@lemoncode/lemony 0.4.1 → 0.5.0

package/catalog/VERSION

@@ -1 +1 @@
-0.4.1
+0.5.0

package/catalog/agents/implementer.md

@@ -54,6 +54,16 @@ what you run, only how many calls carry it.
    behavior (vertical slices, never all-tests-then-all-code). When your invocation
    says **auto-commit is OFF**, the whole run obeys §Staging protocol (below) —
    zero commits, staged save-points.
+   **The checkbox is yours** (L1 — a task with a `tasks.md`; L2 has none). A task's
+   `- [ ]` is its done-marker: flip it to `- [x]` the moment the task reaches green
+   (suite passing), and let the tick ride the task's own commit (auto-commit OFF:
+   the same `git add` — at the human's OK the Orchestrator's pathspec split lands it
+   in the step's state commit beside the code commit; the index is where the two
+   move together) — so the file always says where the work is. Nobody
+   else ticks for you: `lemony review-ledger validate` reports a task still `[ ]` in
+   a group the loop has passed (`unticked-completed-task`) and the human reads it as
+   a forgotten mark **or as work never done** — the honest reason to keep the two in
+   step.
    **Scope: exactly what the invocation hands you.** By default that is the whole
    `tasks.md` list (all-at-once). In **step-by-step mode** the Orchestrator
    invokes you per step — scoped to **one group**, handed **by reference** (the
@@ -124,9 +134,10 @@ iteration only knows what this contract and the worktree tell it:
 
 - **Zero commits, zero pushes.** Never `git commit`, never `git push` — not for
   code, not for state. The Orchestrator commits once the human OKs.
-- **Stage after every green task** — `git add -A` when a checkbox/task reaches
-  green (suite passing). The index is your save-point ladder: everything staged
-  is a proven-green floor.
+- **Stage after every green task** — tick the task's checkbox in `tasks.md`
+  (`- [ ]` → `- [x]`, step 2 of the procedure), then `git add -A`, when a task
+  reaches green (suite passing). The index is your save-point ladder: everything
+  staged is a proven-green floor, and the tick is part of the floor.
 - **Never stage mid-experiment.** A `git add` while red or mid-refactor silently
   **overwrites the save-point** — `git status` looks identical afterwards, and
   recovery yields nameless blobs (practically unrecoverable). Stage only at

package/catalog/agents/orchestrator.md

@@ -365,7 +365,9 @@ numbers still never shift. For each group, in order:
    (fresh context, as always) scoped to **this one group**: give it the branch, the
    task-state paths, and the group's id + header line in `tasks.md` — by reference
    (§Sub-agent invocation), it reads the group's tasks from the file itself (`tdd`
-   skill — checkbox by checkbox with small commits, as always). It commits to the
+   skill — checkbox by checkbox with small commits, as always, and it **ticks each
+   checkbox at green** — the tick rides the task's commit, or its `git add` under
+   auto-commit OFF; the file is the group's progress record). It commits to the
    branch (auto-commit OFF: it **stages** instead of committing — point the
    invocation at the staging protocol in `implementer.md`), logs to `progress.md`,
    and signals done. **No PR yet** — the PR opens after the last group,
@@ -422,13 +424,15 @@ numbers still never shift. For each group, in order:
    gates or the bare real-run floor (`undeclared`).
    Red → **an APPROVE with a red ledger is never relayed**, and a red ledger is not a
    REJECT of the code: the Implementer is not at fault and is **never** re-invoked for
-   it. Route on the `[kind]` lines the verb prints — it closes with
+   the red itself (a human's `changes` at the checkpoint it feeds is the human's call, as
+   at every checkpoint). Route on the `[kind]` lines the verb prints — it closes with
    `N spec-side problem(s) … do not retry the Reviewer while any of these stands.`
    whenever any problem lives outside the sidecar:
 
    - **any spec-side problem** — the verb counts them out loud (`unknown-risk-class`, a
      tag or ref list that did not parse, a duplicated group number, an orphan task, an
-     empty group, a dangling requirement ref, a step with no group) → no retry. They
+     empty group, a dangling requirement ref, a step with no group, a task still
+     `[ ]` in a group the loop has passed) → no retry. They
      live in `tasks.md` / `requirements.md`, which the Reviewer cannot fix: stop and
      bring them to the human as an **anticipated checkpoint** (below) with the verb's
      lines as the content — the spec needs a decision, and the fix routes as a discovery
@@ -436,6 +440,37 @@ numbers still never shift. For each group, in order:
      the sidecar on disk: green → the checkpoint; a sidecar-side red then follows the
      one-retry rule below. The human's `ok` on an anticipated checkpoint is their call,
      as at every gate — what never happens is you relaying a red as an APPROVE.
+     **`unticked-completed-task` is the one spec-side kind that needs no discovery**:
+     the Implementer ticks each task at green, so an unticked task in a passed group
+     is a forgotten mark or work that was never done, and only the human can tell
+     which. Name the task ids in the checkpoint and ask. `ok` = "done, the mark was
+     forgotten" → tick it yourself (`- [ ]` → `- [x]`) and **stage it the moment you
+     do** (`git add .claude/state/tasks/<id>/spec/tasks.md`) — a mediated edit, staged
+     on arrival like a Spec Author update, so the checkpoint contract's spec check
+     (item 4) never reads it as an unconfirmed human spec edit — then re-run the verb.
+     Wherever an OK's composite commits state, the staged tick rides its
+     `.claude/state` half and needs nothing more: every step OK (both knob states),
+     and auto-commit OFF's deferral-ending checkpoint OK, which its pre-gate full pass
+     feeds. **At the merge-gate presentation nothing else commits state before the
+     merge** — the step-8 full pass in either mode, all-at-once under auto-commit ON
+     having had no checkpoint at all — so there, commit it yourself as you stage it,
+     in the same composite turn as the re-run (§Turn economy):
+
+     ```bash
+     git commit -m "task(<id>): tick <T-ids> — human ok on unticked-completed-task" \
+       -- .claude/state/tasks/<id>/spec/tasks.md; \
+       git push   # best-effort — a failure warns, never blocks
+     ```
+
+     A merged `tasks.md` still reading `[ ]` is exactly the harm the kind exists to
+     stop. That post-APPROVE state write moves the stale-approve fingerprint the way
+     the ledger's own write does, and routes as the merge gate's exit-40 rule says
+     (§Merge gate) — a fresh APPROVE re-records the hashes; `--force` stays the
+     human's separate, informed call. `changes` = the
+     task is not done → the normal fix iteration, feedback naming the task. Never tick
+     on your own judgment: the mark is the Implementer's claim, and the verb exists so
+     a missing one is read by a person, not smoothed over by you.
+
    - **anything else** (a problem in the sidecar itself) → re-invoke the **Reviewer**
      (fresh, as always) **once**, with the
      verb's `[kind] message` lines **verbatim** in the spawn prompt — the delta is the
@@ -461,7 +496,12 @@ numbers still never shift. For each group, in order:
    `step_completed` emit (here `review_iterations` is 3) and the same transient
    `awaiting human checkpoint (step N/M)` line in `progress.md` — except you present
    the unresolved disagreement (both positions, the spec slice) instead of a clean
-   step.
+   step. When its content is the verb's `unticked-completed-task` lines, `ok` carries
+   one act before the state commit — tick and stage the named tasks (step 2's routing
+   bullet) — and the transient line names them,
+   `awaiting human checkpoint (step N/M) [unticked: T3, T4]` (step 5), so a cold
+   `/resume` re-presents the same content and owes the same act (the clean-step line
+   carries no suffix).
 
