@outcomeeng/spx 0.6.11 → 0.6.12

package/dist/cli.js

@@ -1787,6 +1787,7 @@ import {
   mkdir as nodeMkdir,
   open as nodeOpen,
   readdir as nodeReaddir,
+  rename as nodeRename,
   rm as nodeRm
 } from "fs/promises";
 import { dirname as dirname2, join as join2 } from "path";
@@ -1880,6 +1881,9 @@ var defaultFileSystem = {
   },
   readdir: nodeReaddir,
   lstat: nodeLstat,
+  rename: async (from, to) => {
+    await nodeRename(from, to);
+  },
   rm: async (path7, options) => {
     await nodeRm(path7, options);
   }
@@ -1972,8 +1976,8 @@ function formatRunTimestamp(date) {
   );
   return `${year}-${month}-${day}${RUN_TIMESTAMP_SEPARATOR}${hours}-${minutes}-${seconds}-${milliseconds}`;
 }
-function generateRunId(randomBytes2 = nodeRandomBytes) {
-  return randomBytes2(STATE_STORE_RUN_TOKEN.ID_BYTES).toString(HEX_ENCODING);
+function generateRunId(randomBytes3 = nodeRandomBytes) {
+  return randomBytes3(STATE_STORE_RUN_TOKEN.ID_BYTES).toString(HEX_ENCODING);
 }
 function createStateStoreRunToken(options) {
   const startedAt = formatRunTimestamp(options.date);
@@ -1995,7 +1999,7 @@ async function createJsonlRunFile(scopeDir, domainName, options = {}) {
   if (!domainRunsDir.ok) return domainRunsDir;
   const maxAttempts = options.maxAttempts ?? RUN_FILE_CREATE_ATTEMPTS;
   const startedDate = (options.now ?? (() => /* @__PURE__ */ new Date()))();
-  const randomBytes2 = options.randomBytes ?? nodeRandomBytes;
+  const randomBytes3 = options.randomBytes ?? nodeRandomBytes;
   try {
     await fs8.mkdir(domainRunsDir.value, { recursive: true });
   } catch (error) {
@@ -2005,7 +2009,7 @@ async function createJsonlRunFile(scopeDir, domainName, options = {}) {
     };
   }
   for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-    const token = createStateStoreRunToken({ date: startedDate, randomBytes: randomBytes2 });
+    const token = createStateStoreRunToken({ date: startedDate, randomBytes: randomBytes3 });
     const name = runFileName(token.runToken);
     const path7 = join2(domainRunsDir.value, name);
     try {
@@ -2528,8 +2532,8 @@ import path2 from "path";
 // src/lib/atomic-file-write.ts
 var TEMP_TOKEN_BYTES = 8;
 var TEMP_SUFFIX = ".tmp";
-function atomicWriteTempPath(targetPath, randomBytes2) {
-  const token = randomBytes2(TEMP_TOKEN_BYTES).toString("hex");
+function atomicWriteTempPath(targetPath, randomBytes3) {
+  const token = randomBytes3(TEMP_TOKEN_BYTES).toString("hex");
   return `${targetPath}.${token}${TEMP_SUFFIX}`;
 }
 async function writeFileAtomic(targetPath, content, options) {
@@ -3223,37 +3227,37 @@ function validateAgents(raw) {
   }
   return { ok: true, value: agents };
 }
-function validateAgentConfig(path7, raw, defaults5) {
+function validateAgentConfig(path7, raw, defaults6) {
   if (!isRecord2(raw)) return { ok: false, error: `${path7} must be an object` };
   const unknown = rejectUnknownFields(path7, raw, HARNESS_ENVIRONMENT_AGENT_CONFIG_ALLOWED_FIELDS);
   if (!unknown.ok) return unknown;
   const enabledRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.ENABLED];
-  const enabled = enabledRaw === void 0 ? { ok: true, value: defaults5.enabled } : validateBoolean(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.ENABLED}`, enabledRaw);
+  const enabled = enabledRaw === void 0 ? { ok: true, value: defaults6.enabled } : validateBoolean(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.ENABLED}`, enabledRaw);
   if (!enabled.ok) return enabled;
   const hooksRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.HOOKS];
-  const hooks = hooksRaw === void 0 ? { ok: true, value: defaults5.hooks } : validateAgentHooks(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.HOOKS}`, hooksRaw, defaults5.hooks);
+  const hooks = hooksRaw === void 0 ? { ok: true, value: defaults6.hooks } : validateAgentHooks(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.HOOKS}`, hooksRaw, defaults6.hooks);
   if (!hooks.ok) return hooks;
   return { ok: true, value: { enabled: enabled.value, hooks: hooks.value } };
 }
-function validateAgentHooks(path7, raw, defaults5) {
+function validateAgentHooks(path7, raw, defaults6) {
   if (!isRecord2(raw)) return { ok: false, error: `${path7} must be an object` };
   const unknown = rejectUnknownFields(path7, raw, HARNESS_ENVIRONMENT_AGENT_HOOKS_ALLOWED_FIELDS);
   if (!unknown.ok) return unknown;
   const sessionStartRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.SESSION_START];
-  const sessionStart = sessionStartRaw === void 0 ? { ok: true, value: defaults5.sessionStart } : validateSessionStartHooks(
+  const sessionStart = sessionStartRaw === void 0 ? { ok: true, value: defaults6.sessionStart } : validateSessionStartHooks(
     `${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.SESSION_START}`,
     sessionStartRaw,
-    defaults5.sessionStart
+    defaults6.sessionStart
   );
   if (!sessionStart.ok) return sessionStart;
   return { ok: true, value: { sessionStart: sessionStart.value } };
 }
-function validateSessionStartHooks(path7, raw, defaults5) {
+function validateSessionStartHooks(path7, raw, defaults6) {
   if (!isRecord2(raw)) return { ok: false, error: `${path7} must be an object` };
   const unknown = rejectUnknownFields(path7, raw, HARNESS_ENVIRONMENT_SESSION_START_HOOKS_ALLOWED_FIELDS);
   if (!unknown.ok) return unknown;
   const compactStdoutRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.COMPACT_STDOUT];
-  const compactStdout = compactStdoutRaw === void 0 ? { ok: true, value: defaults5.compactStdout } : validateBoolean(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.COMPACT_STDOUT}`, compactStdoutRaw);
+  const compactStdout = compactStdoutRaw === void 0 ? { ok: true, value: defaults6.compactStdout } : validateBoolean(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.COMPACT_STDOUT}`, compactStdoutRaw);
   if (!compactStdout.ok) return compactStdout;
   return { ok: true, value: { compactStdout: compactStdout.value } };
 }
@@ -3326,8 +3330,8 @@ function validatePluginBootstrap(raw) {
     }
   };
 }
-function validateEntryArray(path7, raw, validateEntry, defaults5) {
-  if (raw === void 0) return { ok: true, value: defaults5 };
+function validateEntryArray(path7, raw, validateEntry, defaults6) {
+  if (raw === void 0) return { ok: true, value: defaults6 };
   if (!Array.isArray(raw)) return { ok: false, error: `${path7} must be an array` };
   const entries = [];
   for (const [index, entry] of raw.entries()) {
@@ -3618,6 +3622,36 @@ var diagnoseConfigDescriptor = {
   validate: validate2
 };
 
+// src/lib/agent-run-journal/config.ts
+var RUNTIME_SECTION = "runtime";
+var RUNTIME_CONFIG_FIELDS = {
+  EVENT_NAMESPACE: "eventNamespace"
+};
+var RUNTIME_EVENT_NAMESPACE_DEFAULT = "sh.spx";
+var defaults2 = { eventNamespace: RUNTIME_EVENT_NAMESPACE_DEFAULT };
+function validate3(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return { ok: false, error: `${RUNTIME_SECTION} section must be an object` };
+  }
+  const candidate = value;
+  const raw = candidate[RUNTIME_CONFIG_FIELDS.EVENT_NAMESPACE];
+  if (raw === void 0) {
+    return { ok: true, value: { eventNamespace: RUNTIME_EVENT_NAMESPACE_DEFAULT } };
+  }
+  if (typeof raw !== "string" || raw.trim().length === 0) {
+    return {
+      ok: false,
+      error: `${RUNTIME_SECTION}.${RUNTIME_CONFIG_FIELDS.EVENT_NAMESPACE} must be a non-empty string`
+    };
+  }
+  return { ok: true, value: { eventNamespace: raw } };
+}
+var runtimeConfigDescriptor = {
+  section: RUNTIME_SECTION,
+  defaults: defaults2,
+  validate: validate3
+};
+
 // src/lib/file-inclusion/adapters/eslint.ts
 function eslintAdapter(scope2, config) {
   return scope2.excluded.flatMap((entry) => [config.ignoreFlag, entry.path]);
@@ -3678,7 +3712,7 @@ var DEFAULT_SCOPE_CONFIG = {};
 var DEFAULT_TOOLS_CONFIG = Object.fromEntries(
   Object.entries(TOOL_DEFAULT_FLAGS).map(([name, flag]) => [name, { ignoreFlag: flag }])
 );
-var defaults2 = {
+var defaults3 = {
   scope: DEFAULT_SCOPE_CONFIG,
   tools: DEFAULT_TOOLS_CONFIG
 };
@@ -3750,7 +3784,7 @@ function validateTools(raw) {
   }
   return { ok: true, value: tools };
 }
-function validate3(value) {
+function validate4(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { ok: false, error: `${FILE_INCLUSION_SECTION} section must be an object` };
   }
@@ -3777,8 +3811,8 @@ function validate3(value) {
 }
 var fileInclusionConfigDescriptor = {
   section: FILE_INCLUSION_SECTION,
-  defaults: defaults2,
-  validate: validate3
+  defaults: defaults3,
+  validate: validate4
 };
 
