@outcomeeng/spx 0.6.12 → 0.6.13

package/dist/cli.js

@@ -126,6 +126,7 @@ var AGENT_RESUME_LIMITS = {
   RECENT_DAYS: 7,
   PER_AGENT_DISPLAYED_CANDIDATES: 5,
   METADATA_HEAD_BYTES: 131072,
+  ACTIVITY_TAIL_BYTES: 131072,
   HOURS_PER_DAY: 24,
   MINUTES_PER_HOUR: 60,
   SECONDS_PER_MINUTE: 60,
@@ -196,6 +197,10 @@ var FIRST_PICKER_INDEX = 0;
 var PICKER_MOVE_UP_DELTA = -1;
 var PICKER_MOVE_DOWN_DELTA = 1;
 var PICKER_QUIT_INPUT = "q";
+var AGENT_RESUME_TIE_ORDER = {
+  [AGENT_SESSION_KIND.CODEX]: 0,
+  [AGENT_SESSION_KIND.CLAUDE_CODE]: 1
+};
 var AgentResumeModeError = class extends Error {
   constructor(selectedModes) {
     super(`${AGENT_RESUME_TEXT.MODE_CONFLICT}: ${selectedModes.join(", ")}`);
@@ -314,7 +319,7 @@ function renderAgentResumeList(candidates) {
     return AGENT_RESUME_TEXT.NO_MATCHES;
   }
   return candidates.map((candidate) => {
-    const updatedAt = candidate.updatedAt ?? new Date(candidate.modifiedAtMs).toISOString();
+    const updatedAt = candidate.lastActivityAtMs === null ? "unknown" : new Date(candidate.lastActivityAtMs).toISOString();
     return `${updatedAt} ${AGENT_SESSION_LABEL[candidate.agent]} ${candidate.sessionId} ${candidate.cwd}`;
   }).join("\n");
 }
@@ -340,32 +345,41 @@ async function claudeTranscriptFiles(root, fs8, dirAccepts) {
   return perDir.flat();
 }
 async function collectAgentCandidates(agent, files, fs8, cap, match, parseHead) {
-  const seen = /* @__PURE__ */ new Set();
-  const candidates = [];
-  for (const file of files) {
-    if (candidates.length >= cap) {
-      break;
-    }
+  const candidates = await mapWithConcurrency(files, AGENT_RESUME_LIMITS.READ_CONCURRENCY, async (file) => {
     const head = await fs8.readHead(file.path, AGENT_RESUME_LIMITS.METADATA_HEAD_BYTES).catch(() => null);
     if (head === null) {
-      continue;
+      return null;
     }
     const core = parseHead(head);
-    if (core === null || !core.interactive || !match(core) || seen.has(core.sessionId)) {
-      continue;
+    if (core === null || !core.interactive || !match(core)) {
+      return null;
     }
-    seen.add(core.sessionId);
-    candidates.push({
+    const tail = await fs8.readTail(file.path, AGENT_RESUME_LIMITS.ACTIVITY_TAIL_BYTES).catch(() => null);
+    if (tail === null) {
+      return null;
+    }
+    return {
       agent,
       sessionId: core.sessionId,
       cwd: core.cwd,
       sourcePath: file.path,
       modifiedAtMs: file.modifiedAtMs,
+      lastActivityAtMs: latestTranscriptTimestampMs(tail),
       updatedAt: core.updatedAt,
       branch: core.branch
-    });
+    };
+  });
+  const bySessionId = /* @__PURE__ */ new Map();
+  for (const candidate of candidates) {
+    if (candidate === null) {
+      continue;
+    }
+    const existing = bySessionId.get(candidate.sessionId);
+    if (existing === void 0 || compareCandidates(candidate, existing) < 0) {
+      bySessionId.set(candidate.sessionId, candidate);
+    }
   }
-  return candidates;
+  return [...bySessionId.values()].sort(compareCandidates).slice(0, cap);
 }
 async function collectJsonlFiles(root, fs8) {
   const entries = await fs8.readDir(root).catch(() => []);
@@ -475,6 +489,27 @@ function parseJsonObject(line) {
     return null;
   }
 }
+function latestTranscriptTimestampMs(transcriptSlice) {
+  let latest = null;
+  for (const line of transcriptSlice.split("\n")) {
+    const row = parseJsonObject(line);
+    if (row === null) {
+      continue;
+    }
+    const timestampMs = parseTimestampMs(firstString(row, [[AGENT_SESSION_JSON_FIELDS.TIMESTAMP]]));
+    if (timestampMs !== null && (latest === null || timestampMs > latest)) {
+      latest = timestampMs;
+    }
+  }
+  return latest;
+}
+function parseTimestampMs(timestamp) {
+  if (timestamp === null) {
+    return null;
+  }
+  const timestampMs = Date.parse(timestamp);
+  return Number.isNaN(timestampMs) ? null : timestampMs;
+}
 function firstString(row, paths) {
   for (const path7 of paths) {
     const value = valueAtPath(row, path7);
@@ -498,11 +533,30 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function compareCandidates(left, right) {
-  const modifiedDiff = right.modifiedAtMs - left.modifiedAtMs;
-  if (modifiedDiff !== 0) {
-    return modifiedDiff;
+  if (left.lastActivityAtMs !== null && right.lastActivityAtMs !== null) {
+    const activityDiff = right.lastActivityAtMs - left.lastActivityAtMs;
+    if (activityDiff !== 0) {
+      return activityDiff;
+    }
+  } else if (left.lastActivityAtMs !== null) {
+    return -1;
+  } else if (right.lastActivityAtMs !== null) {
+    return 1;
   }
-  return `${left.agent}:${left.sessionId}`.localeCompare(`${right.agent}:${right.sessionId}`);
+  const agentDiff = AGENT_RESUME_TIE_ORDER[left.agent] - AGENT_RESUME_TIE_ORDER[right.agent];
+  if (agentDiff !== 0) {
+    return agentDiff;
+  }
+  return compareCodeUnits(`${left.sessionId}:${left.sourcePath}`, `${right.sessionId}:${right.sourcePath}`);
+}
+function compareCodeUnits(left, right) {
+  if (left < right) {
+    return -1;
+  }
+  if (left > right) {
+    return 1;
+  }
+  return 0;
 }
 function isPathInsideOrEqual(parent, child) {
   const rel = relative(resolve3(parent), resolve3(child));
@@ -1094,6 +1148,19 @@ var nodeAgentSessionFileSystem = {
       await handle.close();
     }
   },
+  async readTail(path7, maxBytes) {
+    const fileStat = await stat(path7);
+    const bytesToRead = Math.min(maxBytes, fileStat.size);
+    const start = Math.max(0, fileStat.size - bytesToRead);
+    const handle = await open(path7, "r");
+    try {
+      const buffer = Buffer.alloc(bytesToRead);
+      const { bytesRead } = await handle.read(buffer, 0, bytesToRead, start);
+      return buffer.toString(AGENT_SESSION_STORE.TEXT_ENCODING, 0, bytesRead);
+    } finally {
+      await handle.close();
+    }
+  },
   async stat(path7) {
     const result = await stat(path7);
     return { mtimeMs: result.mtimeMs };
@@ -3014,6 +3081,7 @@ var AGENT = {
   CLAUDE_CODE: "claudeCode"
 };
 var HARNESS_ENVIRONMENT_CONFIG_FIELDS = {
+  METHODOLOGY: "methodology",
   INSTRUCTIONS: "instructions",
