@mjasnikovs/pi-task 0.40.50 → 0.41.0

package/dist/task/timings.js

@@ -36,3 +36,24 @@ export function formatTimings(entries) {
     lines.push(`${'total'.padEnd(TOP_LABEL_WIDTH)}${formatMs(total).padStart(MS_COLUMN_WIDTH)}`);
     return lines.join('\n');
 }
+/** Heading of one attempt's block inside the `## phase timings` section. */
+const ATTEMPT_HEADING_RE = /^attempt (\d+)$/gm;
+/**
+ * The `## phase timings` body once this attempt's phases are added to it.
+ *
+ * A run re-entered for an autofix resumes at `phase: done` and therefore runs no
+ * phases at all, so rendering only what IT timed wrote an empty block over the
+ * five phases the first attempt measured — the timings vanished for exactly the
+ * tasks that took longest. Each attempt gets its own labelled block instead, and
+ * an unlabelled body written before this grammar is adopted as attempt 1 rather
+ * than discarded.
+ */
+export function mergeTimings(prev, next) {
+    const before = (prev ?? '').trim();
+    if (before.length === 0)
+        return `attempt 1\n\n${formatTimings(next)}`;
+    const seen = [...before.matchAll(ATTEMPT_HEADING_RE)];
+    const body = seen.length === 0 ? `attempt 1\n\n${before}` : before;
+    const last = seen.length === 0 ? 1 : parseInt(seen[seen.length - 1][1], 10);
+    return `${body}\n\nattempt ${last + 1}\n\n${formatTimings(next)}`;
+}

package/dist/task/tree-hash.d.ts

@@ -0,0 +1,8 @@
+import type { GitRunner } from '../shared/git-runner.js';
+/**
+ * Snapshot the worktree content into a tree object. Returns null when git cannot
+ * build the tree (an unborn HEAD, a non-repo cwd, a missing binary).
+ */
+export declare function worktreeTreeHash(git: GitRunner): Promise<string | null>;
+/** The tree object a commit-ish points at — the committed twin of the above. */
+export declare function commitTreeHash(git: GitRunner, revision: string): Promise<string | null>;

package/dist/task/tree-hash.js

@@ -0,0 +1,55 @@
+/**
+ * tree-hash — the content identity of the working tree, computed without touching
+ * the real index or the working tree.
+ *
+ * `git add -A` against a THROWAWAY `GIT_INDEX_FILE` is the whole technique: the
+ * staged state a user (or a half-finished gate) left in the real index survives,
+ * nothing is stashed, and no file moves. Every consumer that asks "is this the
+ * same tree as before?" — the git-state guard's reconcile, the health baseline,
+ * and the evidence cache when it lands — must ask it the same way, or two answers
+ * disagree about the same tree.
+ *
+ * `.pi-tasks` is excluded because the gate machinery writes its own trail there
+ * DURING the work being hashed; including it would make every hash differ from
+ * every other one for reasons that have nothing to do with the code.
+ *
+ * Null means "git could not tell us", never "empty tree": a caller that treats an
+ * unreadable tree as a match would call two different trees identical.
+ */
+import * as fsp from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+/** Keep the gate machinery's own artifacts out of the hash. */
+const EXCLUDE_TASKS_DIR = ':(exclude).pi-tasks';
+function throwawayIndexPath() {
+    return path.join(os.tmpdir(), `pi-task-index-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+}
+/**
+ * Snapshot the worktree content into a tree object. Returns null when git cannot
+ * build the tree (an unborn HEAD, a non-repo cwd, a missing binary).
+ */
+export async function worktreeTreeHash(git) {
+    const tmpIndex = throwawayIndexPath();
+    const env = { GIT_INDEX_FILE: tmpIndex };
+    try {
+        const empty = await git(['read-tree', '--empty'], env);
+        if (empty.exitCode !== 0)
+            return null;
+        const add = await git(['add', '-A', '--', '.', EXCLUDE_TASKS_DIR], env);
+        if (add.exitCode !== 0)
+            return null;
+        const tree = await git(['write-tree'], env);
+        return tree.exitCode === 0 ? tree.stdout.trim() : null;
+    }
+    finally {
+        await fsp.rm(tmpIndex, { force: true }).catch(() => { });
+    }
+}
+/** The tree object a commit-ish points at — the committed twin of the above. */
+export async function commitTreeHash(git, revision) {
+    const r = await git(['rev-parse', `${revision}^{tree}`]);
+    if (r.exitCode !== 0)
+        return null;
+    const sha = r.stdout.trim();
+    return sha.length > 0 ? sha : null;
+}

