path";
+var CONFIG_FILE = "geonosis.json";
+var loadVerifyConfig = (cwd) => {
+  const path = resolve(cwd, CONFIG_FILE);
+  if (!existsSync(path)) {
+    throw new Error(`no ${CONFIG_FILE} in ${cwd} \u2014 verify has no tiers to run`);
+  }
+  const parsed = JSON.parse(readFileSync(path, "utf8"));
+  const verify = parsed.verify;
+  if (typeof verify !== "object" || verify === null || Array.isArray(verify)) {
+    throw new Error(`${CONFIG_FILE} has no "verify" object \u2014 verify has no tiers to run`);
+  }
+  const tiers = {};
+  for (const [tier, steps] of Object.entries(verify)) {
+    if (!Array.isArray(steps) || steps.some((one) => typeof one !== "string")) {
+      throw new Error(`${CONFIG_FILE}: tier "${tier}" must be a list of shell commands`);
+    }
+    tiers[tier] = steps;
+  }
+  return { tiers };
+};
+var known = (config) => Object.keys(config.tiers).toSorted().join(", ");
+var resolveTier = (config, tier, path = []) => {
+  if (path.includes(tier)) {
+    throw new Error(
+      `${CONFIG_FILE}: tier "${tier}" inlines itself \u2014 ${[...path, tier].join(" -> ")}`
+    );
+  }
+  const steps = config.tiers[tier];
+  if (steps === void 0) {
+    throw new Error(
+      `${CONFIG_FILE}: no "${tier}" tier under "verify" \u2014 known tiers: ${known(config)}`
+    );
+  }
+  return steps.flatMap(
+    (step) => step in config.tiers ? resolveTier(config, step, [...path, tier]) : [{ command: step, tier }]
+  );
+};
+
+// src/prove.ts
+import { spawnSync } from "child_process";
+import { mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+var RED_STEP = "exit 3";
+var GREEN_STEP = "echo the-step-that-passes";
+var check = (claim, held, saw) => held ? [] : [`  ${claim} \u2014 saw ${saw}`];
+var prove = ({ entry, execPath }) => {
+  const root = mkdtempSync(join(tmpdir(), "geonosis-verify-prove-"));
+  try {
+    writeFileSync(
+      join(root, "geonosis.json"),
+      JSON.stringify({ verify: { fast: [GREEN_STEP, RED_STEP] } }, null, 2)
+    );
+    const done = spawnSync(execPath, [entry, "fast", "--report", "report.json"], {
+      cwd: root,
+      encoding: "utf8"
+    });
+    const code = done.status ?? -1;
+    let report;
+    try {
+      report = JSON.parse(readFileSync2(join(root, "report.json"), "utf8"));
+    } catch {
+      return {
+        message: `NOT PROVEN \u2014 the planted run wrote no readable report (exit ${code})`,
+        ok: false
+      };
+    }
+    const red = report.steps[1];
+    const green = report.steps[0];
+    const failures = [
+      ...check("a failed step exits 1", code === 1, `exit ${code}`),
+      ...check("the report is red", report.ok === false, `ok ${String(report.ok)}`),
+      ...check(
+        "the passing step passed",
+        green?.ok === true,
+        `${green?.command} ok ${String(green?.ok)}`
+      ),
+      ...check("the failing step is named", red?.command === RED_STEP, String(red?.command)),
+      ...check("the failing step kept its code", red?.exitCode === 3, String(red?.exitCode))
+    ];
+    if (failures.length > 0) return { message: `NOT PROVEN
+${failures.join("\n")}`, ok: false };
+    return {
+      message: `PROVEN \u2014 a planted "${RED_STEP}" step reached the report and exited 1`,
+      ok: true
+    };
+  } finally {
+    rmSync(root, { force: true, recursive: true });
+  }
+};