   AGENTS: "agents",
   PLUGIN_BOOTSTRAP: "pluginBootstrap",
@@ -3033,6 +3101,8 @@ var HARNESS_ENVIRONMENT_CONFIG_FIELDS = {
   VERSION: "version",
   MARKETPLACE: "marketplace"
 };
+var DEFAULT_METHODOLOGY_SOURCE = "outcomeeng/spec-tree";
+var DEFAULT_METHODOLOGY_VERSION = "installed";
 var AGENT_SET = new Set(Object.values(AGENT));
 var DEFAULT_AGENT_INSTRUCTION_TARGET_AGENTS = [
   AGENT.CODEX,
@@ -3040,6 +3110,10 @@ var DEFAULT_AGENT_INSTRUCTION_TARGET_AGENTS = [
 ];
 var DEFAULT_AGENT_INSTRUCTION_FILE_PATH = "AGENTS.md";
 var DEFAULT_HARNESS_ENVIRONMENT_CONFIG = {
+  methodology: {
+    source: DEFAULT_METHODOLOGY_SOURCE,
+    version: DEFAULT_METHODOLOGY_VERSION
+  },
   instructions: {
     files: [
       {
@@ -3073,10 +3147,15 @@ var DEFAULT_HARNESS_ENVIRONMENT_CONFIG = {
   }
 };
 var HARNESS_ENVIRONMENT_ALLOWED_FIELDS = /* @__PURE__ */ new Set([
+  HARNESS_ENVIRONMENT_CONFIG_FIELDS.METHODOLOGY,
   HARNESS_ENVIRONMENT_CONFIG_FIELDS.INSTRUCTIONS,
   HARNESS_ENVIRONMENT_CONFIG_FIELDS.AGENTS,
   HARNESS_ENVIRONMENT_CONFIG_FIELDS.PLUGIN_BOOTSTRAP
 ]);
+var HARNESS_ENVIRONMENT_METHODOLOGY_ALLOWED_FIELDS = /* @__PURE__ */ new Set([
+  HARNESS_ENVIRONMENT_CONFIG_FIELDS.SOURCE,
+  HARNESS_ENVIRONMENT_CONFIG_FIELDS.VERSION
+]);
 var HARNESS_ENVIRONMENT_INSTRUCTIONS_ALLOWED_FIELDS = /* @__PURE__ */ new Set([
   HARNESS_ENVIRONMENT_CONFIG_FIELDS.FILES
 ]);
@@ -3141,6 +3220,21 @@ function validateBoolean(path7, value) {
   }
   return { ok: true, value };
 }
+function validateMethodology(raw) {
+  const sectionPath = `${HARNESS_ENVIRONMENT_SECTION}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.METHODOLOGY}`;
+  if (!isRecord2(raw)) {
+    return { ok: false, error: `${sectionPath} must be an object` };
+  }
+  const unknown = rejectUnknownFields(sectionPath, raw, HARNESS_ENVIRONMENT_METHODOLOGY_ALLOWED_FIELDS);
+  if (!unknown.ok) return unknown;
+  const sourceRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.SOURCE];
+  const source = sourceRaw === void 0 ? { ok: true, value: DEFAULT_HARNESS_ENVIRONMENT_CONFIG.methodology.source } : validateNonEmptyString(`${sectionPath}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.SOURCE}`, sourceRaw);
+  if (!source.ok) return source;
+  const versionRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.VERSION];
+  const version2 = versionRaw === void 0 ? { ok: true, value: DEFAULT_HARNESS_ENVIRONMENT_CONFIG.methodology.version } : validateNonEmptyString(`${sectionPath}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.VERSION}`, versionRaw);
+  if (!version2.ok) return version2;
+  return { ok: true, value: { source: source.value, version: version2.value } };
+}
 function validateAgent(path7, value) {
   if (typeof value !== "string" || !isAgent(value)) {
     return { ok: false, error: `${path7} must be a registered agent` };
@@ -3522,6 +3616,9 @@ function validate(value) {
     HARNESS_ENVIRONMENT_ALLOWED_FIELDS
   );
   if (!unknown.ok) return unknown;
+  const methodologyRaw = value[HARNESS_ENVIRONMENT_CONFIG_FIELDS.METHODOLOGY];
+  const methodology = methodologyRaw === void 0 ? { ok: true, value: DEFAULT_HARNESS_ENVIRONMENT_CONFIG.methodology } : validateMethodology(methodologyRaw);
+  if (!methodology.ok) return methodology;
   const instructionsRaw = value[HARNESS_ENVIRONMENT_CONFIG_FIELDS.INSTRUCTIONS];
   const instructions = instructionsRaw === void 0 ? { ok: true, value: DEFAULT_HARNESS_ENVIRONMENT_CONFIG.instructions } : validateInstructions(instructionsRaw);
   if (!instructions.ok) return instructions;
@@ -3534,6 +3631,7 @@ function validate(value) {
   return {
     ok: true,
     value: {
+      methodology: methodology.value,
       instructions: instructions.value,
       agents: agents.value,
       pluginBootstrap: pluginBootstrap.value
@@ -3815,59 +3913,6 @@ var fileInclusionConfigDescriptor = {
   validate: validate4
 };
 
-// src/config/source-roots.ts
-var TEST_RELEVANT_SOURCE_ROOT_PREFIX = {
-  SOURCE: "src/",
-  TESTING: "testing/",
-  SCRIPTS: "scripts/",
-  ESLINT_RULES: "eslint-rules/"
-};
-var TEST_RELEVANT_SOURCE_ROOT_PREFIXES = [
-  TEST_RELEVANT_SOURCE_ROOT_PREFIX.SOURCE,
-  TEST_RELEVANT_SOURCE_ROOT_PREFIX.TESTING,
-  TEST_RELEVANT_SOURCE_ROOT_PREFIX.SCRIPTS,
-  TEST_RELEVANT_SOURCE_ROOT_PREFIX.ESLINT_RULES
-];
-
-// src/lib/precommit/config.ts
-var PRECOMMIT_SECTION = "precommit";
-var PRECOMMIT_DEFAULTS = {
-  sourceDirs: TEST_RELEVANT_SOURCE_ROOT_PREFIXES,
-  testPattern: ".test.ts"
-};
-function validate5(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return { ok: false, error: `${PRECOMMIT_SECTION} section must be an object` };
-  }
-  const candidate = value;
-  const sourceDirs = candidate["sourceDirs"] ?? PRECOMMIT_DEFAULTS.sourceDirs;
-  if (!Array.isArray(sourceDirs) || !sourceDirs.every((x) => typeof x === "string" && x.length > 0)) {
-    return {
-      ok: false,
-      error: `${PRECOMMIT_SECTION}.sourceDirs must be a non-empty array of non-empty strings`
-    };
-  }
-  const testPattern = candidate["testPattern"] ?? PRECOMMIT_DEFAULTS.testPattern;
-  if (typeof testPattern !== "string" || testPattern.length === 0) {
-    return {
-      ok: false,
-      error: `${PRECOMMIT_SECTION}.testPattern must be a non-empty string`
-    };
-  }
-  return {
-    ok: true,
-    value: {
-      sourceDirs,
-      testPattern
-    }
-  };
-}
-var precommitConfigDescriptor = {
-  section: PRECOMMIT_SECTION,
-  defaults: PRECOMMIT_DEFAULTS,
-  validate: validate5
-};
-
 // src/lib/spec-tree/config.ts
 var SPEC_TREE_KIND_CATEGORY_VALUES = {
   NODE: "node",
@@ -4056,7 +4101,7 @@ function buildConfigFromKindNames(kindNames) {
   const entries = kindNames.map((kind) => [kind, KIND_REGISTRY[kind]]);
   return { kinds: Object.fromEntries(entries) };
 }
-function validate6(value) {
+function validate5(value) {
   if (typeof value !== "object" || value === null) {
     return { ok: false, error: `${SPEC_TREE_SECTION} section must be an object` };
   }
@@ -4155,7 +4200,7 @@ function validateKindDefinitionMap(kindEntries) {
 var specTreeConfigDescriptor = {
   section: SPEC_TREE_SECTION,