    In auto-commit OFF, `OK` is also the moment the group's single code commit
    lands, and `changes` sends the fresh Implementer to iterate **over the worktree**
@@ -571,8 +611,10 @@ numbers still never shift. For each group, in order:
    step's line is transient — update it in place as the loop progresses
    (`fix-loop iteration K — in progress` while implementing/reviewing,
    `awaiting ledger retry (step N/M, retry 1/1)` while the fresh Reviewer redoes a red
-   ledger, `awaiting human checkpoint (step N/M)` while waiting on the human), then
-   replace it with the resolved outcome:
+   ledger, `awaiting human checkpoint (step N/M)` while waiting on the human — with
+   the `[unticked: T3, T4]` suffix when the checkpoint is the anticipated one an
+   `unticked-completed-task` red raised, in all-at-once too, where the counter is
+   absent), then replace it with the resolved outcome:
 
    ```markdown
    Mode: step-by-step
@@ -611,7 +653,10 @@ spec-side problem to the human, and never an APPROVE relayed on a red ledger. Ou
 the step loop the transient line is `awaiting ledger retry (full pass, retry 1/1)` in
 `progress.md` (no step counter), and "the human" is the gate the pass feeds: the
 auto-commit-OFF checkpoint when there is one, otherwise the merge-gate presentation,
-with the verb's lines as the content.
+with the verb's lines as the content. An `unticked-completed-task` there resolves as
+in step 2's routing bullet — on `ok`, tick and stage the named tasks; at the
+auto-commit-OFF checkpoint the OK's composite commits them, at the merge-gate
+presentation you commit them yourself — then re-run the verb.
 
 ## Checkpoint contract (how a human gate presents work)
 
@@ -668,7 +713,10 @@ contract, not a vibe:
      agent-staged floor, so this check fires only on **unmediated** edits and
      the re-presented checkpoint is clean; an unstaged edit that matches the
      recorded `**Resolution**` in `discoveries.md` is confirmed content — stage
-     it, don't re-raise.
+     it, don't re-raise. The one mediated edit that is **not** a discovery — your
+     own `- [ ]` → `- [x]` tick on the human's `ok` to an `unticked-completed-task`
+     checkpoint (step 2) — is staged the same way, as you make it; it has no
+     `discoveries.md` entry to match, and needs none: the `ok` is its record.
 
    The **spec check runs in both knob states** — in auto-commit ON, run it
    **before** step 3's `awaiting` state commit, which would otherwise silently

package/catalog/agents/reviewer.md

@@ -228,9 +228,15 @@ What the validator enforces in this version, so you never have to guess:
 - **Spec-side problems are reported, never dropped — and they are not yours to fix.** A
   `[risk: …]` tag outside the vocabulary (`unknown-risk-class`), a tag or a `(R<n>)` ref
   list that did not parse, a duplicated group number, a task above the first header, an
-  empty group, a ref `requirements.md` never declares, a step with no group: each names
+  empty group, a ref `requirements.md` never declares, a step with no group, a task
+  still `[ ]` in a group the loop has passed (`unticked-completed-task` — the
+  Implementer's done-marker is missing, and whether the work is too is the human's
+  call, not yours): each names
   a defect in `tasks.md` / `requirements.md`, and the verb counts them out loud as
-  **spec-side**. Finish the ledger (a dangling ref leaves the slice — never invent an
+  **spec-side**. The ticks themselves, wherever a diff shows them (the full pass's PR
+  diff does), are the Implementer's done-marks flipped at green — **not a spec
+  change**: never drift, never a finding on their own. Finish the ledger (a dangling
+  ref leaves the slice — never invent an
   entry for a requirement that does not exist), return your verdict as usual, and name
   them in it — the Orchestrator takes them to the human instead of sending you back.
 

package/catalog/commands/pause.md

@@ -9,8 +9,9 @@ A two-step pause:
 
 1. **Write the resume narrative** so future-you (or whoever resumes) can pick
    up cold:
-   - Read `.claude/state/current-<your-user>.md` and the active task's
-     `progress.md` (if any).
+   - Read the active task's `progress.md` (if any) and the latest note under
+     `.claude/state/sessions/<your-user>/` (if any) — that is where the
+     narrative lives; `current-<your-user>.md` only holds session timestamps.
    - Generate a UTC timestamp slug — run `date -u +%Y-%m-%dT%H:%M:%SZ` and use
      it as `<ts>`. Pick a short topic slug from the work in progress.
    - Write `.claude/state/sessions/<your-user>/<ts>-<topic>.md` with this
@@ -19,8 +20,8 @@ A two-step pause:
      ```markdown
      ---
      session_close_ts: <ts>
-     active_task: <issue-id or null>
-     branch: <current branch>
+     active_task: <issue-id or null — the current branch's id: `harness/<id>-<slug>` → `<id>`>
+     branch: <current branch, or (unknown) if HEAD is detached>
      topic: <topic>
      reason: manual
      auto_close: false
@@ -42,7 +43,9 @@ A two-step pause:
      ```
 
 2. **Trigger the session-close hook** so the `session_closed` event lands in
-   `events.jsonl` and `current-<your-user>.md` pointers update:
+   `events.jsonl` (its `task_id` is derived from the current branch when it is
+   a `harness/<id>-<slug>` task branch) and `current-<your-user>.md` gets its
+   `last_close_ts` stamped:
 
    ```bash
    .claude/hooks/session-close.sh --manual

package/catalog/harness.config.schema.json

@@ -89,6 +89,10 @@
           "items": {
             "type": "string"
           }
+        },
+        "verify": {
+          "type": "string",
+          "minLength": 1
         }
       },
       "additionalProperties": false

package/catalog/hooks/init.sh

@@ -138,7 +138,10 @@ fi
 # ladder, and following `git pull --rebase` with `rebase.autostash` set flattens
 # that index — the documented rollback then reverts to the last commit and the
 # group's whole uncommitted work is gone. So on any other branch: silence.
-CURRENT_BRANCH="$(git symbolic-ref --quiet --short HEAD 2>/dev/null || true)"
+# The full ref with `refs/heads/` stripped, not `--short`: the short form
+# lengthens to `heads/<name>` when a tag shares the branch's name, which would
+# fail the `harness/*` test below (same read as `session-close.sh` / `status`).
+CURRENT_BRANCH="$(git symbolic-ref --quiet HEAD 2>/dev/null | sed -n 's#^refs/heads/##p')"
 DEFAULT_BRANCH="$(git symbolic-ref --quiet refs/remotes/origin/HEAD 2>/dev/null | sed 's@^refs/remotes/origin/@@')"
 if [ -n "$DEFAULT_BRANCH" ] && [ "$CURRENT_BRANCH" = "$DEFAULT_BRANCH" ]; then
   BEHIND="$(git rev-list --count "HEAD..origin/$DEFAULT_BRANCH" 2>/dev/null || echo 0)"
@@ -191,8 +194,6 @@ if [ "${#ERRORS[@]}" -eq 0 ] && [ -n "$GIT_USER_EMAIL" ]; then
     mkdir -p "$REPO_ROOT/.claude/state"
     cat > "$CURRENT_PATH" <<EOF
 ---
-active_task: null
-branch: $(git symbolic-ref --quiet --short HEAD 2>/dev/null || echo "(unknown)")
 session_start_ts: $NOW_ISO
 last_close_ts: ""
 ---
@@ -201,22 +202,45 @@ last_close_ts: ""
 
