@outcomeeng/spx 0.6.11 → 0.6.13

package/dist/cli.js

@@ -126,6 +126,7 @@ var AGENT_RESUME_LIMITS = {
   RECENT_DAYS: 7,
   PER_AGENT_DISPLAYED_CANDIDATES: 5,
   METADATA_HEAD_BYTES: 131072,
+  ACTIVITY_TAIL_BYTES: 131072,
   HOURS_PER_DAY: 24,
   MINUTES_PER_HOUR: 60,
   SECONDS_PER_MINUTE: 60,
@@ -196,6 +197,10 @@ var FIRST_PICKER_INDEX = 0;
 var PICKER_MOVE_UP_DELTA = -1;
 var PICKER_MOVE_DOWN_DELTA = 1;
 var PICKER_QUIT_INPUT = "q";
+var AGENT_RESUME_TIE_ORDER = {
+  [AGENT_SESSION_KIND.CODEX]: 0,
+  [AGENT_SESSION_KIND.CLAUDE_CODE]: 1
+};
 var AgentResumeModeError = class extends Error {
   constructor(selectedModes) {
     super(`${AGENT_RESUME_TEXT.MODE_CONFLICT}: ${selectedModes.join(", ")}`);
@@ -314,7 +319,7 @@ function renderAgentResumeList(candidates) {
     return AGENT_RESUME_TEXT.NO_MATCHES;
   }
   return candidates.map((candidate) => {
-    const updatedAt = candidate.updatedAt ?? new Date(candidate.modifiedAtMs).toISOString();
+    const updatedAt = candidate.lastActivityAtMs === null ? "unknown" : new Date(candidate.lastActivityAtMs).toISOString();
     return `${updatedAt} ${AGENT_SESSION_LABEL[candidate.agent]} ${candidate.sessionId} ${candidate.cwd}`;
   }).join("\n");
 }
@@ -340,32 +345,41 @@ async function claudeTranscriptFiles(root, fs8, dirAccepts) {
   return perDir.flat();
 }
 async function collectAgentCandidates(agent, files, fs8, cap, match, parseHead) {
-  const seen = /* @__PURE__ */ new Set();
-  const candidates = [];
-  for (const file of files) {
-    if (candidates.length >= cap) {
-      break;
-    }
+  const candidates = await mapWithConcurrency(files, AGENT_RESUME_LIMITS.READ_CONCURRENCY, async (file) => {
     const head = await fs8.readHead(file.path, AGENT_RESUME_LIMITS.METADATA_HEAD_BYTES).catch(() => null);
     if (head === null) {
-      continue;
+      return null;
     }
     const core = parseHead(head);
-    if (core === null || !core.interactive || !match(core) || seen.has(core.sessionId)) {
-      continue;
+    if (core === null || !core.interactive || !match(core)) {
+      return null;
     }
-    seen.add(core.sessionId);
-    candidates.push({
+    const tail = await fs8.readTail(file.path, AGENT_RESUME_LIMITS.ACTIVITY_TAIL_BYTES).catch(() => null);
+    if (tail === null) {
+      return null;
+    }
+    return {
       agent,
       sessionId: core.sessionId,
       cwd: core.cwd,
       sourcePath: file.path,
       modifiedAtMs: file.modifiedAtMs,
+      lastActivityAtMs: latestTranscriptTimestampMs(tail),
       updatedAt: core.updatedAt,
       branch: core.branch
-    });
+    };
+  });
+  const bySessionId = /* @__PURE__ */ new Map();
+  for (const candidate of candidates) {
+    if (candidate === null) {
+      continue;
+    }
+    const existing = bySessionId.get(candidate.sessionId);
+    if (existing === void 0 || compareCandidates(candidate, existing) < 0) {
+      bySessionId.set(candidate.sessionId, candidate);
+    }
   }
-  return candidates;
+  return [...bySessionId.values()].sort(compareCandidates).slice(0, cap);
 }
 async function collectJsonlFiles(root, fs8) {
   const entries = await fs8.readDir(root).catch(() => []);
@@ -475,6 +489,27 @@ function parseJsonObject(line) {
     return null;
   }
 }
+function latestTranscriptTimestampMs(transcriptSlice) {
+  let latest = null;
+  for (const line of transcriptSlice.split("\n")) {
+    const row = parseJsonObject(line);
+    if (row === null) {
+      continue;
+    }
+    const timestampMs = parseTimestampMs(firstString(row, [[AGENT_SESSION_JSON_FIELDS.TIMESTAMP]]));
+    if (timestampMs !== null && (latest === null || timestampMs > latest)) {
+      latest = timestampMs;
+    }
+  }
+  return latest;
+}
+function parseTimestampMs(timestamp) {
+  if (timestamp === null) {
+    return null;
+  }
+  const timestampMs = Date.parse(timestamp);
+  return Number.isNaN(timestampMs) ? null : timestampMs;
+}
 function firstString(row, paths) {
   for (const path7 of paths) {
     const value = valueAtPath(row, path7);
@@ -498,11 +533,30 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function compareCandidates(left, right) {
-  const modifiedDiff = right.modifiedAtMs - left.modifiedAtMs;
-  if (modifiedDiff !== 0) {
-    return modifiedDiff;
+  if (left.lastActivityAtMs !== null && right.lastActivityAtMs !== null) {
+    const activityDiff = right.lastActivityAtMs - left.lastActivityAtMs;
+    if (activityDiff !== 0) {
+      return activityDiff;
+    }
+  } else if (left.lastActivityAtMs !== null) {
+    return -1;
+  } else if (right.lastActivityAtMs !== null) {
+    return 1;
   }
-  return `${left.agent}:${left.sessionId}`.localeCompare(`${right.agent}:${right.sessionId}`);
+  const agentDiff = AGENT_RESUME_TIE_ORDER[left.agent] - AGENT_RESUME_TIE_ORDER[right.agent];
+  if (agentDiff !== 0) {
+    return agentDiff;
+  }
+  return compareCodeUnits(`${left.sessionId}:${left.sourcePath}`, `${right.sessionId}:${right.sourcePath}`);
+}
+function compareCodeUnits(left, right) {
+  if (left < right) {
+    return -1;
+  }
+  if (left > right) {
+    return 1;
+  }
+  return 0;
 }
 function isPathInsideOrEqual(parent, child) {
   const rel = relative(resolve3(parent), resolve3(child));
@@ -1094,6 +1148,19 @@ var nodeAgentSessionFileSystem = {
       await handle.close();
     }
   },
+  async readTail(path7, maxBytes) {
+    const fileStat = await stat(path7);
+    const bytesToRead = Math.min(maxBytes, fileStat.size);
+    const start = Math.max(0, fileStat.size - bytesToRead);
+    const handle = await open(path7, "r");
+    try {
+      const buffer = Buffer.alloc(bytesToRead);
+      const { bytesRead } = await handle.read(buffer, 0, bytesToRead, start);
+      return buffer.toString(AGENT_SESSION_STORE.TEXT_ENCODING, 0, bytesRead);
+    } finally {
+      await handle.close();
+    }
+  },
   async stat(path7) {
     const result = await stat(path7);
     return { mtimeMs: result.mtimeMs };
@@ -1787,6 +1854,7 @@ import {
   mkdir as nodeMkdir,
   open as nodeOpen,
   readdir as nodeReaddir,
+  rename as nodeRename,
   rm as nodeRm
 } from "fs/promises";
 import { dirname as dirname2, join as join2 } from "path";
@@ -1880,6 +1948,9 @@ var defaultFileSystem = {
   },
   readdir: nodeReaddir,
   lstat: nodeLstat,
+  rename: async (from, to) => {
+    await nodeRename(from, to);
+  },
   rm: async (path7, options) => {
     await nodeRm(path7, options);
   }
@@ -1972,8 +2043,8 @@ function formatRunTimestamp(date) {
   );
   return `${year}-${month}-${day}${RUN_TIMESTAMP_SEPARATOR}${hours}-${minutes}-${seconds}-${milliseconds}`;
 }
-function generateRunId(randomBytes2 = nodeRandomBytes) {
-  return randomBytes2(STATE_STORE_RUN_TOKEN.ID_BYTES).toString(HEX_ENCODING);
+function generateRunId(randomBytes3 = nodeRandomBytes) {
+  return randomBytes3(STATE_STORE_RUN_TOKEN.ID_BYTES).toString(HEX_ENCODING);
 }
 function createStateStoreRunToken(options) {
   const startedAt = formatRunTimestamp(options.date);
@@ -1995,7 +2066,7 @@ async function createJsonlRunFile(scopeDir, domainName, options = {}) {
   if (!domainRunsDir.ok) return domainRunsDir;
   const maxAttempts = options.maxAttempts ?? RUN_FILE_CREATE_ATTEMPTS;
   const startedDate = (options.now ?? (() => /* @__PURE__ */ new Date()))();
-  const randomBytes2 = options.randomBytes ?? nodeRandomBytes;
+  const randomBytes3 = options.randomBytes ?? nodeRandomBytes;
   try {
     await fs8.mkdir(domainRunsDir.value, { recursive: true });
   } catch (error) {
@@ -2005,7 +2076,7 @@ async function createJsonlRunFile(scopeDir, domainName, options = {}) {
     };
   }
   for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-    const token = createStateStoreRunToken({ date: startedDate, randomBytes: randomBytes2 });
+    const token = createStateStoreRunToken({ date: startedDate, randomBytes: randomBytes3 });
     const name = runFileName(token.runToken);
     const path7 = join2(domainRunsDir.value, name);
     try {
@@ -2528,8 +2599,8 @@ import path2 from "path";
 // src/lib/atomic-file-write.ts
 var TEMP_TOKEN_BYTES = 8;
 var TEMP_SUFFIX = ".tmp";
-function atomicWriteTempPath(targetPath, randomBytes2) {
-  const token = randomBytes2(TEMP_TOKEN_BYTES).toString("hex");
+function atomicWriteTempPath(targetPath, randomBytes3) {
+  const token = randomBytes3(TEMP_TOKEN_BYTES).toString("hex");
   return `${targetPath}.${token}${TEMP_SUFFIX}`;
 }
 async function writeFileAtomic(targetPath, content, options) {
@@ -3010,6 +3081,7 @@ var AGENT = {
   CLAUDE_CODE: "claudeCode"
 };
 var HARNESS_ENVIRONMENT_CONFIG_FIELDS = {
+  METHODOLOGY: "methodology",
   INSTRUCTIONS: "instructions",
   AGENTS: "agents",
   PLUGIN_BOOTSTRAP: "pluginBootstrap",
@@ -3029,6 +3101,8 @@ var HARNESS_ENVIRONMENT_CONFIG_FIELDS = {
   VERSION: "version",
   MARKETPLACE: "marketplace"
 };
+var DEFAULT_METHODOLOGY_SOURCE = "outcomeeng/spec-tree";
+var DEFAULT_METHODOLOGY_VERSION = "installed";
 var AGENT_SET = new Set(Object.values(AGENT));
 var DEFAULT_AGENT_INSTRUCTION_TARGET_AGENTS = [
   AGENT.CODEX,
@@ -3036,6 +3110,10 @@ var DEFAULT_AGENT_INSTRUCTION_TARGET_AGENTS = [
 ];
 var DEFAULT_AGENT_INSTRUCTION_FILE_PATH = "AGENTS.md";
 var DEFAULT_HARNESS_ENVIRONMENT_CONFIG = {
+  methodology: {
+    source: DEFAULT_METHODOLOGY_SOURCE,
+    version: DEFAULT_METHODOLOGY_VERSION
+  },
   instructions: {
     files: [
       {
@@ -3069,10 +3147,15 @@ var DEFAULT_HARNESS_ENVIRONMENT_CONFIG = {
   }
 };
 var HARNESS_ENVIRONMENT_ALLOWED_FIELDS = /* @__PURE__ */ new Set([
+  HARNESS_ENVIRONMENT_CONFIG_FIELDS.METHODOLOGY,
   HARNESS_ENVIRONMENT_CONFIG_FIELDS.INSTRUCTIONS,
   HARNESS_ENVIRONMENT_CONFIG_FIELDS.AGENTS,
   HARNESS_ENVIRONMENT_CONFIG_FIELDS.PLUGIN_BOOTSTRAP
 ]);
+var HARNESS_ENVIRONMENT_METHODOLOGY_ALLOWED_FIELDS = /* @__PURE__ */ new Set([
+  HARNESS_ENVIRONMENT_CONFIG_FIELDS.SOURCE,
+  HARNESS_ENVIRONMENT_CONFIG_FIELDS.VERSION
+]);
 var HARNESS_ENVIRONMENT_INSTRUCTIONS_ALLOWED_FIELDS = /* @__PURE__ */ new Set([
   HARNESS_ENVIRONMENT_CONFIG_FIELDS.FILES
 ]);
@@ -3137,6 +3220,21 @@ function validateBoolean(path7, value) {
   }
   return { ok: true, value };
 }
+function validateMethodology(raw) {
+  const sectionPath = `${HARNESS_ENVIRONMENT_SECTION}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.METHODOLOGY}`;
+  if (!isRecord2(raw)) {
+    return { ok: false, error: `${sectionPath} must be an object` };
+  }
+  const unknown = rejectUnknownFields(sectionPath, raw, HARNESS_ENVIRONMENT_METHODOLOGY_ALLOWED_FIELDS);
+  if (!unknown.ok) return unknown;
+  const sourceRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.SOURCE];
+  const source = sourceRaw === void 0 ? { ok: true, value: DEFAULT_HARNESS_ENVIRONMENT_CONFIG.methodology.source } : validateNonEmptyString(`${sectionPath}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.SOURCE}`, sourceRaw);
+  if (!source.ok) return source;
+  const versionRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.VERSION];
+  const version2 = versionRaw === void 0 ? { ok: true, value: DEFAULT_HARNESS_ENVIRONMENT_CONFIG.methodology.version } : validateNonEmptyString(`${sectionPath}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.VERSION}`, versionRaw);
+  if (!version2.ok) return version2;
+  return { ok: true, value: { source: source.value, version: version2.value } };
+}
 function validateAgent(path7, value) {
   if (typeof value !== "string" || !isAgent(value)) {
     return { ok: false, error: `${path7} must be a registered agent` };
@@ -3223,37 +3321,37 @@ function validateAgents(raw) {
   }
   return { ok: true, value: agents };
 }
-function validateAgentConfig(path7, raw, defaults5) {
+function validateAgentConfig(path7, raw, defaults6) {
   if (!isRecord2(raw)) return { ok: false, error: `${path7} must be an object` };
   const unknown = rejectUnknownFields(path7, raw, HARNESS_ENVIRONMENT_AGENT_CONFIG_ALLOWED_FIELDS);
   if (!unknown.ok) return unknown;
   const enabledRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.ENABLED];
-  const enabled = enabledRaw === void 0 ? { ok: true, value: defaults5.enabled } : validateBoolean(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.ENABLED}`, enabledRaw);
+  const enabled = enabledRaw === void 0 ? { ok: true, value: defaults6.enabled } : validateBoolean(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.ENABLED}`, enabledRaw);
   if (!enabled.ok) return enabled;
   const hooksRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.HOOKS];
-  const hooks = hooksRaw === void 0 ? { ok: true, value: defaults5.hooks } : validateAgentHooks(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.HOOKS}`, hooksRaw, defaults5.hooks);
+  const hooks = hooksRaw === void 0 ? { ok: true, value: defaults6.hooks } : validateAgentHooks(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.HOOKS}`, hooksRaw, defaults6.hooks);
   if (!hooks.ok) return hooks;
   return { ok: true, value: { enabled: enabled.value, hooks: hooks.value } };
 }
-function validateAgentHooks(path7, raw, defaults5) {
+function validateAgentHooks(path7, raw, defaults6) {
   if (!isRecord2(raw)) return { ok: false, error: `${path7} must be an object` };
   const unknown = rejectUnknownFields(path7, raw, HARNESS_ENVIRONMENT_AGENT_HOOKS_ALLOWED_FIELDS);