   defaults: buildDefaults(),
-  validate: validate6
+  validate: validate5
 };
 
 // src/config/primitives/path-filter.ts
@@ -4241,7 +4286,7 @@ function resolveDefaultPassingScope() {
   }
   return result.value;
 }
-function validate7(value) {
+function validate6(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { ok: false, error: `${TESTING_SECTION} section must be an object` };
   }
@@ -4265,7 +4310,7 @@ function validate7(value) {
 var testingConfigDescriptor = {
   section: TESTING_SECTION,
   defaults: defaults4,
-  validate: validate7
+  validate: validate6
 };
 
 // src/validation/literal/config.ts
@@ -4329,7 +4374,7 @@ var LITERAL_DEFAULTS = {
 function isNonNegativeInteger(value) {
   return typeof value === "number" && Number.isInteger(value) && value >= 0;
 }
-function validate8(value) {
+function validate7(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { ok: false, error: `${LITERAL_SECTION} section must be an object` };
   }
@@ -4393,7 +4438,7 @@ function isStringArray(value) {
 var literalConfigDescriptor = {
   section: LITERAL_SECTION,
   defaults: LITERAL_DEFAULTS,
-  validate: validate8
+  validate: validate7
 };
 
 // src/validation/config/descriptor.ts
@@ -4486,7 +4531,7 @@ function validateKnip(raw) {
   }
   return { ok: true, value: { enabled: enabledRaw } };
 }
-function validate9(value) {
+function validate8(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { ok: false, error: `${VALIDATION_SECTION} section must be an object` };
   }
@@ -4505,7 +4550,7 @@ function validate9(value) {
 var validationConfigDescriptor = {
   section: VALIDATION_SECTION,
   defaults: defaults5,
-  validate: validate9
+  validate: validate8
 };
 
 // src/config/registry.ts
@@ -4514,7 +4559,6 @@ var productionRegistry = [
   validationConfigDescriptor,
   testingConfigDescriptor,
   fileInclusionConfigDescriptor,
-  precommitConfigDescriptor,
   harnessEnvironmentConfigDescriptor,
   diagnoseConfigDescriptor,
   runtimeConfigDescriptor
@@ -11556,6 +11600,20 @@ function aggregateTestExitCode(invocations, unsupportedSelectionCount = 0) {
   return SUCCESS_EXIT_CODE;
 }
 
+// src/config/source-roots.ts
+var TEST_RELEVANT_SOURCE_ROOT_PREFIX = {
+  SOURCE: "src/",
+  TESTING: "testing/",
+  SCRIPTS: "scripts/",
+  ESLINT_RULES: "eslint-rules/"
+};
+var TEST_RELEVANT_SOURCE_ROOT_PREFIXES = [
+  TEST_RELEVANT_SOURCE_ROOT_PREFIX.SOURCE,
+  TEST_RELEVANT_SOURCE_ROOT_PREFIX.TESTING,
+  TEST_RELEVANT_SOURCE_ROOT_PREFIX.SCRIPTS,
+  TEST_RELEVANT_SOURCE_ROOT_PREFIX.ESLINT_RULES
+];
+
 // src/domains/test/changed-set-planning.ts
 var PATH_SEPARATOR = "/";
 var MARKDOWN_EXTENSION = ".md";
@@ -19676,6 +19734,7 @@ var UNSEALED_NEXT_ACTIONS = [
   VERIFY_LIFECYCLE_ACTION.FINISH
 ];
 var VERIFY_VERIFICATION_TYPE = {
+  AUDIT: "audit",
   REVIEW: "review"
 };
 var VERIFY_VERIFICATION_TYPES = new Set(Object.values(VERIFY_VERIFICATION_TYPE));
@@ -19686,6 +19745,63 @@ var REVIEW_FINDING_DISPOSITION = {
   BLOCKING: "BLOCKING",
   DEBT: "DEBT"
 };
+var REVIEW_SCOPE_COVERAGE_STATE = {
+  CLEAN: "clean",
+  FINDING: "finding"
+};
+var REVIEW_ANCHOR_SIDE = {
+  LEFT: "LEFT",
+  RIGHT: "RIGHT"
+};
+var REVIEW_TERMINAL_STATE = {
+  APPROVED: "approved",
+  CHANGES_REQUESTED: "changes_requested",
+  COMMENTED: "commented"
+};
+var AUDIT_CLASS = {
+  IMPLEMENTATION: "implementation",
+  INSTRUCTIONS: "instructions",
+  SPEC: "spec"
+};
+var AUDIT_KIND = {
+  ADR: "adr",
+  ARCHITECTURE: "architecture",
+  CODE: "code",
+  COVERAGE_GAP: "coverage-gap",
+  EVAL_EVIDENCE: "eval-evidence",
+  GUIDE_TEMPLATE: "guide-template",
+  PDR: "pdr",
+  PROMPT: "prompt",
+  SKILL: "skill",
+  SPEC: "spec",
+  SUBAGENT: "subagent",
+  TESTS: "tests"
+};
+var AUDIT_COVERAGE_REQUIREMENT = {
+  OPTIONAL: "optional",
+  REQUIRED: "required"
+};
+var AUDIT_COVERAGE_STATUS = {
+  AUDITED: "audited",
+  INCOMPLETE: "incomplete",
+  MISSING_SKILL: "missing-skill",
+  NOT_APPLICABLE: "not-applicable",
+  SKIPPED: "skipped",
+  UNSUPPORTED: "unsupported"
+};
+var AUDIT_FINDING_SEVERITY = {
+  BLOCKING: "blocking",
+  DEBT: "debt"
+};
+var TERMINAL_METADATA_VALIDATION_ERROR = {
+  METADATA_INVALID: "metadata-invalid",
+  STATUS_CONFLICT: "status-conflict"
+};
+var VERIFY_EVIDENCE_KIND = {
+  SCOPE: "scope",
+  FINDING: "finding",
+  TERMINAL_METADATA: "terminal-metadata"
+};
 var VERIFY_APPEND_EVENT_TYPE = {
   SCOPE: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.verify.scope`,
   FINDING: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.verify.finding`
@@ -19768,21 +19884,408 @@ function parseAppendPayload(raw) {
 function isJsonRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function readRequiredString(record6, field) {
+  const value = record6[field];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function readRequiredStringValue(record6, field) {
+  const value = record6[field];
+  return typeof value === "string" ? value : void 0;
+}
+var OPTIONAL_FIELD_STATE = {
+  ABSENT: "absent",
+  INVALID: "invalid",
+  PRESENT: "present"
+};
+function readOptionalString2(record6, field) {
+  if (!(field in record6)) return { state: OPTIONAL_FIELD_STATE.ABSENT };
+  const value = record6[field];
+  return typeof value === "string" && value.length > 0 ? { state: OPTIONAL_FIELD_STATE.PRESENT, value } : { state: OPTIONAL_FIELD_STATE.INVALID };
+}
+function readOptionalPositiveInteger(record6, field) {
+  if (!(field in record6)) return { state: OPTIONAL_FIELD_STATE.ABSENT };
+  const value = record6[field];
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? { state: OPTIONAL_FIELD_STATE.PRESENT, value } : { state: OPTIONAL_FIELD_STATE.INVALID };
+}
+function optionalFieldValue(field) {
+  return field.state === OPTIONAL_FIELD_STATE.PRESENT ? field.value : void 0;
+}
+function readRequiredRecord(record6, field) {
+  const value = record6[field];
+  return isJsonRecord(value) ? value : void 0;
+}
+function readOptionalRecord(record6, field) {
+  if (!(field in record6)) return { state: OPTIONAL_FIELD_STATE.ABSENT };
+  const value = record6[field];