 Per-dev pointer (gitignored). The lifecycle hooks read \`session_start_ts\`
 to compute \`session_active_h\` and reset it on each SessionStart that orients.
-
-## Resume hint
-
-_(One paragraph — what to pick up next. Updated by \`/pause\`.)_
+The active task and its branch are not recorded here — \`session-close.sh\`
+derives them from the live branch (\`harness/<id>-<slug>\`) at close time — and
+the narrative resume lives under \`sessions/<user>/\` (written by \`/pause\`).
 EOF
   else
     # Refresh session_start_ts on every orient so close-time math is accurate.
     # awk in-place rewrite of the frontmatter scalar — without this,
     # `session_start_ts` would stay frozen at the first orient and
     # `session_active_h` would be cumulative across every clear/resume.
+    # The same pass drops the dead `active_task` / `branch` scalars a pointer
+    # created by an earlier version still carries — nothing ever updated them,
+    # so they lie (`null` / the init-day branch); the live branch is the source.
+    # Its "Resume hint" section goes too, but ONLY while it is still exactly
+    # the untouched placeholder — the heading, blank lines, the one placeholder
+    # line, and nothing else up to the next heading or EOF (its "Updated by
+    # `/pause`" promise was never kept). Anything a person wrote there — the
+    # placeholder replaced, a paragraph added below it, even a `---` rule —
+    # makes the section theirs and it stays, heading included; so does a
+    # section stripped to its bare heading. Decided by a read-only pre-pass so
+    # the rewrite below never looks ahead; `[[:space:]]*$` tolerates CRLF.
+    PRUNE_HINT="$(awk '
+      inhint && /^---/ { other = 1; next }
+      /^---/ { block++; next }
+      block < 2 { next }
+      /^## Resume hint[[:space:]]*$/ { inhint = 1; seen = 1; next }
+      inhint && /^## / { inhint = 0 }
+      !inhint { next }
+      /^[[:space:]]*$/ { next }
+      /Updated by `\/pause`/ { placeholder++; next }
+      { other = 1 }
+      END { print (seen && placeholder == 1 && !other) ? 1 : 0 }
+    ' "$CURRENT_PATH" 2>/dev/null)"
+    [ "$PRUNE_HINT" = "1" ] || PRUNE_HINT=0
     # Write through a mktemp file, not a predictable `$CURRENT_PATH.tmp`: the
     # latter is a known path an attacker could pre-plant as a symlink for the
     # redirect to follow. `mktemp` refuses to reuse an existing path, and `mv`
     # over CURRENT_PATH itself safely replaces a symlink with a regular file.
     if tmp="$(mktemp "$REPO_ROOT/.claude/state/.ptr.XXXXXX")"; then
-      awk -v ts="$NOW_ISO" '
+      awk -v ts="$NOW_ISO" -v prune="$PRUNE_HINT" '
         /^---/ {
           block++
           if (block == 2 && !seen) print "session_start_ts: " ts
@@ -224,6 +248,10 @@ EOF
           next
         }
         block == 1 && /^session_start_ts:/ { print "session_start_ts: " ts; seen = 1; next }
+        block == 1 && /^(active_task|branch):/ { next }
+        prune && block >= 2 && /^## Resume hint[[:space:]]*$/ { inhint = 1; next }
+        inhint && /^## / { inhint = 0 }
+        inhint { next }
         { print }
       ' "$CURRENT_PATH" > "$tmp" && mv "$tmp" "$CURRENT_PATH" || rm -f "$tmp"
     fi

package/catalog/hooks/session-close.sh

@@ -65,8 +65,6 @@ NOW_ISO="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 # (preinstalled) cover the rest.
 CURRENT_PATH="$REPO_ROOT/.claude/state/current-$USER_SLUG.md"
 SESSION_START_TS=""
-ACTIVE_TASK=""
-TASK_BRANCH=""
 read_frontmatter_field() {
   local field="$1"
   awk -v field="$field" '
@@ -89,10 +87,20 @@ read_frontmatter_field() {
 }
 if [ -f "$CURRENT_PATH" ]; then
   SESSION_START_TS="$(read_frontmatter_field session_start_ts)"
-  ACTIVE_TASK="$(read_frontmatter_field active_task)"
-  TASK_BRANCH="$(read_frontmatter_field branch)"
 fi
 
+# ── Derive the task context from the live branch ───────────────────────────
+# The pointer never carried a real `active_task` / `branch` — nothing in the
+# contract wrote them after init, so every auto-close record copied `null` /
+# the init-day branch. The branch is the source of truth: the Orchestrator
+# works every task on `harness/<id>-<slug>`, so HEAD names the task. The full
+# ref is read and `refs/heads/` stripped rather than `--short`: the short form
+# lengthens to `heads/<name>` when a tag shares the branch's name, which would
+# silently drop the id. Empty (→ `(unknown)`, no task) on a detached HEAD, a
+# rebase in progress, or outside a repo — never a stale guess.
+TASK_BRANCH="$(git -C "$REPO_ROOT" symbolic-ref --quiet HEAD 2>/dev/null | sed -n 's#^refs/heads/##p')"
+ACTIVE_TASK="$(printf '%s' "$TASK_BRANCH" | sed -n 's#^harness/\([0-9][0-9]*\)-..*$#\1#p')"
+
 # Fallback: a session with no recorded start defaults to "started now" so the
 # math is well-defined; duration becomes 0 hours, which the schema accepts.
 if [ -z "$SESSION_START_TS" ]; then
@@ -143,9 +151,9 @@ EMIT_ARGS=(
   --reason="$REASON"
   --auto-close="$AUTO_CLOSE"
 )
-# Skip a literal "null" — a buggy frontmatter may emit the string instead of a
-# real YAML null. The schema would accept it but the line is forensic noise.
-if [ -n "$ACTIVE_TASK" ] && [ "$ACTIVE_TASK" != "null" ]; then
+# Only a task branch yields an id; a session closed on `main` (or detached)
+# emits the envelope without `task_id`, as the schema allows.
+if [ -n "$ACTIVE_TASK" ]; then
   EMIT_ARGS+=(--task-id="$ACTIVE_TASK")
 fi
 # Resolve the CLI via the launcher (local devDependency → global → fail-fast)

package/catalog/schemas/tier2-events-history.md

@@ -31,6 +31,20 @@ Empty sections may be omitted.
 
 ---
 
+## 0.4.2 — 2026-09-10
+
+### Changed
+
+- **`session_closed.task_id` — now derived from the live branch at close time**
+  (`harness/<id>-<slug>` → `<id>`); absent on the default branch or a detached
+  HEAD. Previously the field was **never populated** on this event: the emitter
+  read it from a per-dev pointer field nothing ever wrote. **No field renamed,
+  added, or removed** — the envelope's optional `task_id` is simply present from
+  this version on when a session closes on a task branch. Readers bucketing
+  `session_closed` by task should expect the value to appear at this version.
+
+---
+
 ## 0.2.0 — 2026-07-31
 
 ### Changed

package/catalog/schemas/tier2-events.md

@@ -36,14 +36,14 @@ Every event line starts with this envelope. Per-type fields are added at the
 same top level — there is no nested `payload`, so Zod discriminated unions key on
 `type`.
 