 // src/config/source-roots.ts
@@ -3801,7 +3835,7 @@ var PRECOMMIT_DEFAULTS = {
   sourceDirs: TEST_RELEVANT_SOURCE_ROOT_PREFIXES,
   testPattern: ".test.ts"
 };
-function validate4(value) {
+function validate5(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { ok: false, error: `${PRECOMMIT_SECTION} section must be an object` };
   }
@@ -3831,7 +3865,7 @@ function validate4(value) {
 var precommitConfigDescriptor = {
   section: PRECOMMIT_SECTION,
   defaults: PRECOMMIT_DEFAULTS,
-  validate: validate4
+  validate: validate5
 };
 
 // src/lib/spec-tree/config.ts
@@ -4022,7 +4056,7 @@ function buildConfigFromKindNames(kindNames) {
   const entries = kindNames.map((kind) => [kind, KIND_REGISTRY[kind]]);
   return { kinds: Object.fromEntries(entries) };
 }
-function validate5(value) {
+function validate6(value) {
   if (typeof value !== "object" || value === null) {
     return { ok: false, error: `${SPEC_TREE_SECTION} section must be an object` };
   }
@@ -4121,7 +4155,7 @@ function validateKindDefinitionMap(kindEntries) {
 var specTreeConfigDescriptor = {
   section: SPEC_TREE_SECTION,
   defaults: buildDefaults(),
-  validate: validate5
+  validate: validate6
 };
 
 // src/config/primitives/path-filter.ts
@@ -4194,7 +4228,7 @@ var TESTING_CONFIG_FIELDS = {
   PASSING_SCOPE: "passingScope"
 };
 var DEFAULT_PASSING_SCOPE = resolveDefaultPassingScope();
-var defaults3 = {
+var defaults4 = {
   passingScope: DEFAULT_PASSING_SCOPE
 };
 function resolveDefaultPassingScope() {
@@ -4207,14 +4241,14 @@ function resolveDefaultPassingScope() {
   }
   return result.value;
 }
-function validate6(value) {
+function validate7(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { ok: false, error: `${TESTING_SECTION} section must be an object` };
   }
   const candidate = value;
   const passingScopeRaw = candidate[TESTING_CONFIG_FIELDS.PASSING_SCOPE];
   if (passingScopeRaw === void 0) {
-    return { ok: true, value: defaults3 };
+    return { ok: true, value: defaults4 };
   }
   const passingScopeResult = validatePathFilterConfig(
     passingScopeRaw,
@@ -4230,8 +4264,8 @@ function validate6(value) {
 }
 var testingConfigDescriptor = {
   section: TESTING_SECTION,
-  defaults: defaults3,
-  validate: validate6
+  defaults: defaults4,
+  validate: validate7
 };
 
 // src/validation/literal/config.ts
@@ -4295,7 +4329,7 @@ var LITERAL_DEFAULTS = {
 function isNonNegativeInteger(value) {
   return typeof value === "number" && Number.isInteger(value) && value >= 0;
 }
-function validate7(value) {
+function validate8(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { ok: false, error: `${LITERAL_SECTION} section must be an object` };
   }
@@ -4359,7 +4393,7 @@ function isStringArray(value) {
 var literalConfigDescriptor = {
   section: LITERAL_SECTION,
   defaults: LITERAL_DEFAULTS,
-  validate: validate7
+  validate: validate8
 };
 
 // src/validation/config/descriptor.ts
@@ -4378,7 +4412,7 @@ var VALIDATION_PATH_TOOL_SUBSECTIONS = {
   LITERAL: "literal",
   FORMATTING: "formatting"
 };
-var defaults4 = {
+var defaults5 = {
   paths: {},
   literal: {
     enabled: true,
@@ -4418,7 +4452,7 @@ function validateLiteral(raw) {
     };
   }
   const candidate = raw;
-  const enabledRaw = candidate[VALIDATION_ENABLED_FIELD] ?? defaults4.literal.enabled;
+  const enabledRaw = candidate[VALIDATION_ENABLED_FIELD] ?? defaults5.literal.enabled;
   if (typeof enabledRaw !== "boolean") {
     return {
       ok: false,
@@ -4443,7 +4477,7 @@ function validateKnip(raw) {
     };
   }
   const candidate = raw;
-  const enabledRaw = candidate[VALIDATION_ENABLED_FIELD] ?? defaults4.knip.enabled;
+  const enabledRaw = candidate[VALIDATION_ENABLED_FIELD] ?? defaults5.knip.enabled;
   if (typeof enabledRaw !== "boolean") {
     return {
       ok: false,
@@ -4452,7 +4486,7 @@ function validateKnip(raw) {
   }
   return { ok: true, value: { enabled: enabledRaw } };
 }
-function validate8(value) {
+function validate9(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { ok: false, error: `${VALIDATION_SECTION} section must be an object` };
   }
@@ -4470,8 +4504,8 @@ function validate8(value) {
 }
 var validationConfigDescriptor = {
   section: VALIDATION_SECTION,
-  defaults: defaults4,
-  validate: validate8
+  defaults: defaults5,
+  validate: validate9
 };
 
 // src/config/registry.ts
@@ -4482,15 +4516,16 @@ var productionRegistry = [
   fileInclusionConfigDescriptor,
   precommitConfigDescriptor,
   harnessEnvironmentConfigDescriptor,
-  diagnoseConfigDescriptor
+  diagnoseConfigDescriptor,
+  runtimeConfigDescriptor
 ];
 