   if (!unknown.ok) return unknown;
   const sessionStartRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.SESSION_START];
-  const sessionStart = sessionStartRaw === void 0 ? { ok: true, value: defaults5.sessionStart } : validateSessionStartHooks(
+  const sessionStart = sessionStartRaw === void 0 ? { ok: true, value: defaults6.sessionStart } : validateSessionStartHooks(
     `${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.SESSION_START}`,
     sessionStartRaw,
-    defaults5.sessionStart
+    defaults6.sessionStart
   );
   if (!sessionStart.ok) return sessionStart;
   return { ok: true, value: { sessionStart: sessionStart.value } };
 }
-function validateSessionStartHooks(path7, raw, defaults5) {
+function validateSessionStartHooks(path7, raw, defaults6) {
   if (!isRecord2(raw)) return { ok: false, error: `${path7} must be an object` };
   const unknown = rejectUnknownFields(path7, raw, HARNESS_ENVIRONMENT_SESSION_START_HOOKS_ALLOWED_FIELDS);
   if (!unknown.ok) return unknown;
   const compactStdoutRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.COMPACT_STDOUT];
-  const compactStdout = compactStdoutRaw === void 0 ? { ok: true, value: defaults5.compactStdout } : validateBoolean(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.COMPACT_STDOUT}`, compactStdoutRaw);
+  const compactStdout = compactStdoutRaw === void 0 ? { ok: true, value: defaults6.compactStdout } : validateBoolean(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.COMPACT_STDOUT}`, compactStdoutRaw);
   if (!compactStdout.ok) return compactStdout;
   return { ok: true, value: { compactStdout: compactStdout.value } };
 }
@@ -3326,8 +3424,8 @@ function validatePluginBootstrap(raw) {
     }
   };
 }
-function validateEntryArray(path7, raw, validateEntry, defaults5) {
-  if (raw === void 0) return { ok: true, value: defaults5 };
+function validateEntryArray(path7, raw, validateEntry, defaults6) {
+  if (raw === void 0) return { ok: true, value: defaults6 };
   if (!Array.isArray(raw)) return { ok: false, error: `${path7} must be an array` };
   const entries = [];
   for (const [index, entry] of raw.entries()) {
@@ -3518,6 +3616,9 @@ function validate(value) {
     HARNESS_ENVIRONMENT_ALLOWED_FIELDS
   );
   if (!unknown.ok) return unknown;
+  const methodologyRaw = value[HARNESS_ENVIRONMENT_CONFIG_FIELDS.METHODOLOGY];
+  const methodology = methodologyRaw === void 0 ? { ok: true, value: DEFAULT_HARNESS_ENVIRONMENT_CONFIG.methodology } : validateMethodology(methodologyRaw);
+  if (!methodology.ok) return methodology;
   const instructionsRaw = value[HARNESS_ENVIRONMENT_CONFIG_FIELDS.INSTRUCTIONS];
   const instructions = instructionsRaw === void 0 ? { ok: true, value: DEFAULT_HARNESS_ENVIRONMENT_CONFIG.instructions } : validateInstructions(instructionsRaw);
   if (!instructions.ok) return instructions;
@@ -3530,6 +3631,7 @@ function validate(value) {
   return {
     ok: true,
     value: {
+      methodology: methodology.value,
       instructions: instructions.value,
       agents: agents.value,
       pluginBootstrap: pluginBootstrap.value
@@ -3618,6 +3720,36 @@ var diagnoseConfigDescriptor = {
   validate: validate2
 };
 
+// src/lib/agent-run-journal/config.ts
+var RUNTIME_SECTION = "runtime";
+var RUNTIME_CONFIG_FIELDS = {
+  EVENT_NAMESPACE: "eventNamespace"
+};
+var RUNTIME_EVENT_NAMESPACE_DEFAULT = "sh.spx";
+var defaults2 = { eventNamespace: RUNTIME_EVENT_NAMESPACE_DEFAULT };
+function validate3(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return { ok: false, error: `${RUNTIME_SECTION} section must be an object` };
+  }
+  const candidate = value;
+  const raw = candidate[RUNTIME_CONFIG_FIELDS.EVENT_NAMESPACE];
+  if (raw === void 0) {
+    return { ok: true, value: { eventNamespace: RUNTIME_EVENT_NAMESPACE_DEFAULT } };
+  }
+  if (typeof raw !== "string" || raw.trim().length === 0) {
+    return {
+      ok: false,
+      error: `${RUNTIME_SECTION}.${RUNTIME_CONFIG_FIELDS.EVENT_NAMESPACE} must be a non-empty string`
+    };
+  }
+  return { ok: true, value: { eventNamespace: raw } };
+}
+var runtimeConfigDescriptor = {
+  section: RUNTIME_SECTION,
+  defaults: defaults2,
+  validate: validate3
+};
+
 // src/lib/file-inclusion/adapters/eslint.ts
 function eslintAdapter(scope2, config) {
   return scope2.excluded.flatMap((entry) => [config.ignoreFlag, entry.path]);
@@ -3678,7 +3810,7 @@ var DEFAULT_SCOPE_CONFIG = {};
 var DEFAULT_TOOLS_CONFIG = Object.fromEntries(
   Object.entries(TOOL_DEFAULT_FLAGS).map(([name, flag]) => [name, { ignoreFlag: flag }])
 );
-var defaults2 = {
+var defaults3 = {
   scope: DEFAULT_SCOPE_CONFIG,
   tools: DEFAULT_TOOLS_CONFIG
 };
@@ -3750,7 +3882,7 @@ function validateTools(raw) {
   }
   return { ok: true, value: tools };
 }
-function validate3(value) {
+function validate4(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { ok: false, error: `${FILE_INCLUSION_SECTION} section must be an object` };
   }
@@ -3777,60 +3909,7 @@ function validate3(value) {
 }
 var fileInclusionConfigDescriptor = {
   section: FILE_INCLUSION_SECTION,
-  defaults: defaults2,
-  validate: validate3
-};
-
-// src/config/source-roots.ts
-var TEST_RELEVANT_SOURCE_ROOT_PREFIX = {
-  SOURCE: "src/",
-  TESTING: "testing/",
-  SCRIPTS: "scripts/",
-  ESLINT_RULES: "eslint-rules/"
-};
-var TEST_RELEVANT_SOURCE_ROOT_PREFIXES = [
-  TEST_RELEVANT_SOURCE_ROOT_PREFIX.SOURCE,
-  TEST_RELEVANT_SOURCE_ROOT_PREFIX.TESTING,
-  TEST_RELEVANT_SOURCE_ROOT_PREFIX.SCRIPTS,
-  TEST_RELEVANT_SOURCE_ROOT_PREFIX.ESLINT_RULES
-];
-
-// src/lib/precommit/config.ts
-var PRECOMMIT_SECTION = "precommit";
-var PRECOMMIT_DEFAULTS = {
-  sourceDirs: TEST_RELEVANT_SOURCE_ROOT_PREFIXES,
-  testPattern: ".test.ts"
-};
-function validate4(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return { ok: false, error: `${PRECOMMIT_SECTION} section must be an object` };
-  }
-  const candidate = value;
-  const sourceDirs = candidate["sourceDirs"] ?? PRECOMMIT_DEFAULTS.sourceDirs;
-  if (!Array.isArray(sourceDirs) || !sourceDirs.every((x) => typeof x === "string" && x.length > 0)) {
-    return {
-      ok: false,
-      error: `${PRECOMMIT_SECTION}.sourceDirs must be a non-empty array of non-empty strings`
-    };
-  }
-  const testPattern = candidate["testPattern"] ?? PRECOMMIT_DEFAULTS.testPattern;
-  if (typeof testPattern !== "string" || testPattern.length === 0) {
-    return {
-      ok: false,
-      error: `${PRECOMMIT_SECTION}.testPattern must be a non-empty string`
-    };
-  }
-  return {
-    ok: true,
-    value: {
-      sourceDirs,
-      testPattern
-    }
-  };
-}
-var precommitConfigDescriptor = {
-  section: PRECOMMIT_SECTION,
-  defaults: PRECOMMIT_DEFAULTS,
+  defaults: defaults3,
   validate: validate4
 };
 
@@ -4194,7 +4273,7 @@ var TESTING_CONFIG_FIELDS = {
   PASSING_SCOPE: "passingScope"
 };
 var DEFAULT_PASSING_SCOPE = resolveDefaultPassingScope();
-var defaults3 = {
+var defaults4 = {
   passingScope: DEFAULT_PASSING_SCOPE
 };
 function resolveDefaultPassingScope() {
@@ -4214,7 +4293,7 @@ function validate6(value) {
   const candidate = value;
   const passingScopeRaw = candidate[TESTING_CONFIG_FIELDS.PASSING_SCOPE];
   if (passingScopeRaw === void 0) {
-    return { ok: true, value: defaults3 };
+    return { ok: true, value: defaults4 };
   }
   const passingScopeResult = validatePathFilterConfig(
     passingScopeRaw,
@@ -4230,7 +4309,7 @@ function validate6(value) {
 }
 var testingConfigDescriptor = {
   section: TESTING_SECTION,
-  defaults: defaults3,
+  defaults: defaults4,
   validate: validate6
 };
 
@@ -4378,7 +4457,7 @@ var VALIDATION_PATH_TOOL_SUBSECTIONS = {
   LITERAL: "literal",
   FORMATTING: "formatting"
 };
-var defaults4 = {
+var defaults5 = {
   paths: {},
   literal: {
     enabled: true,
@@ -4418,7 +4497,7 @@ function validateLiteral(raw) {
     };
   }
   const candidate = raw;
-  const enabledRaw = candidate[VALIDATION_ENABLED_FIELD] ?? defaults4.literal.enabled;
+  const enabledRaw = candidate[VALIDATION_ENABLED_FIELD] ?? defaults5.literal.enabled;
   if (typeof enabledRaw !== "boolean") {
     return {
       ok: false,
@@ -4443,7 +4522,7 @@ function validateKnip(raw) {
     };
   }
   const candidate = raw;
-  const enabledRaw = candidate[VALIDATION_ENABLED_FIELD] ?? defaults4.knip.enabled;
+  const enabledRaw = candidate[VALIDATION_ENABLED_FIELD] ?? defaults5.knip.enabled;
   if (typeof enabledRaw !== "boolean") {
     return {
       ok: false,
@@ -4470,7 +4549,7 @@ function validate8(value) {
 }
 var validationConfigDescriptor = {
   section: VALIDATION_SECTION,
-  defaults: defaults4,
+  defaults: defaults5,
   validate: validate8
 };
 
@@ -4480,17 +4559,17 @@ var productionRegistry = [
   validationConfigDescriptor,
   testingConfigDescriptor,
   fileInclusionConfigDescriptor,
-  precommitConfigDescriptor,
   harnessEnvironmentConfigDescriptor,
-  diagnoseConfigDescriptor
+  diagnoseConfigDescriptor,
+  runtimeConfigDescriptor
 ];
 
 // src/config/descriptor-digest.ts
 import { createHash as createHash3 } from "crypto";
 var DEFAULT_DESCRIPTOR_PATH = "descriptor section";
-var SHA256_ALGORITHM2 = "sha256";
+var DESCRIPTOR_DIGEST_SHA256_ALGORITHM = "sha256";
 var UTF8_ENCODING2 = "utf8";
-var HEX_ENCODING2 = "hex";
+var DESCRIPTOR_DIGEST_HEX_ENCODING = "hex";
 function canonicalDescriptorJson(value, path7 = DEFAULT_DESCRIPTOR_PATH) {
   const normalized = normalizeDescriptorJsonValue(value, path7, /* @__PURE__ */ new WeakSet());
   if (!normalized.ok) return normalized;
@@ -4499,7 +4578,7 @@ function canonicalDescriptorJson(value, path7 = DEFAULT_DESCRIPTOR_PATH) {
 function digestDescriptorSection(value, path7 = DEFAULT_DESCRIPTOR_PATH) {
   const canonical = canonicalDescriptorJson(value, path7);
   if (!canonical.ok) return canonical;
-  const sha256 = createHash3(SHA256_ALGORITHM2).update(Buffer.from(canonical.value, UTF8_ENCODING2)).digest(HEX_ENCODING2);
+  const sha256 = createHash3(DESCRIPTOR_DIGEST_SHA256_ALGORITHM).update(Buffer.from(canonical.value, UTF8_ENCODING2)).digest(DESCRIPTOR_DIGEST_HEX_ENCODING);
   return {
     ok: true,
     value: {
@@ -6242,7 +6321,7 @@ import {
   mkdir as nodeMkdir2,
   readFile as nodeReadFile,
   readlink as nodeReadlink,
-  rename as nodeRename,
+  rename as nodeRename2,
   rm as nodeRm2,
   symlink as nodeSymlink,
   writeFile as nodeWriteFile
@@ -6254,7 +6333,7 @@ var defaultOccupancyFileSystem = {
   writeFile: async (path7, data) => {
     await nodeWriteFile(path7, data);
   },
-  rename: nodeRename,
+  rename: nodeRename2,
   symlink: nodeSymlink,
   readlink: nodeReadlink,
   readFile: nodeReadFile,
@@ -7145,9 +7224,9 @@ var JOURNAL_RUN_STATE_INCOMPLETE_REASON = {
 };
 var JOURNAL_RUN_EVENT = {
   SOURCE: "/spx/journal",
-  STARTED_TYPE: "com.outcomeeng.spx.journal.run.started",
-  PROGRESS_TYPE: "com.outcomeeng.spx.journal.run.progress",
-  COMPLETED_TYPE: "com.outcomeeng.spx.journal.run.completed"
+  STARTED_TYPE: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.journal.run.started`,
+  PROGRESS_TYPE: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.journal.run.progress`,
+  COMPLETED_TYPE: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.journal.run.completed`
 };
 var JOURNAL_RUN_STATE_FIELDS = {
   BRANCH_NAME: "branchName",
@@ -7166,13 +7245,18 @@ var JOURNAL_RUN_STATE_FIELDS = {
   STATUS: "status"
 };
 function foldJournalRunState(events, sealed) {
-  if (!sealed) return { ok: false, reason: JOURNAL_RUN_STATE_INCOMPLETE_REASON.UNSEALED };
+  if (!sealed) {
+    return { ok: false, reason: JOURNAL_RUN_STATE_INCOMPLETE_REASON.UNSEALED };
+  }
   let completed;
   for (const event of events) {
     if (event.type === JOURNAL_RUN_EVENT.COMPLETED_TYPE) completed = event;
   }
   if (completed === void 0) {
-    return { ok: false, reason: JOURNAL_RUN_STATE_INCOMPLETE_REASON.MISSING_STATE };
+    return {
+      ok: false,
+      reason: JOURNAL_RUN_STATE_INCOMPLETE_REASON.MISSING_STATE
+    };
   }
   const validated = validateJournalRunState(completed.data);
   if (!validated.ok) {
@@ -7185,13 +7269,17 @@ function foldJournalRunState(events, sealed) {
   return validated;
 }
 function isJournalRunStateStatus(value) {
-  return typeof value === "string" && Object.values(JOURNAL_RUN_STATE_STATUS).includes(value);
+  return typeof value === "string" && Object.values(JOURNAL_RUN_STATE_STATUS).includes(
+    value
+  );
 }
 function isJournalTargetKind(value) {
   return typeof value === "string" && Object.values(JOURNAL_TARGET_KIND).includes(value);
 }
 function validateJournalRunState(value) {
-  if (!isRecord5(value)) return { ok: false, error: "journal run state must be an object" };
+  if (!isRecord5(value)) {
+    return { ok: false, error: "journal run state must be an object" };
+  }
   const identity = readRunStateIdentity(value);
   if (!identity.ok) return identity;
   const body = readRunStateBody(value);
@@ -7203,9 +7291,15 @@ function readRunStateIdentity(value) {
   if (!branchName.ok) return branchName;
   const branchSlug = readString(value, JOURNAL_RUN_STATE_FIELDS.BRANCH_SLUG);
   if (!branchSlug.ok) return branchSlug;
-  const targetKind = readTargetKind(value, JOURNAL_RUN_STATE_FIELDS.TARGET_KIND);