-| Field             | Type   | Required | Axis            | Notes                                                                                                                                                                                                          |
-| ----------------- | ------ | -------- | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `type`            | string | yes      | `internal-enum` | One of the 9 event types listed below. Discriminator.                                                                                                                                                          |
-| `ts`              | string | yes      | `metric`        | UTC ISO 8601 with `Z` suffix (e.g. `2026-05-28T14:30:00.000Z`). **No local offsets.**                                                                                                                          |
-| `user`            | string | yes      | `local-only`    | `git config user.email` of the actor. Never exported in any tier.                                                                                                                                              |
-| `project`         | string | yes      | `identity`      | `task_storage.repo` slug (e.g. `acme/widgets`), from `harness.config.yml`. **Never `OWNER/REPO`** — the CLI refuses to emit while that placeholder is the value (see [Placeholder guard](#placeholder-guard)). |
-| `task_id`         | string | no       | `identity`      | Task issue id (e.g. `42`) when the event has a task context. Absent on session/global events. A per-project correlator — only meaningful alongside `project`, so it shares the `identity` axis.                |
-| `harness_version` | string | yes      | `metric`        | `version` of the **installed** `@lemoncode/lemony` package — _not_ `vendor_version` from config.                                                                                                               |
+| Field             | Type   | Required | Axis            | Notes                                                                                                                                                                                                                                                                 |
+| ----------------- | ------ | -------- | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `type`            | string | yes      | `internal-enum` | One of the 9 event types listed below. Discriminator.                                                                                                                                                                                                                 |
+| `ts`              | string | yes      | `metric`        | UTC ISO 8601 with `Z` suffix (e.g. `2026-05-28T14:30:00.000Z`). **No local offsets.**                                                                                                                                                                                 |
+| `user`            | string | yes      | `local-only`    | `git config user.email` of the actor. Never exported in any tier.                                                                                                                                                                                                     |
+| `project`         | string | yes      | `identity`      | `task_storage.repo` slug (e.g. `acme/widgets`), from `harness.config.yml`. **Never `OWNER/REPO`** — the CLI refuses to emit while that placeholder is the value (see [Placeholder guard](#placeholder-guard)).                                                        |
+| `task_id`         | string | no       | `identity`      | Task issue id (e.g. `42`) when the event has a task context. Absent on global events; `session_closed` carries it when HEAD is a `harness/<id>-<slug>` task branch. A per-project correlator — only meaningful alongside `project`, so it shares the `identity` axis. |
+| `harness_version` | string | yes      | `metric`        | `version` of the **installed** `@lemoncode/lemony` package — _not_ `vendor_version` from config.                                                                                                                                                                      |
 
 ### Placeholder guard
 
@@ -114,7 +114,9 @@ forward-compatible — readers dispatch on `type` and ignore unknowns.
 ### 1. `session_closed` _(P5)_
 
 Emitted by `session-close.sh` on `SessionEnd` or `/pause` (manual). One per
-session.
+session. The envelope's `task_id` is derived from the live branch at close time
+(`harness/<id>-<slug>` → `<id>`); a session closed on the default branch or a
+detached HEAD carries none.
 
 | Field              | Type    | Required | Axis            | Notes                                                                                                           |
 | ------------------ | ------- | -------- | --------------- | --------------------------------------------------------------------------------------------------------------- |

package/catalog/skills/a11y-audit/SKILL.md

@@ -29,7 +29,9 @@ Run the tiers in order; each adds evidence the next builds on.
   token pair — including any dark-mode override — and exits non-zero on a pair below its
   floor. This is the one a11y measurement doable offline, because colour comes from the
   token file. It is complementary to `lemony design-tokens validate` (validate proves colour
-  is a token reference; contrast proves the pair meets its floor).
+  is a token reference; contrast proves the pair meets its floor). When the project declares
+  `design_tokens.verify` in `harness.config.yml`, the same command also runs the design
+  system's own verifier and forwards its report — read that output as T0 evidence too.
 - **T1 — source a11y lint (rides the project).** The project's own linter usually carries an
   accessibility plugin (`eslint-plugin-jsx-a11y`, Svelte's or Vue's a11y rules). Run the
   project's `lint`; don't reimplement it. Read what it flags.

package/catalog/skills/prd-to-spec/SKILL.md

@@ -215,6 +215,11 @@ The review evidence ledger's validator enumerates each group's review slice from
 refs; a task it cannot read is reported as `malformed-task-refs` — a spec defect that
 pauses the loop, never read as "declares none".
 
+The checkbox itself is the **Implementer's done-marker**: it flips `- [ ]` → `- [x]`
+when the task reaches green, with the task's commit. Write every task `- [ ]`; the same
+validator reports a task still `[ ]` in a group the loop has passed
+(`unticked-completed-task`), so the file tracks the progress its shape promises.
+
 Rules: order so the first task is a tracer bullet; never "write all tests" then
 "write all code"; keep each task small enough to verify on its own. Grouping never
 changes task granularity — checkboxes stay atomic and TDD runs per task; only review

package/catalog/skills/resolve-discovery/SKILL.md

@@ -68,12 +68,12 @@ decision **stated in full** — at this moment it exists nowhere on disk; the en
 `**Resolution**` block is only written at step 4 — plus the `discoveries.md` entry
 **by path** for the surrounding context (it reads the entry itself):
 
-| Artifact changed by the decision                                                        | Owner to invoke                                                                                                                                             |
-| --------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `spec/requirements.md`, `spec/design.md`, `spec/tasks.md`                               | **Spec Author**                                                                                                                                             |
-| Implementation code, `progress.md`, `notes.md`                                          | **Implementer** (often just the resumed sub-agent)                                                                                                          |
-| A child issue's trace lines, a triage issue's fix plan, the parent partition-plan issue | **Orchestrator** (you) — `gh issue edit --body-file`, read-modify-write (an oversize discovery answered "partition": `.claude/agents/partition.md`)         |
-| `docs/adr/NNNN-<slug>.md`, `docs/architecture.md`, `docs/playbooks/`                    | **Architect** (on-demand) — `write-adr` to record the decision, `update-architecture` to keep the map true, `playbook-iterate` for a `T6 PLAYBOOK_CONFLICT` |
+| Artifact changed by the decision                                                        | Owner to invoke                                                                                                                                                    |
+| --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `spec/requirements.md`, `spec/design.md`, `spec/tasks.md`                               | **Spec Author** — except a task's checkbox: `- [ ]` → `- [x]` is the Implementer's done-mark at green (the Orchestrator's on a checkpoint `ok`), never a spec edit |
+| Implementation code, `progress.md`, `notes.md`                                          | **Implementer** (often just the resumed sub-agent)                                                                                                                 |
+| A child issue's trace lines, a triage issue's fix plan, the parent partition-plan issue | **Orchestrator** (you) — `gh issue edit --body-file`, read-modify-write (an oversize discovery answered "partition": `.claude/agents/partition.md`)                |
+| `docs/adr/NNNN-<slug>.md`, `docs/architecture.md`, `docs/playbooks/`                    | **Architect** (on-demand) — `write-adr` to record the decision, `update-architecture` to keep the map true, `playbook-iterate` for a `T6 PLAYBOOK_CONFLICT`        |
 
 Not every resolution needs an artifact update first. If the decision is simply "do X"
 with no change to the contract, skip straight to recording it and resuming. If it

package/catalog/skills/tdd/SKILL.md

@@ -80,6 +80,9 @@ Rules:
 - Only enough code to pass current test
 - Don't anticipate future tests
 - Keep tests focused on observable behavior
+- When the behaviors belong to a `tasks.md` task, its checkbox is the task's
+  done-marker: flip `- [ ]` → `- [x]` when the task's **last** behavior is GREEN
+  (the suite passing), and commit (or stage) it with the task's code
 
