@lemoncode/lemony 0.4.0 → 0.5.0

package/dist/cli.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { access, appendFile, chmod, lstat, mkdir, open, readFile, readdir, rename, rm, rmdir, stat, writeFile } from "node:fs/promises";
 import { basename, delimiter, dirname, extname, join, relative, resolve, sep } from "node:path";
 import { argv, cwd, env, exit, stderr, stdin, stdout } from "node:process";
 import { createInterface } from "node:readline/promises";
 import { promisify } from "node:util";
-import { isMap, parse, parseDocument } from "yaml";
+import { parse, parseDocument } from "yaml";
 import { z } from "zod";
 import { createHash, randomBytes } from "node:crypto";
 import { constants } from "node:fs";
@@ -27,7 +27,8 @@ const DEPRECATED_IMPLEMENTATION_KEYS = ["pre_commit_review"];
 const HARNESS_CONFIG_SCHEMA_FILENAME = "harness.config.schema.json";
 const CONFIG_KEY_SINCE = {
 	gates: "0.3.0",
-	"implementation.auto_commit": "0.4.0"
+	"implementation.auto_commit": "0.4.0",
+	"design_tokens.verify": "0.5.0"
 };
 const TASK_STORAGE_REPO_PLACEHOLDER = "OWNER/REPO";
 const TARGETS = ["claude-code"];
@@ -120,7 +121,10 @@ const taskStorageSchema = z.object({
 }).strict();
 const rollbackSchema = z.object({ keep_snapshots: z.union([z.int().positive(), z.literal("unlimited")]).default(3) }).strict().prefault({});
 const telemetrySchema = z.object({ enabled: z.boolean().default(true) }).strict().prefault({});
-const designTokensSchema = z.object({ scan_extensions: z.array(z.string()).default([]) }).strict().prefault({});
+const designTokensSchema = z.object({
+	scan_extensions: z.array(z.string()).default([]),
+	verify: z.string().trim().min(1).optional()
+}).strict().prefault({});
 const mergeSchema = z.object({
 	checks_timeout_secs: z.int().positive().default(600),
 	allow_no_checks: z.boolean().default(false)
@@ -230,8 +234,6 @@ const setConfigValues = (rawYaml, updates) => {
 	}
 	for (const key of DEPRECATED_CONFIG_KEYS) if (doc.has(key)) doc.delete(key);
 	for (const key of DEPRECATED_PATHS_KEYS) if (doc.hasIn(["paths", key])) doc.deleteIn(["paths", key]);
-	const pathsNode = doc.get("paths", true);
-	if (isMap(pathsNode) && pathsNode.items.length === 0) doc.delete("paths");
 	for (const key of DEPRECATED_IMPLEMENTATION_KEYS) if (doc.hasIn(["implementation", key])) doc.deleteIn(["implementation", key]);
 	return doc.toString();
 };
@@ -259,8 +261,6 @@ const pointerScalar = z.union([
 	z.null()
 ]).optional();
 const pointerFrontmatterSchema = z.object({
-	active_task: pointerScalar,
-	branch: pointerScalar,
 	session_start_ts: pointerScalar,
 	last_close_ts: pointerScalar
 });
@@ -1452,6 +1452,7 @@ const flatten = (color, backdrop) => ({
 	b: color.b * color.a + backdrop.b * (1 - color.a),
 	a: 1
 });
+const compositeOver = (color, ground) => flatten(color, ground.a < 1 ? flatten(ground, WHITE) : ground);
 const linearizeChannel = (channel) => {
 	const s = channel / 255;
 	return s <= .03928 ? s / 12.92 : ((s + .055) / 1.055) ** 2.4;
@@ -1507,15 +1508,17 @@ const runContrast = async (inputs) => {
 	};
 	const tokens = collectTokens(parsed);
 	const problems = [];
-	const specs = discoverPairs(tokens, problems);
 	const modes = declaredModes(tokens);
+	const specs = discoverPairs(tokens, modes, problems);
 	const pairs = measurePairs(specs, modes, tokens);
+	const verify = inputs.verify ? await runVerifier(inputs.verify) : void 0;
 	return {
-		ok: problems.length === 0 && pairs.every((pair) => pair.passes),
+		ok: problems.length === 0 && pairs.every((pair) => pair.passes) && (verify === void 0 || verify.code === 0),
 		tokensFound: true,
 		pairsChecked: pairs.length,
 		pairs,
-		problems
+		problems,
+		...verify === void 0 ? {} : { verify }
 	};
 };
 const emptyResult$1 = (tokensFound) => ({
@@ -1554,19 +1557,17 @@ const declaredModes = (tokens) => {
 	for (const token of tokens.values()) {
 		const modes = readExtension(token.node, MODES_EXTENSION);
 		if (isRecord(modes)) {
-			for (const name of Object.keys(modes)) if (name.trim().length > 0) names.add(name);
+			for (const name of Object.keys(modes)) if (name.trim().length > 0 && name !== "base") names.add(name);
 		}
 	}
 	return [...names].toSorted();
 };
-const discoverPairs = (tokens, problems) => {
-	const merged = /* @__PURE__ */ new Map();
-	const add = (spec) => {
-		merged.set(`${spec.foreground}|${spec.background}`, spec);
-	};
-	for (const spec of conventionPairs(tokens)) add(spec);
-	for (const spec of extensionPairs(tokens, problems)) add(spec);
-	return [...merged.values()];
+const pairKey = (spec) => `${spec.foreground}|${spec.background}`;
+const discoverPairs = (tokens, modes, problems) => {
+	const convention = new Map(conventionPairs(tokens).map((spec) => [pairKey(spec), spec]));