+  const targetKind = readTargetKind(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.TARGET_KIND
+  );
   if (!targetKind.ok) return targetKind;
-  const pullRequestNumber = readOptionalNonNegativeInteger(value, JOURNAL_RUN_STATE_FIELDS.PULL_REQUEST_NUMBER);
+  const pullRequestNumber = readOptionalNonNegativeInteger(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.PULL_REQUEST_NUMBER
+  );
   if (!pullRequestNumber.ok) return pullRequestNumber;
   const headSha = readString(value, JOURNAL_RUN_STATE_FIELDS.HEAD_SHA);
   if (!headSha.ok) return headSha;
@@ -7227,9 +7321,15 @@ function readRunStateIdentity(value) {
   };
 }
 function readRunStateBody(value) {
-  const configDigest = readString(value, JOURNAL_RUN_STATE_FIELDS.CONFIG_DIGEST);
+  const configDigest = readString(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.CONFIG_DIGEST
+  );
   if (!configDigest.ok) return configDigest;
-  const participants = readStringArray(value, JOURNAL_RUN_STATE_FIELDS.PARTICIPANTS);
+  const participants = readStringArray(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.PARTICIPANTS
+  );
   if (!participants.ok) return participants;
   const scope2 = readPathFilter(value, JOURNAL_RUN_STATE_FIELDS.SCOPE);
   if (!scope2.ok) return scope2;
@@ -7237,7 +7337,10 @@ function readRunStateBody(value) {
   if (!startedAt.ok) return startedAt;
   const completedAt = readString(value, JOURNAL_RUN_STATE_FIELDS.COMPLETED_AT);
   if (!completedAt.ok) return completedAt;
-  const outputPaths = readStringArray(value, JOURNAL_RUN_STATE_FIELDS.OUTPUT_PATHS);
+  const outputPaths = readStringArray(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.OUTPUT_PATHS
+  );
   if (!outputPaths.ok) return outputPaths;
   const status = readStatus(value, JOURNAL_RUN_STATE_FIELDS.STATUS);
   if (!status.ok) return status;
@@ -7266,7 +7369,10 @@ function readOptionalString(value, field) {
 function readOptionalNonNegativeInteger(value, field) {
   const raw = value[field];
   if (raw === void 0) return { ok: true, value: void 0 };
-  return typeof raw === "number" && Number.isInteger(raw) && raw >= 0 ? { ok: true, value: raw } : { ok: false, error: `${field} must be a non-negative integer when present` };
+  return typeof raw === "number" && Number.isInteger(raw) && raw >= 0 ? { ok: true, value: raw } : {
+    ok: false,
+    error: `${field} must be a non-negative integer when present`
+  };
 }
 function readStringArray(value, field) {
   const raw = value[field];
@@ -7508,6 +7614,7 @@ function createJournal(backend, identity) {
 
 // src/lib/appendable-journal-store/index.ts
 var SEAL_MARKER_SUFFIX = ".sealed";
+var APPENDABLE_JOURNAL_SEAL_MARKER_CONTENT = "";
 var LINE_SEPARATOR3 = "\n";
 function appendableJournalSealMarkerPath(runFilePath) {
   return `${runFilePath}${SEAL_MARKER_SUFFIX}`;
@@ -7547,7 +7654,7 @@ function createAppendableJournalStore(options) {
     readAll,
     async seal() {
       await fs8.mkdir(dirname5(sealMarkerPath), { recursive: true });
-      await fs8.writeFile(sealMarkerPath, "");
+      await fs8.writeFile(sealMarkerPath, APPENDABLE_JOURNAL_SEAL_MARKER_CONTENT);
     },
     async isSealed() {
       return await readFileOrUndefined(fs8, sealMarkerPath) !== void 0;
@@ -8004,6 +8111,20 @@ async function sealJournalRun(ref, options = {}) {
     return { ok: false, error: `${JOURNAL_RUNTIME_ERROR.SEAL_FAILED}: ${toMessage(error)}` };
   }
 }
+async function isJournalRunSealed(ref, options = {}) {
+  const runFilePath = bindRunFilePath(ref);
+  if (!runFilePath.ok) return runFilePath;
+  const fs8 = options.fs ?? defaultFileSystem;
+  if (!await runFileExists(fs8, runFilePath.value)) {
+    return { ok: false, error: JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND };
+  }
+  const store = createAppendableJournalStore({ runFilePath: runFilePath.value, fs: fs8 });
+  try {
+    return { ok: true, value: await store.isSealed() };
+  } catch (error) {
+    return { ok: false, error: `${JOURNAL_RUNTIME_ERROR.READ_FAILED}: ${toMessage(error)}` };
+  }
+}
 async function renderJournalRun(ref, projection, options = {}) {
   const bound = await bindJournal(ref, options.fs);
   if (!bound.ok) return bound;
@@ -11479,6 +11600,20 @@ function aggregateTestExitCode(invocations, unsupportedSelectionCount = 0) {
   return SUCCESS_EXIT_CODE;
 }
 
+// src/config/source-roots.ts
+var TEST_RELEVANT_SOURCE_ROOT_PREFIX = {
+  SOURCE: "src/",
+  TESTING: "testing/",
+  SCRIPTS: "scripts/",
+  ESLINT_RULES: "eslint-rules/"
+};
+var TEST_RELEVANT_SOURCE_ROOT_PREFIXES = [
+  TEST_RELEVANT_SOURCE_ROOT_PREFIX.SOURCE,
+  TEST_RELEVANT_SOURCE_ROOT_PREFIX.TESTING,
+  TEST_RELEVANT_SOURCE_ROOT_PREFIX.SCRIPTS,
+  TEST_RELEVANT_SOURCE_ROOT_PREFIX.ESLINT_RULES
+];
+
 // src/domains/test/changed-set-planning.ts
 var PATH_SEPARATOR = "/";
 var MARKDOWN_EXTENSION = ".md";
@@ -11683,8 +11818,8 @@ var PRODUCT_INPUT_DIGEST_FIELDS = {
   DESCRIPTOR_ID: "descriptorId",
   DIGEST: "digest"
 };
-var SHA256_ALGORITHM3 = "sha256";
-var HEX_ENCODING3 = "hex";
+var SHA256_ALGORITHM2 = "sha256";
+var HEX_ENCODING2 = "hex";
 var SEGMENT_SEPARATOR = "-";
 var defaultFileSystem2 = defaultFileSystem;
 function formatTestRunTimestamp(date) {
@@ -11960,7 +12095,7 @@ function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sha256Hex2(value) {
-  return createHash4(SHA256_ALGORITHM3).update(value).digest(HEX_ENCODING3);
+  return createHash4(SHA256_ALGORITHM2).update(value).digest(HEX_ENCODING2);
 }
 var UNKNOWN_ERROR_MESSAGE = "unknown error";
 function toErrorMessage3(error) {
@@ -19418,13 +19553,13 @@ async function persistVerificationContext(scope2, document, options = {}) {
       const existing = await readExistingContext(fs8, contextPath.value);
       if (!existing.ok) return existing;
       if (existing.value === document.canonicalJson) {
-        return { ok: true, value: { digest: document.digest, contextPath: contextPath.value } };
+        return { ok: true, value: { digest: document.digest, contextPath: contextPath.value, created: false } };
       }
       return { ok: false, error: VERIFICATION_CONTEXT_RUNTIME_ERROR.CONTENT_MISMATCH };
     }
     return { ok: false, error: `${VERIFICATION_CONTEXT_RUNTIME_ERROR.WRITE_FAILED}: ${toMessage(error)}` };
   }
-  return { ok: true, value: { digest: document.digest, contextPath: contextPath.value } };
+  return { ok: true, value: { digest: document.digest, contextPath: contextPath.value, created: true } };
 }
 async function readExistingContext(fs8, contextPath) {
   try {
@@ -19570,6 +19705,7 @@ var verificationContextDomain = {
 import { readFile as readFile13 } from "fs/promises";
 
 // src/commands/verify/cli.ts
+import { randomBytes as randomBytes2 } from "crypto";
 import { dirname as dirname12 } from "path";
 
 // src/domains/verify/verify.ts
@@ -19582,18 +19718,93 @@ var VERIFY_VERB = {
   START: "start",
   INPUT: "input",
   APPEND_SCOPE: "append-scope",
-  APPEND_FINDING: "append-finding"
+  APPEND_FINDING: "append-finding",
+  FINISH: "finish",
+  STATUS: "status",
+  RENDER: "render"
 };
+var VERIFY_LIFECYCLE_ACTION = {
+  SCOPE_ADD: "scope add",
+  FINDING_ADD: "finding add",
+  FINISH: VERIFY_VERB.FINISH
+};
+var UNSEALED_NEXT_ACTIONS = [
+  VERIFY_LIFECYCLE_ACTION.SCOPE_ADD,
+  VERIFY_LIFECYCLE_ACTION.FINDING_ADD,
+  VERIFY_LIFECYCLE_ACTION.FINISH
+];
 var VERIFY_VERIFICATION_TYPE = {
+  AUDIT: "audit",
   REVIEW: "review"
 };
+var VERIFY_VERIFICATION_TYPES = new Set(Object.values(VERIFY_VERIFICATION_TYPE));
+function isVerifyVerificationType(value) {
+  return VERIFY_VERIFICATION_TYPES.has(value);
+}
 var REVIEW_FINDING_DISPOSITION = {
   BLOCKING: "BLOCKING",
   DEBT: "DEBT"
 };
+var REVIEW_SCOPE_COVERAGE_STATE = {
+  CLEAN: "clean",
+  FINDING: "finding"
+};
+var REVIEW_ANCHOR_SIDE = {
+  LEFT: "LEFT",
+  RIGHT: "RIGHT"
+};
+var REVIEW_TERMINAL_STATE = {
+  APPROVED: "approved",
+  CHANGES_REQUESTED: "changes_requested",
+  COMMENTED: "commented"
+};
+var AUDIT_CLASS = {
+  IMPLEMENTATION: "implementation",
+  INSTRUCTIONS: "instructions",
+  SPEC: "spec"
+};
+var AUDIT_KIND = {
+  ADR: "adr",
+  ARCHITECTURE: "architecture",
+  CODE: "code",
+  COVERAGE_GAP: "coverage-gap",
+  EVAL_EVIDENCE: "eval-evidence",
+  GUIDE_TEMPLATE: "guide-template",
+  PDR: "pdr",
+  PROMPT: "prompt",
+  SKILL: "skill",
+  SPEC: "spec",
+  SUBAGENT: "subagent",
+  TESTS: "tests"
+};
+var AUDIT_COVERAGE_REQUIREMENT = {
+  OPTIONAL: "optional",
+  REQUIRED: "required"
+};
+var AUDIT_COVERAGE_STATUS = {
+  AUDITED: "audited",
+  INCOMPLETE: "incomplete",
+  MISSING_SKILL: "missing-skill",
+  NOT_APPLICABLE: "not-applicable",
+  SKIPPED: "skipped",
+  UNSUPPORTED: "unsupported"
+};
+var AUDIT_FINDING_SEVERITY = {
+  BLOCKING: "blocking",
+  DEBT: "debt"
+};
+var TERMINAL_METADATA_VALIDATION_ERROR = {
+  METADATA_INVALID: "metadata-invalid",
+  STATUS_CONFLICT: "status-conflict"
+};
+var VERIFY_EVIDENCE_KIND = {
+  SCOPE: "scope",
+  FINDING: "finding",
+  TERMINAL_METADATA: "terminal-metadata"
+};
 var VERIFY_APPEND_EVENT_TYPE = {
-  SCOPE: "io.spx.verify.scope",
-  FINDING: "io.spx.verify.finding"
+  SCOPE: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.verify.scope`,
+  FINDING: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.verify.finding`
 };
 var VERIFY_EVENT_SOURCE = "/spx/verify";
 var VERIFY_APPEND_EVENT_FIELD = {
@@ -19611,7 +19822,9 @@ var VERIFY_SCOPE_ERROR = {
 var VERIFY_INPUT_DIGEST_PATH = "verify run input";
 function parseChangesetScope(scope2) {
   const separatorIndex = scope2.indexOf(VERIFY_SCOPE_SEPARATOR);
-  if (separatorIndex < 0) return { ok: false, error: VERIFY_SCOPE_ERROR.MALFORMED_CHANGESET };
+  if (separatorIndex < 0) {
+    return { ok: false, error: VERIFY_SCOPE_ERROR.MALFORMED_CHANGESET };
+  }
   const base = scope2.slice(0, separatorIndex);
   const head = scope2.slice(separatorIndex + VERIFY_SCOPE_SEPARATOR.length);
   if (base.length === 0 || head.length === 0 || head.includes(VERIFY_SCOPE_SEPARATOR)) {
@@ -19631,7 +19844,10 @@ function buildRunLocator(parts) {
   };
 }
 function digestRunInput(source, content) {
-  const digest = digestDescriptorSection({ source, content }, VERIFY_INPUT_DIGEST_PATH);
+  const digest = digestDescriptorSection(
+    { source, content },
+    VERIFY_INPUT_DIGEST_PATH
+  );
   if (!digest.ok) return digest;
   return { ok: true, value: digest.value.sha256 };
 }
@@ -19651,7 +19867,10 @@ function verifyInputRecordPath(scope2) {
   if (!token.ok) return token;
   return {
     ok: true,
-    value: join36(runs.value, `${VERIFY_INPUT_RECORD.PREFIX}${token.value}${VERIFY_INPUT_RECORD.SUFFIX}`)
+    value: join36(
+      runs.value,
+      `${VERIFY_INPUT_RECORD.PREFIX}${token.value}${VERIFY_INPUT_RECORD.SUFFIX}`
+    )
   };
 }
 var VERIFY_APPEND_ATTEMPT = 1;
@@ -19665,67 +19884,546 @@ function parseAppendPayload(raw) {
 function isJsonRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function readRequiredString(record6, field) {
+  const value = record6[field];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function readRequiredStringValue(record6, field) {
+  const value = record6[field];
+  return typeof value === "string" ? value : void 0;
+}
+var OPTIONAL_FIELD_STATE = {
+  ABSENT: "absent",
+  INVALID: "invalid",
+  PRESENT: "present"
+};
+function readOptionalString2(record6, field) {
+  if (!(field in record6)) return { state: OPTIONAL_FIELD_STATE.ABSENT };
+  const value = record6[field];
+  return typeof value === "string" && value.length > 0 ? { state: OPTIONAL_FIELD_STATE.PRESENT, value } : { state: OPTIONAL_FIELD_STATE.INVALID };
+}
+function readOptionalPositiveInteger(record6, field) {
+  if (!(field in record6)) return { state: OPTIONAL_FIELD_STATE.ABSENT };
+  const value = record6[field];
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? { state: OPTIONAL_FIELD_STATE.PRESENT, value } : { state: OPTIONAL_FIELD_STATE.INVALID };
+}
+function optionalFieldValue(field) {
+  return field.state === OPTIONAL_FIELD_STATE.PRESENT ? field.value : void 0;
+}
+function readRequiredRecord(record6, field) {
+  const value = record6[field];
+  return isJsonRecord(value) ? value : void 0;
+}
+function readOptionalRecord(record6, field) {
+  if (!(field in record6)) return { state: OPTIONAL_FIELD_STATE.ABSENT };
+  const value = record6[field];
+  return isJsonRecord(value) ? { state: OPTIONAL_FIELD_STATE.PRESENT, value } : { state: OPTIONAL_FIELD_STATE.INVALID };
+}
+function hasInvalidOptionalField(...fields) {
+  return fields.some((field) => field.state === OPTIONAL_FIELD_STATE.INVALID);
+}
 function isReviewFindingDisposition(value) {
   return Object.values(REVIEW_FINDING_DISPOSITION).includes(value);
 }
-function validateReviewFinding(payload) {
+function isReviewScopeCoverageState(value) {
+  return typeof value === "string" && Object.values(REVIEW_SCOPE_COVERAGE_STATE).includes(value);
+}
+function isReviewAnchorSide(value) {
+  return typeof value === "string" && Object.values(REVIEW_ANCHOR_SIDE).includes(value);
+}
+function isReviewTerminalState(value) {
+  return typeof value === "string" && Object.values(REVIEW_TERMINAL_STATE).includes(value);
+}
+function isAuditClass(value) {