 ### 4. Refactor
 

package/catalog/templates/claude-code/harness.config.yml.tpl

@@ -83,10 +83,16 @@ rollback:
 #   - test
 #   - build
 
-# Design tokens (`design-tokens validate`). The anti-hardcode scan inspects a built-in
-# set of UI/style extensions (.css/.scss/.ts/.tsx/.vue/.svelte/.astro/.js/.mdx/.html/…).
-# Add extra suffixes here for a stack the built-ins don't cover — additive, never a
-# replacement. Default none.
+# Design tokens (`design-tokens validate` / `design-tokens contrast`).
+# `scan_extensions`: the anti-hardcode scan inspects a built-in set of UI/style
+# extensions (.css/.scss/.ts/.tsx/.vue/.svelte/.astro/.js/.mdx/.html/…). Add extra
+# suffixes here for a stack the built-ins don't cover — additive, never a replacement.
+# Default none.
+# `verify`: a command line `design-tokens contrast` runs after its own WCAG checks
+# (through `sh -c`, in the repo root) — your design system's own verifier for the rules
+# only it can know (palette under colour-vision-deficiency simulation, property grammar,
+# CSS scans). Its output is forwarded; a non-zero exit fails the gate. Default none.
 # design_tokens:
 #   scan_extensions:
 #     - .foo
+#   verify: pnpm exec my-design-system verify