package/dist/task/verify-reconcile.d.ts

@@ -35,7 +35,8 @@ export declare function findAbsenceConflicts(spec: string, ctx: AbsenceConflictC
  *  each conflict, why it is one, and the reconciliation to apply. */
 export declare function absenceProbeText(conflicts: AbsenceConflict[]): string;
 /** Parse SIBLING titles out of `buildScopeFence`'s listing, whose rows read
- *  `[N] head` and `[N] (THIS STEP) head`. The "(THIS STEP)" row is dropped — a
- *  task may legitimately assert about its own deliverables. '' and undefined
- *  (a bare /task with no plan) yield none. */
+ *  `[N] [done|this|later] head`. The `[this]` row is dropped — a task may
+ *  legitimately assert about its own deliverables; a `[done]` sibling is kept,
+ *  since its deliverable is in the tree and asserting its ABSENCE is the very
+ *  defect this feeds. '' and undefined (a bare /task with no plan) yield none. */
 export declare function siblingTitlesFromPlanContext(planContext: string | undefined): string[];

package/dist/task/verify-reconcile.js

@@ -184,20 +184,19 @@ export function absenceProbeText(conflicts) {
     ].join('\n');
 }
 /** Parse SIBLING titles out of `buildScopeFence`'s listing, whose rows read
- *  `[N] head` and `[N] (THIS STEP) head`. The "(THIS STEP)" row is dropped — a
- *  task may legitimately assert about its own deliverables. '' and undefined
- *  (a bare /task with no plan) yield none. */
+ *  `[N] [done|this|later] head`. The `[this]` row is dropped — a task may
+ *  legitimately assert about its own deliverables; a `[done]` sibling is kept,
+ *  since its deliverable is in the tree and asserting its ABSENCE is the very
+ *  defect this feeds. '' and undefined (a bare /task with no plan) yield none. */
 export function siblingTitlesFromPlanContext(planContext) {
     if (!planContext)
         return [];
     const out = [];
     for (const line of planContext.split('\n')) {
-        const m = /^\[\d+\](.*)$/.exec(line.trim());
-        if (!m)
+        const m = /^\[\d+\] \[(done|this|later)\] (.*)$/.exec(line.trim());
+        if (!m || m[1] === 'this')
             continue;
-        if (m[1].startsWith(' (THIS STEP)'))
-            continue;
-        const title = m[1].trim();
+        const title = m[2].trim();
         if (title.length > 0)
             out.push(title);
     }