+	const explicit = extensionPairs(tokens, modes, problems);
+	for (const spec of explicit) convention.delete(pairKey(spec));
+	return [...convention.values(), ...explicit];
 };
 const conventionPairs = (tokens) => {
 	const pairs = [];
@@ -1583,77 +1584,193 @@ const conventionPairs = (tokens) => {
 			foreground: path,
 			background: basePath,
 			level: DEFAULT_LEVEL,
+			floors: {},
 			source: "convention"
 		});
 	}
 	return pairs;
 };
-const extensionPairs = (tokens, problems) => {
+const DECLARATION_SHAPE = "{ against: \"{token.path}\" | [\"{token.path}\", …], level?, floors?, modes?, over? }";
+const DECLARATION_KEYS = /* @__PURE__ */ new Set([
+	"against",
+	"level",
+	"floors",
+	"modes",
+	"over"
+]);
+const extensionPairs = (tokens, modes, problems) => {
 	const pairs = [];
 	for (const [path, token] of tokens) {
 		const declaration = readExtension(token.node, CONTRAST_EXTENSION);
 		if (declaration === void 0) continue;
 		const entries = Array.isArray(declaration) ? declaration : [declaration];
+		const declared = /* @__PURE__ */ new Set();
 		for (const entry of entries) {
-			if (!isRecord(entry) || typeof entry["against"] !== "string") {
-				problems.push(`token "${path}" has a malformed ${CONTRAST_EXTENSION} declaration — expected { against: "{token.path}", level? }.`);
-				continue;
-			}
-			const against = aliasTarget(entry["against"]) ?? entry["against"];
-			if (against === path) {
-				problems.push(`token "${path}" declares contrast against itself — a pair needs two different tokens.`);
-				continue;
-			}
-			if (!tokens.has(against)) {
-				problems.push(`token "${path}" contrast-against "${entry["against"]}" does not resolve to a known token.`);
+			if (!isRecord(entry)) {
+				problems.push(`token "${path}" has a malformed ${CONTRAST_EXTENSION} declaration — expected ${DECLARATION_SHAPE}.`);
 				continue;
 			}
-			if (!resolveColor(against, "base", tokens)) {
-				problems.push(`token "${path}" contrast-against "${entry["against"]}" is not a colour token.`);
+			const unknownKeys = Object.keys(entry).filter((key) => !DECLARATION_KEYS.has(key));
+			if (unknownKeys.length > 0) {
+				problems.push(`token "${path}" has unknown ${CONTRAST_EXTENSION} key(s) ${unknownKeys.map((key) => `"${key}"`).join(", ")} — expected ${DECLARATION_SHAPE}.`);
 				continue;
 			}
+			const before = problems.length;
+			const backgrounds = tokenPathList(entry["against"], path, "against", problems);
+			if (backgrounds.length === 0) continue;
 			if (!resolveColor(path, "base", tokens)) {
 				problems.push(`token "${path}" declares a contrast pair but is not itself a colour token.`);
 				continue;
 			}
-			pairs.push({
-				foreground: path,
-				background: against,
-				level: normalizeLevel(entry["level"], path, problems),
-				source: "extension"
-			});
+			const level = normalizeLevel(entry["level"], path, problems);
+			const floors = normalizeFloors(entry["floors"], path, modes, problems);
+			const ruleModes = normalizeModes(entry["modes"], path, modes, problems);
+			const measuredModes = (ruleModes ?? modes).filter((mode) => mode !== BASE_MODE);
+			const ownDefects = unresolvedModes(path, measuredModes, tokens);
+			for (const mode of ownDefects) {
+				const problem = `token "${path}" declares a contrast pair but its "${mode}" mode override does not resolve to a colour.`;
+				if (!problems.includes(problem)) problems.push(problem);
+			}
+			if (ruleModes !== void 0) {
+				for (const mode of Object.keys(floors)) if (mode !== "base" && !ruleModes.includes(mode)) problems.push(`token "${path}" sets a contrast floor for mode "${mode}" but restricts the rule to ${ruleModes.map((name) => `"${name}"`).join("/")} — the floor would never apply.`);
+			}
+			const grounds = entry["over"] === void 0 ? [] : tokenPathList(entry["over"], path, "over", problems);
+			const colourGrounds = [];
+			for (const ground of grounds) if (ground === path || backgrounds.includes(ground)) problems.push(`token "${path}" composites over "${ground}", which is an end of the pair itself — \`over\` names the opaque ground beneath the background.`);
+			else if (isColourTarget(ground, path, "over", measuredModes, tokens, problems)) colourGrounds.push(ground);
+			const colourBackgrounds = [];
+			for (const against of backgrounds) if (against === path) problems.push(`token "${path}" declares contrast against itself — a pair needs two different tokens.`);
+			else if (isColourTarget(against, path, "against", measuredModes, tokens, problems)) colourBackgrounds.push(against);
+			if (ownDefects.length > 0 || problems.length > before) continue;
+			for (const background of colourBackgrounds) for (const over of colourGrounds.length === 0 ? [void 0] : colourGrounds) {