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { access, appendFile, chmod, lstat, mkdir, open, readFile, readdir, rename, rm, rmdir, stat, writeFile } from "node:fs/promises";
 import { basename, delimiter, dirname, extname, join, relative, resolve, sep } from "node:path";
 import { argv, cwd, env, exit, stderr, stdin, stdout } from "node:process";
@@ -27,7 +27,8 @@ const DEPRECATED_IMPLEMENTATION_KEYS = ["pre_commit_review"];
 const HARNESS_CONFIG_SCHEMA_FILENAME = "harness.config.schema.json";
 const CONFIG_KEY_SINCE = {
 	gates: "0.3.0",
-	"implementation.auto_commit": "0.4.0"
+	"implementation.auto_commit": "0.4.0",
+	"design_tokens.verify": "0.5.0"
 };
 const TASK_STORAGE_REPO_PLACEHOLDER = "OWNER/REPO";
 const TARGETS = ["claude-code"];
@@ -120,7 +121,10 @@ const taskStorageSchema = z.object({
 }).strict();
 const rollbackSchema = z.object({ keep_snapshots: z.union([z.int().positive(), z.literal("unlimited")]).default(3) }).strict().prefault({});
 const telemetrySchema = z.object({ enabled: z.boolean().default(true) }).strict().prefault({});
-const designTokensSchema = z.object({ scan_extensions: z.array(z.string()).default([]) }).strict().prefault({});
+const designTokensSchema = z.object({
+	scan_extensions: z.array(z.string()).default([]),
+	verify: z.string().trim().min(1).optional()
+}).strict().prefault({});
 const mergeSchema = z.object({
 	checks_timeout_secs: z.int().positive().default(600),
 	allow_no_checks: z.boolean().default(false)
@@ -257,8 +261,6 @@ const pointerScalar = z.union([
 	z.null()
 ]).optional();
 const pointerFrontmatterSchema = z.object({
-	active_task: pointerScalar,
-	branch: pointerScalar,
 	session_start_ts: pointerScalar,
 	last_close_ts: pointerScalar
 });
@@ -1450,6 +1452,7 @@ const flatten = (color, backdrop) => ({
 	b: color.b * color.a + backdrop.b * (1 - color.a),
 	a: 1
 });
+const compositeOver = (color, ground) => flatten(color, ground.a < 1 ? flatten(ground, WHITE) : ground);
 const linearizeChannel = (channel) => {
 	const s = channel / 255;
 	return s <= .03928 ? s / 12.92 : ((s + .055) / 1.055) ** 2.4;
@@ -1505,15 +1508,17 @@ const runContrast = async (inputs) => {
 	};
 	const tokens = collectTokens(parsed);
 	const problems = [];
-	const specs = discoverPairs(tokens, problems);
 	const modes = declaredModes(tokens);
+	const specs = discoverPairs(tokens, modes, problems);
 	const pairs = measurePairs(specs, modes, tokens);
+	const verify = inputs.verify ? await runVerifier(inputs.verify) : void 0;
 	return {
-		ok: problems.length === 0 && pairs.every((pair) => pair.passes),
+		ok: problems.length === 0 && pairs.every((pair) => pair.passes) && (verify === void 0 || verify.code === 0),
 		tokensFound: true,
 		pairsChecked: pairs.length,
 		pairs,
-		problems
+		problems,
+		...verify === void 0 ? {} : { verify }
 	};
 };
 const emptyResult$1 = (tokensFound) => ({
@@ -1552,19 +1557,17 @@ const declaredModes = (tokens) => {
 	for (const token of tokens.values()) {
 		const modes = readExtension(token.node, MODES_EXTENSION);
 		if (isRecord(modes)) {
-			for (const name of Object.keys(modes)) if (name.trim().length > 0) names.add(name);
+			for (const name of Object.keys(modes)) if (name.trim().length > 0 && name !== "base") names.add(name);
 		}
 	}
 	return [...names].toSorted();
 };
-const discoverPairs = (tokens, problems) => {
-	const merged = /* @__PURE__ */ new Map();
-	const add = (spec) => {
-		merged.set(`${spec.foreground}|${spec.background}`, spec);
-	};
-	for (const spec of conventionPairs(tokens)) add(spec);
-	for (const spec of extensionPairs(tokens, problems)) add(spec);
-	return [...merged.values()];
+const pairKey = (spec) => `${spec.foreground}|${spec.background}`;
+const discoverPairs = (tokens, modes, problems) => {
+	const convention = new Map(conventionPairs(tokens).map((spec) => [pairKey(spec), spec]));
+	const explicit = extensionPairs(tokens, modes, problems);
+	for (const spec of explicit) convention.delete(pairKey(spec));
+	return [...convention.values(), ...explicit];
 };
 const conventionPairs = (tokens) => {
 	const pairs = [];
@@ -1581,77 +1584,193 @@ const conventionPairs = (tokens) => {
 			foreground: path,
 			background: basePath,
 			level: DEFAULT_LEVEL,
+			floors: {},
 			source: "convention"
 		});
 	}
 	return pairs;
 };
-const extensionPairs = (tokens, problems) => {
+const DECLARATION_SHAPE = "{ against: \"{token.path}\" | [\"{token.path}\", …], level?, floors?, modes?, over? }";
+const DECLARATION_KEYS = /* @__PURE__ */ new Set([
+	"against",
+	"level",
+	"floors",
+	"modes",
+	"over"
+]);
+const extensionPairs = (tokens, modes, problems) => {
 	const pairs = [];
 	for (const [path, token] of tokens) {
 		const declaration = readExtension(token.node, CONTRAST_EXTENSION);
 		if (declaration === void 0) continue;
 		const entries = Array.isArray(declaration) ? declaration : [declaration];
+		const declared = /* @__PURE__ */ new Set();
 		for (const entry of entries) {
-			if (!isRecord(entry) || typeof entry["against"] !== "string") {
-				problems.push(`token "${path}" has a malformed ${CONTRAST_EXTENSION} declaration — expected { against: "{token.path}", level? }.`);
-				continue;
-			}
-			const against = aliasTarget(entry["against"]) ?? entry["against"];
-			if (against === path) {
-				problems.push(`token "${path}" declares contrast against itself — a pair needs two different tokens.`);
-				continue;
-			}
-			if (!tokens.has(against)) {
-				problems.push(`token "${path}" contrast-against "${entry["against"]}" does not resolve to a known token.`);
+			if (!isRecord(entry)) {
+				problems.push(`token "${path}" has a malformed ${CONTRAST_EXTENSION} declaration — expected ${DECLARATION_SHAPE}.`);
 				continue;
 			}
-			if (!resolveColor(against, "base", tokens)) {
-				problems.push(`token "${path}" contrast-against "${entry["against"]}" is not a colour token.`);
+			const unknownKeys = Object.keys(entry).filter((key) => !DECLARATION_KEYS.has(key));
+			if (unknownKeys.length > 0) {
+				problems.push(`token "${path}" has unknown ${CONTRAST_EXTENSION} key(s) ${unknownKeys.map((key) => `"${key}"`).join(", ")} — expected ${DECLARATION_SHAPE}.`);
 				continue;
 			}
+			const before = problems.length;
+			const backgrounds = tokenPathList(entry["against"], path, "against", problems);
+			if (backgrounds.length === 0) continue;
 			if (!resolveColor(path, "base", tokens)) {
 				problems.push(`token "${path}" declares a contrast pair but is not itself a colour token.`);
 				continue;
 			}
-			pairs.push({
-				foreground: path,
-				background: against,
-				level: normalizeLevel(entry["level"], path, problems),
-				source: "extension"
-			});
+			const level = normalizeLevel(entry["level"], path, problems);
+			const floors = normalizeFloors(entry["floors"], path, modes, problems);
+			const ruleModes = normalizeModes(entry["modes"], path, modes, problems);
+			const measuredModes = (ruleModes ?? modes).filter((mode) => mode !== BASE_MODE);
+			const ownDefects = unresolvedModes(path, measuredModes, tokens);
+			for (const mode of ownDefects) {
+				const problem = `token "${path}" declares a contrast pair but its "${mode}" mode override does not resolve to a colour.`;
+				if (!problems.includes(problem)) problems.push(problem);
+			}
+			if (ruleModes !== void 0) {
+				for (const mode of Object.keys(floors)) if (mode !== "base" && !ruleModes.includes(mode)) problems.push(`token "${path}" sets a contrast floor for mode "${mode}" but restricts the rule to ${ruleModes.map((name) => `"${name}"`).join("/")} — the floor would never apply.`);
+			}
+			const grounds = entry["over"] === void 0 ? [] : tokenPathList(entry["over"], path, "over", problems);
+			const colourGrounds = [];
+			for (const ground of grounds) if (ground === path || backgrounds.includes(ground)) problems.push(`token "${path}" composites over "${ground}", which is an end of the pair itself — \`over\` names the opaque ground beneath the background.`);
+			else if (isColourTarget(ground, path, "over", measuredModes, tokens, problems)) colourGrounds.push(ground);
+			const colourBackgrounds = [];
+			for (const against of backgrounds) if (against === path) problems.push(`token "${path}" declares contrast against itself — a pair needs two different tokens.`);
+			else if (isColourTarget(against, path, "against", measuredModes, tokens, problems)) colourBackgrounds.push(against);
+			if (ownDefects.length > 0 || problems.length > before) continue;
