@skyf0xx/hedgehog 6.3.0 → 6.3.2

package/bin/cli.mjs

@@ -59,7 +59,7 @@ import {
 } from '../src/db/requires.mjs';
 import { whyPath, formatWhy } from '../src/db/why.mjs';
 import { addFriction, listFriction } from '../src/db/friction.mjs';
-import { addDebt, listDebt } from '../src/db/debt.mjs';
+import { addDebt, listDebt, resolveDebt } from '../src/db/debt.mjs';
 import { addDecision, listDecisions } from '../src/db/decision.mjs';
 import {
   shouldPromptForStar,
@@ -100,6 +100,8 @@ import {
   formatReconciliations,
   RECONCILED_DIR,
 } from '../src/db/reconcile.mjs';
+import { NOOP_DIR } from '../src/db/noop.mjs';
+import { runFastpath, loadFastpaths, orphanedFastpathTasks, FASTPATH_DIR } from '../src/db/fastpath.mjs';
 import { HOSTS, HOST_FLAGS, DEFAULT_HOST, availableHosts } from '../src/hosts/index.mjs';
 import { recordHosts, installedHosts } from '../src/hosts/installed.mjs';
 import { wrapSection } from '../src/hosts/claude-md-merge.mjs';
@@ -625,6 +627,11 @@ ${bold('Usage')}
                                                    close one task on your judgment — no scope gate and no
                                                    verify command run; records it under .hedgehog/reconciled/
   npx @skyf0xx/hedgehog reconcile list            list recorded reconciliations
+  npx @skyf0xx/hedgehog fast-path <intent-id> --reason "<why>" --verify "<command>"
+                                                   close every remaining task of a small, already-committed
+                                                   intent below the per-layer loop; still gated by scope
+                                                   and by --verify; records it under .hedgehog/fastpath/
+  npx @skyf0xx/hedgehog fast-path list            list recorded fast-paths
   npx @skyf0xx/hedgehog merge <intent-id>         merge that intent's worktree branch into trunk,
                                                    rebuild trunk's graph, remove the worktree — fails
                                                    if the intent's tasks aren't all complete there
@@ -663,7 +670,8 @@ ${bold('Usage')}
   npx @skyf0xx/hedgehog friction add "<note>"     log a friction note [--task <task-id>]
   npx @skyf0xx/hedgehog friction list             list logged friction, oldest first
   npx @skyf0xx/hedgehog debt add <task-id> "<note>"   declare debt that lands in dependent tasks' packets
-  npx @skyf0xx/hedgehog debt list [<task-id>]     list declared debt, oldest first
+  npx @skyf0xx/hedgehog debt list [<task-id>] [--all]   list open debt, oldest first (--all includes resolved)
+  npx @skyf0xx/hedgehog debt resolve <debt-id> --reason "<why>"   mark a debt note resolved
   npx @skyf0xx/hedgehog decision add <task-id> "<note>"   declare a decision that lands in dependent tasks' packets
   npx @skyf0xx/hedgehog decision list [<task-id>]     list declared decisions, oldest first
   npx @skyf0xx/hedgehog db migrate                bring the graph's schema up to the latest version
@@ -1312,6 +1320,33 @@ async function dbRebuildCommand() {
         `no task with this id exists in the rebuilt graph, so each closes nothing.\n`,
     );
   }
+  // Same reporting split as tasksReconciled above, for the same reason: a
+  // no-op-completed task had no verify_command run and no commit made,
+  // and folding it into the plain "marked complete" count would hide that.
+  if (result.tasksNoop > 0) {
+    console.log(
+      `${dim(`${result.tasksNoop} task(s) replayed from ${NOOP_DIR}/ — closed as a no-op, no commit`)}\n`,
+    );
+  }
+  if (result.orphanedNoop?.length > 0) {
+    console.log(
+      `${yellow(bold('No-op records without a task.'))} ${result.orphanedNoop.join(', ')} —\n` +
+        `no task with this id exists in the rebuilt graph, so each closes nothing.\n`,
+    );
+  }
+  // Same split as tasksReconciled/tasksNoop above: a fast-pathed task had
+  // no per-layer verify_command run against it individually.
+  if (result.tasksFastpathed > 0) {
+    console.log(
+      `${dim(`${result.tasksFastpathed} task(s) replayed from ${FASTPATH_DIR}/ — closed by fast-path, not per-layer verification`)}\n`,
+    );
+  }
+  if (result.orphanedFastpath?.length > 0) {
+    console.log(
+      `${yellow(bold('Fast-path records without a task.'))} ${result.orphanedFastpath.join(', ')} —\n` +
+        `no task with this id exists in the rebuilt graph, so each closes nothing.\n`,
+    );
+  }
   if (result.abandonmentsReplayed?.length > 0) {
     console.log(
       `${dim(`${result.abandonmentsReplayed.length} intent(s) replayed from ${ABANDONED_DIR}/ — kept at planned, not active:`)}\n` +
@@ -2256,7 +2291,7 @@ async function verifyCommand(args) {
       return;
     }
     const overrides = await loadOverrides();
-    result = verifyTask(db, taskId, owner, overrides);
+    result = await verifyTask(db, taskId, owner, overrides);
   } catch (err) {
     console.error(`${red('Verify failed:')} ${err.message}\n`);
     process.exitCode = 1;
@@ -2286,7 +2321,11 @@ async function verifyCommand(args) {
   }
 