+
+// src/report.ts
+import { mkdirSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname, resolve as resolve2 } from "path";
+var DEFAULT_REPORT = ".geonosis/gate-report.json";
+var TAIL_LINES = 40;
+var NEVER_RAN = -1;
+var ANSI = /\[[0-9;]*m/g;
+var lastLines = (output, limit = TAIL_LINES) => output.replaceAll(ANSI, "").replace(/\n+$/, "").split("\n").slice(-limit).join("\n");
+var writeReport = (cwd, path, report) => {
+  const full = resolve2(cwd, path);
+  mkdirSync(dirname(full), { recursive: true });
+  writeFileSync2(full, `${JSON.stringify(report, null, 2)}
+`);
+  return full;
+};
+
+// src/run.ts
+import { spawnSync as spawnSync2 } from "child_process";
+var shellRun = (cwd) => (command) => {
+  const done = spawnSync2(`(
+${command}
+) 2>&1`, { cwd, encoding: "utf8", shell: true });
+  return { exitCode: done.status ?? NEVER_RAN, output: done.stdout ?? "" };
+};
+var numbering = () => {
+  const seen = /* @__PURE__ */ new Map();
+  return (tier) => {
+    const next = (seen.get(tier) ?? 0) + 1;
+    seen.set(tier, next);
+    return `${tier}/${next}`;
+  };
+};
+var skipped = (id, command) => ({
+  command,
+  exitCode: NEVER_RAN,
+  id,
+  ms: 0,
+  ok: false,
+  skipped: true,
+  tail: ""
+});
+var runSteps = ({
+  run,
+  steps: planned,
+  tier
+}) => {
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const idOf = numbering();
+  const steps = [];
+  let stopped = false;
+  for (const { command, tier: from } of planned) {
+    const id = idOf(from);
+    if (stopped) {
+      steps.push(skipped(id, command));
+      continue;
+    }
+    const at = Date.now();
+    const { exitCode, output } = run(command);
+    const ok = exitCode === 0;
+    steps.push({ command, exitCode, id, ms: Date.now() - at, ok, tail: lastLines(output) });
+    stopped = !ok;
+  }
+  return {
+    finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ok: steps.every((one) => one.ok),
+    startedAt,
+    steps,
+    tier
+  };
+};
+
+// src/stats.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname2, resolve as resolve3 } from "path";
+var TURNS_FILE = ".geonosis/stop-turns.json";
+var isCount = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0;
+var readDays = (root) => {
+  const at = resolve3(root, TURNS_FILE);
+  if (!existsSync2(at)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync3(at, "utf8"));
+  } catch (error) {
+    throw new Error(`${TURNS_FILE} is not JSON: ${error.message}`, { cause: error });
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${TURNS_FILE} must hold an object of days`);
+  }
+  const days = {};
+  for (const [day, value] of Object.entries(parsed)) {
+    const row = value;
+    if (!isCount(row.blocked) || !isCount(row.turns)) {
+      throw new Error(`${TURNS_FILE}: ${day} has no readable turn and block counts`);
+    }
+    days[day] = { blocked: row.blocked, turns: row.turns };
+  }
+  return days;
+};
+var windowOf = (days) => {
+  const turns = days.reduce((total, [, one]) => total + one.turns, 0);
+  const blocked = days.reduce((total, [, one]) => total + one.blocked, 0);
+  return { blocked, passRate: turns === 0 ? void 0 : (turns - blocked) / turns, turns };
+};
+var readStats = (root, since) => {
+  const days = Object.entries(readDays(root));
+  if (since === void 0) return windowOf(days);
+  return {