+  return isJsonRecord(value) ? { state: OPTIONAL_FIELD_STATE.PRESENT, value } : { state: OPTIONAL_FIELD_STATE.INVALID };
+}
+function hasInvalidOptionalField(...fields) {
+  return fields.some((field) => field.state === OPTIONAL_FIELD_STATE.INVALID);
+}
 function isReviewFindingDisposition(value) {
   return Object.values(REVIEW_FINDING_DISPOSITION).includes(value);
 }
-function validateReviewFinding(payload) {
+function isReviewScopeCoverageState(value) {
+  return typeof value === "string" && Object.values(REVIEW_SCOPE_COVERAGE_STATE).includes(value);
+}
+function isReviewAnchorSide(value) {
+  return typeof value === "string" && Object.values(REVIEW_ANCHOR_SIDE).includes(value);
+}
+function isReviewTerminalState(value) {
+  return typeof value === "string" && Object.values(REVIEW_TERMINAL_STATE).includes(value);
+}
+function isAuditClass(value) {
+  return typeof value === "string" && Object.values(AUDIT_CLASS).includes(value);
+}
+function isAuditKind(value) {
+  return typeof value === "string" && Object.values(AUDIT_KIND).includes(value);
+}
+function isAuditCoverageRequirement(value) {
+  return typeof value === "string" && Object.values(AUDIT_COVERAGE_REQUIREMENT).includes(value);
+}
+function isAuditCoverageStatus(value) {
+  return typeof value === "string" && Object.values(AUDIT_COVERAGE_STATUS).includes(value);
+}
+function isAuditFindingSeverity(value) {
+  return typeof value === "string" && Object.values(AUDIT_FINDING_SEVERITY).includes(value);
+}
+function isCompatibleAuditKind(auditClass, auditKind) {
+  if (auditKind === AUDIT_KIND.COVERAGE_GAP) return true;
+  if (auditClass === AUDIT_CLASS.INSTRUCTIONS) {
+    return auditKind === AUDIT_KIND.SKILL || auditKind === AUDIT_KIND.SUBAGENT || auditKind === AUDIT_KIND.PROMPT || auditKind === AUDIT_KIND.GUIDE_TEMPLATE;
+  }
+  if (auditClass === AUDIT_CLASS.SPEC) {
+    return auditKind === AUDIT_KIND.SPEC || auditKind === AUDIT_KIND.ADR || auditKind === AUDIT_KIND.PDR;
+  }
+  return auditKind === AUDIT_KIND.CODE || auditKind === AUDIT_KIND.TESTS || auditKind === AUDIT_KIND.ARCHITECTURE || auditKind === AUDIT_KIND.EVAL_EVIDENCE;
+}
+function evidencePayloadValidator(validator) {
+  return (input) => validator(input.payload);
+}
+function readReviewFindingMetadata(payload) {
   if (!isJsonRecord(payload)) return void 0;
   const { disposition, summary } = payload;
   if (!isReviewFindingDisposition(disposition)) return void 0;
   if (typeof summary !== "string" || summary.length === 0) return void 0;
   return { disposition, summary };
 }
-var FINDING_VALIDATORS = {
-  [VERIFY_VERIFICATION_TYPE.REVIEW]: validateReviewFinding
+function validateReviewFinding(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const path7 = readRequiredString(payload, "path");
+  const originalCommit = readRequiredString(payload, "originalCommit");
+  const diffHunk = readRequiredString(payload, "diffHunk");
+  const body = readRequiredString(payload, "body");
+  const { side } = payload;
+  const finding = readReviewFindingMetadata(payload.finding);
+  if (path7 === void 0 || originalCommit === void 0 || diffHunk === void 0 || body === void 0) {
+    return void 0;
+  }
+  if (!isReviewAnchorSide(side)) return void 0;
+  if (finding === void 0) return void 0;
+  const line = readOptionalPositiveInteger(payload, "line");
+  const position = readOptionalPositiveInteger(payload, "position");
+  const providerIdentity = readOptionalString2(payload, "providerIdentity");
+  const url = readOptionalString2(payload, "url");
+  if (hasInvalidOptionalField(line, position, providerIdentity, url)) return void 0;
+  const lineValue = optionalFieldValue(line);
+  const positionValue = optionalFieldValue(position);
+  if (lineValue === void 0 && positionValue === void 0) return void 0;
+  const providerIdentityValue = optionalFieldValue(providerIdentity);
+  const urlValue = optionalFieldValue(url);
+  return {
+    path: path7,
+    side,
+    originalCommit,
+    diffHunk,
+    body,
+    finding,
+    ...providerIdentityValue === void 0 ? {} : { providerIdentity: providerIdentityValue },
+    ...lineValue === void 0 ? {} : { line: lineValue },
+    ...positionValue === void 0 ? {} : { position: positionValue },
+    ...urlValue === void 0 ? {} : { url: urlValue }
+  };
+}
+function validateReviewScope(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const path7 = readRequiredString(payload, "path");
+  const commit = readRequiredString(payload, "commit");
+  const { side, coverageState } = payload;
+  if (path7 === void 0 || commit === void 0) return void 0;
+  if (!isReviewAnchorSide(side)) return void 0;
+  if (!isReviewScopeCoverageState(coverageState)) return void 0;
+  const line = readOptionalPositiveInteger(payload, "line");
+  const position = readOptionalPositiveInteger(payload, "position");
+  const providerIdentity = readOptionalString2(payload, "providerIdentity");
+  const url = readOptionalString2(payload, "url");
+  if (hasInvalidOptionalField(line, position, providerIdentity, url)) return void 0;
+  const lineValue = optionalFieldValue(line);
+  const positionValue = optionalFieldValue(position);
+  const providerIdentityValue = optionalFieldValue(providerIdentity);
+  const urlValue = optionalFieldValue(url);
+  return {
+    path: path7,
+    side,
+    commit,
+    coverageState,
+    ...providerIdentityValue === void 0 ? {} : { providerIdentity: providerIdentityValue },
+    ...lineValue === void 0 ? {} : { line: lineValue },
+    ...positionValue === void 0 ? {} : { position: positionValue },
+    ...urlValue === void 0 ? {} : { url: urlValue }
+  };
+}
+function validateReviewTerminalMetadata(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const actor = readRequiredString(payload, "actor");
+  const body = readRequiredStringValue(payload, "body");
+  const submittedAt = readRequiredString(payload, "submittedAt");
+  const commit = readRequiredString(payload, "commit");
+  const { state } = payload;
+  if (actor === void 0 || body === void 0 || submittedAt === void 0 || commit === void 0) return void 0;
+  if (!isReviewTerminalState(state)) return void 0;