 // src/config/descriptor-digest.ts
 import { createHash as createHash3 } from "crypto";
 var DEFAULT_DESCRIPTOR_PATH = "descriptor section";
-var SHA256_ALGORITHM2 = "sha256";
+var DESCRIPTOR_DIGEST_SHA256_ALGORITHM = "sha256";
 var UTF8_ENCODING2 = "utf8";
-var HEX_ENCODING2 = "hex";
+var DESCRIPTOR_DIGEST_HEX_ENCODING = "hex";
 function canonicalDescriptorJson(value, path7 = DEFAULT_DESCRIPTOR_PATH) {
   const normalized = normalizeDescriptorJsonValue(value, path7, /* @__PURE__ */ new WeakSet());
   if (!normalized.ok) return normalized;
@@ -4499,7 +4534,7 @@ function canonicalDescriptorJson(value, path7 = DEFAULT_DESCRIPTOR_PATH) {
 function digestDescriptorSection(value, path7 = DEFAULT_DESCRIPTOR_PATH) {
   const canonical = canonicalDescriptorJson(value, path7);
   if (!canonical.ok) return canonical;
-  const sha256 = createHash3(SHA256_ALGORITHM2).update(Buffer.from(canonical.value, UTF8_ENCODING2)).digest(HEX_ENCODING2);
+  const sha256 = createHash3(DESCRIPTOR_DIGEST_SHA256_ALGORITHM).update(Buffer.from(canonical.value, UTF8_ENCODING2)).digest(DESCRIPTOR_DIGEST_HEX_ENCODING);
   return {
     ok: true,
     value: {
@@ -6242,7 +6277,7 @@ import {
   mkdir as nodeMkdir2,
   readFile as nodeReadFile,
   readlink as nodeReadlink,
-  rename as nodeRename,
+  rename as nodeRename2,
   rm as nodeRm2,
   symlink as nodeSymlink,
   writeFile as nodeWriteFile
@@ -6254,7 +6289,7 @@ var defaultOccupancyFileSystem = {
   writeFile: async (path7, data) => {
     await nodeWriteFile(path7, data);
   },
-  rename: nodeRename,
+  rename: nodeRename2,
   symlink: nodeSymlink,
   readlink: nodeReadlink,
   readFile: nodeReadFile,
@@ -7145,9 +7180,9 @@ var JOURNAL_RUN_STATE_INCOMPLETE_REASON = {
 };
 var JOURNAL_RUN_EVENT = {
   SOURCE: "/spx/journal",
-  STARTED_TYPE: "com.outcomeeng.spx.journal.run.started",
-  PROGRESS_TYPE: "com.outcomeeng.spx.journal.run.progress",
-  COMPLETED_TYPE: "com.outcomeeng.spx.journal.run.completed"
+  STARTED_TYPE: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.journal.run.started`,
+  PROGRESS_TYPE: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.journal.run.progress`,
+  COMPLETED_TYPE: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.journal.run.completed`
 };
 var JOURNAL_RUN_STATE_FIELDS = {
   BRANCH_NAME: "branchName",
@@ -7166,13 +7201,18 @@ var JOURNAL_RUN_STATE_FIELDS = {
   STATUS: "status"
 };
 function foldJournalRunState(events, sealed) {
-  if (!sealed) return { ok: false, reason: JOURNAL_RUN_STATE_INCOMPLETE_REASON.UNSEALED };
+  if (!sealed) {
+    return { ok: false, reason: JOURNAL_RUN_STATE_INCOMPLETE_REASON.UNSEALED };
+  }
   let completed;
   for (const event of events) {
     if (event.type === JOURNAL_RUN_EVENT.COMPLETED_TYPE) completed = event;
   }
   if (completed === void 0) {
-    return { ok: false, reason: JOURNAL_RUN_STATE_INCOMPLETE_REASON.MISSING_STATE };
+    return {
+      ok: false,
+      reason: JOURNAL_RUN_STATE_INCOMPLETE_REASON.MISSING_STATE
+    };
   }
   const validated = validateJournalRunState(completed.data);
   if (!validated.ok) {
@@ -7185,13 +7225,17 @@ function foldJournalRunState(events, sealed) {
   return validated;
 }
 function isJournalRunStateStatus(value) {
-  return typeof value === "string" && Object.values(JOURNAL_RUN_STATE_STATUS).includes(value);
+  return typeof value === "string" && Object.values(JOURNAL_RUN_STATE_STATUS).includes(
+    value
+  );
 }
 function isJournalTargetKind(value) {
   return typeof value === "string" && Object.values(JOURNAL_TARGET_KIND).includes(value);
 }
 function validateJournalRunState(value) {
-  if (!isRecord5(value)) return { ok: false, error: "journal run state must be an object" };
+  if (!isRecord5(value)) {
+    return { ok: false, error: "journal run state must be an object" };
+  }
   const identity = readRunStateIdentity(value);
   if (!identity.ok) return identity;
   const body = readRunStateBody(value);
@@ -7203,9 +7247,15 @@ function readRunStateIdentity(value) {
   if (!branchName.ok) return branchName;
   const branchSlug = readString(value, JOURNAL_RUN_STATE_FIELDS.BRANCH_SLUG);
   if (!branchSlug.ok) return branchSlug;
-  const targetKind = readTargetKind(value, JOURNAL_RUN_STATE_FIELDS.TARGET_KIND);
+  const targetKind = readTargetKind(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.TARGET_KIND
+  );
   if (!targetKind.ok) return targetKind;
-  const pullRequestNumber = readOptionalNonNegativeInteger(value, JOURNAL_RUN_STATE_FIELDS.PULL_REQUEST_NUMBER);
+  const pullRequestNumber = readOptionalNonNegativeInteger(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.PULL_REQUEST_NUMBER
+  );
   if (!pullRequestNumber.ok) return pullRequestNumber;
   const headSha = readString(value, JOURNAL_RUN_STATE_FIELDS.HEAD_SHA);
   if (!headSha.ok) return headSha;
@@ -7227,9 +7277,15 @@ function readRunStateIdentity(value) {
   };
 }
 function readRunStateBody(value) {
-  const configDigest = readString(value, JOURNAL_RUN_STATE_FIELDS.CONFIG_DIGEST);
+  const configDigest = readString(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.CONFIG_DIGEST
+  );
   if (!configDigest.ok) return configDigest;
-  const participants = readStringArray(value, JOURNAL_RUN_STATE_FIELDS.PARTICIPANTS);
+  const participants = readStringArray(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.PARTICIPANTS
+  );
   if (!participants.ok) return participants;
   const scope2 = readPathFilter(value, JOURNAL_RUN_STATE_FIELDS.SCOPE);
   if (!scope2.ok) return scope2;
@@ -7237,7 +7293,10 @@ function readRunStateBody(value) {
   if (!startedAt.ok) return startedAt;
   const completedAt = readString(value, JOURNAL_RUN_STATE_FIELDS.COMPLETED_AT);
   if (!completedAt.ok) return completedAt;
-  const outputPaths = readStringArray(value, JOURNAL_RUN_STATE_FIELDS.OUTPUT_PATHS);
+  const outputPaths = readStringArray(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.OUTPUT_PATHS
+  );
   if (!outputPaths.ok) return outputPaths;
   const status = readStatus(value, JOURNAL_RUN_STATE_FIELDS.STATUS);
   if (!status.ok) return status;
@@ -7266,7 +7325,10 @@ function readOptionalString(value, field) {
 function readOptionalNonNegativeInteger(value, field) {
   const raw = value[field];
   if (raw === void 0) return { ok: true, value: void 0 };
-  return typeof raw === "number" && Number.isInteger(raw) && raw >= 0 ? { ok: true, value: raw } : { ok: false, error: `${field} must be a non-negative integer when present` };
+  return typeof raw === "number" && Number.isInteger(raw) && raw >= 0 ? { ok: true, value: raw } : {
+    ok: false,
+    error: `${field} must be a non-negative integer when present`
+  };
 }
 function readStringArray(value, field) {
   const raw = value[field];
@@ -7508,6 +7570,7 @@ function createJournal(backend, identity) {
 
 // src/lib/appendable-journal-store/index.ts
 var SEAL_MARKER_SUFFIX = ".sealed";
+var APPENDABLE_JOURNAL_SEAL_MARKER_CONTENT = "";
 var LINE_SEPARATOR3 = "\n";
 function appendableJournalSealMarkerPath(runFilePath) {
   return `${runFilePath}${SEAL_MARKER_SUFFIX}`;
@@ -7547,7 +7610,7 @@ function createAppendableJournalStore(options) {
     readAll,
     async seal() {
       await fs8.mkdir(dirname5(sealMarkerPath), { recursive: true });
-      await fs8.writeFile(sealMarkerPath, "");
+      await fs8.writeFile(sealMarkerPath, APPENDABLE_JOURNAL_SEAL_MARKER_CONTENT);
     },
     async isSealed() {
       return await readFileOrUndefined(fs8, sealMarkerPath) !== void 0;
@@ -8004,6 +8067,20 @@ async function sealJournalRun(ref, options = {}) {
     return { ok: false, error: `${JOURNAL_RUNTIME_ERROR.SEAL_FAILED}: ${toMessage(error)}` };
   }
 }
+async function isJournalRunSealed(ref, options = {}) {
+  const runFilePath = bindRunFilePath(ref);
+  if (!runFilePath.ok) return runFilePath;
+  const fs8 = options.fs ?? defaultFileSystem;
+  if (!await runFileExists(fs8, runFilePath.value)) {
+    return { ok: false, error: JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND };
+  }
+  const store = createAppendableJournalStore({ runFilePath: runFilePath.value, fs: fs8 });
+  try {
+    return { ok: true, value: await store.isSealed() };
+  } catch (error) {
+    return { ok: false, error: `${JOURNAL_RUNTIME_ERROR.READ_FAILED}: ${toMessage(error)}` };
+  }
+}
 async function renderJournalRun(ref, projection, options = {}) {
   const bound = await bindJournal(ref, options.fs);
   if (!bound.ok) return bound;
@@ -11683,8 +11760,8 @@ var PRODUCT_INPUT_DIGEST_FIELDS = {
   DESCRIPTOR_ID: "descriptorId",
   DIGEST: "digest"
 };
-var SHA256_ALGORITHM3 = "sha256";
-var HEX_ENCODING3 = "hex";
+var SHA256_ALGORITHM2 = "sha256";
+var HEX_ENCODING2 = "hex";
 var SEGMENT_SEPARATOR = "-";
 var defaultFileSystem2 = defaultFileSystem;
 function formatTestRunTimestamp(date) {
@@ -11960,7 +12037,7 @@ function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sha256Hex2(value) {
-  return createHash4(SHA256_ALGORITHM3).update(value).digest(HEX_ENCODING3);
+  return createHash4(SHA256_ALGORITHM2).update(value).digest(HEX_ENCODING2);
 }
 var UNKNOWN_ERROR_MESSAGE = "unknown error";
 function toErrorMessage3(error) {
@@ -19418,13 +19495,13 @@ async function persistVerificationContext(scope2, document, options = {}) {
       const existing = await readExistingContext(fs8, contextPath.value);
       if (!existing.ok) return existing;
       if (existing.value === document.canonicalJson) {
-        return { ok: true, value: { digest: document.digest, contextPath: contextPath.value } };
+        return { ok: true, value: { digest: document.digest, contextPath: contextPath.value, created: false } };
       }
       return { ok: false, error: VERIFICATION_CONTEXT_RUNTIME_ERROR.CONTENT_MISMATCH };
     }
     return { ok: false, error: `${VERIFICATION_CONTEXT_RUNTIME_ERROR.WRITE_FAILED}: ${toMessage(error)}` };
   }
-  return { ok: true, value: { digest: document.digest, contextPath: contextPath.value } };
+  return { ok: true, value: { digest: document.digest, contextPath: contextPath.value, created: true } };
 }
 async function readExistingContext(fs8, contextPath) {
   try {
@@ -19570,6 +19647,7 @@ var verificationContextDomain = {
 import { readFile as readFile13 } from "fs/promises";
 
 // src/commands/verify/cli.ts
+import { randomBytes as randomBytes2 } from "crypto";
 import { dirname as dirname12 } from "path";
 