+			for (const background of colourBackgrounds) for (const over of colourGrounds.length === 0 ? [void 0] : colourGrounds) {
+				const key = `${background}|${over ?? ""}`;
+				if (declared.has(key)) problems.push(`token "${path}" declares contrast against "${background}"${over === void 0 ? "" : ` over "${over}"`} more than once — one declaration per pair.`);
+				declared.add(key);
+			}
+			if (ownDefects.length > 0 || problems.length > before) continue;
+			for (const background of colourBackgrounds) {
+				const base = {
+					foreground: path,
+					background,
+					level,
+					floors,
+					source: "extension"
+				};
+				const withModes = ruleModes === void 0 ? base : {
+					...base,
+					modes: ruleModes
+				};
+				if (colourGrounds.length === 0) pairs.push(withModes);
+				else for (const over of colourGrounds) pairs.push({
+					...withModes,
+					over
+				});
+			}
 		}
 	}
 	return pairs;
 };
+const tokenPathList = (raw, path, field, problems) => {
+	const list = Array.isArray(raw) ? raw : [raw];
+	if (list.length === 0 || !list.every((item) => typeof item === "string")) {
+		problems.push(`token "${path}" has a malformed ${CONTRAST_EXTENSION} declaration — \`${field}\` must be a token path or a non-empty array of them (expected ${DECLARATION_SHAPE}).`);
+		return [];
+	}
+	return list.map((item) => aliasTarget(item) ?? item);
+};
+const isColourTarget = (target, path, field, modes, tokens, problems) => {
+	if (!tokens.has(target)) {
+		problems.push(`token "${path}" contrast-${field} "${target}" does not resolve to a known token.`);
+		return false;
+	}
+	if (!resolveColor(target, "base", tokens)) {
+		problems.push(`token "${path}" contrast-${field} "${target}" is not a colour token.`);
+		return false;
+	}
+	const unresolved = unresolvedModes(target, modes, tokens);
+	for (const mode of unresolved) problems.push(`token "${path}" contrast-${field} "${target}" has a "${mode}" mode override that does not resolve to a colour.`);
+	return unresolved.length === 0;
+};
+const unresolvedModes = (target, modes, tokens) => modes.filter((mode) => resolveColor(target, mode, tokens) === void 0);
 const normalizeLevel = (raw, path, problems) => {
 	if (raw === void 0) return DEFAULT_LEVEL;
 	if (typeof raw === "string" && CONTRAST_LEVELS.includes(raw)) return raw;
 	problems.push(`token "${path}" has an unknown contrast level "${String(raw)}" — use ${CONTRAST_LEVELS.join("/")}.`);
 	return DEFAULT_LEVEL;
 };
+const normalizeFloors = (raw, path, modes, problems) => {
+	if (raw === void 0) return {};
+	if (!isRecord(raw)) {
+		problems.push(`token "${path}" has malformed contrast floors — expected { base?: number, <mode>?: number }.`);
+		return {};
+	}
+	const floors = Object.create(null);
+	for (const [mode, value] of Object.entries(raw)) {
+		if (mode !== "base" && !modes.includes(mode)) {
+			problems.push(`token "${path}" sets a contrast floor for mode "${mode}", which no ${MODES_EXTENSION} block declares — use ${[BASE_MODE, ...modes].join("/")}.`);
+			continue;
+		}
+		if (typeof value !== "number" || !Number.isFinite(value) || value < 1 || value > 21) {
+			problems.push(`token "${path}" has an invalid contrast floor for mode "${mode}" (${String(value)}) — a WCAG ratio is a number between 1 and 21.`);
+			continue;
+		}
+		floors[mode] = value;
+	}
+	return floors;
+};
+const normalizeModes = (raw, path, modes, problems) => {
+	if (raw === void 0) return void 0;
+	if (!Array.isArray(raw) || raw.length === 0 || !raw.every((item) => typeof item === "string")) {
+		problems.push(`token "${path}" has malformed contrast modes — expected a non-empty array of mode names.`);
+		return;
+	}
+	const unknown = raw.filter((mode) => mode !== "base" && !modes.includes(mode));
+	if (unknown.length > 0) {
+		problems.push(`token "${path}" restricts contrast to mode(s) ${unknown.map((mode) => `"${mode}"`).join(", ")}, which no ${MODES_EXTENSION} block declares — use ${[BASE_MODE, ...modes].join("/")}.`);
+		return;
+	}
+	return [...new Set(raw)];
+};
+const floorFor = (spec, mode) => ownFloor(spec.floors, mode) ?? ownFloor(spec.floors, "base") ?? WCAG_FLOORS[spec.level];
+const ownFloor = (floors, mode) => Object.hasOwn(floors, mode) ? floors[mode] : void 0;
 const measurePairs = (specs, modes, tokens) => {
 	const rows = [];
 	for (const spec of specs) {
-		const baseFg = resolveColor(spec.foreground, BASE_MODE, tokens);
-		const baseBg = resolveColor(spec.background, BASE_MODE, tokens);
-		if (!baseFg || !baseBg) continue;
-		rows.push(makeRow(spec, BASE_MODE, baseFg, baseBg));
-		for (const mode of modes) {
-			const fg = resolveColor(spec.foreground, mode, tokens) ?? baseFg;
-			const bg = resolveColor(spec.background, mode, tokens) ?? baseBg;
-			if (sameColor(fg, baseFg) && sameColor(bg, baseBg)) continue;
-			rows.push(makeRow(spec, mode, fg, bg));
+		const base = resolvePair(spec, BASE_MODE, tokens);
+		if (!base) continue;
+		const explicit = spec.modes !== void 0;
+		const rowModes = spec.modes ?? ["base", ...modes];
+		for (const mode of rowModes) {
+			const colours = mode === "base" ? base : resolvePair(spec, mode, tokens) ?? base;
+			if (!explicit && mode !== "base" && sameColor(colours.fg, base.fg) && sameColor(colours.bg, base.bg) && floorFor(spec, mode) === floorFor(spec, "base")) continue;
+			rows.push(makeRow(spec, mode, colours.fg, colours.bg));
 		}
 	}
 	return rows;
 };
+const resolvePair = (spec, mode, tokens) => {
+	const resolveEnd = (path) => resolveColor(path, mode, tokens) ?? (mode === "base" ? void 0 : resolveColor(path, "base", tokens));
+	const fg = resolveEnd(spec.foreground);
+	const against = resolveEnd(spec.background);
+	if (!fg || !against) return void 0;
+	if (spec.over === void 0) return {
+		fg,
+		bg: against
+	};
+	const ground = resolveEnd(spec.over);
+	if (!ground) return void 0;
+	return {
+		fg,
+		bg: compositeOver(against, ground)
+	};
+};
 const makeRow = (spec, mode, foreground, background) => {
 	const ratio = contrastRatio(foreground, background);
-	const floor = WCAG_FLOORS[spec.level];
+	const floor = floorFor(spec, mode);
 	return {
 		foreground: spec.foreground,
 		background: spec.background,
+		...spec.over === void 0 ? {} : { over: spec.over },
 		mode,
 		level: spec.level,
 		ratio,
@@ -1675,6 +1794,13 @@ const resolveColor = (path, mode, tokens, seen = /* @__PURE__ */ new Set()) => {
 	if (alias !== void 0) return resolveColor(alias, mode, tokens, seen);
 	return typeof value === "string" ? parseColor(value) : void 0;
 };
+const runVerifier = async (hook) => {
+	const result = await hook.run("sh", ["-c", hook.command]);
+	return {
+		command: hook.command,
+		...result
+	};
+};
 //#endregion
 //#region src/design-tokens/design-sync.constant.ts
 const DESIGN_TOOL_EXTENSION = "com.lemony.design-tool";
@@ -2095,13 +2221,14 @@ const SPEC_SIDE_KINDS = [
 	"malformed-risk-marker",
 	"malformed-task-refs",
 	"unknown-risk-class",
-	"dangling-requirement-ref"
+	"dangling-requirement-ref",
+	"unticked-completed-task"
 ];
 const GROUP_HEADER = /^##\s+Group\s+(\d+)\b/;
 const RISK_MARKER = /\[risk:\s*([^\]]*)\]\s*$/;
 const RISK_MARKER_ALL = /\[risk:/gi;
 const RISK_MARKER_LOOKALIKE = /\[\s*risks?\s*:/i;
-const TASK_LINE = /^\s*[-*+]\s*\[[ xX]\]\s*(?:\*\*|__|`)?\s*(T\d+)\b/;
+const TASK_LINE = /^\s*[-*+]\s*\[([ xX])\]\s*(?:\*\*|__|`)?\s*(T\d+)\b/;
 const TASK_REFS = /^\(((?:R\d+)(?:\s*,\s*R\d+)*)\)/;
 const TASK_REFS_LOOKALIKE_ALL = /\(\s*R\d+/g;
 const TASK_TITLE_WRAPPER = /^\s*[-*+]\s*\[[ xX]\]\s*(\*\*|__)/;
@@ -2156,7 +2283,7 @@ const parseTasksSpec = (text) => {
 		const blockEnd = taskBlockEnd(lines, index);
 		const parts = lines.slice(index, blockEnd).map((part) => part.trim());
 		index = blockEnd - 1;
-		const task = parseTaskBlock(match[1] ?? "", parts);
+		const task = parseTaskBlock(match[2] ?? "", (match[1] ?? " ") !== " ", parts);
 		if (task.malformedRefs) malformedTaskRefs.push(task.id);
 		if (current) {
 			current.tasks.push(task.task);
@@ -2197,7 +2324,7 @@ const taskBlockEnd = (lines, start) => {
 	}
 	return end;
 };
-const parseTaskBlock = (id, parts) => {
+const parseTaskBlock = (id, ticked, parts) => {
 	const block = parts.join(" ");
 	const opener = refsOpener(parts, block);
 	const refs = opener === void 0 ? null : declarationAt(parts, block, opener);
@@ -2206,6 +2333,7 @@ const parseTaskBlock = (id, parts) => {
 		id,
 		task: {
 			id,
+			ticked,
 			requirementRefs: [...new Set(requirementRefs)]
 		},
 		malformedRefs: refs === null && hasRefLookalike(parts)