+				const key = `${background}|${over ?? ""}`;
+				if (declared.has(key)) problems.push(`token "${path}" declares contrast against "${background}"${over === void 0 ? "" : ` over "${over}"`} more than once — one declaration per pair.`);
+				declared.add(key);
+			}
+			if (ownDefects.length > 0 || problems.length > before) continue;
+			for (const background of colourBackgrounds) {
+				const base = {
+					foreground: path,
+					background,
+					level,
+					floors,
+					source: "extension"
+				};
+				const withModes = ruleModes === void 0 ? base : {
+					...base,
+					modes: ruleModes
+				};
+				if (colourGrounds.length === 0) pairs.push(withModes);
+				else for (const over of colourGrounds) pairs.push({
+					...withModes,
+					over
+				});
+			}
 		}
 	}
 	return pairs;
 };
+const tokenPathList = (raw, path, field, problems) => {
+	const list = Array.isArray(raw) ? raw : [raw];
+	if (list.length === 0 || !list.every((item) => typeof item === "string")) {
+		problems.push(`token "${path}" has a malformed ${CONTRAST_EXTENSION} declaration — \`${field}\` must be a token path or a non-empty array of them (expected ${DECLARATION_SHAPE}).`);
+		return [];
+	}
+	return list.map((item) => aliasTarget(item) ?? item);
+};
+const isColourTarget = (target, path, field, modes, tokens, problems) => {
+	if (!tokens.has(target)) {
+		problems.push(`token "${path}" contrast-${field} "${target}" does not resolve to a known token.`);
+		return false;
+	}
+	if (!resolveColor(target, "base", tokens)) {
+		problems.push(`token "${path}" contrast-${field} "${target}" is not a colour token.`);
+		return false;
+	}
+	const unresolved = unresolvedModes(target, modes, tokens);
+	for (const mode of unresolved) problems.push(`token "${path}" contrast-${field} "${target}" has a "${mode}" mode override that does not resolve to a colour.`);
+	return unresolved.length === 0;
+};
+const unresolvedModes = (target, modes, tokens) => modes.filter((mode) => resolveColor(target, mode, tokens) === void 0);
 const normalizeLevel = (raw, path, problems) => {
 	if (raw === void 0) return DEFAULT_LEVEL;
 	if (typeof raw === "string" && CONTRAST_LEVELS.includes(raw)) return raw;
 	problems.push(`token "${path}" has an unknown contrast level "${String(raw)}" — use ${CONTRAST_LEVELS.join("/")}.`);
 	return DEFAULT_LEVEL;
 };
+const normalizeFloors = (raw, path, modes, problems) => {
+	if (raw === void 0) return {};
+	if (!isRecord(raw)) {
+		problems.push(`token "${path}" has malformed contrast floors — expected { base?: number, <mode>?: number }.`);
+		return {};
+	}
+	const floors = Object.create(null);
+	for (const [mode, value] of Object.entries(raw)) {
+		if (mode !== "base" && !modes.includes(mode)) {
+			problems.push(`token "${path}" sets a contrast floor for mode "${mode}", which no ${MODES_EXTENSION} block declares — use ${[BASE_MODE, ...modes].join("/")}.`);
+			continue;
+		}
+		if (typeof value !== "number" || !Number.isFinite(value) || value < 1 || value > 21) {
+			problems.push(`token "${path}" has an invalid contrast floor for mode "${mode}" (${String(value)}) — a WCAG ratio is a number between 1 and 21.`);
+			continue;
+		}
+		floors[mode] = value;
+	}
+	return floors;
+};
+const normalizeModes = (raw, path, modes, problems) => {
+	if (raw === void 0) return void 0;
+	if (!Array.isArray(raw) || raw.length === 0 || !raw.every((item) => typeof item === "string")) {
+		problems.push(`token "${path}" has malformed contrast modes — expected a non-empty array of mode names.`);
+		return;
+	}
+	const unknown = raw.filter((mode) => mode !== "base" && !modes.includes(mode));
+	if (unknown.length > 0) {
+		problems.push(`token "${path}" restricts contrast to mode(s) ${unknown.map((mode) => `"${mode}"`).join(", ")}, which no ${MODES_EXTENSION} block declares — use ${[BASE_MODE, ...modes].join("/")}.`);
+		return;
+	}
+	return [...new Set(raw)];
+};
+const floorFor = (spec, mode) => ownFloor(spec.floors, mode) ?? ownFloor(spec.floors, "base") ?? WCAG_FLOORS[spec.level];
+const ownFloor = (floors, mode) => Object.hasOwn(floors, mode) ? floors[mode] : void 0;
 const measurePairs = (specs, modes, tokens) => {
 	const rows = [];
 	for (const spec of specs) {
-		const baseFg = resolveColor(spec.foreground, BASE_MODE, tokens);
-		const baseBg = resolveColor(spec.background, BASE_MODE, tokens);
-		if (!baseFg || !baseBg) continue;
-		rows.push(makeRow(spec, BASE_MODE, baseFg, baseBg));
-		for (const mode of modes) {
-			const fg = resolveColor(spec.foreground, mode, tokens) ?? baseFg;
-			const bg = resolveColor(spec.background, mode, tokens) ?? baseBg;
-			if (sameColor(fg, baseFg) && sameColor(bg, baseBg)) continue;
-			rows.push(makeRow(spec, mode, fg, bg));
+		const base = resolvePair(spec, BASE_MODE, tokens);