package/dist/task/verify-resolution.d.ts

@@ -1,30 +1,50 @@
+import type { SpecContradiction } from './gate-resolution.js';
 /** The observe-only contract handed to the child. The same string as
  *  verify-work's VERIFY_TOOLS, so both passes are told the same thing. */
 declare const RESOLUTION_TOOLS = "read,bash";
 /** Which card the picker tints RECOMMENDED. */
 export type ResolutionRecommendation = 'autofix' | 'accept';
+/**
+ * The marker a judge emits INSTEAD of a recommendation when it finds the two
+ * gates contradict each other: the acceptance criterion can only be met by
+ * editing a path the same spec freezes.
+ *
+ * It exists because the judge was previously offered AUTOFIX or ACCEPT and
+ * nothing else, so a contradiction it had already diagnosed came back as
+ * "AUTOFIX" and the loop spent its whole budget re-deriving it (0053).
+ */
+export declare const BLOCKED_BY_FROZEN = "BLOCKED-BY-FROZEN";
 export interface ResolutionOutcome {
     /** The card to recommend. Defaults to 'autofix' (conservative: re-do, don't
      *  bless) when the research could not run or emitted no verdict. */
     recommend: ResolutionRecommendation;
     /** Short, human-readable rationale shown under the picker. Always set. */
     rationale: string;
+    /** Set only by the BLOCKED-BY-FROZEN marker: the criterion the spec's own
+     *  freeze makes unreachable. Outranks `recommend` in the gate's decision
+     *  table — no re-run and no picker answer can resolve a contradiction. */
+    contradiction?: SpecContradiction;
 }
 /**
  * Build the resolution research child's prompt. Pure, so the wording is
  * unit-tested without spawning pi. The contract it states: investigate the real
  * workspace and end on exactly one `VERIFY-RESOLUTION:` line.
  */
-export declare function buildResolutionPrompt(spec: string, failReason: string): string;
+export declare function buildResolutionPrompt(spec: string, failReason: string, qaRecord?: string): string;
 /**
- * Parse the child's recommendation out of the LAST
- * `VERIFY-RESOLUTION: AUTOFIX|ACCEPT` marker, case-insensitively. Last match
- * wins: the model reasons before concluding, and a bash command it runs can
- * print the token back, so an earlier occurrence is not the verdict.
+ * Parse the child's verdict out of the LAST `VERIFY-RESOLUTION:` marker,
+ * case-insensitively. Last match wins: the model reasons before concluding, and a
+ * bash command it runs can print the token back, so an earlier occurrence is not
+ * the verdict.
  *
  * No marker → AUTOFIX (re-do rather than bless), with a rationale saying the
  * research was inconclusive. A marker with no trailing sentence gets a stock
  * rationale, so `rationale` is never empty.
+ *
+ * A BLOCKED-BY-FROZEN marker yields a CONTRADICTION plus an `accept`
+ * recommendation, which is what the gate does with it once the contradiction is
+ * recorded as debt. A marker that names no path is not a usable contradiction and
+ * degrades to that recommendation alone.
  */
 export declare function parseResolutionVerdict(text: string): ResolutionOutcome;
 export declare const ACCEPT_VALUE = "accept";
@@ -62,6 +82,9 @@ export interface ResolutionDeps {
     signal?: AbortSignal;
     /** The composed spec the task was verified against. */
     spec: string;
+    /** The task's rendered Q&A, which resolves each constraint's provenance tag —
+     *  the same input the verify child got, so both weigh the spec alike. */
+    qaRecord?: string;
     /** The verify gate's FAIL reason (VerifyOutcome.reason). */
     failReason: string;
     /** Runs the research child and returns its assistant text. Injected so the