+  const providerIdentity = readOptionalString2(payload, "providerIdentity");
+  const url = readOptionalString2(payload, "url");
+  if (hasInvalidOptionalField(providerIdentity, url)) return void 0;
+  const providerIdentityValue = optionalFieldValue(providerIdentity);
+  const urlValue = optionalFieldValue(url);
+  return {
+    actor,
+    state,
+    body,
+    submittedAt,
+    commit,
+    ...providerIdentityValue === void 0 ? {} : { providerIdentity: providerIdentityValue },
+    ...urlValue === void 0 ? {} : { url: urlValue }
+  };
+}
+function validateReviewTerminal(input) {
+  const validated = input.metadata === void 0 ? void 0 : validateReviewTerminalMetadata(input.metadata);
+  if (input.metadata !== void 0 && validated === void 0) {
+    return { ok: false, error: TERMINAL_METADATA_VALIDATION_ERROR.METADATA_INVALID };
+  }
+  const evidenceStatus = expectedReviewEvidenceTerminalStatus(input.events);
+  const metadataStatus = expectedReviewMetadataTerminalStatus(validated);
+  if (evidenceStatus !== void 0 && metadataStatus !== void 0 && evidenceStatus !== metadataStatus) {
+    return { ok: false, error: TERMINAL_METADATA_VALIDATION_ERROR.STATUS_CONFLICT };
+  }
+  const expectedStatus = evidenceStatus ?? metadataStatus;
+  if (expectedStatus !== void 0 && input.terminalStatus !== expectedStatus) {
+    return { ok: false, error: TERMINAL_METADATA_VALIDATION_ERROR.STATUS_CONFLICT };
+  }
+  if (validated === void 0) return { ok: true, value: void 0 };
+  return {
+    ok: true,
+    value: {
+      actor: validated.actor,
+      state: validated.state,
+      body: validated.body,
+      submittedAt: validated.submittedAt,
+      commit: validated.commit,
+      ...validated.providerIdentity === void 0 ? {} : { providerIdentity: validated.providerIdentity },
+      ...validated.url === void 0 ? {} : { url: validated.url }
+    }
+  };
+}
+function validateAuditProducerIdentity(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const producerKind = readRequiredString(payload, "producerKind");
+  const agentName = readRequiredString(payload, "agentName");
+  const agentOwningPluginName = readRequiredString(payload, "agentOwningPluginName");
+  const skillName = readRequiredString(payload, "skillName");
+  const skillOwningPluginName = readRequiredString(payload, "skillOwningPluginName");
+  const invocationRole = readRequiredString(payload, "invocationRole");
+  if (producerKind === void 0 || agentName === void 0 || agentOwningPluginName === void 0 || skillName === void 0 || skillOwningPluginName === void 0 || invocationRole === void 0) {
+    return void 0;
+  }
+  return {
+    producerKind,
+    agentName,
+    agentOwningPluginName,
+    skillName,
+    skillOwningPluginName,
+    invocationRole
+  };
+}
+function validateAuditProducerProvenance(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const agentOwningPluginVersion = readRequiredString(payload, "agentOwningPluginVersion");
+  const skillOwningPluginVersion = readRequiredString(payload, "skillOwningPluginVersion");
+  if (agentOwningPluginVersion === void 0 || skillOwningPluginVersion === void 0) return void 0;
+  const toolVersion = readOptionalString2(payload, "toolVersion");
+  if (hasInvalidOptionalField(toolVersion)) return void 0;
+  const toolVersionValue = optionalFieldValue(toolVersion);
+  return {
+    agentOwningPluginVersion,
+    skillOwningPluginVersion,
+    ...toolVersionValue === void 0 ? {} : { toolVersion: toolVersionValue }
+  };
+}
+function validateAuditPriorContextPartitions(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const changedFilePartition = readRequiredString(payload, "changedFilePartition");
+  const concernPartition = readRequiredString(payload, "concernPartition");
+  if (changedFilePartition === void 0 || concernPartition === void 0) return void 0;
+  const languagePartition = readOptionalString2(payload, "languagePartition");
+  if (hasInvalidOptionalField(languagePartition)) return void 0;
+  const languagePartitionValue = optionalFieldValue(languagePartition);
+  return {
+    changedFilePartition,
+    concernPartition,
+    ...languagePartitionValue === void 0 ? {} : { languagePartition: languagePartitionValue }
+  };
+}
+function validateOptionalAuditProducerProvenance(producerProvenance) {
+  if (producerProvenance.state !== OPTIONAL_FIELD_STATE.PRESENT) return producerProvenance;
+  const value = validateAuditProducerProvenance(producerProvenance.value);
+  return value === void 0 ? { state: OPTIONAL_FIELD_STATE.INVALID } : { state: OPTIONAL_FIELD_STATE.PRESENT, value };
+}
+function auditKindAllowsProducerProvenance(auditKind, producerProvenance) {
+  return auditKind !== AUDIT_KIND.COVERAGE_GAP || producerProvenance === void 0;
+}
+function auditKindAllowsCoverageStatus(auditKind, coverageStatus) {
+  return auditKind !== AUDIT_KIND.COVERAGE_GAP || coverageStatus !== AUDIT_COVERAGE_STATUS.AUDITED && coverageStatus !== AUDIT_COVERAGE_STATUS.NOT_APPLICABLE;
+}
+function validateAuditScope(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const unitId = readRequiredString(payload, "unitId");
+  const subject = readRequiredString(payload, "subject");
+  const { auditClass, auditKind, coverageRequirement, coverageStatus } = payload;
+  if (unitId === void 0 || subject === void 0) return void 0;
+  if (!isAuditClass(auditClass) || !isAuditKind(auditKind)) return void 0;
+  if (!isCompatibleAuditKind(auditClass, auditKind)) return void 0;
+  if (!isAuditCoverageRequirement(coverageRequirement)) return void 0;
+  if (!isAuditCoverageStatus(coverageStatus)) return void 0;
+  if (!auditKindAllowsCoverageStatus(auditKind, coverageStatus)) return void 0;
+  const priorContext = validateAuditPriorContextPartitions(readRequiredRecord(payload, "priorContext"));
+  const expectedProducer = validateAuditProducerIdentity(readRequiredRecord(payload, "expectedProducer"));
+  const recordedByRunDriver = validateAuditProducerIdentity(readRequiredRecord(payload, "recordedByRunDriver"));
+  if (priorContext === void 0 || expectedProducer === void 0 || recordedByRunDriver === void 0) {