+		if (!base) continue;
+		const explicit = spec.modes !== void 0;
+		const rowModes = spec.modes ?? ["base", ...modes];
+		for (const mode of rowModes) {
+			const colours = mode === "base" ? base : resolvePair(spec, mode, tokens) ?? base;
+			if (!explicit && mode !== "base" && sameColor(colours.fg, base.fg) && sameColor(colours.bg, base.bg) && floorFor(spec, mode) === floorFor(spec, "base")) continue;
+			rows.push(makeRow(spec, mode, colours.fg, colours.bg));
 		}
 	}
 	return rows;
 };
+const resolvePair = (spec, mode, tokens) => {
+	const resolveEnd = (path) => resolveColor(path, mode, tokens) ?? (mode === "base" ? void 0 : resolveColor(path, "base", tokens));
+	const fg = resolveEnd(spec.foreground);
+	const against = resolveEnd(spec.background);
+	if (!fg || !against) return void 0;
+	if (spec.over === void 0) return {
+		fg,
+		bg: against
+	};
+	const ground = resolveEnd(spec.over);
+	if (!ground) return void 0;
+	return {
+		fg,
+		bg: compositeOver(against, ground)
+	};
+};
 const makeRow = (spec, mode, foreground, background) => {
 	const ratio = contrastRatio(foreground, background);
-	const floor = WCAG_FLOORS[spec.level];
+	const floor = floorFor(spec, mode);
 	return {
 		foreground: spec.foreground,
 		background: spec.background,
+		...spec.over === void 0 ? {} : { over: spec.over },
 		mode,
 		level: spec.level,
 		ratio,
@@ -1677,6 +1794,13 @@ const resolveColor = (path, mode, tokens, seen = /* @__PURE__ */ new Set()) => {
 	if (alias !== void 0) return resolveColor(alias, mode, tokens, seen);
 	return typeof value === "string" ? parseColor(value) : void 0;
 };
+const runVerifier = async (hook) => {
+	const result = await hook.run("sh", ["-c", hook.command]);
+	return {
+		command: hook.command,
+		...result
+	};
+};
 //#endregion
 //#region src/design-tokens/design-sync.constant.ts
 const DESIGN_TOOL_EXTENSION = "com.lemony.design-tool";
@@ -2097,16 +2221,18 @@ const SPEC_SIDE_KINDS = [
 	"malformed-risk-marker",
 	"malformed-task-refs",
 	"unknown-risk-class",
-	"dangling-requirement-ref"
+	"dangling-requirement-ref",
+	"unticked-completed-task"
 ];
 const GROUP_HEADER = /^##\s+Group\s+(\d+)\b/;
 const RISK_MARKER = /\[risk:\s*([^\]]*)\]\s*$/;
 const RISK_MARKER_ALL = /\[risk:/gi;
 const RISK_MARKER_LOOKALIKE = /\[\s*risks?\s*:/i;
-const TASK_LINE = /^\s*[-*+]\s*\[[ xX]\]\s*(?:\*\*|__|`)?\s*(T\d+)\b/;
+const TASK_LINE = /^\s*[-*+]\s*\[([ xX])\]\s*(?:\*\*|__|`)?\s*(T\d+)\b/;
 const TASK_REFS = /^\(((?:R\d+)(?:\s*,\s*R\d+)*)\)/;
-const TASK_REFS_LOOKALIKE = /\(\s*R\d+/;
-const TASK_REFS_AFTER_TITLE = /(?:\*\*|__)\s*(\(\s*R\d+)/;
+const TASK_REFS_LOOKALIKE_ALL = /\(\s*R\d+/g;
+const TASK_TITLE_WRAPPER = /^\s*[-*+]\s*\[[ xX]\]\s*(\*\*|__)/;
+const TASK_REFS_AFTER_TITLE_CLOSE = /^\s*(\(\s*R\d+)/;
 const REQUIREMENT_LINE = /^\s*-\s*\*\*(R\d+)\*\*/;
 const TEST_FILE = /(^|\/)__tests__\/|\.(spec|test)\.[cm]?[jt]sx?$/;
 //#endregion
@@ -2157,7 +2283,7 @@ const parseTasksSpec = (text) => {
 		const blockEnd = taskBlockEnd(lines, index);
 		const parts = lines.slice(index, blockEnd).map((part) => part.trim());
 		index = blockEnd - 1;
-		const task = parseTaskBlock(match[1] ?? "", parts);
+		const task = parseTaskBlock(match[2] ?? "", (match[1] ?? " ") !== " ", parts);
 		if (task.malformedRefs) malformedTaskRefs.push(task.id);
 		if (current) {
 			current.tasks.push(task.task);
@@ -2198,7 +2324,7 @@ const taskBlockEnd = (lines, start) => {
 	}
 	return end;
 };
-const parseTaskBlock = (id, parts) => {
+const parseTaskBlock = (id, ticked, parts) => {
 	const block = parts.join(" ");
 	const opener = refsOpener(parts, block);
 	const refs = opener === void 0 ? null : declarationAt(parts, block, opener);
@@ -2207,9 +2333,10 @@ const parseTaskBlock = (id, parts) => {
 		id,
 		task: {
 			id,
+			ticked,
 			requirementRefs: [...new Set(requirementRefs)]
 		},
-		malformedRefs: refs === null && TASK_REFS_LOOKALIKE.test(block)
+		malformedRefs: refs === null && hasRefLookalike(parts)
 	};
 };
 const declarationAt = (parts, block, opener) => {
@@ -2230,17 +2357,40 @@ const declarationClosesLine = (parts, end) => {
 	return /^(?:\*\*|__)/.test(tail) && lineEnds.has(end + 2);
 };
 const refsOpener = (parts, block) => {
-	const candidates = [];
-	const onFirstLine = TASK_REFS_LOOKALIKE.exec(parts[0] ?? "")?.index;
-	if (onFirstLine !== void 0) candidates.push(onFirstLine);
-	const afterTitle = TASK_REFS_AFTER_TITLE.exec(block);
-	if (afterTitle) candidates.push(afterTitle.index + afterTitle[0].lastIndexOf("("));
-	let offset = (parts[0] ?? "").length + 1;
+	const first = parts[0] ?? "";
+	const attempted = [];
+	for (const lookalike of first.matchAll(TASK_REFS_LOOKALIKE_ALL)) {
+		if (isLinkTarget(first, lookalike.index)) continue;