 // src/domains/verify/verify.ts
@@ -19582,18 +19660,35 @@ var VERIFY_VERB = {
   START: "start",
   INPUT: "input",
   APPEND_SCOPE: "append-scope",
-  APPEND_FINDING: "append-finding"
+  APPEND_FINDING: "append-finding",
+  FINISH: "finish",
+  STATUS: "status",
+  RENDER: "render"
+};
+var VERIFY_LIFECYCLE_ACTION = {
+  SCOPE_ADD: "scope add",
+  FINDING_ADD: "finding add",
+  FINISH: VERIFY_VERB.FINISH
 };
+var UNSEALED_NEXT_ACTIONS = [
+  VERIFY_LIFECYCLE_ACTION.SCOPE_ADD,
+  VERIFY_LIFECYCLE_ACTION.FINDING_ADD,
+  VERIFY_LIFECYCLE_ACTION.FINISH
+];
 var VERIFY_VERIFICATION_TYPE = {
   REVIEW: "review"
 };
+var VERIFY_VERIFICATION_TYPES = new Set(Object.values(VERIFY_VERIFICATION_TYPE));
+function isVerifyVerificationType(value) {
+  return VERIFY_VERIFICATION_TYPES.has(value);
+}
 var REVIEW_FINDING_DISPOSITION = {
   BLOCKING: "BLOCKING",
   DEBT: "DEBT"
 };
 var VERIFY_APPEND_EVENT_TYPE = {
-  SCOPE: "io.spx.verify.scope",
-  FINDING: "io.spx.verify.finding"
+  SCOPE: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.verify.scope`,
+  FINDING: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.verify.finding`
 };
 var VERIFY_EVENT_SOURCE = "/spx/verify";
 var VERIFY_APPEND_EVENT_FIELD = {
@@ -19611,7 +19706,9 @@ var VERIFY_SCOPE_ERROR = {
 var VERIFY_INPUT_DIGEST_PATH = "verify run input";
 function parseChangesetScope(scope2) {
   const separatorIndex = scope2.indexOf(VERIFY_SCOPE_SEPARATOR);
-  if (separatorIndex < 0) return { ok: false, error: VERIFY_SCOPE_ERROR.MALFORMED_CHANGESET };
+  if (separatorIndex < 0) {
+    return { ok: false, error: VERIFY_SCOPE_ERROR.MALFORMED_CHANGESET };
+  }
   const base = scope2.slice(0, separatorIndex);
   const head = scope2.slice(separatorIndex + VERIFY_SCOPE_SEPARATOR.length);
   if (base.length === 0 || head.length === 0 || head.includes(VERIFY_SCOPE_SEPARATOR)) {
@@ -19631,7 +19728,10 @@ function buildRunLocator(parts) {
   };
 }
 function digestRunInput(source, content) {
-  const digest = digestDescriptorSection({ source, content }, VERIFY_INPUT_DIGEST_PATH);
+  const digest = digestDescriptorSection(
+    { source, content },
+    VERIFY_INPUT_DIGEST_PATH
+  );
   if (!digest.ok) return digest;
   return { ok: true, value: digest.value.sha256 };
 }
@@ -19651,7 +19751,10 @@ function verifyInputRecordPath(scope2) {
   if (!token.ok) return token;
   return {
     ok: true,
-    value: join36(runs.value, `${VERIFY_INPUT_RECORD.PREFIX}${token.value}${VERIFY_INPUT_RECORD.SUFFIX}`)
+    value: join36(
+      runs.value,
+      `${VERIFY_INPUT_RECORD.PREFIX}${token.value}${VERIFY_INPUT_RECORD.SUFFIX}`
+    )
   };
 }
 var VERIFY_APPEND_ATTEMPT = 1;
@@ -19700,6 +19803,58 @@ function buildAppendEvent(args) {
     }
   };
 }
+var VERIFY_TERMINAL_EVENT_TYPE = `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.verify.terminal`;
+var VERIFY_TERMINAL_EVENT_FIELD = {
+  TERMINAL_STATUS: "terminalStatus"
+};
+var VERIFY_TERMINAL_EVENT_ID_PREFIX = "verify-terminal-";
+function isVerifyTerminalStatus(value) {
+  return isJournalRunStateStatus(value);
+}
+function buildTerminalEvent(args) {
+  return {
+    id: `${VERIFY_TERMINAL_EVENT_ID_PREFIX}${args.runToken}`,
+    source: VERIFY_EVENT_SOURCE,
+    type: VERIFY_TERMINAL_EVENT_TYPE,
+    time: args.at.toISOString(),
+    attempt: VERIFY_APPEND_ATTEMPT,
+    data: {
+      [VERIFY_TERMINAL_EVENT_FIELD.TERMINAL_STATUS]: args.terminalStatus
+    }
+  };
+}
+var VERIFY_NO_EVENTS_SEQUENCE = 0;
+function findTerminalEvent(events) {
+  return events.find((event) => event.type === VERIFY_TERMINAL_EVENT_TYPE);
+}
+function terminalStatusOf(event) {
+  if (event === void 0 || !isJsonRecord(event.data)) return void 0;
+  const status = event.data[VERIFY_TERMINAL_EVENT_FIELD.TERMINAL_STATUS];
+  return typeof status === "string" ? status : void 0;
+}
+function countVerifyFindings(events) {
+  return events.filter(
+    (event) => event.type === VERIFY_APPEND_EVENT_TYPE.FINDING
+  ).length;
+}
+function lastSequenceOf(events) {
+  return events.reduce(
+    (max, event) => event.seq > max ? event.seq : max,
+    VERIFY_NO_EVENTS_SEQUENCE
+  );
+}
+function projectVerifyRun(events) {
+  const terminal = findTerminalEvent(events);
+  const terminalStatus = terminalStatusOf(terminal);
+  const sealed = terminal !== void 0;
+  return {
+    sealed,
+    ...terminalStatus === void 0 ? {} : { terminalStatus },
+    findingCount: countVerifyFindings(events),
+    lastSequence: lastSequenceOf(events),
+    nextActions: sealed ? [] : UNSEALED_NEXT_ACTIONS
+  };
+}
 
