@redue/cli 0.1.0-alpha.31 → 0.1.0-alpha.33

package/CHANGELOG.md

@@ -1,5 +1,86 @@
 # Changelog
 
+## 0.1.0-alpha.33 — 2026-11-06
+
+pytest checks follow the project's quick suite, and the hook starts for
+every check form.
+
+- **The pull-request workflow's narrowed suite.** For pytest, `init` now
+  reads `coverage run -m pytest`, quoted arguments (`-m "not slow"`) and
+  lines continued with a backslash, and leaves out options that only write
+  a report (`--junit-xml`, `--html`, `--durations`). When a workflow that
+  runs on pull requests narrows the suite (`-m`, `-k`, `--ignore`,
+  `--deselect`), its line wins. On project-lighter/lighter the test check is
+  now `pytest tests -m "not slow"` (4.7 s), not the full suite with its
+  CIFAR download: setup took 68 s instead of 10.5 minutes, and all three
+  checks qualify.
+- **Trigger rules that Claude Code matches.** A hook trigger rule with a
+  quote in it never started the hook in a real session, so such a check's
+  runs were neither skipped nor recorded. A rule now ends before the first
+  character outside letters, digits, spaces and `_./:=,+@-`, and the hook
+  matches the whole command itself, spaces inside quotes included.
+- **`redue agent doctor` checks the trigger rules.** `trigger_rules` says
+  whether the installed rules start the hook for every command form of
+  every configured check, as REDUE models Claude Code's matching, and names
+  the forms they miss.
+- **README.** Setup can take longer with a large environment or a slow
+  suite; trial runs stop at 5 minutes and `redue init --check test
+  --no-time-limit` tries a check without the limit.
+
+Measured: stranger sessions on lighter (alpha.32 code with these changes)
+skipped mypy and pytest after a docs edit and ran both through REDUE after
+a source change, 0 critical. Python product census: 0 critical; 17 test,
+15 typecheck and 22 lint checks qualify, as in alpha.32. `init` on the 13
+slowest census repos chose the same checks as alpha.32.
+
+## 0.1.0-alpha.32 — 2026-11-05
+
+REDUE's status is now the point: what is verified on the code as it is
+now, what is stale, what is due.
+
+- **`redue verify`.** Runs every check that is due (STALE, or UNVERIFIED
+  with a program that exists), starting the observer if needed, then shows
+  the full status. It exits 0 only when every check that can be verified
+  ends CURRENT / PASS. `--json` gives `verified`, the checks it ran and the
+  status. It runs what is due up to three rounds, since a run can make
+  another check due.
+- **Not verifiable.** A check no run can confirm shows as NOT VERIFIABLE
+  with the reason: a recording-only check, or one whose last two passing
+  runs changed the same inputs while they ran (a test script that rebuilds
+  a tracked bundle). `verify`, its exit code, the end-of-turn check and the
+  status line's due count leave it out; the status line shows it ("✓ 3
+  verified · 1 not verifiable"). Any other change, or a failing run, makes
+  it due again. JSON: `"verifiable": false` and a `not_verifiable` count.
+- **A status line in Claude Code.** `redue setup claude` adds one:
+  "REDUE ✓ 3 verified", "REDUE ✓ 1 verified · 2 due: typecheck, test",
+  "REDUE ✗ 1 failing: lint". A status line you already have stays; setup
+  prints the command instead.
+- **End-of-turn check.** When the agent changed files during a turn and a
+  check is due, the hook asks it once to run `redue verify` before it
+  finishes. It never asks twice in a turn. `"endOfTurnCheck": false` in
+  the config turns it off.
+- **Faster sandboxed runs.** Receipts and checkpoints keep each installed
+  tree (`.venv`, `node_modules`) as one digest, a run computes only its own
+  check's context, and Linux keeps the Landlock probe's answer. What `redue
+  run` adds to a sub-second check on GitHub's Linux runners fell from
+  270-514 ms to 125-205 ms (lighter's ruff 514 to 155 ms); on macOS from
+  390-710 ms to 310-435 ms, where an FSEvents history stall (150-190 ms in
+  about a third of checkpoints) remains. The Landlock launcher now refuses
+  a network-less run on a kernel below ABI 4.
+- **Windows.** A status call before the first `redue start` no longer
+  leaves a file that makes `start` refuse the state directory.
+
+Measured with the verification-gap study (21 tasks on 7 repositories, 2
+runs, Claude Code headless): sessions that ended with every check verified
+on the final code went from 5 of 42 to 41 of 42 with Sonnet 5.5, and from
+20 of 42 to 42 of 42 with Opus 5.5, with no check REDUE called CURRENT /
+PASS failing on the final code. In the product census, 73% of 330 checks
+had a definite answer (CURRENT or STALE) after their second run (alpha.29:
+71%); 97% of those on the sandboxed recipe with ignored files and
+documentation hidden. `init` on the 13 slowest census repos took 3874 s on
+Linux and 4797 s on macOS (alpha.31: 4139 s and 5517 s), with the same
+checks chosen.
+
 ## 0.1.0-alpha.31 — 2026-11-03
 