+    return void 0;
+  }
+  const parentUnitId = readOptionalString2(payload, "parentUnitId");
+  const producerProvenance = validateOptionalAuditProducerProvenance(
+    readOptionalRecord(payload, "producerProvenance")
+  );
+  if (hasInvalidOptionalField(parentUnitId, producerProvenance)) return void 0;
+  const parentUnitIdValue = optionalFieldValue(parentUnitId);
+  const producerProvenanceValue = optionalFieldValue(producerProvenance);
+  if (parentUnitIdValue === unitId) return void 0;
+  if (!auditKindAllowsProducerProvenance(auditKind, producerProvenanceValue)) return void 0;
+  return {
+    unitId,
+    auditClass,
+    auditKind,
+    subject,
+    coverageRequirement,
+    coverageStatus,
+    priorContext,
+    expectedProducer,
+    recordedByRunDriver,
+    ...parentUnitIdValue === void 0 ? {} : { parentUnitId: parentUnitIdValue },
+    ...producerProvenanceValue === void 0 ? {} : { producerProvenance: producerProvenanceValue }
+  };
+}
+function validateAuditFindingEvidence(evidence) {
+  if (evidence === void 0) return void 0;
+  const observed = readRequiredString(evidence, "observed");
+  const expected = readRequiredString(evidence, "expected");
+  if (observed === void 0 || expected === void 0) return void 0;
+  return { observed, expected };
+}
+function validateAuditFinding(payload) {
+  if (!isJsonRecord(payload)) return void 0;
+  const unitId = readRequiredString(payload, "unitId");
+  const rule = readRequiredString(payload, "rule");
+  const location = readRequiredString(payload, "location");
+  const message = readRequiredString(payload, "message");
+  const { severity } = payload;
+  if (unitId === void 0 || rule === void 0 || location === void 0 || message === void 0) {
+    return void 0;
+  }
+  if (!isAuditFindingSeverity(severity)) return void 0;
+  const producerIdentity = validateAuditProducerIdentity(readRequiredRecord(payload, "producerIdentity"));
+  const producerProvenance = validateAuditProducerProvenance(readRequiredRecord(payload, "producerProvenance"));
+  const evidence = validateAuditFindingEvidence(readRequiredRecord(payload, "evidence"));
+  if (producerIdentity === void 0 || producerProvenance === void 0 || evidence === void 0) {
+    return void 0;
+  }
+  return {
+    unitId,
+    producerIdentity,
+    producerProvenance,
+    rule,
+    severity,
+    location,
+    message,
+    evidence
+  };
+}
+function auditFindingReferencesRecordedScope(events, finding) {
+  return events.some((event) => {
+    if (event.type !== VERIFY_APPEND_EVENT_TYPE.SCOPE || !isJsonRecord(event.data)) return false;
+    const scope2 = validateAuditScope(event.data[VERIFY_APPEND_EVENT_FIELD.PAYLOAD]);
+    return scope2?.unitId === finding.unitId;
+  });
+}
+function validateAuditFindingForRun(input) {
+  const finding = validateAuditFinding(input.payload);
+  if (finding === void 0) return void 0;
+  return auditFindingReferencesRecordedScope(input.events, finding) ? finding : void 0;
+}
+var EVIDENCE_VALIDATORS = {
+  [VERIFY_VERIFICATION_TYPE.AUDIT]: {
+    [VERIFY_EVIDENCE_KIND.SCOPE]: evidencePayloadValidator(validateAuditScope),
+    [VERIFY_EVIDENCE_KIND.FINDING]: validateAuditFindingForRun,
+    [VERIFY_EVIDENCE_KIND.TERMINAL_METADATA]: validateAuditTerminal
+  },
+  [VERIFY_VERIFICATION_TYPE.REVIEW]: {
+    [VERIFY_EVIDENCE_KIND.SCOPE]: evidencePayloadValidator(validateReviewScope),
+    [VERIFY_EVIDENCE_KIND.FINDING]: evidencePayloadValidator(validateReviewFinding),
+    [VERIFY_EVIDENCE_KIND.TERMINAL_METADATA]: validateReviewTerminal
+  }
 };
-function findingValidatorFor(verificationType) {
-  return FINDING_VALIDATORS[verificationType];
+function evidenceValidatorFor(verificationType, evidenceKind) {
+  return EVIDENCE_VALIDATORS[verificationType]?.[evidenceKind];
+}
+function terminalMetadataValidatorFor(verificationType) {
+  return EVIDENCE_VALIDATORS[verificationType]?.[VERIFY_EVIDENCE_KIND.TERMINAL_METADATA];
+}
+function expectedReviewEvidenceTerminalStatus(events) {
+  if (countVerifyFindings(events) > 0 || countReviewScopeFindingUnits(events) > 0) {
+    return JOURNAL_RUN_STATE_STATUS.REJECTED;
+  }
+  return void 0;
+}
+function auditCoverageRejectsRun(scope2) {
+  if (scope2.coverageRequirement !== AUDIT_COVERAGE_REQUIREMENT.REQUIRED) return false;
+  return scope2.auditKind === AUDIT_KIND.COVERAGE_GAP || scope2.coverageStatus === AUDIT_COVERAGE_STATUS.UNSUPPORTED || scope2.coverageStatus === AUDIT_COVERAGE_STATUS.MISSING_SKILL || scope2.coverageStatus === AUDIT_COVERAGE_STATUS.SKIPPED || scope2.coverageStatus === AUDIT_COVERAGE_STATUS.INCOMPLETE;
+}
+function expectedAuditTerminalStatus(events) {
+  const hasFinding = countVerifyFindings(events) > 0;
+  const auditScopeEvents = events.filter((event) => {
+    if (event.type !== VERIFY_APPEND_EVENT_TYPE.SCOPE || !isJsonRecord(event.data)) return false;
+    return validateAuditScope(event.data[VERIFY_APPEND_EVENT_FIELD.PAYLOAD]) !== void 0;
+  });
+  const hasUncoveredRequiredScope = events.some((event) => {
+    if (event.type !== VERIFY_APPEND_EVENT_TYPE.SCOPE || !isJsonRecord(event.data)) return false;
+    const payload = event.data[VERIFY_APPEND_EVENT_FIELD.PAYLOAD];
+    const scope2 = validateAuditScope(payload);
+    return scope2 === void 0 ? false : auditCoverageRejectsRun(scope2);
+  });
+  return hasFinding || auditScopeEvents.length === 0 || hasUncoveredRequiredScope ? JOURNAL_RUN_STATE_STATUS.REJECTED : JOURNAL_RUN_STATE_STATUS.APPROVED;
+}
+function validateAuditTerminal(input) {
+  if (input.metadata !== void 0) {
+    return { ok: false, error: TERMINAL_METADATA_VALIDATION_ERROR.METADATA_INVALID };
+  }
+  if (input.terminalStatus !== expectedAuditTerminalStatus(input.events)) {
+    return { ok: false, error: TERMINAL_METADATA_VALIDATION_ERROR.STATUS_CONFLICT };
+  }
+  return { ok: true, value: void 0 };
+}
+function expectedReviewMetadataTerminalStatus(metadata) {
+  if (metadata?.state === REVIEW_TERMINAL_STATE.APPROVED) return JOURNAL_RUN_STATE_STATUS.APPROVED;
+  if (metadata?.state === REVIEW_TERMINAL_STATE.CHANGES_REQUESTED) return JOURNAL_RUN_STATE_STATUS.REJECTED;