package/dist/task/verify-resolution.js

@@ -14,10 +14,9 @@
  * INVESTIGATE the real workspace: a genuine defect in the work (→ AUTOFIX), or
  * an artifact the gate misjudged (→ ACCEPT).
  *
- * The recommendation also decides whether a human is asked at all. In
- * task-gates.ts an AUTOFIX recommendation is applied UNATTENDED, bounded by
- * MAX_AUTO_AUTOFIX; the picker is reached on an ACCEPT recommendation, once that
- * bound is spent, or when the FAIL is UNOBSERVED or frozen-blocked.
+ * The recommendation is one input to gate-resolution.ts's decision table, which
+ * alone decides whether a human is asked. This module never overrides itself: an
+ * ACCEPT reached here stands.
  *
  * Tools: `read` + `bash`, the same string as verify-work's VERIFY_TOOLS. That is
  * a CONTRACT, not a capability — `bash` can write. gate-child.ts marks the
@@ -28,15 +27,28 @@
  * rather than blessing it.
  */
 import { USER_CANCELLED } from './child-runner.js';
+import { annotateConstraints, renderConstraintPolicy } from './constraint-policy.js';
+import { specValue } from './verify-work.js';
 /** The observe-only contract handed to the child. The same string as
  *  verify-work's VERIFY_TOOLS, so both passes are told the same thing. */
 const RESOLUTION_TOOLS = 'read,bash';
+/**
+ * The marker a judge emits INSTEAD of a recommendation when it finds the two
+ * gates contradict each other: the acceptance criterion can only be met by
+ * editing a path the same spec freezes.
+ *
+ * It exists because the judge was previously offered AUTOFIX or ACCEPT and
+ * nothing else, so a contradiction it had already diagnosed came back as
+ * "AUTOFIX" and the loop spent its whole budget re-deriving it (0053).
+ */
+export const BLOCKED_BY_FROZEN = 'BLOCKED-BY-FROZEN';
 /**
  * Build the resolution research child's prompt. Pure, so the wording is
  * unit-tested without spawning pi. The contract it states: investigate the real
  * workspace and end on exactly one `VERIFY-RESOLUTION:` line.
  */
-export function buildResolutionPrompt(spec, failReason) {
+export function buildResolutionPrompt(spec, failReason, qaRecord) {
+    const weights = annotateConstraints(specValue(spec, qaRecord).constraints);
     return [
         "A strict verification gate just FAILED an AI coding agent's task and the",
         'run paused. You are the reviewer who decides what to recommend next. The',
@@ -49,6 +61,13 @@ export function buildResolutionPrompt(spec, failReason) {
         'THE TASK SPEC (its ACCEPTANCE criteria and VERIFY block were the contract):',
         spec.trim(),
         '',
+        ...(weights === null ?
+            []
+            : [
+                "THE SPEC'S CONSTRAINTS, BY WEIGHT (rule 5 below says what each weight is worth):",
+                weights,
+                ''
+            ]),
         "THE GATE'S FAILURE REASON:",
         failReason.trim(),
         '',
@@ -86,25 +105,46 @@ export function buildResolutionPrompt(spec, failReason) {
         '   when you run it — that is AUTOFIX. When you cannot positively confirm the',
         '   artifact works, recommend AUTOFIX: re-doing the work is the safe default;',
         '   blessing broken work is the failure mode this whole gate exists to stop.',
+        '4. If the ONLY edit that could satisfy the failing criterion is to a file the',
+        "   spec's CONSTRAINTS forbid this task from modifying, neither verdict above",
+        '   is true: a re-run happens under the same freeze and cannot converge. Report',
+        '   the contradiction instead, naming the frozen path and the criterion.',
+        // The SAME policy the verify child was held to (constraint-policy.ts). Two
+        // children reading one spec must not weigh its constraints differently —
+        // that disagreement is what made a grill-invented constraint unwaivable.
+        ...renderConstraintPolicy('5.'),
         '',
         'When done, output EXACTLY ONE of these as the final line:',