 A check that runs longer than init's trial limit no longer holds up

package/README.md

@@ -1,14 +1,36 @@
 # REDUE
 
-**Know which checks still hold. Redo what's due.**
+**Know what is verified on the code you have now.**
 
-You or your coding agent ran the typecheck, the linter or the tests. Then the
-code changed, or a new agent session started with no memory of it. REDUE
-records each check's result with the exact inputs it ran on, and tells you and
-your agent whether that result still applies to the code you have now, so a
-check that still holds is not run again and one that is stale is.
+Your typecheck, linter and tests passed at some point. Then the code
+changed, or a new agent session started with no memory of what ran. REDUE
+records each check's result with the exact inputs it ran on, and gives you
+and your coding agent one dependable answer: which checks are verified on
+the code as it is now, which are stale, and which are due. When it cannot
+tell, it says so and why; it never guesses a result into place.
 
-## Quickstart (about 5 minutes)
+## What it changes
+
+Coding agents often finish without running every check on their final code.
+In headless Claude Code sessions on realistic tasks whose prompts never
+mention checks (bug fixes, small features and refactors; 21 tasks on 7
+TypeScript and Python projects, two runs each), the share of sessions that
+ended with every check verified on the final code:
+
+| Model | Without REDUE | With REDUE |
+|---|---|---|
+| Sonnet 5.5 | 12% (5 of 42) | 98% (41 of 42) |
+| Opus 5.5 | 48% (20 of 42) | 100% (42 of 42) |
+
+A check counts as verified when the session ran all of it on the final code,
+or REDUE said CURRENT for it at the end; counting only the agents' own check
+commands, it was 90% and 98% with REDUE. REDUE never called a failing check
+verified: in no session did it say CURRENT / PASS for a check that failed
+when run plainly on the final code. Without REDUE, 4 Sonnet sessions ended
+with a failing check they had not run; with it, none did. The harness and
+tasks are in [`eval/`](eval/README.md).
+
+## Quickstart
 
 You need macOS or Linux, Node 22 or 24, Git, Claude Code, and either a
 JavaScript or TypeScript project with its dependencies installed
@@ -31,37 +53,86 @@ stops before writing anything if the dependencies are not installed. It:
   workflows, Makefile, justfile, tox, nox or scripts give them: mypy,
   pyright and ty (typecheck), ruff (lint) and pytest (test). It says which
   checks it left out and why, and which it can only record, not reuse;
-- connects Claude Code: a short section in `CLAUDE.md`, a skill, and two hooks
-  in `.claude/settings.local.json`;
+- connects Claude Code: a short section in `CLAUDE.md`, a skill, hooks in
+  `.claude/settings.local.json`, and a status line there. A status line you
+  already have stays;
 - starts REDUE's file observer, waits while it indexes the project (a minute
   or more in a large one), then runs each check that can qualify once, so
-  there is a first result to reuse, and prints one line per run (the run's
-  own output only when it fails);
+  there is a first result, and prints one line per run (the run's own output
+  only when it fails);
 - prints every file it writes. Running it again changes nothing.
 