+    ...windowOf(days.filter(([day]) => day >= since)),
+    before: windowOf(days.filter(([day]) => day < since)),
+    since
+  };
+};
+var percent = (rate) => rate === void 0 ? "no turns recorded" : `${(rate * 100).toFixed(1)} %`;
+var line = (label, window) => `  ${label.padEnd(10)} ${String(window.turns).padStart(6)} turns \xB7 ${String(window.blocked).padStart(6)} blocked \xB7 ${percent(window.passRate)} first try`;
+var formatStats = (stats) => {
+  if (stats.turns === 0 && stats.before === void 0) {
+    return `first-try pass rate: no turns recorded \u2014 the Stop hook has not written ${TURNS_FILE} here yet`;
+  }
+  return [
+    "first-try pass rate \u2014 the share of turn-ends whose fast tier was green",
+    ...stats.before === void 0 ? [] : [line("before", stats.before)],
+    line(stats.since === void 0 ? "all" : `${stats.since}+`, stats)
+  ].join("\n");
+};
+var recordTurn = ({
+  blocked,
+  day,
+  root
+}) => {
+  const days = readDays(root);
+  const seen = days[day] ?? { blocked: 0, turns: 0 };
+  days[day] = { blocked: seen.blocked + (blocked ? 1 : 0), turns: seen.turns + 1 };
+  const at = resolve3(root, TURNS_FILE);
+  mkdirSync2(dirname2(at), { recursive: true });
+  writeFileSync3(at, `${JSON.stringify(days, null, 2)}
+`);
+};
+
+export {
+  CONFIG_FILE,
+  loadVerifyConfig,
+  resolveTier,
+  prove,
+  DEFAULT_REPORT,
+  TAIL_LINES,
+  NEVER_RAN,
+  lastLines,
+  writeReport,
+  shellRun,
+  runSteps,
+  TURNS_FILE,
+  readStats,
+  formatStats,
+  recordTurn
+};

package/dist/cli.js

@@ -0,0 +1,129 @@
+import {
+  DEFAULT_REPORT,
+  formatStats,
+  loadVerifyConfig,
+  prove,
+  readStats,
+  resolveTier,
+  runSteps,
+  shellRun,
+  writeReport
+} from "./chunk-4HXX3SXM.js";
+
+// src/cli.ts
+import { acquireExclusive } from "@geonosis/ratchet";
+var REFUSED = 2;
+var USAGE = "usage: geonosis-verify <tier> [--report <path>] [--exclusive] [--exclusive-timeout <seconds>] | --prove | stats [--since <YYYY-MM-DD>] [--json]";
+var refuse = (message) => {
+  process.stderr.write(`geonosis-verify: ${message}
+`);
+  process.exit(REFUSED);
+};
+var args = process.argv.slice(2);
+if (args.includes("--prove")) {
+  const proof = prove({ entry: process.argv[1] ?? "", execPath: process.execPath });
+  process.stdout.write(`${proof.message}
+`);
+  process.exit(proof.ok ? 0 : REFUSED);
+}
+if (args[0] === "stats") {
+  const rest = args.slice(1);
+  let since;
+  for (let at = 0; at < rest.length; at += 1) {
+    const arg = rest[at] ?? "";
+    if (arg === "--since") {
+      const next = rest[at + 1];
+      if (next === void 0 || next.startsWith("--")) refuse("--since needs a YYYY-MM-DD date");
+      since = next;
+      at += 1;
+    } else if (arg !== "--json") {
+      refuse(`unknown option "${arg}" \u2014 ${USAGE}`);
+    }
+  }
+  try {
+    const stats = readStats(process.cwd(), since);
+    process.stdout.write(
+      rest.includes("--json") ? `${JSON.stringify(stats, void 0, 2)}
+` : `${formatStats(stats)}
+`
+    );
+  } catch (error) {
+    refuse(error.message);
+  }
+  process.exit(0);
+}
+var tier = "";
+var reportPath = DEFAULT_REPORT;
+var exclusive = false;
+var timeoutSeconds;
+var valueAfter = (at, flag) => {
+  const next = args[at + 1];
+  if (next === void 0 || next.startsWith("--")) refuse(`${flag} needs a value`);
+  return next ?? "";
+};