 // src/commands/verify/cli.ts
 var VERIFY_CLI_EXIT_CODE = {
@@ -19710,19 +19865,40 @@ var VERIFY_CLI_ENV = {
   BRANCH: SPX_VERIFY_ENV.BRANCH
 };
 var VERIFY_CLI_ERROR = {
-  INPUT_REQUIRED: "spx verify start requires --input <input-source>",
-  RUN_REQUIRED: "spx verify existing-run verbs require an explicit --run <run-token>",
-  RUN_NOT_FOUND: "spx verify could not locate the requested run",
-  CHANGED_SCOPE_FAILED: "spx verify could not derive the changeset changed-file scope",
-  INPUT_PERSIST_FAILED: "spx verify could not persist the recorded run input",
-  INPUT_READ_FAILED: "spx verify could not read the recorded run input",
-  PAYLOAD_REQUIRED: "spx verify append verbs require --payload <payload-source>",
-  IDEMPOTENCY_KEY_REQUIRED: "spx verify append verbs require --idempotency-key <key>",
-  PAYLOAD_READ_FAILED: "spx verify could not read the append payload",
-  PAYLOAD_INVALID: "spx verify append payload is not valid JSON",
-  FINDING_INVALID: "spx verify append-finding payload failed verification-type validation",
-  UNSUPPORTED_VERIFICATION_TYPE: "spx verify append-finding has no finding validator for the verification type",
-  APPEND_FAILED: "spx verify could not append the evidence event"
+  INPUT_REQUIRED: "spx verification run start requires --input <input-source>",
+  RUN_REQUIRED: "spx verification run existing-run commands require an explicit --run <run-token>",
+  RUN_NOT_FOUND: "spx verification run could not locate the requested run",
+  RUN_SELECTOR_MISMATCH: "spx verification run selector does not match the recorded run",
+  CHANGED_SCOPE_FAILED: "spx verification run could not derive the changeset changed-file scope",
+  INPUT_PERSIST_FAILED: "spx verification run could not persist the recorded run input",
+  INPUT_READ_FAILED: "spx verification run could not read the recorded run input",
+  PAYLOAD_REQUIRED: "spx verification run evidence-add commands require --payload <payload-source>",
+  IDEMPOTENCY_KEY_REQUIRED: "spx verification run evidence-add commands require --idempotency-key <key>",
+  PAYLOAD_READ_FAILED: "spx verification run could not read the evidence payload",
+  PAYLOAD_INVALID: "spx verification run evidence payload is not valid JSON",
+  RUN_FINISHED: "spx verification run cannot add evidence to a finished run",
+  FINDING_INVALID: "spx verification run finding add payload failed verification-type validation",
+  UNSUPPORTED_VERIFICATION_TYPE: "spx verification run verification type is not registered",
+  APPEND_FAILED: "spx verification run could not append the evidence event",
+  TERMINAL_STATUS_REQUIRED: "spx verification run finish requires --terminal-status <status>",
+  TERMINAL_STATUS_INVALID: "spx verification run finish requires a terminal status in the journal terminal-status vocabulary",
+  FINISH_FAILED: "spx verification run could not record terminal completion",
+  SEAL_FAILED: "spx verification run could not seal the run journal",
+  STATUS_FAILED: "spx verification run could not read the run status",
+  RENDER_FAILED: "spx verification run could not render the run projection"
+};
+var VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD = {
+  RUN: "run=",
+  VERIFICATION_TYPE: "verification-type=",
+  SCOPE_TYPE: "scope-type=",
+  SCOPE: "scope=",
+  BACKEND: "backend=",
+  NAMESPACE: "namespace=",
+  TARGET: "target="
+};
+var VERIFY_START_ROLLBACK_ARTIFACT = {
+  CONTEXT_FILE: "verification context file",
+  RUN_FILE: "journal run file"
 };
 function okResult3(output) {
   return { exitCode: VERIFY_CLI_EXIT_CODE.OK, output };
@@ -19781,73 +19957,131 @@ async function persistInputRecord(runScope2, record6, deps) {
   const fs8 = deps.fs ?? defaultFileSystem;
   try {
     await fs8.mkdir(dirname12(path7.value), { recursive: true });
-    await fs8.writeFile(path7.value, JSON.stringify(record6));
+    await writeFileAtomic(path7.value, JSON.stringify(record6), { fs: fs8, randomBytes: randomBytes2 });
     return { ok: true, value: void 0 };
   } catch (error) {
     return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_PERSIST_FAILED}: ${toMessage2(error)}` };
   }
 }
+async function readStartInputContent(source, deps) {
+  try {
+    return { ok: true, value: await deps.readInputSource(source) };
+  } catch (error) {
+    return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_READ_FAILED}: ${toMessage2(error)}` };
+  }
+}
+async function removeStartedRunArtifact(path7, label, deps) {
+  const fs8 = deps.fs ?? defaultFileSystem;
+  try {
+    await fs8.rm(path7, { force: true });
+    return { ok: true, value: void 0 };
+  } catch (error) {
+    return {
+      ok: false,
+      error: `${VERIFY_CLI_ERROR.INPUT_PERSIST_FAILED}: rollback failed for ${label}: ${toMessage2(error)}`
+    };
+  }
+}
+async function removeStartedRunArtifacts(artifacts, deps) {
+  const rollbackErrors = [];
+  if (artifacts.contextPath !== void 0) {
+    const contextRollback = await removeStartedRunArtifact(
+      artifacts.contextPath,
+      VERIFY_START_ROLLBACK_ARTIFACT.CONTEXT_FILE,
+      deps
+    );
+    if (!contextRollback.ok) rollbackErrors.push(contextRollback.error);
+  }
+  if (artifacts.runFile !== void 0) {
+    const runRollback = await removeStartedRunArtifact(
+      artifacts.runFile,
+      VERIFY_START_ROLLBACK_ARTIFACT.RUN_FILE,
+      deps
+    );
+    if (!runRollback.ok) rollbackErrors.push(runRollback.error);
+  }
+  if (rollbackErrors.length > 0) return { ok: false, error: rollbackErrors.join("; ") };
+  return { ok: true, value: void 0 };
+}
+function isStoredRecordedInput(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record6 = value;
+  return typeof record6.scopeIdentity === "string" && typeof record6.scopeType === "string" && typeof record6.source === "string" && typeof record6.digest === "string" && typeof record6.content === "string";
+}
+function parseRecordedInput(content) {
+  try {
+    const parsed = JSON.parse(content);
+    if (!isStoredRecordedInput(parsed)) {
+      return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_READ_FAILED}: recorded input is missing required fields` };
+    }
+    return { ok: true, value: parsed };
+  } catch (error) {
+    return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_READ_FAILED}: ${toMessage2(error)}` };
+  }
+}
 async function readInputRecordAt(path7, deps) {
   const fs8 = deps.fs ?? defaultFileSystem;
+  let content;
   try {
-    const content = await fs8.readFile(path7, STATE_STORE_TEXT_ENCODING);
-    return { ok: true, value: JSON.parse(content) };
+    content = await fs8.readFile(path7, STATE_STORE_TEXT_ENCODING);
   } catch (error) {
     if (hasErrorCode(error, ERROR_CODE_NOT_FOUND)) return { ok: true, value: void 0 };
     return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_READ_FAILED}: ${toMessage2(error)}` };
   }
+  const parsed = parseRecordedInput(content);
+  if (!parsed.ok) return parsed;
+  return { ok: true, value: parsed.value };
 }
-function verifyRunNotFoundDiagnostic(context) {
+function verifyRunLocatorDiagnostic(summary, context) {
   return [
-    VERIFY_CLI_ERROR.RUN_NOT_FOUND,
-    `run=${context.runToken}`,
-    `verification-type=${context.verificationType}`,
-    `scope-type=${context.scopeType}`,
-    `scope=${context.scopeIdentity}`,
-    `backend=${context.backendIdentity}`,
-    `namespace=${context.storageNamespace}`,
-    `target=${context.searchedTarget}`
+    summary,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.RUN}${context.runToken}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.VERIFICATION_TYPE}${context.verificationType}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.SCOPE_TYPE}${context.scopeType}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.SCOPE}${context.scopeIdentity}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.BACKEND}${context.backendIdentity}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.NAMESPACE}${context.storageNamespace}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.TARGET}${context.searchedTarget}`
   ].join(" ");
 }
-async function verifyStartCommand(options, deps) {
-  if (options.scopeType !== VERIFY_SCOPE_TYPE.CHANGESET) return errorResult3(VERIFY_SCOPE_ERROR.UNSUPPORTED_SCOPE_TYPE);
-  if (options.input.trim().length === 0) return errorResult3(VERIFY_CLI_ERROR.INPUT_REQUIRED);
-  const scope2 = parseChangesetScope(options.scope);
-  if (!scope2.ok) return errorResult3(scope2.error);
-  const resolved = await resolveVerifyScope(deps);
-  if (!resolved.ok) return errorResult3(resolved.error);
-  const inputContent = await deps.readInputSource(options.input);
-  const inputDigest = digestRunInput(options.input, inputContent);
-  if (!inputDigest.ok) return errorResult3(inputDigest.error);
-  const context = await verificationContextCreateCommand(
-    {
-      subject: VERIFICATION_CONTEXT_SUBJECT_KIND.CHANGESET,
-      base: scope2.value.base,
-      head: scope2.value.head,
-      predicate: options.verificationType,
-      workflow: options.verificationType
-    },
-    forwardDeps(deps)
-  );
-  if (context.exitCode !== VERIFY_CLI_EXIT_CODE.OK) return errorResult3(context.output);
-  const contextDigest = JSON.parse(context.output).digest;
+function verifyRunNotFoundDiagnostic(context) {
+  return verifyRunLocatorDiagnostic(VERIFY_CLI_ERROR.RUN_NOT_FOUND, context);
+}
+async function completeVerifyStartCommand(args) {
+  const { options, deps } = args;
   const opened = await journalOpenCommand(
-    { type: options.verificationType, branchSlug: resolved.value.branchSlug },
+    { type: options.verificationType, branchSlug: args.branchSlug },
     forwardDeps(deps)
   );
-  if (opened.exitCode !== VERIFY_CLI_EXIT_CODE.OK) return errorResult3(opened.output);
+  if (opened.exitCode !== VERIFY_CLI_EXIT_CODE.OK) {
+    const rollback = await removeStartedRunArtifacts(
+      { ...args.contextCreated ? { contextPath: args.contextPath } : {} },
+      deps
+    );
+    return errorResult3(rollback.ok ? opened.output : `${opened.output}; ${rollback.error}`);
+  }
   const { runToken, runFile } = JSON.parse(opened.output);
   const runScope2 = {
-    productDir: resolved.value.productDir,
-    branchSlug: resolved.value.branchSlug,
+    productDir: args.productDir,
+    branchSlug: args.branchSlug,
     type: options.verificationType,
     runToken
   };
-  const recorded = { source: options.input, digest: inputDigest.value, content: inputContent };