@@ -2424,6 +2552,7 @@ const runLedgerValidate = async (inputs) => {
 			});
 		}
 	}
+	checkTicks(spec.groups, address, problems);
 	const slice = sliceForGroups(groups);
 	result.basis = slice.basis;
 	const dangling = await collectDanglingRefs(requirementsPath, slice.ids, problems);
@@ -2459,6 +2588,17 @@ const resolveGroups = (groups, address, problems) => {
 		message: `tasks.md declares ${groups.length} group(s); step ${address.step} has none. One step is one group.`
 	});
 };
+const checkTicks = (groups, address, problems) => {
+	const passed = address.kind === "full-pass" ? groups : groups.filter((group) => group.index <= address.step);
+	for (const group of passed) for (const task of group.tasks) {
+		if (task.ticked) continue;
+		problems.push({
+			kind: "unticked-completed-task",
+			message: `${task.id} (Group ${group.index}) is still "[ ]" in tasks.md, in a group the loop has passed. The Implementer ticks a task when it reaches green; an unticked task here is a forgotten mark or work that was never done — the human decides which.`,
+			subject: task.id
+		});
+	}
+};
 const collectDanglingRefs = async (requirementsPath, sliceIds, problems) => {
 	const referenced = sliceIds.filter((id) => id.startsWith("R"));
 	if (referenced.length === 0) return [];
@@ -3979,22 +4119,26 @@ const isReadable = async (path) => {
 	}
 };
 //#endregion
+//#region src/status/parse-task-branch.ts
+const TASK_BRANCH = /^harness\/(\d+)-.+$/;
+const parseTaskBranch = (branch) => branch === null ? null : TASK_BRANCH.exec(branch)?.[1] ?? null;
+//#endregion
 //#region src/status/status.ts
 const PAUSED_LABEL = "harness:status:paused-for-clarification";
 const runStatus = async (deps) => {
 	const { repoRoot } = deps;
 	const config = await readHarnessConfig(repoRoot);
-	const pointer = await readPointer(repoRoot, deps.readGitUserEmail);
+	const lastSession = await readPointer(repoRoot, deps.readGitUserEmail);
 	const { branch, behind } = await deps.gitBehind(repoRoot);
 	const provider = createTaskTrackerProvider(config.task_storage.type, deps.runCommand);
 	const openDiscoveries = await countOpenDiscoveries(provider, config.task_storage.repo);
 	return {
 		vendorVersion: config.vendor_version,
 		taskStorageRepo: config.task_storage.repo,
-		activeTask: pointer.activeTask,
-		branch: branch ?? pointer.branch,
+		activeTask: parseTaskBranch(branch),
+		branch,
 		behind,
-		lastSession: pointer.lastSession,
+		lastSession,
 		openDiscoveries,
 		designToolDrift: await readDriftState(repoRoot)
 	};
@@ -4011,11 +4155,7 @@ const readDriftState = async (repoRoot) => {
 	}
 };
 const readPointer = async (repoRoot, readGitUserEmail) => {
-	const empty = {
-		activeTask: null,
-		branch: null,
-		lastSession: null
-	};
+	const empty = null;
 	const email = await readGitUserEmail(repoRoot);
 	if (!email) return empty;
 	const slug = email.split("@")[0] ?? "";
@@ -4031,12 +4171,7 @@ const readPointer = async (repoRoot, readGitUserEmail) => {
 	if (!match) return empty;
 	const parsed = pointerFrontmatterSchema.safeParse(parse(match[1] ?? ""));
 	if (!parsed.success) return empty;
-	const front = parsed.data;
-	return {
-		activeTask: normalize(front.active_task),
-		branch: normalize(front.branch),
-		lastSession: normalize(front.last_close_ts)
-	};
+	return normalize(parsed.data.last_close_ts);
 };
 const normalize = (value) => {
 	if (value === null || value === void 0) return null;
@@ -4108,7 +4243,7 @@ const COMMANDS = [
 	},
 	{
 		name: "review-ledger",
-		summary: "Validate the Reviewer's evidence ledger (the JSON sidecar under the task's state) against the spec's groups, the anchored diff and the declared gates: shape, criteria-vs-slice, unknown risk classes, the mutant floor, the gates floor (deterministic, agent-free; exits non-zero on an invalid ledger).",
+		summary: "Validate the Reviewer's evidence ledger (the JSON sidecar under the task's state) against the spec's groups, the anchored diff and the declared gates: shape, criteria-vs-slice, unknown risk classes, the mutant floor, the gates floor, the tick check on passed groups (deterministic, agent-free; exits non-zero on an invalid ledger).",
 		usage: "lemony review-ledger validate --task-id=<id> --anchor=<oid> (--step=<N> | --full-pass)"
 	},
 	{
@@ -5389,6 +5524,31 @@ const makeRunCommand = () => async (cmd, args) => {
 		};
 	}
 };
+const makeVerifierRunCommand = () => (cmd, args) => new Promise((resolveResult) => {
+	const child = spawn(cmd, args, { stdio: [
+		"ignore",
+		"pipe",
+		"pipe"
+	] });
+	const out = [];
+	const err = [];
+	child.stdout.on("data", (chunk) => out.push(chunk));
+	child.stderr.on("data", (chunk) => err.push(chunk));
+	child.on("error", (error) => {
+		resolveResult({
+			code: error.code === "ENOENT" ? 127 : 1,
+			stdout: Buffer.concat(out).toString("utf8"),
+			stderr: `${Buffer.concat(err).toString("utf8")}${error.message}\n`
+		});
+	});
+	child.on("close", (code, signal) => {
+		resolveResult({
+			code: code ?? 1,
+			stdout: Buffer.concat(out).toString("utf8"),
+			stderr: `${Buffer.concat(err).toString("utf8")}${signal ? `killed by ${signal}\n` : ""}`
+		});
+	});
+});
 const buildResolveDeps = () => {
 	const rl = createInterface({
 		input: stdin,
@@ -5413,10 +5573,10 @@ const gitBehind = async (repoRoot) => {
 		repoRoot,
 		"symbolic-ref",
 		"--quiet",
-		"--short",
 		"HEAD"
 	]);
-	const branch = branchResult.code === 0 ? branchResult.stdout.trim() || null : null;
+	const ref = branchResult.code === 0 ? branchResult.stdout.trim() : "";
+	const branch = ref.startsWith("refs/heads/") ? ref.slice(11) || null : null;
 	const headRef = await run("git", [
 		"-C",
 		repoRoot,
@@ -5800,20 +5960,41 @@ const designTokensValidate = async (args) => {
 	exit(1);
 };
 const designTokensContrast = async () => {
-	const result = await runContrast({ repoRoot: cwd() });
+	const verify = (await pathExists(join(cwd(), "harness.config.yml")) ? await readHarnessConfig(cwd()) : void 0)?.design_tokens.verify;
+	const result = await runContrast({
+		repoRoot: cwd(),
+		...verify === void 0 ? {} : { verify: {
+			command: verify,
+			run: makeVerifierRunCommand()
+		} }
+	});
 	if (!result.tokensFound) {
 		console.log(`No docs/design-tokens.json — design-tokens contrast skipped (consume-if-exists; the harness never creates it).`);
 		return;
 	}
 	const failures = result.pairs.filter((pair) => !pair.passes);
+	const forwardVerifier = () => {
+		if (result.verify === void 0) return;
+		const { stdout: out, stderr: err } = result.verify;
+		if (out.length > 0) stdout.write(out.endsWith("\n") ? out : `${out}\n`);
+		if (err.length > 0) stderr.write(err.endsWith("\n") ? err : `${err}\n`);
+	};
 	if (result.ok) {
 		console.log(result.pairsChecked === 0 ? `design-tokens contrast: no foreground/background pairs found (use the on-* convention or $extensions["com.lemony.contrast"]).` : `design-tokens contrast OK: ${result.pairsChecked} pair(s) meet their WCAG floor.`);
+		forwardVerifier();
+		if (result.verify !== void 0) console.log(`design-tokens verify OK: \`${result.verify.command}\` exited 0.`);
 		return;
 	}
-	console.error(`design-tokens contrast found ${failures.length + result.problems.length} issue(s):`);
-	for (const pair of failures) console.error(`  ${pair.foreground} on ${pair.background} (${pair.mode}, ${pair.level}): ${pair.ratio}:1 < ${pair.floor}:1`);
+	const failedVerifier = result.verify !== void 0 && result.verify.code !== 0 ? result.verify : void 0;
+	console.error(`design-tokens contrast found ${failures.length + result.problems.length + (failedVerifier ? 1 : 0)} issue(s):`);
+	for (const pair of failures) {
+		const over = pair.over === void 0 ? "" : ` over ${pair.over}`;
+		console.error(`  ${pair.foreground} on ${pair.background}${over} (${pair.mode}, ${pair.level}): ${pair.ratio}:1 < ${pair.floor}:1`);
+	}
 	for (const problem of result.problems) console.error(`  ${problem}`);
-	exit(1);
+	forwardVerifier();
+	if (failedVerifier) console.error(`  design_tokens.verify \`${failedVerifier.command}\` exited ${failedVerifier.code}.`);
+	process.exitCode = 1;
 };
 const designTokensImport = async (args) => {
 	const from = parseFlag(args, "from");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lemoncode/lemony",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Lemony — a Harness for AI Coding. Vendor package: installer, agent role catalog, generic skill catalog, hooks, and templates for a Spec-Driven Development workflow.",
   "type": "module",
   "private": false,