+		attempted.push(lookalike.index);
+		break;
+	}
+	const afterTitle = afterTitleClose(first, block);
+	if (afterTitle !== void 0) attempted.push(afterTitle);
+	if (attempted.length > 0) return Math.min(...attempted);
+	const closing = [];
+	let offset = first.length + 1;
 	for (const part of parts.slice(1)) {
-		if (/^\(\s*R\d+/.test(part)) candidates.push(offset);
+		for (const lookalike of part.matchAll(TASK_REFS_LOOKALIKE_ALL)) {
+			if (isLinkTarget(part, lookalike.index)) continue;
+			const at = offset + lookalike.index;
+			if (declarationAt(parts, block, at) !== null) closing.push(at);
+		}
 		offset += part.length + 1;
 	}
-	return candidates.length === 0 ? void 0 : Math.min(...candidates);
+	return closing.length === 1 ? closing[0] : void 0;
+};
+const hasRefLookalike = (parts) => parts.some((part) => [...part.matchAll(TASK_REFS_LOOKALIKE_ALL)].some((lookalike) => !isLinkTarget(part, lookalike.index)));
+const isLinkTarget = (line, index) => line[index - 1] === "]";
+const afterTitleClose = (first, block) => {
+	const wrapper = TASK_TITLE_WRAPPER.exec(first);
+	const marker = wrapper?.[1];
+	if (!wrapper || marker === void 0) return void 0;
+	const close = block.indexOf(marker, wrapper[0].length);
+	if (close < 0) return void 0;
+	const tail = block.slice(close + marker.length);
+	const opener = TASK_REFS_AFTER_TITLE_CLOSE.exec(tail);
+	if (!opener) return void 0;
+	return close + marker.length + opener[0].indexOf("(");
 };
 const parseRiskMarker = (line) => {
 	const marker = RISK_MARKER.exec(line);
@@ -2381,7 +2531,7 @@ const runLedgerValidate = async (inputs) => {
 	});
 	for (const id of spec.malformedTaskRefs) problems.push({
 		kind: "malformed-task-refs",
-		message: `${id} carries a "(R<n>"-shaped tail that is not a well-formed "(R1, R2)" ref list. Left as-is it reads as a task that references no requirement, and its slice shrinks to itself.`,
+		message: `${id} carries a "(R<n>"-shaped ref list that is not a declaration: a declaration is one comma-separated "(R1, R2)" group that ends a line — no ranges ("R1–R3"), nothing after the closing paren on that line — at the end of the task's first line, right after the title's bold close, or the only group ending a continuation line. Left as-is it reads as a task that references no requirement, and its slice shrinks to itself.`,
 		subject: id
 	});
 	const groups = resolveGroups(spec.groups, address, problems);
@@ -2402,6 +2552,7 @@ const runLedgerValidate = async (inputs) => {
 			});
 		}
 	}
+	checkTicks(spec.groups, address, problems);
 	const slice = sliceForGroups(groups);
 	result.basis = slice.basis;
 	const dangling = await collectDanglingRefs(requirementsPath, slice.ids, problems);
@@ -2437,6 +2588,17 @@ const resolveGroups = (groups, address, problems) => {
 		message: `tasks.md declares ${groups.length} group(s); step ${address.step} has none. One step is one group.`
 	});
 };
+const checkTicks = (groups, address, problems) => {
+	const passed = address.kind === "full-pass" ? groups : groups.filter((group) => group.index <= address.step);
+	for (const group of passed) for (const task of group.tasks) {
+		if (task.ticked) continue;
+		problems.push({
+			kind: "unticked-completed-task",
+			message: `${task.id} (Group ${group.index}) is still "[ ]" in tasks.md, in a group the loop has passed. The Implementer ticks a task when it reaches green; an unticked task here is a forgotten mark or work that was never done — the human decides which.`,
+			subject: task.id
+		});
+	}
+};
 const collectDanglingRefs = async (requirementsPath, sliceIds, problems) => {
 	const referenced = sliceIds.filter((id) => id.startsWith("R"));
 	if (referenced.length === 0) return [];
@@ -3039,7 +3201,8 @@ const prunePrefix = async (repoRoot, options = {}) => {
 		}
 		if (sentOffset > size) return { prunedBytes: 0 };
 		const stateDir = stateDirOf(repoRoot);
-		const drainPath = join(stateDir, `${DRAINING_BASENAME}.${`${process.pid}-${randomBytes(4).toString("hex")}`}`);
+		const id = `${process.pid}-${randomBytes(4).toString("hex")}`;
+		const drainPath = join(stateDir, `${DRAINING_BASENAME}.${id}`);
 		const metaPath = `${drainPath}.meta`;
 		await mkdir(stateDir, { recursive: true });
 		await writeFile(metaPath, JSON.stringify({ sent_offset: sentOffset }));
@@ -3080,14 +3243,15 @@ const appendRejects = async (repoRoot, rejects, now) => {
 	const path = join(repoRoot, REJECTED_RELPATH);
 	await mkdir(dirname(path), { recursive: true });
 	const ts = now().toISOString();
-	await appendFile(path, `${rejects.map((reject) => {
+	const body = rejects.map((reject) => {
 		const entry = {
 			ts,
 			reason: reject.reason,
 			line: reject.line
 		};
 		return JSON.stringify(entry);
-	}).join("\n")}\n`);
+	}).join("\n");