+  return void 0;
 }
 function findAppendedSequence(events, idempotencyKey, eventType) {
   const match = events.find(
@@ -19805,6 +20308,7 @@ function buildAppendEvent(args) {
 }
 var VERIFY_TERMINAL_EVENT_TYPE = `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.verify.terminal`;
 var VERIFY_TERMINAL_EVENT_FIELD = {
+  TERMINAL_METADATA: "terminalMetadata",
   TERMINAL_STATUS: "terminalStatus"
 };
 var VERIFY_TERMINAL_EVENT_ID_PREFIX = "verify-terminal-";
@@ -19819,7 +20323,8 @@ function buildTerminalEvent(args) {
     time: args.at.toISOString(),
     attempt: VERIFY_APPEND_ATTEMPT,
     data: {
-      [VERIFY_TERMINAL_EVENT_FIELD.TERMINAL_STATUS]: args.terminalStatus
+      [VERIFY_TERMINAL_EVENT_FIELD.TERMINAL_STATUS]: args.terminalStatus,
+      ...args.terminalMetadata === void 0 ? {} : { [VERIFY_TERMINAL_EVENT_FIELD.TERMINAL_METADATA]: args.terminalMetadata }
     }
   };
 }
@@ -19832,11 +20337,23 @@ function terminalStatusOf(event) {
   const status = event.data[VERIFY_TERMINAL_EVENT_FIELD.TERMINAL_STATUS];
   return typeof status === "string" ? status : void 0;
 }
+function terminalMetadataOf(event) {
+  if (event === void 0 || !isJsonRecord(event.data)) return void 0;
+  return event.data[VERIFY_TERMINAL_EVENT_FIELD.TERMINAL_METADATA];
+}
 function countVerifyFindings(events) {
   return events.filter(
     (event) => event.type === VERIFY_APPEND_EVENT_TYPE.FINDING
   ).length;
 }
+function countReviewScopeFindingUnits(events) {
+  return events.filter((event) => {
+    if (event.type !== VERIFY_APPEND_EVENT_TYPE.SCOPE || !isJsonRecord(event.data)) return false;
+    const payload = event.data[VERIFY_APPEND_EVENT_FIELD.PAYLOAD];
+    const scope2 = validateReviewScope(payload);
+    return scope2?.coverageState === REVIEW_SCOPE_COVERAGE_STATE.FINDING;
+  }).length;
+}
 function lastSequenceOf(events) {
   return events.reduce(
     (max, event) => event.seq > max ? event.seq : max,
@@ -19846,10 +20363,12 @@ function lastSequenceOf(events) {
 function projectVerifyRun(events) {
   const terminal = findTerminalEvent(events);
   const terminalStatus = terminalStatusOf(terminal);
+  const terminalMetadata = terminalMetadataOf(terminal);
   const sealed = terminal !== void 0;
   return {
     sealed,
     ...terminalStatus === void 0 ? {} : { terminalStatus },
+    ...terminalMetadata === void 0 ? {} : { terminalMetadata },
     findingCount: countVerifyFindings(events),
     lastSequence: lastSequenceOf(events),
     nextActions: sealed ? [] : UNSEALED_NEXT_ACTIONS
@@ -19877,11 +20396,14 @@ var VERIFY_CLI_ERROR = {
   PAYLOAD_READ_FAILED: "spx verification run could not read the evidence payload",
   PAYLOAD_INVALID: "spx verification run evidence payload is not valid JSON",
   RUN_FINISHED: "spx verification run cannot add evidence to a finished run",
+  SCOPE_INVALID: "spx verification run scope add payload failed verification-type validation",
   FINDING_INVALID: "spx verification run finding add payload failed verification-type validation",
   UNSUPPORTED_VERIFICATION_TYPE: "spx verification run verification type is not registered",
   APPEND_FAILED: "spx verification run could not append the evidence event",
   TERMINAL_STATUS_REQUIRED: "spx verification run finish requires --terminal-status <status>",
   TERMINAL_STATUS_INVALID: "spx verification run finish requires a terminal status in the journal terminal-status vocabulary",
+  TERMINAL_METADATA_INVALID: "spx verification run terminal metadata failed verification-type validation",
+  TERMINAL_STATUS_CONFLICT: "spx verification run terminal status conflicts with verification-type terminal metadata: status-conflict",
   FINISH_FAILED: "spx verification run could not record terminal completion",
   SEAL_FAILED: "spx verification run could not seal the run journal",
   STATUS_FAILED: "spx verification run could not read the run status",
@@ -20271,12 +20793,18 @@ function appendRunSelectorMismatchDiagnostic(options, backendIdentity, namespace
     searchedTarget
   });
 }
-function validateAppendFinding(verb, verificationType, payload) {
-  if (verb !== VERIFY_VERB.APPEND_FINDING) return void 0;
-  const validator = findingValidatorFor(verificationType);
-  if (validator === void 0) return VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE;
-  if (validator(payload) === void 0) return VERIFY_CLI_ERROR.FINDING_INVALID;
-  return void 0;
+function validateAppendEvidence(verb, verificationType, payload, events) {
+  const evidenceKind = verb === VERIFY_VERB.APPEND_FINDING ? VERIFY_EVIDENCE_KIND.FINDING : VERIFY_EVIDENCE_KIND.SCOPE;
+  const validator = evidenceValidatorFor(verificationType, evidenceKind);
+  if (validator === void 0) return { ok: false, error: VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE };
+  const validated = validator({ payload, events });
+  if (validated === void 0) {
+    return {
+      ok: false,
+      error: verb === VERIFY_VERB.APPEND_FINDING ? VERIFY_CLI_ERROR.FINDING_INVALID : VERIFY_CLI_ERROR.SCOPE_INVALID
+    };
+  }
+  return { ok: true, value: JSON.parse(JSON.stringify(validated)) };
 }
 function appendEventType(verb) {
   return verb === VERIFY_VERB.APPEND_FINDING ? VERIFY_APPEND_EVENT_TYPE.FINDING : VERIFY_APPEND_EVENT_TYPE.SCOPE;
@@ -20299,12 +20827,12 @@ async function verifyAppend(options, deps, verb) {
   }
   const parsed = parseAppendPayload(rawPayload);
   if (parsed === void 0) return errorResult3(VERIFY_CLI_ERROR.PAYLOAD_INVALID);
-  const findingError = validateAppendFinding(verb, options.verificationType, parsed);
-  if (findingError !== void 0) return errorResult3(findingError);
+  const evidence = validateAppendEvidence(verb, options.verificationType, parsed, existingEvents);
+  if (!evidence.ok) return errorResult3(evidence.error);
   const event = buildAppendEvent({
     eventType,
     idempotencyKey: options.idempotencyKey,
-    payload: parsed,
+    payload: evidence.value,
     at: deps.now?.() ?? /* @__PURE__ */ new Date()
   });
   const appended = await journalAppendCommand(journalScope, event, binding, forwardDeps(deps));