+  return typeof value === "string" && Object.values(AUDIT_CLASS).includes(value);
+}
+function isAuditKind(value) {
+  return typeof value === "string" && Object.values(AUDIT_KIND).includes(value);
+}
+function isAuditCoverageRequirement(value) {
+  return typeof value === "string" && Object.values(AUDIT_COVERAGE_REQUIREMENT).includes(value);
+}
+function isAuditCoverageStatus(value) {
+  return typeof value === "string" && Object.values(AUDIT_COVERAGE_STATUS).includes(value);
+}
+function isAuditFindingSeverity(value) {
+  return typeof value === "string" && Object.values(AUDIT_FINDING_SEVERITY).includes(value);
+}
+function isCompatibleAuditKind(auditClass, auditKind) {
+  if (auditKind === AUDIT_KIND.COVERAGE_GAP) return true;
+  if (auditClass === AUDIT_CLASS.INSTRUCTIONS) {
+    return auditKind === AUDIT_KIND.SKILL || auditKind === AUDIT_KIND.SUBAGENT || auditKind === AUDIT_KIND.PROMPT || auditKind === AUDIT_KIND.GUIDE_TEMPLATE;
+  }
+  if (auditClass === AUDIT_CLASS.SPEC) {
+    return auditKind === AUDIT_KIND.SPEC || auditKind === AUDIT_KIND.ADR || auditKind === AUDIT_KIND.PDR;
+  }
+  return auditKind === AUDIT_KIND.CODE || auditKind === AUDIT_KIND.TESTS || auditKind === AUDIT_KIND.ARCHITECTURE || auditKind === AUDIT_KIND.EVAL_EVIDENCE;
+}
+function evidencePayloadValidator(validator) {
+  return (input) => validator(input.payload);
+}
+function readReviewFindingMetadata(payload) {
   if (!isJsonRecord(payload)) return void 0;
   const { disposition, summary } = payload;
   if (!isReviewFindingDisposition(disposition)) return void 0;
   if (typeof summary !== "string" || summary.length === 0) return void 0;
   return { disposition, summary };
 }
-var FINDING_VALIDATORS = {
-  [VERIFY_VERIFICATION_TYPE.REVIEW]: validateReviewFinding
-};
-function findingValidatorFor(verificationType) {
-  return FINDING_VALIDATORS[verificationType];
+function validateReviewFinding(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const path7 = readRequiredString(payload, "path");
+  const originalCommit = readRequiredString(payload, "originalCommit");
+  const diffHunk = readRequiredString(payload, "diffHunk");
+  const body = readRequiredString(payload, "body");
+  const { side } = payload;
+  const finding = readReviewFindingMetadata(payload.finding);
+  if (path7 === void 0 || originalCommit === void 0 || diffHunk === void 0 || body === void 0) {
+    return void 0;
+  }
+  if (!isReviewAnchorSide(side)) return void 0;
+  if (finding === void 0) return void 0;
+  const line = readOptionalPositiveInteger(payload, "line");
+  const position = readOptionalPositiveInteger(payload, "position");
+  const providerIdentity = readOptionalString2(payload, "providerIdentity");
+  const url = readOptionalString2(payload, "url");
+  if (hasInvalidOptionalField(line, position, providerIdentity, url)) return void 0;
+  const lineValue = optionalFieldValue(line);
+  const positionValue = optionalFieldValue(position);
+  if (lineValue === void 0 && positionValue === void 0) return void 0;
+  const providerIdentityValue = optionalFieldValue(providerIdentity);
+  const urlValue = optionalFieldValue(url);
+  return {
+    path: path7,
+    side,
+    originalCommit,
+    diffHunk,
+    body,
+    finding,
+    ...providerIdentityValue === void 0 ? {} : { providerIdentity: providerIdentityValue },
+    ...lineValue === void 0 ? {} : { line: lineValue },
+    ...positionValue === void 0 ? {} : { position: positionValue },
+    ...urlValue === void 0 ? {} : { url: urlValue }
+  };
 }
-function findAppendedSequence(events, idempotencyKey, eventType) {
-  const match = events.find(
-    (event) => event.type === eventType && isJsonRecord(event.data) && event.data[VERIFY_APPEND_EVENT_FIELD.IDEMPOTENCY_KEY] === idempotencyKey
-  );
-  return match?.seq;
+function validateReviewScope(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const path7 = readRequiredString(payload, "path");
+  const commit = readRequiredString(payload, "commit");
+  const { side, coverageState } = payload;
+  if (path7 === void 0 || commit === void 0) return void 0;
+  if (!isReviewAnchorSide(side)) return void 0;
+  if (!isReviewScopeCoverageState(coverageState)) return void 0;
+  const line = readOptionalPositiveInteger(payload, "line");
+  const position = readOptionalPositiveInteger(payload, "position");
+  const providerIdentity = readOptionalString2(payload, "providerIdentity");
+  const url = readOptionalString2(payload, "url");
+  if (hasInvalidOptionalField(line, position, providerIdentity, url)) return void 0;
+  const lineValue = optionalFieldValue(line);
+  const positionValue = optionalFieldValue(position);
+  const providerIdentityValue = optionalFieldValue(providerIdentity);
+  const urlValue = optionalFieldValue(url);
+  return {
+    path: path7,
+    side,
+    commit,
+    coverageState,
+    ...providerIdentityValue === void 0 ? {} : { providerIdentity: providerIdentityValue },
+    ...lineValue === void 0 ? {} : { line: lineValue },
+    ...positionValue === void 0 ? {} : { position: positionValue },
+    ...urlValue === void 0 ? {} : { url: urlValue }
+  };
 }
-function buildAppendEvent(args) {
+function validateReviewTerminalMetadata(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const actor = readRequiredString(payload, "actor");
+  const body = readRequiredStringValue(payload, "body");
+  const submittedAt = readRequiredString(payload, "submittedAt");
+  const commit = readRequiredString(payload, "commit");
+  const { state } = payload;
+  if (actor === void 0 || body === void 0 || submittedAt === void 0 || commit === void 0) return void 0;
+  if (!isReviewTerminalState(state)) return void 0;
+  const providerIdentity = readOptionalString2(payload, "providerIdentity");
+  const url = readOptionalString2(payload, "url");
+  if (hasInvalidOptionalField(providerIdentity, url)) return void 0;
+  const providerIdentityValue = optionalFieldValue(providerIdentity);
+  const urlValue = optionalFieldValue(url);
   return {
-    id: args.idempotencyKey,
-    source: VERIFY_EVENT_SOURCE,
-    type: args.eventType,
-    time: args.at.toISOString(),
-    attempt: VERIFY_APPEND_ATTEMPT,
-    data: {
-      [VERIFY_APPEND_EVENT_FIELD.IDEMPOTENCY_KEY]: args.idempotencyKey,
-      [VERIFY_APPEND_EVENT_FIELD.PAYLOAD]: args.payload
+    actor,
+    state,
+    body,
+    submittedAt,
+    commit,
+    ...providerIdentityValue === void 0 ? {} : { providerIdentity: providerIdentityValue },
+    ...urlValue === void 0 ? {} : { url: urlValue }
+  };
+}
+function validateReviewTerminal(input) {
+  const validated = input.metadata === void 0 ? void 0 : validateReviewTerminalMetadata(input.metadata);
+  if (input.metadata !== void 0 && validated === void 0) {
+    return { ok: false, error: TERMINAL_METADATA_VALIDATION_ERROR.METADATA_INVALID };
+  }
+  const evidenceStatus = expectedReviewEvidenceTerminalStatus(input.events);
+  const metadataStatus = expectedReviewMetadataTerminalStatus(validated);
+  if (evidenceStatus !== void 0 && metadataStatus !== void 0 && evidenceStatus !== metadataStatus) {
+    return { ok: false, error: TERMINAL_METADATA_VALIDATION_ERROR.STATUS_CONFLICT };
+  }
+  const expectedStatus = evidenceStatus ?? metadataStatus;
+  if (expectedStatus !== void 0 && input.terminalStatus !== expectedStatus) {
+    return { ok: false, error: TERMINAL_METADATA_VALIDATION_ERROR.STATUS_CONFLICT };
+  }
+  if (validated === void 0) return { ok: true, value: void 0 };
+  return {
+    ok: true,
+    value: {
+      actor: validated.actor,
+      state: validated.state,
+      body: validated.body,
+      submittedAt: validated.submittedAt,
+      commit: validated.commit,
+      ...validated.providerIdentity === void 0 ? {} : { providerIdentity: validated.providerIdentity },
+      ...validated.url === void 0 ? {} : { url: validated.url }
     }
   };
 }
-
-// src/commands/verify/cli.ts
-var VERIFY_CLI_EXIT_CODE = {
-  OK: 0,
-  ERROR: 1
-};
-var VERIFY_CLI_ENV = {
-  BRANCH: SPX_VERIFY_ENV.BRANCH
-};
-var VERIFY_CLI_ERROR = {
-  INPUT_REQUIRED: "spx verify start requires --input <input-source>",
-  RUN_REQUIRED: "spx verify existing-run verbs require an explicit --run <run-token>",
-  RUN_NOT_FOUND: "spx verify could not locate the requested run",
-  CHANGED_SCOPE_FAILED: "spx verify could not derive the changeset changed-file scope",
-  INPUT_PERSIST_FAILED: "spx verify could not persist the recorded run input",
-  INPUT_READ_FAILED: "spx verify could not read the recorded run input",
-  PAYLOAD_REQUIRED: "spx verify append verbs require --payload <payload-source>",
-  IDEMPOTENCY_KEY_REQUIRED: "spx verify append verbs require --idempotency-key <key>",
-  PAYLOAD_READ_FAILED: "spx verify could not read the append payload",
-  PAYLOAD_INVALID: "spx verify append payload is not valid JSON",
-  FINDING_INVALID: "spx verify append-finding payload failed verification-type validation",
-  UNSUPPORTED_VERIFICATION_TYPE: "spx verify append-finding has no finding validator for the verification type",
-  APPEND_FAILED: "spx verify could not append the evidence event"
-};
-function okResult3(output) {
-  return { exitCode: VERIFY_CLI_EXIT_CODE.OK, output };
+function validateAuditProducerIdentity(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const producerKind = readRequiredString(payload, "producerKind");
+  const agentName = readRequiredString(payload, "agentName");
+  const agentOwningPluginName = readRequiredString(payload, "agentOwningPluginName");
+  const skillName = readRequiredString(payload, "skillName");
+  const skillOwningPluginName = readRequiredString(payload, "skillOwningPluginName");
+  const invocationRole = readRequiredString(payload, "invocationRole");
+  if (producerKind === void 0 || agentName === void 0 || agentOwningPluginName === void 0 || skillName === void 0 || skillOwningPluginName === void 0 || invocationRole === void 0) {
+    return void 0;
+  }
+  return {
+    producerKind,
+    agentName,
+    agentOwningPluginName,
+    skillName,
+    skillOwningPluginName,
+    invocationRole
+  };
+}
+function validateAuditProducerProvenance(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const agentOwningPluginVersion = readRequiredString(payload, "agentOwningPluginVersion");
+  const skillOwningPluginVersion = readRequiredString(payload, "skillOwningPluginVersion");
+  if (agentOwningPluginVersion === void 0 || skillOwningPluginVersion === void 0) return void 0;
+  const toolVersion = readOptionalString2(payload, "toolVersion");
+  if (hasInvalidOptionalField(toolVersion)) return void 0;
+  const toolVersionValue = optionalFieldValue(toolVersion);
+  return {
+    agentOwningPluginVersion,
+    skillOwningPluginVersion,
+    ...toolVersionValue === void 0 ? {} : { toolVersion: toolVersionValue }
+  };
+}
+function validateAuditPriorContextPartitions(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const changedFilePartition = readRequiredString(payload, "changedFilePartition");
+  const concernPartition = readRequiredString(payload, "concernPartition");
+  if (changedFilePartition === void 0 || concernPartition === void 0) return void 0;
+  const languagePartition = readOptionalString2(payload, "languagePartition");
+  if (hasInvalidOptionalField(languagePartition)) return void 0;
+  const languagePartitionValue = optionalFieldValue(languagePartition);
+  return {
+    changedFilePartition,
+    concernPartition,
+    ...languagePartitionValue === void 0 ? {} : { languagePartition: languagePartitionValue }
+  };
+}
+function validateOptionalAuditProducerProvenance(producerProvenance) {
+  if (producerProvenance.state !== OPTIONAL_FIELD_STATE.PRESENT) return producerProvenance;
+  const value = validateAuditProducerProvenance(producerProvenance.value);
+  return value === void 0 ? { state: OPTIONAL_FIELD_STATE.INVALID } : { state: OPTIONAL_FIELD_STATE.PRESENT, value };
+}
+function auditKindAllowsProducerProvenance(auditKind, producerProvenance) {
+  return auditKind !== AUDIT_KIND.COVERAGE_GAP || producerProvenance === void 0;
+}
+function auditKindAllowsCoverageStatus(auditKind, coverageStatus) {
+  return auditKind !== AUDIT_KIND.COVERAGE_GAP || coverageStatus !== AUDIT_COVERAGE_STATUS.AUDITED && coverageStatus !== AUDIT_COVERAGE_STATUS.NOT_APPLICABLE;
+}
+function validateAuditScope(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const unitId = readRequiredString(payload, "unitId");
+  const subject = readRequiredString(payload, "subject");
+  const { auditClass, auditKind, coverageRequirement, coverageStatus } = payload;
+  if (unitId === void 0 || subject === void 0) return void 0;
+  if (!isAuditClass(auditClass) || !isAuditKind(auditKind)) return void 0;
+  if (!isCompatibleAuditKind(auditClass, auditKind)) return void 0;
+  if (!isAuditCoverageRequirement(coverageRequirement)) return void 0;
+  if (!isAuditCoverageStatus(coverageStatus)) return void 0;
+  if (!auditKindAllowsCoverageStatus(auditKind, coverageStatus)) return void 0;
+  const priorContext = validateAuditPriorContextPartitions(readRequiredRecord(payload, "priorContext"));
+  const expectedProducer = validateAuditProducerIdentity(readRequiredRecord(payload, "expectedProducer"));