-Then start a new Claude Code session in the project and work as usual. When
-the agent is about to rerun a check whose last pass still applies, the hook
-skips it and tells the agent why. After an edit, the hook runs the check
-through REDUE so the new result is recorded.
+Setup takes a minute or two in most projects. It can take longer in a large
+environment, such as a `.venv` with PyTorch or a workspace with many
+packages, because the observer indexes every installed file first, and with
+a slow test suite, because `init` runs each check once plainly and once in
+the sandbox before it chooses how to run it. Each of those trial runs stops
+after 5 minutes; a check that runs longer is left out of the sandbox, and
+setup names it and prints the command that tries it without the limit, such
+as `redue init --check test --no-time-limit`. For pytest, `init` takes the
+arguments the project's own workflows run it with, and prefers a
+pull-request workflow that leaves slow tests out (`-m "not slow"`).
 
-To look yourself:
+Then start a new Claude Code session in the project and work as usual. The
+status line shows where things stand, updated as the agent works:
+
+```text
+REDUE ✓ 3 verified
+REDUE ✓ 2 verified · 1 due: typecheck
+REDUE ✓ 2 verified · 1 not verifiable
+```
+
+When the agent runs a check whose last pass still applies, the hook skips
+the rerun and tells it why; after an edit, the hook runs the check through
+REDUE so the new result is recorded. When the agent is about to finish a
+turn in which files changed while a check is due, the hook asks it once to
+run `redue verify` first (`"endOfTurnCheck": false` in the config turns
+this off).
+
+To ask yourself:
 
 ```text
 $ redue status
 ✓ typecheck  CURRENT / PASS
 ✓ lint  CURRENT / PASS
+✓ test  CURRENT / PASS
 
 # after editing src/main.ts
-$ redue explain typecheck
-typecheck: STALE / PASS
-src/main.ts changed
-Due again when verification is needed: redue run "typecheck"
+$ redue status
+⚠ typecheck  STALE / PASS
+  src/main.ts changed
+⚠ lint  STALE / PASS
+  src/main.ts changed
+✓ test  CURRENT / PASS
+
+$ redue verify
+redue verify: running typecheck (STALE: src/main.ts changed)
+typecheck: PASS recorded.
+Check redue status before reusing this evidence.
+redue verify: running lint (STALE: src/main.ts changed)
+lint: PASS recorded.
+Check redue status before reusing this evidence.
+
+✓ typecheck  CURRENT / PASS
+✓ lint  CURRENT / PASS
+✓ test  CURRENT / PASS
+Verified: every check that can be verified (3) passed on the files as they are now.
 ```
 
 `redue status` checks the files and your environment before it answers, as
 the agent's hook does. `redue status --cached` gives the last answer the
 observer published without checking; it can say UNVERIFIED ("cannot confirm
 your execution context") where `redue status` would say CURRENT.
+`redue explain CHECK` says why a check is in its state.
+
+`redue verify` runs every check that is due (STALE, or UNVERIFIED with a
+command it can run), then prints the status. It exits 0 only when every
+check that can be verified ends CURRENT / PASS, so it answers "is everything
+verified on the code as it is now?" in one command. A check no run can
+confirm is shown as NOT VERIFIABLE with the reason, and left out: a
+recording-only check, or one whose runs change its own inputs (two passing
+runs in a row changed the same files, such as a test script that rebuilds a
+tracked bundle). Any other change, or a failing run, makes it due again.
 
 `redue stats` shows, per check, the reruns the hook skipped, the time saved,
 the recorded runs and the top reasons a check was UNVERIFIED, from a log kept
@@ -69,6 +140,26 @@ on your machine.
 
 To undo everything setup did: `redue remove`.
 