+  const recorded = {
+    scopeIdentity: options.scope,
+    scopeType: options.scopeType,
+    source: options.input,
+    digest: args.inputDigest,
+    content: args.inputContent
+  };
   const persisted = await persistInputRecord(runScope2, recorded, deps);
-  if (!persisted.ok) return errorResult3(persisted.error);
-  const changedScope = await resolveChangedScope(scope2.value, deps);
-  if (!changedScope.ok) return errorResult3(changedScope.error);
+  if (!persisted.ok) {
+    const rollback = await removeStartedRunArtifacts(
+      { ...args.contextCreated ? { contextPath: args.contextPath } : {}, runFile },
+      deps
+    );
+    return errorResult3(rollback.ok ? persisted.error : `${persisted.error}; ${rollback.error}`);
+  }
   const namespace = verifyRunsDir(runScope2);
   if (!namespace.ok) return errorResult3(namespace.error);
   const locator = buildRunLocator({
@@ -19855,52 +20089,69 @@ async function verifyStartCommand(options, deps) {
     verificationType: options.verificationType,
     scopeType: options.scopeType,
     scopeIdentity: options.scope,
-    backendIdentity: resolved.value.backendIdentity,
+    backendIdentity: args.backendIdentity,
     storageNamespace: namespace.value,
     runTarget: runFile
   });
   const report2 = {
     runToken,
-    contextDigest,
-    changedScope: changedScope.value,
-    input: { source: options.input, digest: inputDigest.value },
+    contextDigest: args.contextDigest,
+    changedScope: args.changedScope,
+    input: { source: options.input, digest: args.inputDigest },
     locator
   };
   return okResult3(JSON.stringify(report2));
 }
-async function verifyInputCommand(options, deps) {
-  if (options.run.trim().length === 0) return errorResult3(VERIFY_CLI_ERROR.RUN_REQUIRED);
+async function verifyStartCommand(options, deps) {
+  if (!isVerifyVerificationType(options.verificationType)) {
+    return errorResult3(VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE);
+  }
+  if (options.scopeType !== VERIFY_SCOPE_TYPE.CHANGESET) return errorResult3(VERIFY_SCOPE_ERROR.UNSUPPORTED_SCOPE_TYPE);
+  if (options.input.trim().length === 0) return errorResult3(VERIFY_CLI_ERROR.INPUT_REQUIRED);
+  const scope2 = parseChangesetScope(options.scope);
+  if (!scope2.ok) return errorResult3(scope2.error);
   const resolved = await resolveVerifyScope(deps);
   if (!resolved.ok) return errorResult3(resolved.error);
-  const runScope2 = {
+  const inputContent = await readStartInputContent(options.input, deps);
+  if (!inputContent.ok) return errorResult3(inputContent.error);
+  const inputDigest = digestRunInput(options.input, inputContent.value);
+  if (!inputDigest.ok) return errorResult3(inputDigest.error);
+  const changedScope = await resolveChangedScope(scope2.value, deps);
+  if (!changedScope.ok) return errorResult3(changedScope.error);
+  const context = await verificationContextCreateCommand(
+    {
+      subject: VERIFICATION_CONTEXT_SUBJECT_KIND.CHANGESET,
+      base: scope2.value.base,
+      head: scope2.value.head,
+      predicate: options.verificationType,
+      workflow: options.verificationType
+    },
+    forwardDeps(deps)
+  );
+  if (context.exitCode !== VERIFY_CLI_EXIT_CODE.OK) return errorResult3(context.output);
+  const { digest: contextDigest, contextPath, created: contextCreated } = JSON.parse(context.output);
+  return completeVerifyStartCommand({
+    options,
+    deps,
     productDir: resolved.value.productDir,
     branchSlug: resolved.value.branchSlug,
-    type: options.verificationType,
-    runToken: options.run
-  };
-  const path7 = verifyInputRecordPath(runScope2);
-  if (!path7.ok) return errorResult3(path7.error);
-  const namespace = verifyRunsDir(runScope2);
-  if (!namespace.ok) return errorResult3(namespace.error);
-  const record6 = await readInputRecordAt(path7.value, deps);
-  if (!record6.ok) return errorResult3(record6.error);
-  if (record6.value === void 0) {
-    return errorResult3(
-      verifyRunNotFoundDiagnostic({
-        runToken: options.run,
-        verificationType: options.verificationType,
-        scopeType: options.scopeType,
-        scopeIdentity: options.scope,
-        backendIdentity: resolved.value.backendIdentity,
-        storageNamespace: namespace.value,
-        searchedTarget: path7.value
-      })
-    );
-  }
+    backendIdentity: resolved.value.backendIdentity,
+    changedScope: changedScope.value,
+    inputDigest: inputDigest.value,
+    inputContent: inputContent.value,
+    contextDigest,
+    contextPath,
+    contextCreated
+  });
+}
+async function verifyInputCommand(options, deps) {
+  const run = await resolveExistingRun(options, deps);
+  if (!run.ok) return errorResult3(run.error);
+  const record6 = run.value.recordedInput;
   const report2 = {
-    source: record6.value.source,
-    digest: record6.value.digest,
-    content: record6.value.content
+    source: record6.source,
+    digest: record6.digest,
+    content: record6.content
   };
   return okResult3(JSON.stringify(report2));
 }
@@ -19909,12 +20160,36 @@ async function readRunJournalEvents(scope2, deps) {
   if (read.exitCode !== VERIFY_CLI_EXIT_CODE.OK) return { ok: false, error: read.output };
   return { ok: true, value: JSON.parse(read.output) };
 }
+async function readAppendExistingEvents(options, deps, journalScope, backendIdentity, namespace) {
+  const existingEvents = await readRunJournalEvents(journalScope, deps);
+  if (!existingEvents.ok) {
+    if (existingEvents.error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
+      return {
+        ok: false,
+        error: appendRunNotFoundDiagnostic(options, backendIdentity, namespace)
+      };
+    }
+    return { ok: false, error: `${VERIFY_CLI_ERROR.APPEND_FAILED}: ${existingEvents.error}` };
+  }
+  if (findTerminalEvent(existingEvents.value) !== void 0) {
+    return { ok: false, error: VERIFY_CLI_ERROR.RUN_FINISHED };
+  }
+  return existingEvents;
+}
 async function prepareAppend(options, deps) {
   if (options.run.trim().length === 0) return { ok: false, error: VERIFY_CLI_ERROR.RUN_REQUIRED };
+  if (!isVerifyVerificationType(options.verificationType)) {
+    return { ok: false, error: VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE };
+  }
   if (options.payload.trim().length === 0) return { ok: false, error: VERIFY_CLI_ERROR.PAYLOAD_REQUIRED };
   if (options.idempotencyKey.trim().length === 0) {
     return { ok: false, error: VERIFY_CLI_ERROR.IDEMPOTENCY_KEY_REQUIRED };
   }
+  if (options.scopeType !== VERIFY_SCOPE_TYPE.CHANGESET) {
+    return { ok: false, error: VERIFY_SCOPE_ERROR.UNSUPPORTED_SCOPE_TYPE };
+  }
+  const scope2 = parseChangesetScope(options.scope);
+  if (!scope2.ok) return scope2;
   const readPayload = deps.readPayloadSource;
   const binding = deps.journalBinding;
   if (readPayload === void 0 || binding === void 0) return { ok: false, error: VERIFY_CLI_ERROR.APPEND_FAILED };
@@ -19928,25 +20203,53 @@ async function prepareAppend(options, deps) {
   };
   const namespace = verifyRunsDir(runScope2);
   if (!namespace.ok) return namespace;
+  const journalScope = {
+    type: options.verificationType,
+    runToken: options.run,
+    branchSlug: resolved.value.branchSlug
+  };
+  const existingEvents = await readAppendExistingEvents(
+    options,
+    deps,
+    journalScope,
+    resolved.value.backendIdentity,
+    namespace.value
+  );
+  if (!existingEvents.ok) return existingEvents;
   const inputPath = verifyInputRecordPath(runScope2);
   if (!inputPath.ok) return inputPath;
   const inputRecord = await readInputRecordAt(inputPath.value, deps);
   if (!inputRecord.ok) return inputRecord;
   if (inputRecord.value === void 0) {
-    return { ok: false, error: appendRunNotFoundDiagnostic(options, resolved.value.backendIdentity, namespace.value) };
+    return {
+      ok: false,
+      error: appendRunNotFoundDiagnostic(options, resolved.value.backendIdentity, namespace.value, inputPath.value)
+    };
+  }
+  if (!recordedSelectorMatches(inputRecord.value, options)) {
+    return {
+      ok: false,
+      error: appendRunSelectorMismatchDiagnostic(
+        options,
+        resolved.value.backendIdentity,
+        namespace.value,
+        inputPath.value
+      )
+    };
   }
   return {
     ok: true,
     value: {
       readPayload,
       binding,
-      journalScope: { type: options.verificationType, runToken: options.run, branchSlug: resolved.value.branchSlug },
+      journalScope,
       namespace: namespace.value,
-      backendIdentity: resolved.value.backendIdentity
+      backendIdentity: resolved.value.backendIdentity,
+      existingEvents: existingEvents.value
     }
   };
 }
-function appendRunNotFoundDiagnostic(options, backendIdentity, namespace) {
+function appendRunNotFoundDiagnostic(options, backendIdentity, namespace, searchedTarget = namespace) {
   return verifyRunNotFoundDiagnostic({
     runToken: options.run,
     verificationType: options.verificationType,
@@ -19954,7 +20257,18 @@ function appendRunNotFoundDiagnostic(options, backendIdentity, namespace) {
     scopeIdentity: options.scope,
     backendIdentity,
     storageNamespace: namespace,
-    searchedTarget: namespace
+    searchedTarget
+  });
+}
+function appendRunSelectorMismatchDiagnostic(options, backendIdentity, namespace, searchedTarget) {
+  return verifyRunLocatorDiagnostic(VERIFY_CLI_ERROR.RUN_SELECTOR_MISMATCH, {
+    runToken: options.run,
+    verificationType: options.verificationType,
+    scopeType: options.scopeType,
+    scopeIdentity: options.scope,
+    backendIdentity,
+    storageNamespace: namespace,
+    searchedTarget
   });
 }
 function validateAppendFinding(verb, verificationType, payload) {
@@ -19970,16 +20284,9 @@ function appendEventType(verb) {
 async function verifyAppend(options, deps, verb) {
   const prepared = await prepareAppend(options, deps);
   if (!prepared.ok) return errorResult3(prepared.error);
-  const { readPayload, binding, journalScope, namespace, backendIdentity } = prepared.value;
+  const { readPayload, binding, journalScope, existingEvents } = prepared.value;
   const eventType = appendEventType(verb);
-  const before = await readRunJournalEvents(journalScope, deps);
-  if (!before.ok) {
-    if (before.error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
-      return errorResult3(appendRunNotFoundDiagnostic(options, backendIdentity, namespace));