@@ -20422,6 +20950,7 @@ function verifyFinishReport(runToken, projection) {
   return {
     runToken,
     ...projection.terminalStatus === void 0 ? {} : { terminalStatus: projection.terminalStatus },
+    ...projection.terminalMetadata === void 0 ? {} : { terminalMetadata: projection.terminalMetadata },
     sealed: projection.sealed,
     findingCount: projection.findingCount,
     lastSequence: projection.lastSequence
@@ -20446,6 +20975,31 @@ function finishReadFailure(run, options, error) {
   }
   return errorResult3(`${VERIFY_CLI_ERROR.FINISH_FAILED}: ${error}`);
 }
+async function readTerminalMetadata(options, deps) {
+  if (options.terminalMetadata === void 0) return { ok: true, value: void 0 };
+  const readPayload = deps.readPayloadSource;
+  if (readPayload === void 0) return { ok: false, error: VERIFY_CLI_ERROR.TERMINAL_METADATA_INVALID };
+  try {
+    const rawMetadata = await readPayload(options.terminalMetadata);
+    const parsed = parseAppendPayload(rawMetadata);
+    if (parsed === void 0) return { ok: false, error: VERIFY_CLI_ERROR.PAYLOAD_INVALID };
+    return { ok: true, value: parsed };
+  } catch (error) {
+    return { ok: false, error: `${VERIFY_CLI_ERROR.PAYLOAD_READ_FAILED}: ${toMessage2(error)}` };
+  }
+}
+function validateTerminalMetadata(verificationType, terminalStatus, metadata, events) {
+  const validator = terminalMetadataValidatorFor(verificationType);
+  if (validator === void 0) {
+    return metadata === void 0 ? { ok: true, value: void 0 } : { ok: false, error: VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE };
+  }
+  const validated = validator({ terminalStatus, metadata, events });
+  if (validated.ok) return { ok: true, value: validated.value };
+  return {
+    ok: false,
+    error: validated.error === TERMINAL_METADATA_VALIDATION_ERROR.STATUS_CONFLICT ? VERIFY_CLI_ERROR.TERMINAL_STATUS_CONFLICT : VERIFY_CLI_ERROR.TERMINAL_METADATA_INVALID
+  };
+}
 async function finishProjectionResult(run, deps) {
   const events = await readRunJournalEvents(run.journalScope, deps);
   if (!events.ok) return errorResult3(`${VERIFY_CLI_ERROR.FINISH_FAILED}: ${events.error}`);
@@ -20475,11 +21029,21 @@ async function verifyFinishCommand(options, deps) {
   if (inputRecord.value === void 0) {
     return errorResult3(existingRunNotFound(run.value, options));
   }
+  const rawTerminalMetadata = await readTerminalMetadata(options, deps);
+  if (!rawTerminalMetadata.ok) return errorResult3(rawTerminalMetadata.error);
+  const terminalMetadata = validateTerminalMetadata(
+    options.verificationType,
+    options.terminalStatus,
+    rawTerminalMetadata.value,
+    before.value
+  );
+  if (!terminalMetadata.ok) return errorResult3(terminalMetadata.error);
   const binding = deps.journalBinding;
   if (binding === void 0) return errorResult3(VERIFY_CLI_ERROR.FINISH_FAILED);
   const event = buildTerminalEvent({
     runToken: run.value.runToken,
     terminalStatus: options.terminalStatus,
+    ...terminalMetadata.value === void 0 ? {} : { terminalMetadata: terminalMetadata.value },
     at: deps.now?.() ?? /* @__PURE__ */ new Date()
   });
   const appended = await journalAppendCommand(run.value.journalScope, event, binding, forwardDeps(deps));
@@ -20513,6 +21077,7 @@ async function verifyStatusCommand(options, deps) {
     sealed: projection.sealed,
     lastSequence: projection.lastSequence,
     ...projection.terminalStatus === void 0 ? {} : { terminalStatus: projection.terminalStatus },
+    ...projection.terminalMetadata === void 0 ? {} : { terminalMetadata: projection.terminalMetadata },
     findingCount: projection.findingCount,
     nextActions: projection.nextActions
   };
@@ -20539,6 +21104,7 @@ async function verifyRenderCommand(options, deps) {
     findingCount: projection.findingCount,
     sealed: projection.sealed,
     ...projection.terminalStatus === void 0 ? {} : { terminalStatus: projection.terminalStatus },
+    ...projection.terminalMetadata === void 0 ? {} : { terminalMetadata: projection.terminalMetadata },
     events: events.value
   };
   return okResult3(JSON.stringify(report2));
@@ -20576,6 +21142,7 @@ var VERIFY_CLI = {
   payloadOptionDescription: "Evidence payload source; stdin or a file path",
   idempotencyKeyOption: "--idempotency-key <key>",
   idempotencyKeyOptionDescription: "Caller-supplied idempotency key for the evidence add",
+  terminalMetadataOption: "--terminal-metadata <payload-source>",
   terminalStatusOption: "--terminal-status <status>"
 };
 var CLI_SOURCE_ENCODING = "utf8";
@@ -20629,7 +21196,7 @@ function registerVerifyCommands(program, invocation, handlers = DEFAULT_VERIFY_C
   findingCommand.command(VERIFY_CLI.addCommandName).description("Record a validated verification finding for a started run").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.payloadOption, VERIFY_CLI.payloadOptionDescription).requiredOption(VERIFY_CLI.idempotencyKeyOption, VERIFY_CLI.idempotencyKeyOptionDescription).action(async (options) => {
     reportCliResult(await handlers.appendFinding(options, deps()), invocation.io);
   });
-  runCommand.command(VERIFY_CLI.finishCommandName).description("Record terminal completion, seal the run journal, and report its terminal projection").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.terminalStatusOption, "Terminal status recorded before sealing").action(async (options) => {
+  runCommand.command(VERIFY_CLI.finishCommandName).description("Record terminal completion, seal the run journal, and report its terminal projection").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.terminalStatusOption, "Terminal status recorded before sealing").option(VERIFY_CLI.terminalMetadataOption, "Verification-type terminal metadata source; stdin or a file path").action(async (options) => {
     reportCliResult(await handlers.finish(options, deps()), invocation.io);
   });
   runCommand.command(VERIFY_CLI.statusCommandName).description("Report the run's resumable status projected from its journal history").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").action(async (options) => {