+## Time saved, as a bonus
+
+A check whose last pass still applies does not run again. Headless Claude
+Code sessions (Sonnet 5.5, CI Linux runner) on the same tasks with and
+without REDUE, three sessions per task. Session time, medians per task
+summed over the projects:
+
+- **Typecheck** (twilio-node, semiotic, Ultra-Card, SwitchHosts; four tasks;
+  96 sessions; 0.1.0-alpha.12 code): 464 s without, 330 s with. REDUE skipped
+  33 typechecks. Each was checked afterwards with plain `tsc` on the exact tree
+  it was skipped on, and all 33 agreed.
+- **Unit tests** (cheerio with Vitest 4, SwitchHosts with Vitest 5, twilio-node
+  with Jest 29; four tasks; 72 sessions; 0.1.0-alpha.14 code): 515 s without,
+  295 s with. REDUE skipped 21 test runs. Each was rerun plainly three times on
+  the exact tree, and all passed every time.
+
+API cost was the same in both arms. The savings come only when an earlier
+pass still applies: a task that changes source code saves nothing. A handful
+of projects and three runs per task show direction, not a general rate.
+
 ## Still CURRENT after your build and tests
 
 Running the project's build or tests writes files (`dist/`, `.next/`,
@@ -122,26 +213,6 @@ into and the sandbox can't run (inside Claude Code's macOS sandbox, on
 Windows), the project uses Bun, or a check writes into its own inputs.
 [Supported projects](docs/user/supported-projects.md) has the details.
 
-## Measured with Claude Code
-
-Headless Claude Code sessions (Sonnet 5.5, CI Linux runner) on the same tasks
-with and without REDUE, three sessions per task. Session time, medians per
-task summed over the projects:
-
-- **Typecheck** (twilio-node, semiotic, Ultra-Card, SwitchHosts; four tasks;
-  96 sessions; 0.1.0-alpha.12 code): 464 s without, 330 s with. REDUE skipped
-  33 typechecks. Each was checked afterwards with plain `tsc` on the exact tree
-  it was skipped on, and all 33 agreed.
-- **Unit tests** (cheerio with Vitest 4, SwitchHosts with Vitest 5, twilio-node
-  with Jest 29; four tasks; 72 sessions; 0.1.0-alpha.14 code): 515 s without,
-  295 s with. REDUE skipped 21 test runs. Each was rerun plainly three times on
-  the exact tree, and all passed every time.
-
-API cost was the same in both arms. The savings come only when an earlier
-pass still applies: a task that changes source code saves nothing. A handful
-of projects and three runs per task show direction, not a general rate. The
-harness, tasks and raw results are in [`eval/`](eval/README.md).
-
 ## What REDUE won't do
 
 - **Prove your code is correct.** CURRENT means the inputs of the recorded
@@ -151,9 +222,10 @@ harness, tasks and raw results are in [`eval/`](eval/README.md).
 - **Trust what it cannot see.** A program it cannot account for, a file it
   does not observe, or a gap in observation makes the result UNVERIFIED and
   says why. It never turns that into CURRENT by guessing.
-- **Support yet:** TypeScript 7's native compiler, Bun, per-package checks in
-  large monorepos, results shared across machines, and the general recipe on
-  Windows (Windows has the strict recipes only).
+- **Support yet:** Bun, per-package checks in large monorepos, results shared
+  across machines, and the general recipe on Windows (Windows has the strict
+  recipes only). TypeScript 7's native compiler is covered: a typecheck that
+  runs it gets the [sandboxed recipe](docs/user/sandbox.md).
 
 ## What the states mean
 
@@ -163,6 +235,7 @@ harness, tasks and raw results are in [`eval/`](eval/README.md).
 | STALE | An input changed since the recorded result. | Rerun when you need the answer. |
 | UNVERIFIED | REDUE cannot tell: no result yet, an input it cannot see, or observation not ready. | Read the reason; rerun if it matters. |
 | FAILED | The last run failed: the check ran and reported a failure, or could not run. | Fix and rerun. |
+| NOT VERIFIABLE | No run can confirm a result: a recording-only check, or one whose runs change its own inputs. | Read the reason; `redue verify` leaves it out. |
 