         '  VERIFY-RESOLUTION: AUTOFIX <one sentence why the work must be re-done>',
         '  VERIFY-RESOLUTION: ACCEPT <one sentence why the artifact is good as-is>',
+        `  VERIFY-RESOLUTION: ${BLOCKED_BY_FROZEN} <frozen path> — <the criterion it blocks>`,
         'Output the verdict line verbatim — it is parsed mechanically.'
     ].join('\n');
 }
 /**
- * Parse the child's recommendation out of the LAST
- * `VERIFY-RESOLUTION: AUTOFIX|ACCEPT` marker, case-insensitively. Last match
- * wins: the model reasons before concluding, and a bash command it runs can
- * print the token back, so an earlier occurrence is not the verdict.
+ * The path/criterion separator the marker's contract states. An em dash is what
+ * the prompt shows; a model that retypes it as an en dash or a spaced hyphen
+ * means the same thing, and losing a contradiction over a dash costs the whole
+ * autofix budget.
+ */
+const CONTRADICTION_SEP = /\s+[—–]\s+|\s+-{1,2}\s+/;
+/**
+ * Parse the child's verdict out of the LAST `VERIFY-RESOLUTION:` marker,
+ * case-insensitively. Last match wins: the model reasons before concluding, and a
+ * bash command it runs can print the token back, so an earlier occurrence is not
+ * the verdict.
  *
  * No marker → AUTOFIX (re-do rather than bless), with a rationale saying the
  * research was inconclusive. A marker with no trailing sentence gets a stock
  * rationale, so `rationale` is never empty.
+ *
+ * A BLOCKED-BY-FROZEN marker yields a CONTRADICTION plus an `accept`
+ * recommendation, which is what the gate does with it once the contradiction is
+ * recorded as debt. A marker that names no path is not a usable contradiction and
+ * degrades to that recommendation alone.
  */
 export function parseResolutionVerdict(text) {
-    const re = /VERIFY-RESOLUTION:\s*(AUTOFIX|ACCEPT)\b[ \t]*(.*)/gi;
+    const re = new RegExp(`VERIFY-RESOLUTION:\\s*(AUTOFIX|ACCEPT|${BLOCKED_BY_FROZEN})\\b[ \\t]*(.*)`, 'gi');
     let last = null;
     for (let m = re.exec(text); m !== null; m = re.exec(text))
         last = m;
@@ -114,11 +154,28 @@ export function parseResolutionVerdict(text) {
             rationale: 'research inconclusive — defaulting to re-doing the work'
         };
     }
-    const recommend = last[1].toUpperCase() === 'ACCEPT' ? 'accept' : 'autofix';
-    const rationale = last[2].trim()
+    const verdict = last[1].toUpperCase();
+    const tail = last[2].trim();
+    if (verdict === BLOCKED_BY_FROZEN)
+        return blockedVerdict(tail);
+    const recommend = verdict === 'ACCEPT' ? 'accept' : 'autofix';
+    const rationale = tail
         || (recommend === 'accept' ? 'artifact judged acceptable' : 'work judged to need fixing');
     return { recommend, rationale };
 }
+function blockedVerdict(tail) {
+    const sep = CONTRADICTION_SEP.exec(tail);
+    const frozenPath = (sep ? tail.slice(0, sep.index) : (tail.split(/\s+/)[0] ?? '')).trim();
+    const criterion = sep ? tail.slice(sep.index + sep[0].length).trim() : '';
+    const rationale = frozenPath.length > 0 ?
+        `blocked by spec-frozen \`${frozenPath}\`${criterion ? `: ${criterion}` : ''}`
+        : 'judged blocked by a spec-frozen path, but the marker named none';
+    return {
+        recommend: 'accept',
+        rationale,
+        ...(frozenPath.length > 0 ? { contradiction: { criterion, frozenPath } } : {})
+    };
+}
 // ─── Picker plumbing ─────────────────────────────────────────────────────────
 //
 // These pure helpers shape the boxed two-choice picker (task-gates.ts
@@ -179,7 +236,7 @@ export function classifyResolutionAnswer(answer) {
 export async function researchResolution(deps) {
     let text;
     try {
-        text = await deps.runChild(RESOLUTION_TOOLS, buildResolutionPrompt(deps.spec, deps.failReason), deps.signal);
+        text = await deps.runChild(RESOLUTION_TOOLS, buildResolutionPrompt(deps.spec, deps.failReason, deps.qaRecord), deps.signal);
     }
     catch (err) {
         if (err instanceof Error && err.message === USER_CANCELLED)