+  const recordedByRunDriver = validateAuditProducerIdentity(readRequiredRecord(payload, "recordedByRunDriver"));
+  if (priorContext === void 0 || expectedProducer === void 0 || recordedByRunDriver === void 0) {
+    return void 0;
+  }
+  const parentUnitId = readOptionalString2(payload, "parentUnitId");
+  const producerProvenance = validateOptionalAuditProducerProvenance(
+    readOptionalRecord(payload, "producerProvenance")
+  );
+  if (hasInvalidOptionalField(parentUnitId, producerProvenance)) return void 0;
+  const parentUnitIdValue = optionalFieldValue(parentUnitId);
+  const producerProvenanceValue = optionalFieldValue(producerProvenance);
+  if (parentUnitIdValue === unitId) return void 0;
+  if (!auditKindAllowsProducerProvenance(auditKind, producerProvenanceValue)) return void 0;
+  return {
+    unitId,
+    auditClass,
+    auditKind,
+    subject,
+    coverageRequirement,
+    coverageStatus,
+    priorContext,
+    expectedProducer,
+    recordedByRunDriver,
+    ...parentUnitIdValue === void 0 ? {} : { parentUnitId: parentUnitIdValue },
+    ...producerProvenanceValue === void 0 ? {} : { producerProvenance: producerProvenanceValue }
+  };
+}
+function validateAuditFindingEvidence(evidence) {
+  if (evidence === void 0) return void 0;
+  const observed = readRequiredString(evidence, "observed");
+  const expected = readRequiredString(evidence, "expected");
+  if (observed === void 0 || expected === void 0) return void 0;
+  return { observed, expected };
+}
+function validateAuditFinding(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const unitId = readRequiredString(payload, "unitId");
+  const rule = readRequiredString(payload, "rule");
+  const location = readRequiredString(payload, "location");
+  const message = readRequiredString(payload, "message");
+  const { severity } = payload;
+  if (unitId === void 0 || rule === void 0 || location === void 0 || message === void 0) {
+    return void 0;
+  }
+  if (!isAuditFindingSeverity(severity)) return void 0;
+  const producerIdentity = validateAuditProducerIdentity(readRequiredRecord(payload, "producerIdentity"));
+  const producerProvenance = validateAuditProducerProvenance(readRequiredRecord(payload, "producerProvenance"));
+  const evidence = validateAuditFindingEvidence(readRequiredRecord(payload, "evidence"));
+  if (producerIdentity === void 0 || producerProvenance === void 0 || evidence === void 0) {
+    return void 0;
+  }
+  return {
+    unitId,
+    producerIdentity,
+    producerProvenance,
+    rule,
+    severity,
+    location,
+    message,
+    evidence
+  };
+}
+function auditFindingReferencesRecordedScope(events, finding) {
+  return events.some((event) => {
+    if (event.type !== VERIFY_APPEND_EVENT_TYPE.SCOPE || !isJsonRecord(event.data)) return false;
+    const scope2 = validateAuditScope(event.data[VERIFY_APPEND_EVENT_FIELD.PAYLOAD]);
+    return scope2?.unitId === finding.unitId;
+  });
+}
+function validateAuditFindingForRun(input) {
+  const finding = validateAuditFinding(input.payload);
+  if (finding === void 0) return void 0;
+  return auditFindingReferencesRecordedScope(input.events, finding) ? finding : void 0;
+}
+var EVIDENCE_VALIDATORS = {
+  [VERIFY_VERIFICATION_TYPE.AUDIT]: {
+    [VERIFY_EVIDENCE_KIND.SCOPE]: evidencePayloadValidator(validateAuditScope),
+    [VERIFY_EVIDENCE_KIND.FINDING]: validateAuditFindingForRun,
+    [VERIFY_EVIDENCE_KIND.TERMINAL_METADATA]: validateAuditTerminal
+  },
+  [VERIFY_VERIFICATION_TYPE.REVIEW]: {
+    [VERIFY_EVIDENCE_KIND.SCOPE]: evidencePayloadValidator(validateReviewScope),
+    [VERIFY_EVIDENCE_KIND.FINDING]: evidencePayloadValidator(validateReviewFinding),
+    [VERIFY_EVIDENCE_KIND.TERMINAL_METADATA]: validateReviewTerminal
+  }
+};
+function evidenceValidatorFor(verificationType, evidenceKind) {
+  return EVIDENCE_VALIDATORS[verificationType]?.[evidenceKind];
+}
+function terminalMetadataValidatorFor(verificationType) {
+  return EVIDENCE_VALIDATORS[verificationType]?.[VERIFY_EVIDENCE_KIND.TERMINAL_METADATA];
+}
+function expectedReviewEvidenceTerminalStatus(events) {
+  if (countVerifyFindings(events) > 0 || countReviewScopeFindingUnits(events) > 0) {
+    return JOURNAL_RUN_STATE_STATUS.REJECTED;
+  }
+  return void 0;
+}
+function auditCoverageRejectsRun(scope2) {
+  if (scope2.coverageRequirement !== AUDIT_COVERAGE_REQUIREMENT.REQUIRED) return false;
+  return scope2.auditKind === AUDIT_KIND.COVERAGE_GAP || scope2.coverageStatus === AUDIT_COVERAGE_STATUS.UNSUPPORTED || scope2.coverageStatus === AUDIT_COVERAGE_STATUS.MISSING_SKILL || scope2.coverageStatus === AUDIT_COVERAGE_STATUS.SKIPPED || scope2.coverageStatus === AUDIT_COVERAGE_STATUS.INCOMPLETE;
+}
+function expectedAuditTerminalStatus(events) {
+  const hasFinding = countVerifyFindings(events) > 0;
+  const auditScopeEvents = events.filter((event) => {
+    if (event.type !== VERIFY_APPEND_EVENT_TYPE.SCOPE || !isJsonRecord(event.data)) return false;
+    return validateAuditScope(event.data[VERIFY_APPEND_EVENT_FIELD.PAYLOAD]) !== void 0;
+  });
+  const hasUncoveredRequiredScope = events.some((event) => {
+    if (event.type !== VERIFY_APPEND_EVENT_TYPE.SCOPE || !isJsonRecord(event.data)) return false;
+    const payload = event.data[VERIFY_APPEND_EVENT_FIELD.PAYLOAD];
+    const scope2 = validateAuditScope(payload);
+    return scope2 === void 0 ? false : auditCoverageRejectsRun(scope2);
+  });
+  return hasFinding || auditScopeEvents.length === 0 || hasUncoveredRequiredScope ? JOURNAL_RUN_STATE_STATUS.REJECTED : JOURNAL_RUN_STATE_STATUS.APPROVED;
+}
+function validateAuditTerminal(input) {
+  if (input.metadata !== void 0) {
+    return { ok: false, error: TERMINAL_METADATA_VALIDATION_ERROR.METADATA_INVALID };
+  }
+  if (input.terminalStatus !== expectedAuditTerminalStatus(input.events)) {
+    return { ok: false, error: TERMINAL_METADATA_VALIDATION_ERROR.STATUS_CONFLICT };
+  }
+  return { ok: true, value: void 0 };
+}
+function expectedReviewMetadataTerminalStatus(metadata) {
+  if (metadata?.state === REVIEW_TERMINAL_STATE.APPROVED) return JOURNAL_RUN_STATE_STATUS.APPROVED;
+  if (metadata?.state === REVIEW_TERMINAL_STATE.CHANGES_REQUESTED) return JOURNAL_RUN_STATE_STATUS.REJECTED;
+  return void 0;
+}
+function findAppendedSequence(events, idempotencyKey, eventType) {
+  const match = events.find(
+    (event) => event.type === eventType && isJsonRecord(event.data) && event.data[VERIFY_APPEND_EVENT_FIELD.IDEMPOTENCY_KEY] === idempotencyKey
+  );
+  return match?.seq;
+}
+function buildAppendEvent(args) {
+  return {
+    id: args.idempotencyKey,
+    source: VERIFY_EVENT_SOURCE,
+    type: args.eventType,
+    time: args.at.toISOString(),
+    attempt: VERIFY_APPEND_ATTEMPT,
+    data: {
+      [VERIFY_APPEND_EVENT_FIELD.IDEMPOTENCY_KEY]: args.idempotencyKey,
+      [VERIFY_APPEND_EVENT_FIELD.PAYLOAD]: args.payload
+    }
+  };
+}
+var VERIFY_TERMINAL_EVENT_TYPE = `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.verify.terminal`;
+var VERIFY_TERMINAL_EVENT_FIELD = {
+  TERMINAL_METADATA: "terminalMetadata",
+  TERMINAL_STATUS: "terminalStatus"
+};
+var VERIFY_TERMINAL_EVENT_ID_PREFIX = "verify-terminal-";
+function isVerifyTerminalStatus(value) {
+  return isJournalRunStateStatus(value);
+}
+function buildTerminalEvent(args) {
+  return {
+    id: `${VERIFY_TERMINAL_EVENT_ID_PREFIX}${args.runToken}`,
+    source: VERIFY_EVENT_SOURCE,
+    type: VERIFY_TERMINAL_EVENT_TYPE,
+    time: args.at.toISOString(),
+    attempt: VERIFY_APPEND_ATTEMPT,
+    data: {
+      [VERIFY_TERMINAL_EVENT_FIELD.TERMINAL_STATUS]: args.terminalStatus,
+      ...args.terminalMetadata === void 0 ? {} : { [VERIFY_TERMINAL_EVENT_FIELD.TERMINAL_METADATA]: args.terminalMetadata }
+    }
+  };
+}
+var VERIFY_NO_EVENTS_SEQUENCE = 0;
+function findTerminalEvent(events) {
+  return events.find((event) => event.type === VERIFY_TERMINAL_EVENT_TYPE);
+}
+function terminalStatusOf(event) {
+  if (event === void 0 || !isJsonRecord(event.data)) return void 0;
+  const status = event.data[VERIFY_TERMINAL_EVENT_FIELD.TERMINAL_STATUS];
+  return typeof status === "string" ? status : void 0;
+}
+function terminalMetadataOf(event) {
+  if (event === void 0 || !isJsonRecord(event.data)) return void 0;
+  return event.data[VERIFY_TERMINAL_EVENT_FIELD.TERMINAL_METADATA];
+}
+function countVerifyFindings(events) {
+  return events.filter(
+    (event) => event.type === VERIFY_APPEND_EVENT_TYPE.FINDING
+  ).length;
+}
+function countReviewScopeFindingUnits(events) {
+  return events.filter((event) => {
+    if (event.type !== VERIFY_APPEND_EVENT_TYPE.SCOPE || !isJsonRecord(event.data)) return false;
+    const payload = event.data[VERIFY_APPEND_EVENT_FIELD.PAYLOAD];
+    const scope2 = validateReviewScope(payload);
+    return scope2?.coverageState === REVIEW_SCOPE_COVERAGE_STATE.FINDING;
+  }).length;
+}
+function lastSequenceOf(events) {
+  return events.reduce(
+    (max, event) => event.seq > max ? event.seq : max,
+    VERIFY_NO_EVENTS_SEQUENCE
+  );
+}
+function projectVerifyRun(events) {
+  const terminal = findTerminalEvent(events);
+  const terminalStatus = terminalStatusOf(terminal);
+  const terminalMetadata = terminalMetadataOf(terminal);
+  const sealed = terminal !== void 0;
+  return {
+    sealed,
+    ...terminalStatus === void 0 ? {} : { terminalStatus },
+    ...terminalMetadata === void 0 ? {} : { terminalMetadata },
+    findingCount: countVerifyFindings(events),
+    lastSequence: lastSequenceOf(events),
+    nextActions: sealed ? [] : UNSEALED_NEXT_ACTIONS
+  };
+}
+
+// src/commands/verify/cli.ts
+var VERIFY_CLI_EXIT_CODE = {
+  OK: 0,
+  ERROR: 1
+};
+var VERIFY_CLI_ENV = {
+  BRANCH: SPX_VERIFY_ENV.BRANCH
+};
+var VERIFY_CLI_ERROR = {
+  INPUT_REQUIRED: "spx verification run start requires --input <input-source>",
+  RUN_REQUIRED: "spx verification run existing-run commands require an explicit --run <run-token>",
+  RUN_NOT_FOUND: "spx verification run could not locate the requested run",
+  RUN_SELECTOR_MISMATCH: "spx verification run selector does not match the recorded run",
+  CHANGED_SCOPE_FAILED: "spx verification run could not derive the changeset changed-file scope",
+  INPUT_PERSIST_FAILED: "spx verification run could not persist the recorded run input",
+  INPUT_READ_FAILED: "spx verification run could not read the recorded run input",
+  PAYLOAD_REQUIRED: "spx verification run evidence-add commands require --payload <payload-source>",
+  IDEMPOTENCY_KEY_REQUIRED: "spx verification run evidence-add commands require --idempotency-key <key>",
+  PAYLOAD_READ_FAILED: "spx verification run could not read the evidence payload",
+  PAYLOAD_INVALID: "spx verification run evidence payload is not valid JSON",
+  RUN_FINISHED: "spx verification run cannot add evidence to a finished run",
+  SCOPE_INVALID: "spx verification run scope add payload failed verification-type validation",
+  FINDING_INVALID: "spx verification run finding add payload failed verification-type validation",
+  UNSUPPORTED_VERIFICATION_TYPE: "spx verification run verification type is not registered",
+  APPEND_FAILED: "spx verification run could not append the evidence event",
+  TERMINAL_STATUS_REQUIRED: "spx verification run finish requires --terminal-status <status>",
+  TERMINAL_STATUS_INVALID: "spx verification run finish requires a terminal status in the journal terminal-status vocabulary",
+  TERMINAL_METADATA_INVALID: "spx verification run terminal metadata failed verification-type validation",
+  TERMINAL_STATUS_CONFLICT: "spx verification run terminal status conflicts with verification-type terminal metadata: status-conflict",
+  FINISH_FAILED: "spx verification run could not record terminal completion",
+  SEAL_FAILED: "spx verification run could not seal the run journal",
+  STATUS_FAILED: "spx verification run could not read the run status",
+  RENDER_FAILED: "spx verification run could not render the run projection"
+};
+var VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD = {
+  RUN: "run=",
+  VERIFICATION_TYPE: "verification-type=",
+  SCOPE_TYPE: "scope-type=",
+  SCOPE: "scope=",
+  BACKEND: "backend=",
+  NAMESPACE: "namespace=",
+  TARGET: "target="
+};
+var VERIFY_START_ROLLBACK_ARTIFACT = {
+  CONTEXT_FILE: "verification context file",
+  RUN_FILE: "journal run file"
+};
+function okResult3(output) {
+  return { exitCode: VERIFY_CLI_EXIT_CODE.OK, output };
 }
 function errorResult3(error) {
   return { exitCode: VERIFY_CLI_EXIT_CODE.ERROR, output: error };
@@ -19781,73 +20479,131 @@ async function persistInputRecord(runScope2, record6, deps) {
   const fs8 = deps.fs ?? defaultFileSystem;
   try {
     await fs8.mkdir(dirname12(path7.value), { recursive: true });
-    await fs8.writeFile(path7.value, JSON.stringify(record6));
+    await writeFileAtomic(path7.value, JSON.stringify(record6), { fs: fs8, randomBytes: randomBytes2 });
     return { ok: true, value: void 0 };
   } catch (error) {
     return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_PERSIST_FAILED}: ${toMessage2(error)}` };
   }
 }
+async function readStartInputContent(source, deps) {
+  try {
+    return { ok: true, value: await deps.readInputSource(source) };
+  } catch (error) {