+	await appendFile(path, `${body}\n`);
 	return rejects.length;
 };
 //#endregion
@@ -3759,7 +3923,8 @@ const checkVersionPin = (deps, config) => {
 };
 const checkCliResolution = async (deps) => {
 	const name = "cli-resolution";
-	if (await isExecutable(join(deps.repoRoot, "node_modules", ".bin", "lemony"))) return {
+	const localBin = join(deps.repoRoot, "node_modules", ".bin", LEMONY_BIN);
+	if (await isExecutable(localBin)) return {
 		name,
 		status: "ok",
 		detail: `Telemetry CLI resolves from node_modules/.bin/${LEMONY_BIN} (the durable setup).`
@@ -3954,22 +4119,26 @@ const isReadable = async (path) => {
 	}
 };
 //#endregion
+//#region src/status/parse-task-branch.ts
+const TASK_BRANCH = /^harness\/(\d+)-.+$/;
+const parseTaskBranch = (branch) => branch === null ? null : TASK_BRANCH.exec(branch)?.[1] ?? null;
+//#endregion
 //#region src/status/status.ts
 const PAUSED_LABEL = "harness:status:paused-for-clarification";
 const runStatus = async (deps) => {
 	const { repoRoot } = deps;
 	const config = await readHarnessConfig(repoRoot);
-	const pointer = await readPointer(repoRoot, deps.readGitUserEmail);
+	const lastSession = await readPointer(repoRoot, deps.readGitUserEmail);
 	const { branch, behind } = await deps.gitBehind(repoRoot);
 	const provider = createTaskTrackerProvider(config.task_storage.type, deps.runCommand);
 	const openDiscoveries = await countOpenDiscoveries(provider, config.task_storage.repo);
 	return {
 		vendorVersion: config.vendor_version,
 		taskStorageRepo: config.task_storage.repo,
-		activeTask: pointer.activeTask,
-		branch: branch ?? pointer.branch,
+		activeTask: parseTaskBranch(branch),
+		branch,
 		behind,
-		lastSession: pointer.lastSession,
+		lastSession,
 		openDiscoveries,
 		designToolDrift: await readDriftState(repoRoot)
 	};
@@ -3986,11 +4155,7 @@ const readDriftState = async (repoRoot) => {
 	}
 };
 const readPointer = async (repoRoot, readGitUserEmail) => {
-	const empty = {
-		activeTask: null,
-		branch: null,
-		lastSession: null
-	};
+	const empty = null;
 	const email = await readGitUserEmail(repoRoot);
 	if (!email) return empty;
 	const slug = email.split("@")[0] ?? "";
@@ -4006,12 +4171,7 @@ const readPointer = async (repoRoot, readGitUserEmail) => {
 	if (!match) return empty;
 	const parsed = pointerFrontmatterSchema.safeParse(parse(match[1] ?? ""));
 	if (!parsed.success) return empty;
-	const front = parsed.data;
-	return {
-		activeTask: normalize(front.active_task),
-		branch: normalize(front.branch),
-		lastSession: normalize(front.last_close_ts)
-	};
+	return normalize(parsed.data.last_close_ts);
 };
 const normalize = (value) => {
 	if (value === null || value === void 0) return null;
@@ -4083,7 +4243,7 @@ const COMMANDS = [
 	},
 	{
 		name: "review-ledger",
-		summary: "Validate the Reviewer's evidence ledger (the JSON sidecar under the task's state) against the spec's groups, the anchored diff and the declared gates: shape, criteria-vs-slice, unknown risk classes, the mutant floor, the gates floor (deterministic, agent-free; exits non-zero on an invalid ledger).",
+		summary: "Validate the Reviewer's evidence ledger (the JSON sidecar under the task's state) against the spec's groups, the anchored diff and the declared gates: shape, criteria-vs-slice, unknown risk classes, the mutant floor, the gates floor, the tick check on passed groups (deterministic, agent-free; exits non-zero on an invalid ledger).",
 		usage: "lemony review-ledger validate --task-id=<id> --anchor=<oid> (--step=<N> | --full-pass)"
 	},
 	{
@@ -4236,7 +4396,8 @@ const snapshotDestPaths = (version, bundle) => {
 	];
 };
 const writeSnapshot = async (repoRoot, version, bundle) => {
-	const staging = join(snapshotsRootDir(repoRoot), STAGING_DIR);
+	const root = snapshotsRootDir(repoRoot);
+	const staging = join(root, STAGING_DIR);
 	await assertNoSymlinkTraversal(repoRoot, snapshotDestPaths(version, bundle));
 	await rm(staging, {
 		recursive: true,
@@ -4595,9 +4756,10 @@ const COMPANION_DOCS = [
 	"partition"
 ];
 const renderFile = async (templatePath, relPath, vars) => {
+	const template = await readFile(templatePath, "utf8");
 	return {
 		relPath,
-		content: renderTemplate(await readFile(templatePath, "utf8"), vars),
+		content: renderTemplate(template, vars),
 		executable: false
 	};
 };
@@ -4673,7 +4835,8 @@ const appendGitignoreBlock = async (repoRoot) => {
 		await writeFile(gitignorePath, next);
 		return ".gitignore";
 	}
-	await writeFile(gitignorePath, `${current}${current.length === 0 ? "" : current.endsWith("\n") ? "\n" : "\n\n"}${GITIGNORE_BLOCK}\n`);
+	const prefix = current.length === 0 ? "" : current.endsWith("\n") ? "\n" : "\n\n";
+	await writeFile(gitignorePath, `${current}${prefix}${GITIGNORE_BLOCK}\n`);