 ## Without Claude Code, or step by step
 
@@ -171,6 +244,7 @@ redue init          # write redue.config.json from your scripts
 redue start         # start the file observer
 redue run typecheck # run a check through REDUE and record the result
 redue status        # what still holds
+redue verify        # run what is due; exit 0 when everything is CURRENT / PASS
 ```
 
 Codex is supported too (`redue agent setup codex --apply`); see

package/bin/redue.mjs

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import {mark,traceBase,traceContext,traceEnvironment,traceId} from '../src/decision-profile.mjs';
 traceBase({...traceContext(),request:traceId(),work:'client'});
-mark('client.loaded');
+mark('client.loaded',{sinceStartMs:Math.round(performance.now())});
 import {directCompiler,directQualification,directEnvironment,directInstalledInputs,directInterpretation} from '../src/direct-typescript.mjs';
 import {runArgv,tscRun} from '../src/typescript-invocation.mjs';
 import {testEnvironment,testRunnerAt,testsInterpretation,testsQualification} from '../src/test-direct.mjs';
@@ -49,6 +49,8 @@ Commands:
   detail [CHECK] [--json]  Alias for explain
   run CHECK [--if-due] Execute one configured check and record its outcome; with --if-due,
                        only when its last pass does not apply to the files as they are now
+  verify [--json]      Run every check that is due (STALE, or UNVERIFIED with a runnable command),
+                       then show the status; exit 0 only when every check is CURRENT / PASS
   stats [--json]       Per check: skips, time saved, recorded runs, why checks were UNVERIFIED
   remove-state         Stop and remove only this configuration's owned local state
 
@@ -66,6 +68,12 @@ if(args.length===3&&args[0]==='agent'&&args[1]==='hook'&&args[2]==='claude'){
   const {runClaudeHook}=await import('../src/claude-hook.mjs');
   await runClaudeHook(fileURLToPath(import.meta.url));process.exit(0);
 }
+// Claude Code's status line, also before config discovery: it prints one
+// line, or nothing where REDUE is not set up.
+if(args.length===3&&args[0]==='agent'&&args[1]==='statusline'&&args[2]==='claude'){
+  const {runStatusLine}=await import('../src/claude-hook.mjs');
+  await runStatusLine(fileURLToPath(import.meta.url));await exit(0);
+}
 if(args.length===1&&args[0]==='--version'){console.log(version);process.exit(0);}
 // Internal: the entry this command runs, so setup and the hook can tell
 // whether the `redue` on PATH (a link, a package manager's shim, a wrapper)
@@ -99,7 +107,7 @@ if(command==='agent'){
   catch(e){error(e.message);}
   await exit(0);
 }
-if(!['init','start','stop','status','detail','explain','run','stats','remove-state'].includes(command))
+if(!['init','start','stop','status','detail','explain','run','verify','stats','remove-state'].includes(command))
   error(`unknown command ${command||'<none>'}; use --help`);
 const json=args.includes('--json');
 // run --if-due: run the check only when its last pass does not apply now.
@@ -319,7 +327,9 @@ if(publicConfig.schema!==1)error('config schema must be 1');
 if(!Array.isArray(publicConfig.checks)||!publicConfig.checks.length)
   error('config needs at least one explicitly defined check');
 for(const key of Object.keys(publicConfig))
-  if(!['schema','root','checks','packageManager'].includes(key))error(`unsupported config field ${key}`);
+  if(!['schema','root','checks','packageManager','endOfTurnCheck'].includes(key))error(`unsupported config field ${key}`);
+// The Claude Code hook's end-of-turn check; only the hook reads it.
+if(publicConfig.endOfTurnCheck!==undefined&&typeof publicConfig.endOfTurnCheck!=='boolean')error('endOfTurnCheck must be true or false');
 if(check&&!publicConfig.checks.some(row=>row.name===check))error(`unknown check ${check}; use redue status to list configured checks`);
 const root=realObservedPath(path.resolve(path.dirname(configFile),publicConfig.root||'.'));
 const state=stateOverride||projectState(root,configFile);
@@ -507,6 +517,75 @@ if(!maintenance&&!created){
   }
 }
 
+if(command==='verify'){