package/dist/task/verify-work.d.ts

@@ -1,4 +1,8 @@
+import { type EmittedNote } from './env-notes.js';
 import { type CrossTaskDeletion } from './task-provenance.js';
+import { type HealthBaseline, type HealthSignal } from './health-baseline.js';
+import { type Spec } from './spec-model.js';
+import { type SuppressionHit } from './suppression-probe.js';
 /**
  * The verification child gets exactly two tools: `read` and `bash`.
  *
@@ -14,19 +18,43 @@ import { type CrossTaskDeletion } from './task-provenance.js';
  *    mutated tree. The enforce pass, whose job IS editing, runs `read,edit`.
  */
 declare const VERIFY_TOOLS = "read,bash";
-export interface VerifyOutcome {
-    /** true → the work verified (or verification disabled / nothing to verify).
-     *  false → the child reported the work does NOT satisfy its spec, or the pass
-     *  could not run / produced no verdict. */
-    ok: boolean;
-    /** Short, human-readable reason. Always set when ok === false; on the pass
-     *  path set to the no-op cause ('disabled', 'no spec to verify'). */
+/**
+ * The work verified, or there was nothing to verify.
+ *
+ * The FAIL-only fields are declared `?: undefined` rather than omitted: a pass may
+ * not carry them (`{ok: true, failClass: …}` is still a compile error), but a
+ * caller holding the bare union can still READ them without narrowing first, which
+ * is how every consumer asks "was this unobserved?" in one expression.
+ */
+export interface VerifyPass {
+    ok: true;
+    /** The NO-OP cause ('disabled', 'no spec to verify'). Absent on a genuine
+     *  pass, which is the only signal the enforce pass may edit against. */
     reason?: string;
-    /** True when the FAIL is specifically an UNOBSERVED outcome (rule 5c): a
-     *  spec-required behavioral check could not run because its tooling is absent.
-     *  The gate routes this straight to the human picker instead of an unattended
-     *  AUTOFIX re-run, which cannot provision a missing tool. Only meaningful when
-     *  ok === false. */
+    failClass?: undefined;
+    unobserved?: undefined;
+    crossTaskDeletions?: undefined;
+    inheritedHealth?: string;
+    probes?: ProbeFindings;
+}
+/**
+ * The work did NOT satisfy its spec, or the pass could not run.
+ *
+ * `failClass` is REQUIRED. Optional, it travelled as the prefix of `reason` and
+ * every downstream classifier recovered it by re-typing that literal, so a reword
+ * of the mint disarmed them with no compile error — and one site (the
+ * mutation-guard FAIL) simply never set it, which left the decision table with no
+ * class to route on. `VERIFY_FAIL_PREFIX` owns the display strings so mint and
+ * match cannot drift.
+ */
+export interface VerifyFail {
+    ok: false;
+    failClass: VerifyFailClass;
+    /** Short, human-readable reason, minted under the class's prefix. */
+    reason: string;
+    /** Rule 5c: a spec-required behavioral check could not run because its tooling
+     *  is absent. Sets the AUTOFIX budget to zero on any class — an unattended
+     *  re-run cannot provision a missing tool. */
     unobserved?: boolean;
     /** The deterministic cross-task deletion findings (see task-provenance.ts) that
      *  were live when this verdict was produced: sibling tasks' committed
@@ -34,17 +62,20 @@ export interface VerifyOutcome {
      *  can record each as a durable debt if the user ACCEPTs anyway — the deletion
      *  then ships in the next commit and the final gate must re-check it. */
     crossTaskDeletions?: CrossTaskDeletion[];
-    /**
-     * WHICH KIND of FAIL this is, as data. Only meaningful when ok === false.
-     *
-     * Without it the class travels only as the PREFIX of `reason`, and every
-     * downstream classifier has to recover it by re-typing that literal — a
-     * reword of the mint would then disarm them with no compile error.