 	return ".gitignore";
 };
 const removeGitignoreBlock = async (repoRoot) => {
@@ -4834,9 +4997,10 @@ const runInstall = async (options) => {
 	const losers = await collectLosers(repoRoot, actions);
 	let snapshotVersion = null;
 	if (losers.length > 0) {
+		const baseline = new Map(vendorFiles.map((file) => [file.relPath, file.content]));
 		await writeSnapshot(repoRoot, vendorVersion, {
 			working: losers,
-			baseline: new Map(vendorFiles.map((file) => [file.relPath, file.content]))
+			baseline
 		});
 		snapshotVersion = vendorVersion;
 	}
@@ -4893,7 +5057,8 @@ const runInstall = async (options) => {
 	};
 };
 const collectLosers = (repoRoot, actions) => {
-	return collectWorkingFiles(repoRoot, actions.filter((action) => action.kind === "pick-vendor").map((action) => action.relPath));
+	const losingPaths = actions.filter((action) => action.kind === "pick-vendor").map((action) => action.relPath);
+	return collectWorkingFiles(repoRoot, losingPaths);
 };
 //#endregion
 //#region src/install/resolve-collision.ts
@@ -4932,12 +5097,14 @@ const runReconcile = async (inputs) => {
 	const fromVersion = config.vendor_version;
 	const target = config.target;
 	const taskStorageRepo = config.task_storage.repo;
-	const predatedKeys = findPredatedKeys(await readFile(join(repoRoot, HARNESS_CONFIG_FILENAME), "utf8"), fromVersion, toVersion, inputs.configKeySince ?? CONFIG_KEY_SINCE);
+	const rawConfig = await readFile(join(repoRoot, HARNESS_CONFIG_FILENAME), "utf8");
+	const predatedKeys = findPredatedKeys(rawConfig, fromVersion, toVersion, inputs.configKeySince ?? CONFIG_KEY_SINCE);
 	const baselineVersion = await findBaselineVersion(repoRoot);
 	const baseline = baselineVersion ? await readBaseline(repoRoot, baselineVersion) : /* @__PURE__ */ new Map();
 	const hadBaseline = baseline.size > 0;
 	const capabilities = await scanRepo(repoRoot);
-	const skills = selectSkills(await readCatalogSkills(vendorRoot), capabilities);
+	const catalogSkills = await readCatalogSkills(vendorRoot);
+	const skills = selectSkills(catalogSkills, capabilities);
 	const vendorNew = await materializeVendorFiles({
 		vendorRoot,
 		target,
@@ -4973,14 +5140,16 @@ const runReconcile = async (inputs) => {
 		predatedKeys
 	};
 	if (hadBaseline) {
+		const working = await collectWorkingFiles(repoRoot, [...baseline.keys()]);
 		await writeSnapshot(repoRoot, fromVersion, {
-			working: await collectWorkingFiles(repoRoot, [...baseline.keys()]),
+			working,
 			baseline
 		});
 		await rotateSnapshots(repoRoot, config.rollback.keep_snapshots);
 	}
 	await applyActions(repoRoot, actions);
-	const { lostHookCommands } = await resyncSpecialCased(repoRoot, join(vendorRoot, "templates", target));
+	const templateRoot = join(vendorRoot, "templates", target);
+	const { lostHookCommands } = await resyncSpecialCased(repoRoot, templateRoot);
 	const labelSync = inputs.runCommand ? await syncLabels(taskStorageRepo, createTaskTrackerProvider(config.task_storage.type, inputs.runCommand)) : null;
 	await writeBaseline(repoRoot, toVersion, vendorNew);
 	await writeConfigValues(repoRoot, configBumps);
@@ -5014,7 +5183,8 @@ const applyActions = async (repoRoot, actions) => {
 			default: return;
 		}
 	}));
-	await pruneEmptyDirs(repoRoot, actions.filter((action) => action.kind === "prune").map((action) => action.relPath));
+	const prunedPaths = actions.filter((action) => action.kind === "prune").map((action) => action.relPath);
+	await pruneEmptyDirs(repoRoot, prunedPaths);
 };
 const summarize = (actions) => {
 	const conflictedFiles = [];
@@ -5044,12 +5214,10 @@ const summarize = (actions) => {
 				winner: "vendor"
 			});
 			break;
-		case "pick-client":
-			pickedFiles.push({
-				relPath: action.relPath,
-				winner: "client"
-			});
-			break;
+		case "pick-client": pickedFiles.push({
+			relPath: action.relPath,
+			winner: "client"
+		});
 	}
 	return {
 		conflictedFiles,
@@ -5155,11 +5323,12 @@ const runRollback = async (options) => {
 	await assertNoSymlinkTraversal(repoRoot, [...restorePaths, ...removePaths]);
 	await Promise.all(bundle.working.map((file) => writeManaged(repoRoot, file.relPath, file.content, file.executable)));
 	await Promise.all(removePaths.map((path) => rm(join(repoRoot, path), { force: true })));
-	await writeBaseline(repoRoot, target, [...bundle.baseline].map(([relPath, content]) => ({
+	const baselineFiles = [...bundle.baseline].map(([relPath, content]) => ({
 		relPath,
 		content,
 		executable: false
-	})));
+	}));
+	await writeBaseline(repoRoot, target, baselineFiles);
 	await writeConfigValues(repoRoot, { vendor_version: target });
 	return {
 		repoRoot,
@@ -5355,6 +5524,31 @@ const makeRunCommand = () => async (cmd, args) => {
 		};
 	}
 };