+  const self=(more,options)=>spawnSync(process.execPath,[fileURLToPath(import.meta.url),'--config',configFile,
+    ...(stateOverride?['--state-dir',stateOverride]:[]),...more],{env:process.env,...options});
+  const ask=()=>{const r=self(['status','--sync','--json'],{encoding:'utf8',stdio:['ignore','pipe','ignore'],timeout:600_000});
+    try{return JSON.parse(r.stdout);}catch{return null;}};
+  const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+  let status=ask();
+  // Nothing is confirmed without the observer: start it as the session hook
+  // does, and wait while it indexes.
+  if(!status?.observation?.healthy){
+    let pid=null;try{pid=Number(fs.readFileSync(path.join(state,'observer.lock','pid'),'utf8'));}catch{}
+    if(!(Number.isSafeInteger(pid)&&pid>0&&processAlive(pid))){
+      if(!json)console.error('redue verify: starting the observer');
+      self(['start'],{stdio:['ignore','ignore','inherit']});status=ask();
+    }
+    for(const until=Date.now()+120_000;!status?.observation?.healthy&&
+      ['discovery','indexing','reconciling','validating','initializing'].includes(status?.observation?.phase)&&Date.now()<until;){
+      await sleep(1000);status=ask();}
+  }
+  // A check is due when its last result does not apply to the files as they
+  // are now, and it can run: its program is there.
+  const runnable=row=>{const command=checks.find(item=>item.name===row.name)?.command?.[0];
+    if(typeof command!=='string'||command.endsWith('<unavailable>'))return false;
+    if(command.includes('/'))return fs.existsSync(path.resolve(root,checks.find(item=>item.name===row.name).cwd||'.',command));
+    return Boolean(findExecutable(command));};
+  // A check no run can confirm (recording-only, or one that rewrites its own
+  // inputs: verifiable false) is never due. A run can make another check due
+  // (a suite that writes an input), and a check that rewrites its own inputs
+  // shows that on its second run: verify runs what is due again, three rounds
+  // at most.
+  // In a round, a check whose last run changed its inputs runs first, so the
+  // checks its run makes due run after it.
+  // A check that already ran here is due again only when it is STALE or its
+  // inputs changed during its run: another UNVERIFIED reason would not clear.
+  const changedOwn=row=>/declared input event occurred during execution/.test(row.reason||'');
+  const ranNames=new Set();
+  const dueOf=value=>(value?.checks||[]).filter(row=>row.verifiable!==false&&
+    (row.freshness==='STALE'||row.freshness==='UNVERIFIED'&&runnable(row)&&(!ranNames.has(row.name)||changedOwn(row))))
+    .sort((a,b)=>changedOwn(b)-changedOwn(a));
+  // While the observer indexes or reconciles (a run may have changed a manifest).
+  const settle=async()=>{for(const until=Date.now()+120_000;!status?.observation?.healthy&&
+    ['discovery','indexing','reconciling','validating','initializing'].includes(status?.observation?.phase)&&Date.now()<until;){
+    await sleep(1000);status=ask();}};
+  const {note,dueNote}=await import('../src/stats.mjs');
+  const ran=[];
+  for(let round=0,due=dueOf(status);round<3&&due.length&&status?.observation?.healthy;round++,due=dueOf(status)){
+    for(const row of due){
+      const entry=dueNote(status,row.name);if(entry)note(state,entry);
+      if(!json)console.error(`redue verify: running ${row.name} (${row.freshness}: ${row.reason})`);
+      // With --json, the check's output goes to stderr; stdout carries the answer.
+      const r=self(['run',row.name],{stdio:json?['ignore',2,2]:'inherit'});
+      ran.push({check:row.name,was:row.freshness,exit:r.status});ranNames.add(row.name);
+    }
+    status=ask();await settle();
+  }
+  const final=status;
+  const counted=(final?.checks||[]).filter(row=>row.verifiable!==false);
+  const verified=Boolean(final?.observation?.healthy)&&counted.length>0&&counted.every(row=>row.freshness==='CURRENT'&&row.result==='PASS');
+  if(json)console.log(JSON.stringify({schema:1,verified,ran,status:final}));
+  else{
+    if(ran.length)console.log('');
+    console.log(final?renderStatus(final):'UNVERIFIED — status did not answer.');