+    return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_READ_FAILED}: ${toMessage2(error)}` };
+  }
+}
+async function removeStartedRunArtifact(path7, label, deps) {
+  const fs8 = deps.fs ?? defaultFileSystem;
+  try {
+    await fs8.rm(path7, { force: true });
+    return { ok: true, value: void 0 };
+  } catch (error) {
+    return {
+      ok: false,
+      error: `${VERIFY_CLI_ERROR.INPUT_PERSIST_FAILED}: rollback failed for ${label}: ${toMessage2(error)}`
+    };
+  }
+}
+async function removeStartedRunArtifacts(artifacts, deps) {
+  const rollbackErrors = [];
+  if (artifacts.contextPath !== void 0) {
+    const contextRollback = await removeStartedRunArtifact(
+      artifacts.contextPath,
+      VERIFY_START_ROLLBACK_ARTIFACT.CONTEXT_FILE,
+      deps
+    );
+    if (!contextRollback.ok) rollbackErrors.push(contextRollback.error);
+  }
+  if (artifacts.runFile !== void 0) {
+    const runRollback = await removeStartedRunArtifact(
+      artifacts.runFile,
+      VERIFY_START_ROLLBACK_ARTIFACT.RUN_FILE,
+      deps
+    );
+    if (!runRollback.ok) rollbackErrors.push(runRollback.error);
+  }
+  if (rollbackErrors.length > 0) return { ok: false, error: rollbackErrors.join("; ") };
+  return { ok: true, value: void 0 };
+}
+function isStoredRecordedInput(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record6 = value;
+  return typeof record6.scopeIdentity === "string" && typeof record6.scopeType === "string" && typeof record6.source === "string" && typeof record6.digest === "string" && typeof record6.content === "string";
+}
+function parseRecordedInput(content) {
+  try {
+    const parsed = JSON.parse(content);
+    if (!isStoredRecordedInput(parsed)) {
+      return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_READ_FAILED}: recorded input is missing required fields` };
+    }
+    return { ok: true, value: parsed };
+  } catch (error) {
+    return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_READ_FAILED}: ${toMessage2(error)}` };
+  }
+}
 async function readInputRecordAt(path7, deps) {
   const fs8 = deps.fs ?? defaultFileSystem;
+  let content;
   try {
-    const content = await fs8.readFile(path7, STATE_STORE_TEXT_ENCODING);
-    return { ok: true, value: JSON.parse(content) };
+    content = await fs8.readFile(path7, STATE_STORE_TEXT_ENCODING);
   } catch (error) {
     if (hasErrorCode(error, ERROR_CODE_NOT_FOUND)) return { ok: true, value: void 0 };
     return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_READ_FAILED}: ${toMessage2(error)}` };
   }
+  const parsed = parseRecordedInput(content);
+  if (!parsed.ok) return parsed;
+  return { ok: true, value: parsed.value };
 }
-function verifyRunNotFoundDiagnostic(context) {
+function verifyRunLocatorDiagnostic(summary, context) {
   return [
-    VERIFY_CLI_ERROR.RUN_NOT_FOUND,
-    `run=${context.runToken}`,
-    `verification-type=${context.verificationType}`,
-    `scope-type=${context.scopeType}`,
-    `scope=${context.scopeIdentity}`,
-    `backend=${context.backendIdentity}`,
-    `namespace=${context.storageNamespace}`,
-    `target=${context.searchedTarget}`
+    summary,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.RUN}${context.runToken}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.VERIFICATION_TYPE}${context.verificationType}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.SCOPE_TYPE}${context.scopeType}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.SCOPE}${context.scopeIdentity}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.BACKEND}${context.backendIdentity}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.NAMESPACE}${context.storageNamespace}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.TARGET}${context.searchedTarget}`
   ].join(" ");
 }
-async function verifyStartCommand(options, deps) {
-  if (options.scopeType !== VERIFY_SCOPE_TYPE.CHANGESET) return errorResult3(VERIFY_SCOPE_ERROR.UNSUPPORTED_SCOPE_TYPE);
-  if (options.input.trim().length === 0) return errorResult3(VERIFY_CLI_ERROR.INPUT_REQUIRED);
-  const scope2 = parseChangesetScope(options.scope);
-  if (!scope2.ok) return errorResult3(scope2.error);
-  const resolved = await resolveVerifyScope(deps);
-  if (!resolved.ok) return errorResult3(resolved.error);
-  const inputContent = await deps.readInputSource(options.input);
-  const inputDigest = digestRunInput(options.input, inputContent);
-  if (!inputDigest.ok) return errorResult3(inputDigest.error);
-  const context = await verificationContextCreateCommand(
-    {
-      subject: VERIFICATION_CONTEXT_SUBJECT_KIND.CHANGESET,
-      base: scope2.value.base,
-      head: scope2.value.head,
-      predicate: options.verificationType,
-      workflow: options.verificationType
-    },
-    forwardDeps(deps)
-  );
-  if (context.exitCode !== VERIFY_CLI_EXIT_CODE.OK) return errorResult3(context.output);
-  const contextDigest = JSON.parse(context.output).digest;
+function verifyRunNotFoundDiagnostic(context) {
+  return verifyRunLocatorDiagnostic(VERIFY_CLI_ERROR.RUN_NOT_FOUND, context);
+}
+async function completeVerifyStartCommand(args) {
+  const { options, deps } = args;
   const opened = await journalOpenCommand(
-    { type: options.verificationType, branchSlug: resolved.value.branchSlug },
+    { type: options.verificationType, branchSlug: args.branchSlug },
     forwardDeps(deps)
   );
-  if (opened.exitCode !== VERIFY_CLI_EXIT_CODE.OK) return errorResult3(opened.output);
+  if (opened.exitCode !== VERIFY_CLI_EXIT_CODE.OK) {
+    const rollback = await removeStartedRunArtifacts(
+      { ...args.contextCreated ? { contextPath: args.contextPath } : {} },
+      deps
+    );
+    return errorResult3(rollback.ok ? opened.output : `${opened.output}; ${rollback.error}`);
+  }
   const { runToken, runFile } = JSON.parse(opened.output);
   const runScope2 = {
-    productDir: resolved.value.productDir,
-    branchSlug: resolved.value.branchSlug,
+    productDir: args.productDir,
+    branchSlug: args.branchSlug,
     type: options.verificationType,
     runToken
   };
-  const recorded = { source: options.input, digest: inputDigest.value, content: inputContent };
+  const recorded = {
+    scopeIdentity: options.scope,
+    scopeType: options.scopeType,
+    source: options.input,
+    digest: args.inputDigest,
+    content: args.inputContent
+  };
   const persisted = await persistInputRecord(runScope2, recorded, deps);
-  if (!persisted.ok) return errorResult3(persisted.error);
-  const changedScope = await resolveChangedScope(scope2.value, deps);
-  if (!changedScope.ok) return errorResult3(changedScope.error);
+  if (!persisted.ok) {
+    const rollback = await removeStartedRunArtifacts(
+      { ...args.contextCreated ? { contextPath: args.contextPath } : {}, runFile },
+      deps
+    );
+    return errorResult3(rollback.ok ? persisted.error : `${persisted.error}; ${rollback.error}`);
+  }
   const namespace = verifyRunsDir(runScope2);
   if (!namespace.ok) return errorResult3(namespace.error);
   const locator = buildRunLocator({
@@ -19855,52 +20611,69 @@ async function verifyStartCommand(options, deps) {
     verificationType: options.verificationType,
     scopeType: options.scopeType,
     scopeIdentity: options.scope,
-    backendIdentity: resolved.value.backendIdentity,
+    backendIdentity: args.backendIdentity,
     storageNamespace: namespace.value,
     runTarget: runFile
   });
   const report2 = {
     runToken,
-    contextDigest,
-    changedScope: changedScope.value,
-    input: { source: options.input, digest: inputDigest.value },
+    contextDigest: args.contextDigest,
+    changedScope: args.changedScope,
+    input: { source: options.input, digest: args.inputDigest },
     locator
   };
   return okResult3(JSON.stringify(report2));
 }
-async function verifyInputCommand(options, deps) {
-  if (options.run.trim().length === 0) return errorResult3(VERIFY_CLI_ERROR.RUN_REQUIRED);
+async function verifyStartCommand(options, deps) {
+  if (!isVerifyVerificationType(options.verificationType)) {
+    return errorResult3(VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE);
+  }
+  if (options.scopeType !== VERIFY_SCOPE_TYPE.CHANGESET) return errorResult3(VERIFY_SCOPE_ERROR.UNSUPPORTED_SCOPE_TYPE);
+  if (options.input.trim().length === 0) return errorResult3(VERIFY_CLI_ERROR.INPUT_REQUIRED);
+  const scope2 = parseChangesetScope(options.scope);
+  if (!scope2.ok) return errorResult3(scope2.error);
   const resolved = await resolveVerifyScope(deps);
   if (!resolved.ok) return errorResult3(resolved.error);
-  const runScope2 = {
+  const inputContent = await readStartInputContent(options.input, deps);
+  if (!inputContent.ok) return errorResult3(inputContent.error);
+  const inputDigest = digestRunInput(options.input, inputContent.value);
+  if (!inputDigest.ok) return errorResult3(inputDigest.error);
+  const changedScope = await resolveChangedScope(scope2.value, deps);
+  if (!changedScope.ok) return errorResult3(changedScope.error);
+  const context = await verificationContextCreateCommand(
+    {
+      subject: VERIFICATION_CONTEXT_SUBJECT_KIND.CHANGESET,
+      base: scope2.value.base,
+      head: scope2.value.head,
+      predicate: options.verificationType,
+      workflow: options.verificationType
+    },
+    forwardDeps(deps)
+  );
+  if (context.exitCode !== VERIFY_CLI_EXIT_CODE.OK) return errorResult3(context.output);
+  const { digest: contextDigest, contextPath, created: contextCreated } = JSON.parse(context.output);
+  return completeVerifyStartCommand({
+    options,
+    deps,
     productDir: resolved.value.productDir,
     branchSlug: resolved.value.branchSlug,
-    type: options.verificationType,
-    runToken: options.run
-  };
-  const path7 = verifyInputRecordPath(runScope2);
-  if (!path7.ok) return errorResult3(path7.error);
-  const namespace = verifyRunsDir(runScope2);
-  if (!namespace.ok) return errorResult3(namespace.error);
-  const record6 = await readInputRecordAt(path7.value, deps);
-  if (!record6.ok) return errorResult3(record6.error);
-  if (record6.value === void 0) {
-    return errorResult3(
-      verifyRunNotFoundDiagnostic({
-        runToken: options.run,
-        verificationType: options.verificationType,
-        scopeType: options.scopeType,
-        scopeIdentity: options.scope,
-        backendIdentity: resolved.value.backendIdentity,
-        storageNamespace: namespace.value,
-        searchedTarget: path7.value
-      })
-    );
-  }
+    backendIdentity: resolved.value.backendIdentity,
+    changedScope: changedScope.value,
+    inputDigest: inputDigest.value,
+    inputContent: inputContent.value,
+    contextDigest,
+    contextPath,
+    contextCreated
+  });
+}
+async function verifyInputCommand(options, deps) {
+  const run = await resolveExistingRun(options, deps);
+  if (!run.ok) return errorResult3(run.error);
+  const record6 = run.value.recordedInput;
   const report2 = {
-    source: record6.value.source,
-    digest: record6.value.digest,
-    content: record6.value.content
+    source: record6.source,
+    digest: record6.digest,
+    content: record6.content
   };
   return okResult3(JSON.stringify(report2));
 }
@@ -19909,12 +20682,36 @@ async function readRunJournalEvents(scope2, deps) {
   if (read.exitCode !== VERIFY_CLI_EXIT_CODE.OK) return { ok: false, error: read.output };
   return { ok: true, value: JSON.parse(read.output) };
 }
+async function readAppendExistingEvents(options, deps, journalScope, backendIdentity, namespace) {
+  const existingEvents = await readRunJournalEvents(journalScope, deps);
+  if (!existingEvents.ok) {
+    if (existingEvents.error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
+      return {
+        ok: false,
+        error: appendRunNotFoundDiagnostic(options, backendIdentity, namespace)
+      };
+    }
+    return { ok: false, error: `${VERIFY_CLI_ERROR.APPEND_FAILED}: ${existingEvents.error}` };
+  }
+  if (findTerminalEvent(existingEvents.value) !== void 0) {
+    return { ok: false, error: VERIFY_CLI_ERROR.RUN_FINISHED };
+  }
+  return existingEvents;
+}
 async function prepareAppend(options, deps) {
   if (options.run.trim().length === 0) return { ok: false, error: VERIFY_CLI_ERROR.RUN_REQUIRED };
+  if (!isVerifyVerificationType(options.verificationType)) {
+    return { ok: false, error: VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE };
+  }
   if (options.payload.trim().length === 0) return { ok: false, error: VERIFY_CLI_ERROR.PAYLOAD_REQUIRED };
   if (options.idempotencyKey.trim().length === 0) {
     return { ok: false, error: VERIFY_CLI_ERROR.IDEMPOTENCY_KEY_REQUIRED };
   }
+  if (options.scopeType !== VERIFY_SCOPE_TYPE.CHANGESET) {
+    return { ok: false, error: VERIFY_SCOPE_ERROR.UNSUPPORTED_SCOPE_TYPE };
+  }
+  const scope2 = parseChangesetScope(options.scope);
+  if (!scope2.ok) return scope2;
   const readPayload = deps.readPayloadSource;
   const binding = deps.journalBinding;
   if (readPayload === void 0 || binding === void 0) return { ok: false, error: VERIFY_CLI_ERROR.APPEND_FAILED };
@@ -19928,25 +20725,53 @@ async function prepareAppend(options, deps) {
   };
   const namespace = verifyRunsDir(runScope2);