+const makeVerifierRunCommand = () => (cmd, args) => new Promise((resolveResult) => {
+	const child = spawn(cmd, args, { stdio: [
+		"ignore",
+		"pipe",
+		"pipe"
+	] });
+	const out = [];
+	const err = [];
+	child.stdout.on("data", (chunk) => out.push(chunk));
+	child.stderr.on("data", (chunk) => err.push(chunk));
+	child.on("error", (error) => {
+		resolveResult({
+			code: error.code === "ENOENT" ? 127 : 1,
+			stdout: Buffer.concat(out).toString("utf8"),
+			stderr: `${Buffer.concat(err).toString("utf8")}${error.message}\n`
+		});
+	});
+	child.on("close", (code, signal) => {
+		resolveResult({
+			code: code ?? 1,
+			stdout: Buffer.concat(out).toString("utf8"),
+			stderr: `${Buffer.concat(err).toString("utf8")}${signal ? `killed by ${signal}\n` : ""}`
+		});
+	});
+});
 const buildResolveDeps = () => {
 	const rl = createInterface({
 		input: stdin,
@@ -5379,10 +5573,10 @@ const gitBehind = async (repoRoot) => {
 		repoRoot,
 		"symbolic-ref",
 		"--quiet",
-		"--short",
 		"HEAD"
 	]);
-	const branch = branchResult.code === 0 ? branchResult.stdout.trim() || null : null;
+	const ref = branchResult.code === 0 ? branchResult.stdout.trim() : "";
+	const branch = ref.startsWith("refs/heads/") ? ref.slice(11) || null : null;
 	const headRef = await run("git", [
 		"-C",
 		repoRoot,
@@ -5700,16 +5894,18 @@ const telemetryEnable = async (repoRoot) => {
 	for (const line of formatTelemetryStatus(report)) console.log(line);
 };
 const telemetrySend = async (repoRoot) => {
+	const endpoint = env["LEMONY_TELEMETRY_ENDPOINT"] ?? "https://lemony-telemetry.lemoncode.workers.dev";
 	const result = await sendTelemetry({
 		repoRoot,
-		endpoint: env["LEMONY_TELEMETRY_ENDPOINT"] ?? "https://lemony-telemetry.lemoncode.workers.dev"
+		endpoint
 	});
 	console.log(`telemetry ${result.outcome} (${result.segmentsSent} sent, ${result.quarantined} quarantined)`);
 };
 const telemetryFlush = async (repoRoot) => {
+	const endpoint = env["LEMONY_TELEMETRY_ENDPOINT"] ?? "https://lemony-telemetry.lemoncode.workers.dev";
 	const result = await sendTelemetry({
 		repoRoot,
-		endpoint: env["LEMONY_TELEMETRY_ENDPOINT"] ?? "https://lemony-telemetry.lemoncode.workers.dev"
+		endpoint
 	});
 	for (const line of formatTelemetryFlush(result)) console.log(line);
 };
@@ -5764,20 +5960,41 @@ const designTokensValidate = async (args) => {
 	exit(1);
 };
 const designTokensContrast = async () => {
-	const result = await runContrast({ repoRoot: cwd() });
+	const verify = (await pathExists(join(cwd(), "harness.config.yml")) ? await readHarnessConfig(cwd()) : void 0)?.design_tokens.verify;
+	const result = await runContrast({
+		repoRoot: cwd(),
+		...verify === void 0 ? {} : { verify: {
+			command: verify,
+			run: makeVerifierRunCommand()
+		} }
+	});
 	if (!result.tokensFound) {
 		console.log(`No docs/design-tokens.json — design-tokens contrast skipped (consume-if-exists; the harness never creates it).`);
 		return;
 	}
 	const failures = result.pairs.filter((pair) => !pair.passes);
+	const forwardVerifier = () => {
+		if (result.verify === void 0) return;
+		const { stdout: out, stderr: err } = result.verify;
+		if (out.length > 0) stdout.write(out.endsWith("\n") ? out : `${out}\n`);
+		if (err.length > 0) stderr.write(err.endsWith("\n") ? err : `${err}\n`);
+	};
 	if (result.ok) {
 		console.log(result.pairsChecked === 0 ? `design-tokens contrast: no foreground/background pairs found (use the on-* convention or $extensions["com.lemony.contrast"]).` : `design-tokens contrast OK: ${result.pairsChecked} pair(s) meet their WCAG floor.`);
+		forwardVerifier();
+		if (result.verify !== void 0) console.log(`design-tokens verify OK: \`${result.verify.command}\` exited 0.`);
 		return;
 	}
-	console.error(`design-tokens contrast found ${failures.length + result.problems.length} issue(s):`);
-	for (const pair of failures) console.error(`  ${pair.foreground} on ${pair.background} (${pair.mode}, ${pair.level}): ${pair.ratio}:1 < ${pair.floor}:1`);
+	const failedVerifier = result.verify !== void 0 && result.verify.code !== 0 ? result.verify : void 0;
+	console.error(`design-tokens contrast found ${failures.length + result.problems.length + (failedVerifier ? 1 : 0)} issue(s):`);
+	for (const pair of failures) {
+		const over = pair.over === void 0 ? "" : ` over ${pair.over}`;
+		console.error(`  ${pair.foreground} on ${pair.background}${over} (${pair.mode}, ${pair.level}): ${pair.ratio}:1 < ${pair.floor}:1`);
+	}
 	for (const problem of result.problems) console.error(`  ${problem}`);
-	exit(1);
+	forwardVerifier();
+	if (failedVerifier) console.error(`  design_tokens.verify \`${failedVerifier.command}\` exited ${failedVerifier.code}.`);
+	process.exitCode = 1;
 };
 const designTokensImport = async (args) => {
 	const from = parseFlag(args, "from");