+    const other=final?.checks?.length-counted.length;
+    console.log((verified?`Verified: every check that can be verified (${counted.length}) passed on the files as they are now.`:
+      counted.length?'Not verified: some checks did not end CURRENT / PASS.':'Not verified: no check can be verified here.')+
+      (other?` ${other} not verifiable, left out.`:''));
+  }
+  await exit(verified?0:1);
+}
 if(command==='status'&&!sync){
   const value=readCachedStatus(state,publicConfig.checks);
   console.log(json?JSON.stringify(value):renderStatus(value,{short}));

package/docs/user/agents.md

@@ -87,6 +87,32 @@ paths no longer exist. When the hook runs a check through REDUE for the
 agent, it likewise writes plain `redue run` only if its own PATH finds this
 install, else the absolute form.
 
+The same command also runs on UserPromptSubmit and Stop, for the end-of-turn
+check. At the start of a turn it notes the observer's count of file events
+and which checks are CURRENT (on Windows, from a synchronized status). When
+the agent stops, it asks status: if a check is due (STALE or UNVERIFIED) and
+files changed during the turn (the count moved, a check CURRENT at the start
+is due now, or the turn's transcript has an Edit, Write, MultiEdit or
+NotebookEdit call), it
+blocks the stop once with "Before you finish, run `redue verify` and report
+what it says". It never asks twice in a turn, and never on the stop that
+follows its reminder (`stop_hook_active`), so it cannot loop. A turn that
+changed nothing ends quietly even when a check is due, and so does any turn
+where the observer is not healthy. `"endOfTurnCheck": false` in the config
+turns it off.
+
+Setup also adds Claude Code's status line, `redue agent statusline claude`,
+in the same file and the same form. It prints one line from a synchronized
+status (the observer's cached one when that takes over 3 s): `REDUE ✓ 3
+verified`, `REDUE ✓ 1 verified · 2 due: typecheck, test`, `REDUE ✗ 1 failing:
+lint`, `REDUE ✓ 3 verified · 1 not verifiable`, `REDUE … checking files` while
+the observer indexes, or `REDUE ? observer not running`. A check that is not
+verifiable (see [the JSON interface](json.md)) is never due, here or for the
+end-of-turn check. Where Claude Code already has a status line (in the
+local or shared project settings, or your user settings), setup leaves it and
+prints the command, so you can add REDUE's line to yours. `redue agent remove
+claude --apply` and `redue remove` take out only REDUE's status line.
+
 Agents often chain an edit and a check (`printf … >> README.md && npm run
 lint`). In a simple chain (commands joined by `&&`, `||` or `;`, with no
 subshell, here-document, command substitution, background job or shell
@@ -281,7 +307,18 @@ config resolution, cached observer health, a bounded read-only control-access pr
 managed-file integrity, detected host
 version, and loading guidance. `behavior_verified: false` is deliberate: intact
 files do not prove the agent followed them. For Claude, doctor reports whether the
-typecheck hook is installed. Doctor neither
+typecheck hook is installed, the status line, and `trigger_rules`: whether the
+`if` rules in the settings start the hook for every command form of every
+configured check (`covered`, or the forms they miss, which would run plainly,
+neither skipped nor recorded), including the fan-out commands and the forms
+after a `cd` into a check's directory. It applies the rules as REDUE models
+Claude Code's matching, not by asking Claude Code: `Bash(PREFIX*)` (or the
+legacy `Bash(PREFIX:*)`) matches a simple command that starts with PREFIX in
+the characters known to match (letters, digits, spaces and `_./:=,+@-`), and a
+hook with no `if` matches every command. Setup ends a rule before any other
+character, such as the quote in `-m "not slow"`, and the hook then matches
+the whole command itself, spaces inside quotes included; a rule that would
+end before the program's first argument is not written. Doctor neither
 executes checks nor starts observers, reconciles inputs, or installs a host.
 
 Doctor separates missing/unreadable state, a missing or refused endpoint, an