   if (!namespace.ok) return namespace;
+  const journalScope = {
+    type: options.verificationType,
+    runToken: options.run,
+    branchSlug: resolved.value.branchSlug
+  };
+  const existingEvents = await readAppendExistingEvents(
+    options,
+    deps,
+    journalScope,
+    resolved.value.backendIdentity,
+    namespace.value
+  );
+  if (!existingEvents.ok) return existingEvents;
   const inputPath = verifyInputRecordPath(runScope2);
   if (!inputPath.ok) return inputPath;
   const inputRecord = await readInputRecordAt(inputPath.value, deps);
   if (!inputRecord.ok) return inputRecord;
   if (inputRecord.value === void 0) {
-    return { ok: false, error: appendRunNotFoundDiagnostic(options, resolved.value.backendIdentity, namespace.value) };
+    return {
+      ok: false,
+      error: appendRunNotFoundDiagnostic(options, resolved.value.backendIdentity, namespace.value, inputPath.value)
+    };
+  }
+  if (!recordedSelectorMatches(inputRecord.value, options)) {
+    return {
+      ok: false,
+      error: appendRunSelectorMismatchDiagnostic(
+        options,
+        resolved.value.backendIdentity,
+        namespace.value,
+        inputPath.value
+      )
+    };
   }
   return {
     ok: true,
     value: {
       readPayload,
       binding,
-      journalScope: { type: options.verificationType, runToken: options.run, branchSlug: resolved.value.branchSlug },
+      journalScope,
       namespace: namespace.value,
-      backendIdentity: resolved.value.backendIdentity
+      backendIdentity: resolved.value.backendIdentity,
+      existingEvents: existingEvents.value
     }
   };
 }
-function appendRunNotFoundDiagnostic(options, backendIdentity, namespace) {
+function appendRunNotFoundDiagnostic(options, backendIdentity, namespace, searchedTarget = namespace) {
   return verifyRunNotFoundDiagnostic({
     runToken: options.run,
     verificationType: options.verificationType,
@@ -19954,15 +20779,32 @@ function appendRunNotFoundDiagnostic(options, backendIdentity, namespace) {
     scopeIdentity: options.scope,
     backendIdentity,
     storageNamespace: namespace,
-    searchedTarget: namespace
+    searchedTarget
   });
 }
-function validateAppendFinding(verb, verificationType, payload) {
-  if (verb !== VERIFY_VERB.APPEND_FINDING) return void 0;
-  const validator = findingValidatorFor(verificationType);
-  if (validator === void 0) return VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE;
-  if (validator(payload) === void 0) return VERIFY_CLI_ERROR.FINDING_INVALID;
-  return void 0;
+function appendRunSelectorMismatchDiagnostic(options, backendIdentity, namespace, searchedTarget) {
+  return verifyRunLocatorDiagnostic(VERIFY_CLI_ERROR.RUN_SELECTOR_MISMATCH, {
+    runToken: options.run,
+    verificationType: options.verificationType,
+    scopeType: options.scopeType,
+    scopeIdentity: options.scope,
+    backendIdentity,
+    storageNamespace: namespace,
+    searchedTarget
+  });
+}
+function validateAppendEvidence(verb, verificationType, payload, events) {
+  const evidenceKind = verb === VERIFY_VERB.APPEND_FINDING ? VERIFY_EVIDENCE_KIND.FINDING : VERIFY_EVIDENCE_KIND.SCOPE;
+  const validator = evidenceValidatorFor(verificationType, evidenceKind);
+  if (validator === void 0) return { ok: false, error: VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE };
+  const validated = validator({ payload, events });
+  if (validated === void 0) {
+    return {
+      ok: false,
+      error: verb === VERIFY_VERB.APPEND_FINDING ? VERIFY_CLI_ERROR.FINDING_INVALID : VERIFY_CLI_ERROR.SCOPE_INVALID
+    };
+  }
+  return { ok: true, value: JSON.parse(JSON.stringify(validated)) };
 }
 function appendEventType(verb) {
   return verb === VERIFY_VERB.APPEND_FINDING ? VERIFY_APPEND_EVENT_TYPE.FINDING : VERIFY_APPEND_EVENT_TYPE.SCOPE;
@@ -19970,16 +20812,9 @@ function appendEventType(verb) {
 async function verifyAppend(options, deps, verb) {
   const prepared = await prepareAppend(options, deps);
   if (!prepared.ok) return errorResult3(prepared.error);
-  const { readPayload, binding, journalScope, namespace, backendIdentity } = prepared.value;
+  const { readPayload, binding, journalScope, existingEvents } = prepared.value;
   const eventType = appendEventType(verb);
-  const before = await readRunJournalEvents(journalScope, deps);
-  if (!before.ok) {
-    if (before.error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
-      return errorResult3(appendRunNotFoundDiagnostic(options, backendIdentity, namespace));
-    }
-    return errorResult3(`${VERIFY_CLI_ERROR.APPEND_FAILED}: ${before.error}`);
-  }
-  const existing = findAppendedSequence(before.value, options.idempotencyKey, eventType);
+  const existing = findAppendedSequence(existingEvents, options.idempotencyKey, eventType);
   if (existing !== void 0) {
     const report3 = { sequence: existing, idempotent: true };
     return okResult3(JSON.stringify(report3));
@@ -19992,12 +20827,12 @@ async function verifyAppend(options, deps, verb) {
   }
   const parsed = parseAppendPayload(rawPayload);
   if (parsed === void 0) return errorResult3(VERIFY_CLI_ERROR.PAYLOAD_INVALID);
-  const findingError = validateAppendFinding(verb, options.verificationType, parsed);
-  if (findingError !== void 0) return errorResult3(findingError);
+  const evidence = validateAppendEvidence(verb, options.verificationType, parsed, existingEvents);
+  if (!evidence.ok) return errorResult3(evidence.error);
   const event = buildAppendEvent({
     eventType,
     idempotencyKey: options.idempotencyKey,
-    payload: parsed,
+    payload: evidence.value,
     at: deps.now?.() ?? /* @__PURE__ */ new Date()
   });
   const appended = await journalAppendCommand(journalScope, event, binding, forwardDeps(deps));
@@ -20017,24 +20852,309 @@ async function verifyAppendScopeCommand(options, deps) {
 async function verifyAppendFindingCommand(options, deps) {
   return verifyAppend(options, deps, VERIFY_VERB.APPEND_FINDING);
 }
+function existingRunNotFound(run, options) {
+  return verifyRunNotFoundDiagnostic({
+    runToken: run.runToken,
+    verificationType: options.verificationType,
+    scopeType: options.scopeType,
+    scopeIdentity: options.scope,
+    backendIdentity: run.backendIdentity,
+    storageNamespace: run.namespace,
+    searchedTarget: run.inputRecordPath
+  });
+}
+function existingRunSelectorMismatch(run, options) {
+  return verifyRunLocatorDiagnostic(VERIFY_CLI_ERROR.RUN_SELECTOR_MISMATCH, {
+    runToken: run.runToken,
+    verificationType: options.verificationType,
+    scopeType: options.scopeType,
+    scopeIdentity: options.scope,
+    backendIdentity: run.backendIdentity,
+    storageNamespace: run.namespace,
+    searchedTarget: run.inputRecordPath
+  });
+}
+function recordedSelectorMatches(record6, options) {
+  return record6.scopeType === options.scopeType && record6.scopeIdentity === options.scope;
+}
+async function readExistingRecordedInput(run, deps) {
+  return readInputRecordAt(run.inputRecordPath, deps);
+}
+async function resolveExistingRunAddress(options, deps) {
+  if (!isVerifyVerificationType(options.verificationType)) {
+    return { ok: false, error: VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE };
+  }
+  if (options.scopeType !== VERIFY_SCOPE_TYPE.CHANGESET) {
+    return { ok: false, error: VERIFY_SCOPE_ERROR.UNSUPPORTED_SCOPE_TYPE };
+  }
+  const scope2 = parseChangesetScope(options.scope);
+  if (!scope2.ok) return scope2;
+  if (options.run.trim().length === 0) return { ok: false, error: VERIFY_CLI_ERROR.RUN_REQUIRED };
+  const resolved = await resolveVerifyScope(deps);
+  if (!resolved.ok) return resolved;
+  const runScope2 = {
+    productDir: resolved.value.productDir,
+    branchSlug: resolved.value.branchSlug,
+    type: options.verificationType,
+    runToken: options.run
+  };
+  const namespace = verifyRunsDir(runScope2);
+  if (!namespace.ok) return namespace;
+  const inputPath = verifyInputRecordPath(runScope2);
+  if (!inputPath.ok) return inputPath;
+  return {
+    ok: true,
+    value: {
+      productDir: resolved.value.productDir,
+      runToken: options.run,
+      journalScope: { type: options.verificationType, runToken: options.run, branchSlug: resolved.value.branchSlug },
+      namespace: namespace.value,
+      backendIdentity: resolved.value.backendIdentity,
+      inputRecordPath: inputPath.value
+    }
+  };
+}
+async function resolveExistingRun(options, deps) {
+  const address = await resolveExistingRunAddress(options, deps);
+  if (!address.ok) return address;
+  const inputRecord = await readExistingRecordedInput(address.value, deps);
+  if (!inputRecord.ok) return inputRecord;
+  if (inputRecord.value === void 0) {
+    return { ok: false, error: existingRunNotFound(address.value, options) };
+  }
+  if (!recordedSelectorMatches(inputRecord.value, options)) {
+    return { ok: false, error: existingRunSelectorMismatch(address.value, options) };
+  }
+  const run = { ...address.value, recordedInput: inputRecord.value };
+  return { ok: true, value: run };
+}
+function isRecordedInputReadFailure(error) {
+  return error.startsWith(VERIFY_CLI_ERROR.INPUT_READ_FAILED);
+}
+async function readRecordedInputForProjection(run, options, events, deps) {
+  const terminal = findTerminalEvent(events);
+  const inputRecord = await readExistingRecordedInput(run, deps);
+  if (!inputRecord.ok) {
+    if (terminal !== void 0 && isRecordedInputReadFailure(inputRecord.error)) {
+      return { ok: true, value: void 0 };
+    }
+    return inputRecord;
+  }
+  if (inputRecord.value === void 0) return { ok: true, value: void 0 };
+  if (!recordedSelectorMatches(inputRecord.value, options)) {
+    return { ok: false, error: existingRunSelectorMismatch(run, options) };
+  }
+  return { ok: true, value: inputRecord.value };
+}
+function verifyFinishReport(runToken, projection) {
+  return {
+    runToken,
+    ...projection.terminalStatus === void 0 ? {} : { terminalStatus: projection.terminalStatus },
+    ...projection.terminalMetadata === void 0 ? {} : { terminalMetadata: projection.terminalMetadata },
+    sealed: projection.sealed,
+    findingCount: projection.findingCount,
+    lastSequence: projection.lastSequence
+  };
+}
+async function isJournalPhysicallySealed(run, deps) {
+  return isJournalRunSealed(
+    { ...run.journalScope, productDir: run.productDir },
+    { ...deps.fs === void 0 ? {} : { fs: deps.fs } }
+  );
+}
+async function sealExistingRun(run, deps) {
+  const sealed = await journalSealCommand(run.journalScope, forwardDeps(deps));
+  if (sealed.exitCode !== VERIFY_CLI_EXIT_CODE.OK) {
+    return errorResult3(`${VERIFY_CLI_ERROR.SEAL_FAILED}: ${sealed.output}`);
+  }
+  return void 0;
+}
+function finishReadFailure(run, options, error) {
+  if (error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
+    return errorResult3(existingRunNotFound(run, options));
+  }
+  return errorResult3(`${VERIFY_CLI_ERROR.FINISH_FAILED}: ${error}`);
+}
+async function readTerminalMetadata(options, deps) {
+  if (options.terminalMetadata === void 0) return { ok: true, value: void 0 };
+  const readPayload = deps.readPayloadSource;
+  if (readPayload === void 0) return { ok: false, error: VERIFY_CLI_ERROR.TERMINAL_METADATA_INVALID };
+  try {
+    const rawMetadata = await readPayload(options.terminalMetadata);
+    const parsed = parseAppendPayload(rawMetadata);
+    if (parsed === void 0) return { ok: false, error: VERIFY_CLI_ERROR.PAYLOAD_INVALID };
+    return { ok: true, value: parsed };
+  } catch (error) {
+    return { ok: false, error: `${VERIFY_CLI_ERROR.PAYLOAD_READ_FAILED}: ${toMessage2(error)}` };
+  }
+}
+function validateTerminalMetadata(verificationType, terminalStatus, metadata, events) {
+  const validator = terminalMetadataValidatorFor(verificationType);
+  if (validator === void 0) {
+    return metadata === void 0 ? { ok: true, value: void 0 } : { ok: false, error: VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE };
+  }
+  const validated = validator({ terminalStatus, metadata, events });
+  if (validated.ok) return { ok: true, value: validated.value };
+  return {
+    ok: false,
+    error: validated.error === TERMINAL_METADATA_VALIDATION_ERROR.STATUS_CONFLICT ? VERIFY_CLI_ERROR.TERMINAL_STATUS_CONFLICT : VERIFY_CLI_ERROR.TERMINAL_METADATA_INVALID
+  };
+}
+async function finishProjectionResult(run, deps) {
+  const events = await readRunJournalEvents(run.journalScope, deps);
+  if (!events.ok) return errorResult3(`${VERIFY_CLI_ERROR.FINISH_FAILED}: ${events.error}`);
+  return okResult3(JSON.stringify(verifyFinishReport(run.runToken, projectVerifyRun(events.value))));
+}
+async function retrySealForTerminalRun(run, deps) {
+  const physicallySealed = await isJournalPhysicallySealed(run, deps);
+  if (!physicallySealed.ok) return void 0;
+  if (physicallySealed.value) return void 0;
+  return sealExistingRun(run, deps);
+}
+async function verifyFinishCommand(options, deps) {
+  if (options.terminalStatus.trim().length === 0) return errorResult3(VERIFY_CLI_ERROR.TERMINAL_STATUS_REQUIRED);
+  if (!isVerifyTerminalStatus(options.terminalStatus)) return errorResult3(VERIFY_CLI_ERROR.TERMINAL_STATUS_INVALID);