-    }
-    return errorResult3(`${VERIFY_CLI_ERROR.APPEND_FAILED}: ${before.error}`);
-  }
-  const existing = findAppendedSequence(before.value, options.idempotencyKey, eventType);
+  const existing = findAppendedSequence(existingEvents, options.idempotencyKey, eventType);
   if (existing !== void 0) {
     const report3 = { sequence: existing, idempotent: true };
     return okResult3(JSON.stringify(report3));
@@ -20017,24 +20324,270 @@ async function verifyAppendScopeCommand(options, deps) {
 async function verifyAppendFindingCommand(options, deps) {
   return verifyAppend(options, deps, VERIFY_VERB.APPEND_FINDING);
 }
+function existingRunNotFound(run, options) {
+  return verifyRunNotFoundDiagnostic({
+    runToken: run.runToken,
+    verificationType: options.verificationType,
+    scopeType: options.scopeType,
+    scopeIdentity: options.scope,
+    backendIdentity: run.backendIdentity,
+    storageNamespace: run.namespace,
+    searchedTarget: run.inputRecordPath
+  });
+}
+function existingRunSelectorMismatch(run, options) {
+  return verifyRunLocatorDiagnostic(VERIFY_CLI_ERROR.RUN_SELECTOR_MISMATCH, {
+    runToken: run.runToken,
+    verificationType: options.verificationType,
+    scopeType: options.scopeType,
+    scopeIdentity: options.scope,
+    backendIdentity: run.backendIdentity,
+    storageNamespace: run.namespace,
+    searchedTarget: run.inputRecordPath
+  });
+}
+function recordedSelectorMatches(record6, options) {
+  return record6.scopeType === options.scopeType && record6.scopeIdentity === options.scope;
+}
+async function readExistingRecordedInput(run, deps) {
+  return readInputRecordAt(run.inputRecordPath, deps);
+}
+async function resolveExistingRunAddress(options, deps) {
+  if (!isVerifyVerificationType(options.verificationType)) {
+    return { ok: false, error: VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE };
+  }
+  if (options.scopeType !== VERIFY_SCOPE_TYPE.CHANGESET) {
+    return { ok: false, error: VERIFY_SCOPE_ERROR.UNSUPPORTED_SCOPE_TYPE };
+  }
+  const scope2 = parseChangesetScope(options.scope);
+  if (!scope2.ok) return scope2;
+  if (options.run.trim().length === 0) return { ok: false, error: VERIFY_CLI_ERROR.RUN_REQUIRED };
+  const resolved = await resolveVerifyScope(deps);
+  if (!resolved.ok) return resolved;
+  const runScope2 = {
+    productDir: resolved.value.productDir,
+    branchSlug: resolved.value.branchSlug,
+    type: options.verificationType,
+    runToken: options.run
+  };
+  const namespace = verifyRunsDir(runScope2);
+  if (!namespace.ok) return namespace;
+  const inputPath = verifyInputRecordPath(runScope2);
+  if (!inputPath.ok) return inputPath;
+  return {
+    ok: true,
+    value: {
+      productDir: resolved.value.productDir,
+      runToken: options.run,
+      journalScope: { type: options.verificationType, runToken: options.run, branchSlug: resolved.value.branchSlug },
+      namespace: namespace.value,
+      backendIdentity: resolved.value.backendIdentity,
+      inputRecordPath: inputPath.value
+    }
+  };
+}
+async function resolveExistingRun(options, deps) {
+  const address = await resolveExistingRunAddress(options, deps);
+  if (!address.ok) return address;
+  const inputRecord = await readExistingRecordedInput(address.value, deps);
+  if (!inputRecord.ok) return inputRecord;
+  if (inputRecord.value === void 0) {
+    return { ok: false, error: existingRunNotFound(address.value, options) };
+  }
+  if (!recordedSelectorMatches(inputRecord.value, options)) {
+    return { ok: false, error: existingRunSelectorMismatch(address.value, options) };
+  }
+  const run = { ...address.value, recordedInput: inputRecord.value };
+  return { ok: true, value: run };
+}
+function isRecordedInputReadFailure(error) {
+  return error.startsWith(VERIFY_CLI_ERROR.INPUT_READ_FAILED);
+}
+async function readRecordedInputForProjection(run, options, events, deps) {
+  const terminal = findTerminalEvent(events);
+  const inputRecord = await readExistingRecordedInput(run, deps);
+  if (!inputRecord.ok) {
+    if (terminal !== void 0 && isRecordedInputReadFailure(inputRecord.error)) {
+      return { ok: true, value: void 0 };
+    }
+    return inputRecord;
+  }
+  if (inputRecord.value === void 0) return { ok: true, value: void 0 };
+  if (!recordedSelectorMatches(inputRecord.value, options)) {
+    return { ok: false, error: existingRunSelectorMismatch(run, options) };
+  }
+  return { ok: true, value: inputRecord.value };
+}
+function verifyFinishReport(runToken, projection) {
+  return {
+    runToken,
+    ...projection.terminalStatus === void 0 ? {} : { terminalStatus: projection.terminalStatus },
+    sealed: projection.sealed,
+    findingCount: projection.findingCount,
+    lastSequence: projection.lastSequence
+  };
+}
+async function isJournalPhysicallySealed(run, deps) {
+  return isJournalRunSealed(
+    { ...run.journalScope, productDir: run.productDir },
+    { ...deps.fs === void 0 ? {} : { fs: deps.fs } }
+  );
+}
+async function sealExistingRun(run, deps) {
+  const sealed = await journalSealCommand(run.journalScope, forwardDeps(deps));
+  if (sealed.exitCode !== VERIFY_CLI_EXIT_CODE.OK) {
+    return errorResult3(`${VERIFY_CLI_ERROR.SEAL_FAILED}: ${sealed.output}`);
+  }
+  return void 0;
+}
+function finishReadFailure(run, options, error) {
+  if (error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
+    return errorResult3(existingRunNotFound(run, options));
+  }
+  return errorResult3(`${VERIFY_CLI_ERROR.FINISH_FAILED}: ${error}`);
+}
+async function finishProjectionResult(run, deps) {
+  const events = await readRunJournalEvents(run.journalScope, deps);
+  if (!events.ok) return errorResult3(`${VERIFY_CLI_ERROR.FINISH_FAILED}: ${events.error}`);
+  return okResult3(JSON.stringify(verifyFinishReport(run.runToken, projectVerifyRun(events.value))));
+}
+async function retrySealForTerminalRun(run, deps) {
+  const physicallySealed = await isJournalPhysicallySealed(run, deps);
+  if (!physicallySealed.ok) return void 0;
+  if (physicallySealed.value) return void 0;
+  return sealExistingRun(run, deps);
+}
+async function verifyFinishCommand(options, deps) {
+  if (options.terminalStatus.trim().length === 0) return errorResult3(VERIFY_CLI_ERROR.TERMINAL_STATUS_REQUIRED);
+  if (!isVerifyTerminalStatus(options.terminalStatus)) return errorResult3(VERIFY_CLI_ERROR.TERMINAL_STATUS_INVALID);
+  const run = await resolveExistingRunAddress(options, deps);
+  if (!run.ok) return errorResult3(run.error);
+  const before = await readRunJournalEvents(run.value.journalScope, deps);
+  if (!before.ok) {
+    return finishReadFailure(run.value, options, before.error);
+  }
+  const inputRecord = await readRecordedInputForProjection(run.value, options, before.value, deps);
+  if (!inputRecord.ok) return errorResult3(inputRecord.error);
+  if (findTerminalEvent(before.value) !== void 0) {
+    const retrySeal = await retrySealForTerminalRun(run.value, deps);
+    return retrySeal ?? finishProjectionResult(run.value, deps);
+  }
+  if (inputRecord.value === void 0) {
+    return errorResult3(existingRunNotFound(run.value, options));
+  }
+  const binding = deps.journalBinding;
+  if (binding === void 0) return errorResult3(VERIFY_CLI_ERROR.FINISH_FAILED);
+  const event = buildTerminalEvent({
+    runToken: run.value.runToken,
+    terminalStatus: options.terminalStatus,
+    at: deps.now?.() ?? /* @__PURE__ */ new Date()
+  });
+  const appended = await journalAppendCommand(run.value.journalScope, event, binding, forwardDeps(deps));
+  if (appended.exitCode !== VERIFY_CLI_EXIT_CODE.OK) {
+    return errorResult3(`${VERIFY_CLI_ERROR.FINISH_FAILED}: ${appended.output}`);
+  }
+  const sealResult = await sealExistingRun(run.value, deps);
+  if (sealResult !== void 0) return sealResult;
+  return finishProjectionResult(run.value, deps);
+}
+async function verifyStatusCommand(options, deps) {
+  const run = await resolveExistingRunAddress(options, deps);
+  if (!run.ok) return errorResult3(run.error);
+  const events = await readRunJournalEvents(run.value.journalScope, deps);
+  if (!events.ok) {
+    if (events.error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
+      return errorResult3(existingRunNotFound(run.value, options));
+    }
+    return errorResult3(`${VERIFY_CLI_ERROR.STATUS_FAILED}: ${events.error}`);
+  }
+  const inputRecord = await readRecordedInputForProjection(run.value, options, events.value, deps);
+  if (!inputRecord.ok) return errorResult3(inputRecord.error);
+  if (inputRecord.value === void 0 && findTerminalEvent(events.value) === void 0) {
+    return errorResult3(existingRunNotFound(run.value, options));
+  }
+  const projection = projectVerifyRun(events.value);
+  const report2 = {
+    runToken: run.value.runToken,
+    verificationType: options.verificationType,
+    scopeType: options.scopeType,
+    sealed: projection.sealed,
+    lastSequence: projection.lastSequence,
+    ...projection.terminalStatus === void 0 ? {} : { terminalStatus: projection.terminalStatus },
+    findingCount: projection.findingCount,
+    nextActions: projection.nextActions
+  };
+  return okResult3(JSON.stringify(report2));
+}
+async function verifyRenderCommand(options, deps) {
+  const run = await resolveExistingRunAddress(options, deps);
+  if (!run.ok) return errorResult3(run.error);
+  const events = await readRunJournalEvents(run.value.journalScope, deps);
+  if (!events.ok) {
+    if (events.error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
+      return errorResult3(existingRunNotFound(run.value, options));
+    }
+    return errorResult3(`${VERIFY_CLI_ERROR.RENDER_FAILED}: ${events.error}`);
+  }
+  const inputRecord = await readRecordedInputForProjection(run.value, options, events.value, deps);
+  if (!inputRecord.ok) return errorResult3(inputRecord.error);
+  if (inputRecord.value === void 0 && findTerminalEvent(events.value) === void 0) {
+    return errorResult3(existingRunNotFound(run.value, options));
+  }
+  const projection = projectVerifyRun(events.value);
+  const report2 = {
+    runToken: run.value.runToken,
+    findingCount: projection.findingCount,
+    sealed: projection.sealed,
+    ...projection.terminalStatus === void 0 ? {} : { terminalStatus: projection.terminalStatus },
+    events: events.value
+  };
+  return okResult3(JSON.stringify(report2));
+}
 