package/docs/user/configuration.md

@@ -33,6 +33,14 @@ For the explicit direct compiler choice and generated exact argv, see
 A general check (`"qualification": "node-script-v1"`) has a `script` and no
 `command`; see the [general recipe](node-script.md).
 
+## End-of-turn check
+
+With Claude Code, REDUE's hook checks at the end of each agent turn: when the
+turn changed files and a check is due, it asks the agent once to run
+`redue verify` before it finishes ([agents](agents.md)). To turn this off,
+add `"endOfTurnCheck": false` at the top level of the config. Only the hook
+reads it; the observer does not need a restart.
+
 ## Arbitrary commands
 
 An unrecognized ecosystem can still record ordinary execution:

package/docs/user/direct-typescript.md

@@ -64,8 +64,9 @@ byte for byte, in one of two ways:
 
 CI runs the same contract suite against the last release of each minor from
 5.0 to 5.8 that the reviewed releases do not cover. Later minors (6.1 and up)
-wait until CI covers them. TypeScript 7 (the native compiler) is not
-supported.
+wait until CI covers them. This recipe does not take TypeScript 7 (the
+native compiler); a typecheck that runs it gets the
+[sandboxed recipe](sandbox.md).
 
 ## Script forms
 

package/docs/user/json.md

@@ -59,3 +59,21 @@ JSON summary. **Its stdout is not a JSON-only stream.** Query status/details aft
 completion for machine-readable evidence. Normal check exit codes are preserved;
 interruption/process-start failures are nonzero. REDUE retains metadata and receipts,
 not arbitrary terminal output. The CLI does not infer tests executed from prose.
+
+A check no run can confirm has `"verifiable": false` (its `freshness` stays
+UNVERIFIED and `reason` says why): a recording-only check (no qualification
+contract, inputs it cannot resolve), or one whose last two runs passed while
+the same inputs changed during them, with its plan, environment and every
+other input unchanged since. Anything else changing, a failing run or a
+clean run makes it verifiable (and due) again. Such checks are counted in
+`not_verifiable`, not in the other counts, and do not set `state`. A cached
+answer (`--cached`) never marks a check this way.
+
+`verify --json` writes one JSON object to stdout: `verified` (true only when the
+observer is healthy, at least one check is verifiable, and every verifiable
+check is CURRENT / PASS), `ran` (each check it ran, in order: `check`, `was`
+(STALE or UNVERIFIED) and the run's `exit`), and `status`, the synchronized
+status after those runs. It runs what is due up to three rounds, since a run
+can make another check due; a check whose last run changed its inputs runs
+first in a round. It never runs a check that is not verifiable. The checks'
+own output goes to stderr. It exits 0 when `verified` is true, else 1.

package/docs/user/sandbox.md

@@ -41,9 +41,13 @@ built declarations) gets the whole checkout. See
   `.venv` (`uv sync` makes one; Poetry does with `virtualenvs.in-project`).
   `init` uses the arguments your CI workflow, Makefile, tox, nox, justfile or
   shell scripts in `scripts/` run the tool with, through `uv run`, `poetry run`,
-  `python -m` or `.venv/bin`. Without them it uses the tool's default:
-  `ruff check`, `ty check`, `pyright`, and `mypy` (with `.` when mypy's
-  configuration names no `files`).
+  `python -m`, `coverage run -m` or `.venv/bin`, including quoted arguments
+  (`-m "not slow"`) and lines continued with a backslash. It takes the first
+  such line, but a pull-request workflow's when it narrows the test suite
+  (`-m`, `-k`, `--ignore`, `--deselect`), and leaves out options that only
+  write a report (`--junit-xml`, `--html`, `--durations`). Without them it
+  uses the tool's default: `ruff check`, `ty check`, `pyright`, `pytest`, and
+  `mypy` (with `.` when mypy's configuration names no `files`).
 - **Platforms:** macOS (Seatbelt, `sandbox-exec`) and Linux 6.7 or later
   (Landlock; the launcher needs Python 3).
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.31",
+  "version": "0.1.0-alpha.33",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"