-     * `VERIFY_FAIL_PREFIX` owns the strings so mint and match cannot drift, and
-     * `verifyFailClass` prefers this field over the prefix.
-     */
-    failClass?: VerifyFailClass;
+    inheritedHealth?: string;
+    /** What the deterministic probes found for THIS verdict, carried out so an
+     *  AUTOFIX re-run is told what the gate already knows (see fix-context.ts)
+     *  instead of re-deriving it from the one-line reason. */
+    probes?: ProbeFindings;
 }
+/**
+ * `inheritedHealth` is declared on BOTH halves: the repo's own static checks that
+ * were already failing the same way before this task ran (health-baseline.ts).
+ * A task can verify perfectly in a repo that arrived red, so a PASS carries it
+ * too — dropping it on the pass path is where a sibling's defect disappears until
+ * the run-end gate rediscovers it with nobody's name on it.
+ */
+export type VerifyOutcome = VerifyPass | VerifyFail;
 /**
  * The kinds of verify FAIL. `VERIFY_FAIL_PREFIX` below is a
  * `Record<VerifyFailClass, string>`, so a new member here is a compile error
@@ -72,18 +103,18 @@ export declare const VERIFY_FAIL_PREFIX: Record<VerifyFailClass, string>;
  * mints its `static checks:` line through a different path entirely. This is the
  * only place in src/ that tests a reason against a prefix.
  */
-export declare function verifyFailClass(o: Pick<VerifyOutcome, 'failClass' | 'reason'>): VerifyFailClass | undefined;
+export declare function verifyFailClass(o: {
+    failClass?: VerifyFailClass;
+    reason?: string;
+}): VerifyFailClass | undefined;
 /** The class a recorded reason STRING belongs to, by its minted prefix. */
 export declare function failClassOfReason(reason: string): VerifyFailClass | undefined;
 /** Does this class name a deterministic whole-repo static check, at either altitude? */
 export declare function isStaticClass(cls: VerifyFailClass | undefined): boolean;
 /**
- * Slice the delivered spec (GOAL / CONSTRAINTS / ACCEPTANCE / VERIFY) out of a
- * task file body. The compose and critique phases write the section named `spec`,
- * so the composed spec lives under `## spec` and runs to the next line matching
- * `## ` plus non-space (`## phase timings`); a `### ` subheading stays inside.
- * Returns null when there is no spec section or it is blank (a task that never
- * reached compose), which the caller treats as a pass — nothing to verify against.
+ * The delivered spec's TEXT, for the children that must read its prose verbatim.
+ * The slicing itself lives in spec-model.ts beside the parser, so "the spec
+ * section" is one definition rather than one per consumer.
  */
 export declare function extractSpecForVerification(taskBody: string): string | null;
 /**
@@ -115,6 +146,7 @@ export declare function extractSpecForVerification(taskBody: string): string | n
  * 'VerifyProbes'").
  */
 export interface ProbeRaw {
+    evidence: string[];
     substitution: string[];
     prohibition: string[];
     crossTaskDeletion: CrossTaskDeletion[];
@@ -124,15 +156,19 @@ export interface ProbeRaw {
     scriptEscape: string[];
     runnerGlob: string[];
     testAssembly: string[];
+    repoHealth: string[];
+    suppressionWidening: SuppressionHit[];
 }
 /** Stable identity of one probe channel: table row ↔ findings-bag key. */
 export type ProbeKey = keyof ProbeRaw;
 /**
- * The channels a CALLER binds — every key but `skipEscape`, which is pure text
- * analysis of `deps.spec` and is sourced inside its own table row, so it is never
- * absent and never bound from outside.
+ * The channels a CALLER binds. Two keys are not among them: `skipEscape`, which is
+ * pure text analysis of `deps.spec` and is sourced inside its own table row, and
+ * `repoHealth`, whose findings are the classified DELTA of a check