 // src/interfaces/cli/verify.ts
+var VERIFICATION_RUN_CLI_SURFACE = {
+  addCommandName: "add",
+  findingResourceCommandName: "finding",
+  forbiddenRootCommandName: "verify",
+  forbiddenRunHelpTerms: ["Append", "append"],
+  forbiddenRunCommandNames: ["journal", "event", "append-scope", "append-finding"],
+  rootCommandName: "verification",
+  runCommandName: "run",
+  scopeResourceCommandName: "scope"
+};
 var VERIFY_CLI = {
-  commandName: "verify",
+  addCommandName: VERIFICATION_RUN_CLI_SURFACE.addCommandName,
+  commandName: VERIFICATION_RUN_CLI_SURFACE.rootCommandName,
   description: "Record and replay a typed verification run",
   startCommandName: VERIFY_VERB.START,
   inputCommandName: VERIFY_VERB.INPUT,
-  appendScopeCommandName: VERIFY_VERB.APPEND_SCOPE,
-  appendFindingCommandName: VERIFY_VERB.APPEND_FINDING,
+  findingCommandName: VERIFICATION_RUN_CLI_SURFACE.findingResourceCommandName,
+  runCommandName: VERIFICATION_RUN_CLI_SURFACE.runCommandName,
+  scopeCommandName: VERIFICATION_RUN_CLI_SURFACE.scopeResourceCommandName,
+  finishCommandName: VERIFY_VERB.FINISH,
+  statusCommandName: VERIFY_VERB.STATUS,
+  renderCommandName: VERIFY_VERB.RENDER,
   verificationTypeOption: "--verification-type <type>",
   scopeTypeOption: "--scope-type <scope-type>",
   scopeOption: "--scope <base>..<head>",
   inputOption: "--input <input-source>",
   runOption: "--run <token>",
   payloadOption: "--payload <payload-source>",
-  idempotencyKeyOption: "--idempotency-key <key>"
+  payloadOptionDescription: "Evidence payload source; stdin or a file path",
+  idempotencyKeyOption: "--idempotency-key <key>",
+  idempotencyKeyOptionDescription: "Caller-supplied idempotency key for the evidence add",
+  terminalStatusOption: "--terminal-status <status>"
 };
 var CLI_SOURCE_ENCODING = "utf8";
+var DEFAULT_VERIFY_CLI_HANDLERS = {
+  appendFinding: verifyAppendFindingCommand,
+  appendScope: verifyAppendScopeCommand,
+  finish: verifyFinishCommand,
+  input: verifyInputCommand,
+  render: verifyRenderCommand,
+  start: verifyStartCommand,
+  status: verifyStatusCommand
+};
 async function readStdinText() {
   const chunks = [];
   for await (const chunk of process.stdin) {
@@ -20049,30 +20602,43 @@ async function readCliSource(source) {
 var verifyDomain = {
   name: VERIFY_CLI.commandName,
   description: VERIFY_CLI.description,
-  register: (program, invocation) => {
-    const deps = () => ({
-      cwd: invocation.resolveEffectiveInvocationDir(),
-      readInputSource: readCliSource,
-      readPayloadSource: readCliSource,
-      // The append verbs write a single structured JSON result to stdout, so the run's event
-      // stream goes to stderr under the local backend rather than sharing the result channel.
-      journalBinding: createJournalStreamBinding(invocation.io, stderrStreamSink(invocation.io))
-    });
-    const command = program.command(VERIFY_CLI.commandName).description(VERIFY_CLI.description);
-    command.command(VERIFY_CLI.startCommandName).description("Start a changeset-scoped verification run and report its run locator").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.inputOption, "Verification input source; stdin or a file path").action(async (options) => {
-      reportCliResult(await verifyStartCommand(options, deps()), invocation.io);
-    });
-    command.command(VERIFY_CLI.inputCommandName).description("Replay the verification input recorded at start").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").action(async (options) => {
-      reportCliResult(await verifyInputCommand(options, deps()), invocation.io);
-    });
-    command.command(VERIFY_CLI.appendScopeCommandName).description("Record the inspected scope for a started run").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.payloadOption, "Append payload source; stdin or a file path").requiredOption(VERIFY_CLI.idempotencyKeyOption, "Caller-supplied idempotency key for the append").action(async (options) => {
-      reportCliResult(await verifyAppendScopeCommand(options, deps()), invocation.io);
-    });
-    command.command(VERIFY_CLI.appendFindingCommandName).description("Record a validated verification finding for a started run").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.payloadOption, "Append payload source; stdin or a file path").requiredOption(VERIFY_CLI.idempotencyKeyOption, "Caller-supplied idempotency key for the append").action(async (options) => {
-      reportCliResult(await verifyAppendFindingCommand(options, deps()), invocation.io);
-    });
-  }
-};
+  register: (program, invocation) => registerVerifyCommands(program, invocation)
+};
+function registerVerifyCommands(program, invocation, handlers = DEFAULT_VERIFY_CLI_HANDLERS) {
+  const deps = () => ({
+    cwd: invocation.resolveEffectiveInvocationDir(),
+    readInputSource: readCliSource,
+    readPayloadSource: readCliSource,
+    // The append verbs write a single structured JSON result to stdout, so the run's event
+    // stream goes to stderr under the local backend rather than sharing the result channel.
+    journalBinding: createJournalStreamBinding(invocation.io, stderrStreamSink(invocation.io))
+  });
+  const command = program.command(VERIFY_CLI.commandName).description(VERIFY_CLI.description);
+  const runCommand = command.command(VERIFY_CLI.runCommandName).description("Manage a typed verification run lifecycle");
+  runCommand.command(VERIFY_CLI.startCommandName).description("Start a changeset-scoped verification run and report its run locator").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.inputOption, "Verification input source; stdin or a file path").action(async (options) => {
+    reportCliResult(await handlers.start(options, deps()), invocation.io);
+  });
+  runCommand.command(VERIFY_CLI.inputCommandName).description("Replay the verification input recorded at start").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").action(async (options) => {
+    reportCliResult(await handlers.input(options, deps()), invocation.io);
+  });
+  const scopeCommand = runCommand.command(VERIFY_CLI.scopeCommandName).description("Manage inspected scope evidence for a started verification run");
+  scopeCommand.command(VERIFY_CLI.addCommandName).description("Record the inspected scope for a started run").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.payloadOption, VERIFY_CLI.payloadOptionDescription).requiredOption(VERIFY_CLI.idempotencyKeyOption, VERIFY_CLI.idempotencyKeyOptionDescription).action(async (options) => {
+    reportCliResult(await handlers.appendScope(options, deps()), invocation.io);
+  });
+  const findingCommand = runCommand.command(VERIFY_CLI.findingCommandName).description("Manage finding evidence for a started verification run");
+  findingCommand.command(VERIFY_CLI.addCommandName).description("Record a validated verification finding for a started run").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.payloadOption, VERIFY_CLI.payloadOptionDescription).requiredOption(VERIFY_CLI.idempotencyKeyOption, VERIFY_CLI.idempotencyKeyOptionDescription).action(async (options) => {
+    reportCliResult(await handlers.appendFinding(options, deps()), invocation.io);
+  });
+  runCommand.command(VERIFY_CLI.finishCommandName).description("Record terminal completion, seal the run journal, and report its terminal projection").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.terminalStatusOption, "Terminal status recorded before sealing").action(async (options) => {
+    reportCliResult(await handlers.finish(options, deps()), invocation.io);
+  });
+  runCommand.command(VERIFY_CLI.statusCommandName).description("Report the run's resumable status projected from its journal history").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").action(async (options) => {
+    reportCliResult(await handlers.status(options, deps()), invocation.io);
+  });
+  runCommand.command(VERIFY_CLI.renderCommandName).description("Render the run's journal projection with its authoritative finding count").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").action(async (options) => {
+    reportCliResult(await handlers.render(options, deps()), invocation.io);
+  });
+}
 
 // src/interfaces/cli/worktree.ts
 import { randomBytes as nodeRandomBytes4 } from "crypto";