+for (let at = 0; at < args.length; at += 1) {
+  const arg = args[at] ?? "";
+  if (arg === "--report") {
+    reportPath = valueAfter(at, "--report");
+    at += 1;
+  } else if (arg === "--exclusive") {
+    exclusive = true;
+  } else if (arg === "--exclusive-timeout") {
+    const seconds = Number(valueAfter(at, "--exclusive-timeout"));
+    if (!(seconds > 0)) refuse("--exclusive-timeout needs a number of seconds");
+    timeoutSeconds = seconds;
+    at += 1;
+  } else if (arg.startsWith("-")) {
+    refuse(`unknown option "${arg}" \u2014 ${USAGE}`);
+  } else if (tier === "") {
+    tier = arg;
+  } else {
+    refuse(`one tier at a time \u2014 got "${tier}" and "${arg}"`);
+  }
+}
+if (tier === "") refuse(`name a tier \u2014 ${USAGE}`);
+var cwd = process.cwd();
+var steps = [];
+try {
+  steps = resolveTier(loadVerifyConfig(cwd), tier);
+} catch (error) {
+  refuse(error.message);
+}
+var release = () => void 0;
+if (exclusive) {
+  try {
+    release = await acquireExclusive(timeoutSeconds === void 0 ? {} : { timeoutSeconds });
+  } catch (error) {
+    refuse(error.message);
+  }
+}
+var giveBack = () => {
+  release();
+  process.exit(130);
+};
+process.on("SIGINT", giveBack);
+process.on("SIGTERM", giveBack);
+var code = REFUSED;
+try {
+  const report = runSteps({ run: shellRun(cwd), steps, tier });
+  for (const step of report.steps) {
+    const verdict = step.skipped ? "skip" : step.ok ? "ok  " : "FAIL";
+    process.stdout.write(`  ${verdict}  ${step.id}  ${step.command} (${step.ms} ms)
+`);
+  }
+  try {
+    const at = writeReport(cwd, reportPath, report);
+    process.stdout.write(`${report.ok ? "verify PASS" : "verify FAIL"} \u2014 ${tier} \u2014 ${at}
+`);
+    code = report.ok ? 0 : 1;
+  } catch (error) {
+    process.stderr.write(
+      `geonosis-verify: could not write ${reportPath}: ${error.message}
+`
+    );
+    code = REFUSED;
+  }
+} finally {
+  release();
+}
+process.exit(code);

package/dist/index.js

@@ -0,0 +1,34 @@
+import {
+  CONFIG_FILE,
+  DEFAULT_REPORT,
+  NEVER_RAN,
+  TAIL_LINES,
+  TURNS_FILE,
+  formatStats,
+  lastLines,
+  loadVerifyConfig,
+  prove,
+  readStats,
+  recordTurn,
+  resolveTier,
+  runSteps,
+  shellRun,
+  writeReport
+} from "./chunk-4HXX3SXM.js";
+export {
+  CONFIG_FILE,
+  DEFAULT_REPORT,
+  NEVER_RAN,
+  TAIL_LINES,
+  TURNS_FILE,
+  formatStats,
+  lastLines,
+  loadVerifyConfig,
+  prove,
+  readStats,
+  recordTurn,
+  resolveTier,
+  runSteps,
+  shellRun,
+  writeReport
+};

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@geonosis/verify",
+  "version": "1.0.0",
+  "description": "One gate runner — tiers of shell steps, run serially, recorded as a JSON gate report.",
+  "keywords": [
+    "gate",
+    "ci",
+    "verify",
+    "tiers",
+    "report",
+    "hooks"
+  ],
+  "homepage": "https://github.com/microcompanies/geonosis/tree/main/packages/verify",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/microcompanies/geonosis.git",
+    "directory": "packages/verify"
+  },
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "geonosis-verify": "bin/geonosis-verify.mjs"
+  },
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "files": [
+    "bin",
+    "dist"
+  ],
+  "dependencies": {
+    "@geonosis/ratchet": "1.0.0"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit"
+  }
+}