+ * `runWorkVerification` has already run — only that function holds both the
+ * baseline and the result, so only it can source the row.
  */
-export type BoundProbeKey = Exclude<ProbeKey, 'skipEscape'>;
+export type BoundProbeKey = Exclude<ProbeKey, 'skipEscape' | 'repoHealth'>;
 /**
  * The bound probes: one optional thunk per channel, typed to that channel's raw
  * shape. Built in ONE place (gate-deps' `buildVerifyProbes`); an absent key means
@@ -150,6 +186,12 @@ export type ProbeFindings = Partial<Record<ProbeKey, string[]>>;
  * checked against the table rather than against a hand-kept list.
  */
 export declare const BOUND_PROBE_KEYS: readonly BoundProbeKey[];
+/**
+ * The spec as a VALUE, with each constraint's `[from:]` tag resolved against the
+ * task's own Q&A record. Shared by the verify prompt and the resolution judge, so
+ * one constraint cannot carry two weights.
+ */
+export declare function specValue(spec: string, qaRecord?: string): Spec;
 /**
  * Build the verification child's prompt. Kept pure so the wording is unit-tested
  * without spawning pi. The contract: run the spec's own verification in the real
@@ -162,8 +204,14 @@ export declare const BOUND_PROBE_KEYS: readonly BoundProbeKey[];
 export declare function buildVerifyPrompt(spec: string, findings?: ProbeFindings, context?: {
     /** Environment facts earlier gate children discovered — see env-notes.ts. */
     envNotes?: string;
+    /** This run's id: the notes it recorded lead, older runs' follow. */
+    envRunId?: string;
     /** Cross-slice interface facts the design pins — see contracts.ts. */
     contracts?: string;
+    /** The task file's rendered Q&A, which is what resolves a constraint's
+     *  `[from: Q<n>]` tag to the kind of answer that produced it. Absent ⇒
+     *  every tagged constraint reads as `derived`, which is advisory. */
+    qaRecord?: string;
 }): string;
 /**
  * Parse the child's verdict out of the LAST `WORK-VERIFIED: PASS|FAIL|UNOBSERVED`
@@ -206,7 +254,15 @@ export interface VerificationDeps {
     repoHealth?: () => Promise<{
         ok: boolean;
         reason: string;
-    }>;
+    } & HealthSignal>;
+    /**
+     * What those same checks said BEFORE this task ran (see health-baseline.ts).
+     * Consulted only when `repoHealth` comes back red, and it is what decides
+     * whose defect that is: a check failing the same way before is `pre-existing`
+     * and becomes a probe row, not a FAIL. ABSENT, or null, → every red check is
+     * this task's, which is the behavior that shipped before the baseline existed.
+     */
+    healthBaseline?: () => Promise<HealthBaseline | null>;
     /**
      * Progress hook for the DETERMINISTIC stage — the repo-health run plus the
      * `probes` below, all of which run BEFORE the child (and therefore before the
@@ -245,7 +301,10 @@ export interface VerificationDeps {
      */
     envNotes?: {
         read: () => Promise<string>;
-        append: (notes: string[]) => Promise<void>;
+        append: (notes: readonly EmittedNote[]) => Promise<void>;
+        /** The run these notes belong to, so the child's prompt can lead with the
+         *  facts measured against the tree it is standing in. */
+        runId?: string;
     };
     /**
      * Per-run cross-slice contract registry (see contracts.ts): `read` supplies the
@@ -255,6 +314,10 @@ export interface VerificationDeps {
      * `/task` runs, or a design pinning no shared boundary).
      */
     contracts?: () => Promise<string>;
+    /** The task file's `## grill Q&A` text, which resolves each constraint's
+     *  provenance tag (see `specValue`). ABSENT ⇒ every tagged constraint is
+     *  advisory, which is the safe reading of a provenance nobody can confirm. */
+    qaRecord?: string;
 }
 /**
  * Run the verification pass for one task. `repoHealth` runs first and can FAIL on