+  const run = await resolveExistingRunAddress(options, deps);
+  if (!run.ok) return errorResult3(run.error);
+  const before = await readRunJournalEvents(run.value.journalScope, deps);
+  if (!before.ok) {
+    return finishReadFailure(run.value, options, before.error);
+  }
+  const inputRecord = await readRecordedInputForProjection(run.value, options, before.value, deps);
+  if (!inputRecord.ok) return errorResult3(inputRecord.error);
+  if (findTerminalEvent(before.value) !== void 0) {
+    const retrySeal = await retrySealForTerminalRun(run.value, deps);
+    return retrySeal ?? finishProjectionResult(run.value, deps);
+  }
+  if (inputRecord.value === void 0) {
+    return errorResult3(existingRunNotFound(run.value, options));
+  }
+  const rawTerminalMetadata = await readTerminalMetadata(options, deps);
+  if (!rawTerminalMetadata.ok) return errorResult3(rawTerminalMetadata.error);
+  const terminalMetadata = validateTerminalMetadata(
+    options.verificationType,
+    options.terminalStatus,
+    rawTerminalMetadata.value,
+    before.value
+  );
+  if (!terminalMetadata.ok) return errorResult3(terminalMetadata.error);
+  const binding = deps.journalBinding;
+  if (binding === void 0) return errorResult3(VERIFY_CLI_ERROR.FINISH_FAILED);
+  const event = buildTerminalEvent({
+    runToken: run.value.runToken,
+    terminalStatus: options.terminalStatus,
+    ...terminalMetadata.value === void 0 ? {} : { terminalMetadata: terminalMetadata.value },
+    at: deps.now?.() ?? /* @__PURE__ */ new Date()
+  });
+  const appended = await journalAppendCommand(run.value.journalScope, event, binding, forwardDeps(deps));
+  if (appended.exitCode !== VERIFY_CLI_EXIT_CODE.OK) {
+    return errorResult3(`${VERIFY_CLI_ERROR.FINISH_FAILED}: ${appended.output}`);
+  }
+  const sealResult = await sealExistingRun(run.value, deps);
+  if (sealResult !== void 0) return sealResult;
+  return finishProjectionResult(run.value, deps);
+}
+async function verifyStatusCommand(options, deps) {
+  const run = await resolveExistingRunAddress(options, deps);
+  if (!run.ok) return errorResult3(run.error);
+  const events = await readRunJournalEvents(run.value.journalScope, deps);
+  if (!events.ok) {
+    if (events.error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
+      return errorResult3(existingRunNotFound(run.value, options));
+    }
+    return errorResult3(`${VERIFY_CLI_ERROR.STATUS_FAILED}: ${events.error}`);
+  }
+  const inputRecord = await readRecordedInputForProjection(run.value, options, events.value, deps);
+  if (!inputRecord.ok) return errorResult3(inputRecord.error);
+  if (inputRecord.value === void 0 && findTerminalEvent(events.value) === void 0) {
+    return errorResult3(existingRunNotFound(run.value, options));
+  }
+  const projection = projectVerifyRun(events.value);
+  const report2 = {
+    runToken: run.value.runToken,
+    verificationType: options.verificationType,
+    scopeType: options.scopeType,
+    sealed: projection.sealed,
+    lastSequence: projection.lastSequence,
+    ...projection.terminalStatus === void 0 ? {} : { terminalStatus: projection.terminalStatus },
+    ...projection.terminalMetadata === void 0 ? {} : { terminalMetadata: projection.terminalMetadata },
+    findingCount: projection.findingCount,
+    nextActions: projection.nextActions
+  };
+  return okResult3(JSON.stringify(report2));
+}
+async function verifyRenderCommand(options, deps) {
+  const run = await resolveExistingRunAddress(options, deps);
+  if (!run.ok) return errorResult3(run.error);
+  const events = await readRunJournalEvents(run.value.journalScope, deps);
+  if (!events.ok) {
+    if (events.error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
+      return errorResult3(existingRunNotFound(run.value, options));
+    }
+    return errorResult3(`${VERIFY_CLI_ERROR.RENDER_FAILED}: ${events.error}`);
+  }
+  const inputRecord = await readRecordedInputForProjection(run.value, options, events.value, deps);
+  if (!inputRecord.ok) return errorResult3(inputRecord.error);
+  if (inputRecord.value === void 0 && findTerminalEvent(events.value) === void 0) {
+    return errorResult3(existingRunNotFound(run.value, options));
+  }
+  const projection = projectVerifyRun(events.value);
+  const report2 = {
+    runToken: run.value.runToken,
+    findingCount: projection.findingCount,
+    sealed: projection.sealed,
+    ...projection.terminalStatus === void 0 ? {} : { terminalStatus: projection.terminalStatus },
+    ...projection.terminalMetadata === void 0 ? {} : { terminalMetadata: projection.terminalMetadata },
+    events: events.value
+  };
+  return okResult3(JSON.stringify(report2));
+}
 
 // src/interfaces/cli/verify.ts
+var VERIFICATION_RUN_CLI_SURFACE = {
+  addCommandName: "add",
+  findingResourceCommandName: "finding",
+  forbiddenRootCommandName: "verify",
+  forbiddenRunHelpTerms: ["Append", "append"],
+  forbiddenRunCommandNames: ["journal", "event", "append-scope", "append-finding"],
+  rootCommandName: "verification",
+  runCommandName: "run",
+  scopeResourceCommandName: "scope"
+};
 var VERIFY_CLI = {
-  commandName: "verify",
+  addCommandName: VERIFICATION_RUN_CLI_SURFACE.addCommandName,
+  commandName: VERIFICATION_RUN_CLI_SURFACE.rootCommandName,
   description: "Record and replay a typed verification run",
   startCommandName: VERIFY_VERB.START,
   inputCommandName: VERIFY_VERB.INPUT,
-  appendScopeCommandName: VERIFY_VERB.APPEND_SCOPE,
-  appendFindingCommandName: VERIFY_VERB.APPEND_FINDING,
+  findingCommandName: VERIFICATION_RUN_CLI_SURFACE.findingResourceCommandName,
+  runCommandName: VERIFICATION_RUN_CLI_SURFACE.runCommandName,
+  scopeCommandName: VERIFICATION_RUN_CLI_SURFACE.scopeResourceCommandName,
+  finishCommandName: VERIFY_VERB.FINISH,
+  statusCommandName: VERIFY_VERB.STATUS,
+  renderCommandName: VERIFY_VERB.RENDER,
   verificationTypeOption: "--verification-type <type>",
   scopeTypeOption: "--scope-type <scope-type>",
   scopeOption: "--scope <base>..<head>",
   inputOption: "--input <input-source>",
   runOption: "--run <token>",
   payloadOption: "--payload <payload-source>",
-  idempotencyKeyOption: "--idempotency-key <key>"
+  payloadOptionDescription: "Evidence payload source; stdin or a file path",
+  idempotencyKeyOption: "--idempotency-key <key>",
+  idempotencyKeyOptionDescription: "Caller-supplied idempotency key for the evidence add",
+  terminalMetadataOption: "--terminal-metadata <payload-source>",
+  terminalStatusOption: "--terminal-status <status>"
 };
 var CLI_SOURCE_ENCODING = "utf8";
+var DEFAULT_VERIFY_CLI_HANDLERS = {
+  appendFinding: verifyAppendFindingCommand,
+  appendScope: verifyAppendScopeCommand,
+  finish: verifyFinishCommand,
+  input: verifyInputCommand,
+  render: verifyRenderCommand,
+  start: verifyStartCommand,
+  status: verifyStatusCommand
+};
 async function readStdinText() {
   const chunks = [];
   for await (const chunk of process.stdin) {
@@ -20049,30 +21169,43 @@ async function readCliSource(source) {
 var verifyDomain = {
   name: VERIFY_CLI.commandName,
   description: VERIFY_CLI.description,
-  register: (program, invocation) => {
-    const deps = () => ({
-      cwd: invocation.resolveEffectiveInvocationDir(),
-      readInputSource: readCliSource,
-      readPayloadSource: readCliSource,
-      // The append verbs write a single structured JSON result to stdout, so the run's event
-      // stream goes to stderr under the local backend rather than sharing the result channel.
-      journalBinding: createJournalStreamBinding(invocation.io, stderrStreamSink(invocation.io))
-    });
-    const command = program.command(VERIFY_CLI.commandName).description(VERIFY_CLI.description);
-    command.command(VERIFY_CLI.startCommandName).description("Start a changeset-scoped verification run and report its run locator").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.inputOption, "Verification input source; stdin or a file path").action(async (options) => {
-      reportCliResult(await verifyStartCommand(options, deps()), invocation.io);
-    });
-    command.command(VERIFY_CLI.inputCommandName).description("Replay the verification input recorded at start").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").action(async (options) => {
-      reportCliResult(await verifyInputCommand(options, deps()), invocation.io);
-    });
-    command.command(VERIFY_CLI.appendScopeCommandName).description("Record the inspected scope for a started run").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.payloadOption, "Append payload source; stdin or a file path").requiredOption(VERIFY_CLI.idempotencyKeyOption, "Caller-supplied idempotency key for the append").action(async (options) => {
-      reportCliResult(await verifyAppendScopeCommand(options, deps()), invocation.io);
-    });
-    command.command(VERIFY_CLI.appendFindingCommandName).description("Record a validated verification finding for a started run").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.payloadOption, "Append payload source; stdin or a file path").requiredOption(VERIFY_CLI.idempotencyKeyOption, "Caller-supplied idempotency key for the append").action(async (options) => {
-      reportCliResult(await verifyAppendFindingCommand(options, deps()), invocation.io);
-    });
-  }
-};
+  register: (program, invocation) => registerVerifyCommands(program, invocation)
+};
+function registerVerifyCommands(program, invocation, handlers = DEFAULT_VERIFY_CLI_HANDLERS) {
+  const deps = () => ({
+    cwd: invocation.resolveEffectiveInvocationDir(),
+    readInputSource: readCliSource,
+    readPayloadSource: readCliSource,
+    // The append verbs write a single structured JSON result to stdout, so the run's event
+    // stream goes to stderr under the local backend rather than sharing the result channel.
+    journalBinding: createJournalStreamBinding(invocation.io, stderrStreamSink(invocation.io))
+  });
+  const command = program.command(VERIFY_CLI.commandName).description(VERIFY_CLI.description);
+  const runCommand = command.command(VERIFY_CLI.runCommandName).description("Manage a typed verification run lifecycle");
+  runCommand.command(VERIFY_CLI.startCommandName).description("Start a changeset-scoped verification run and report its run locator").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.inputOption, "Verification input source; stdin or a file path").action(async (options) => {
+    reportCliResult(await handlers.start(options, deps()), invocation.io);
+  });
+  runCommand.command(VERIFY_CLI.inputCommandName).description("Replay the verification input recorded at start").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").action(async (options) => {
+    reportCliResult(await handlers.input(options, deps()), invocation.io);
+  });
+  const scopeCommand = runCommand.command(VERIFY_CLI.scopeCommandName).description("Manage inspected scope evidence for a started verification run");
+  scopeCommand.command(VERIFY_CLI.addCommandName).description("Record the inspected scope for a started run").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.payloadOption, VERIFY_CLI.payloadOptionDescription).requiredOption(VERIFY_CLI.idempotencyKeyOption, VERIFY_CLI.idempotencyKeyOptionDescription).action(async (options) => {
+    reportCliResult(await handlers.appendScope(options, deps()), invocation.io);
+  });
+  const findingCommand = runCommand.command(VERIFY_CLI.findingCommandName).description("Manage finding evidence for a started verification run");
+  findingCommand.command(VERIFY_CLI.addCommandName).description("Record a validated verification finding for a started run").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.payloadOption, VERIFY_CLI.payloadOptionDescription).requiredOption(VERIFY_CLI.idempotencyKeyOption, VERIFY_CLI.idempotencyKeyOptionDescription).action(async (options) => {
+    reportCliResult(await handlers.appendFinding(options, deps()), invocation.io);
+  });
+  runCommand.command(VERIFY_CLI.finishCommandName).description("Record terminal completion, seal the run journal, and report its terminal projection").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.terminalStatusOption, "Terminal status recorded before sealing").option(VERIFY_CLI.terminalMetadataOption, "Verification-type terminal metadata source; stdin or a file path").action(async (options) => {
+    reportCliResult(await handlers.finish(options, deps()), invocation.io);
+  });
+  runCommand.command(VERIFY_CLI.statusCommandName).description("Report the run's resumable status projected from its journal history").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").action(async (options) => {
+    reportCliResult(await handlers.status(options, deps()), invocation.io);
+  });
+  runCommand.command(VERIFY_CLI.renderCommandName).description("Render the run's journal projection with its authoritative finding count").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").action(async (options) => {
+    reportCliResult(await handlers.render(options, deps()), invocation.io);
+  });
+}
 
 // src/interfaces/cli/worktree.ts
 import { randomBytes as nodeRandomBytes4 } from "crypto";