   console.log(`${green(bold('Verified.'))} Task ${bold(taskId)} is now ${bold('complete')}.`);
-  if (result.commitSha) console.log(`  ${dim('commit')}  ${result.commitSha}`);
+  if (result.noop) {
+    console.log(`  ${dim('no-op — nothing in scope to verify or commit')}`);
+  } else if (result.commitSha) {
+    console.log(`  ${dim('commit')}  ${result.commitSha}`);
+  }
   if (result.unlocked.length === 0) {
     console.log(`  ${dim('no dependents unlocked')}`);
   } else {
@@ -3502,6 +3541,97 @@ async function reconcileCommand(args) {
   console.log(`${formatEvidence(evidence)}\n`);
 }
 
+// `hedgehog fast-path <intent-id> --reason "<why>" --verify "<command>"` —
+// closes every remaining task of an intent below the normal per-layer
+// claim/verify ceremony (see src/db/fastpath.mjs). Requires a clean
+// working tree, checks the fix against the union of the remaining tasks'
+// own scope, and runs `--verify` for real before completing anything.
+async function fastpathCommand(args) {
+  await ensureDb();
+
+  if (!(await exists(DB_PATH))) {
+    console.error(`${red('No build graph found.')} Run ${bold('hedgehog db init')} first.\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  const sub = args[0];
+
+  if (sub === 'list') {
+    const fastpaths = await loadFastpaths();
+    const db = openDb({ readOnly: true });
+    let orphaned;
+    try {
+      orphaned = orphanedFastpathTasks(db, fastpaths);
+    } finally {
+      db.close();
+    }
+    if (fastpaths.size === 0) {
+      console.log(`${dim('No intent has been fast-pathed.')}\n`);
+      return;
+    }
+    for (const record of fastpaths.values()) {
+      console.log(`${bold(record.intent)}`);
+      console.log(`  ${record.reason}`);
+      console.log(`  verified with: ${record.verify_command}`);
+      console.log(`  confirmed ${record.confirmed_at}`);
+      console.log(`  tasks: ${record.tasks.join(', ')}`);
+      console.log();
+    }
+    if (orphaned.length > 0) {
+      console.log(
+        `${dim(`Orphaned: ${orphaned.join(', ')} — no task with this id exists in the build graph.`)}\n`,
+      );
+    }
+    return;
+  }
+
+  const intentId = args[0];
+  const reasonIdx = args.indexOf('--reason');
+  const reason = reasonIdx !== -1 ? args[reasonIdx + 1] : undefined;
+  const verifyIdx = args.indexOf('--verify');
+  const verifyCommand = verifyIdx !== -1 ? args[verifyIdx + 1] : undefined;
+
+  if (!intentId || intentId.startsWith('--') || !reason || !verifyCommand) {
+    console.error(
+      `${red('Usage:')} hedgehog fast-path <intent-id> --reason "<why>" --verify "<command>"\n` +
+        `   or: hedgehog fast-path list\n\n` +
+        `${dim('A fast-path is a narrow exception, not a default: use it only for a change')}\n` +
+        `${dim('small enough that the per-layer loop costs more than the risk it prevents —')}\n` +
+        `${dim('already committed, already tested, low risk. --verify names one real command')}\n` +
+        `${dim('that must pass; the working tree must already be clean; and the diff since')}\n` +
+        `${dim("the graph's last credited commit is still checked against the union of the")}\n` +
+        `${dim('remaining tasks\' own scope — a fast-path never bypasses scope gating.')}\n`,
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  printDbTarget();
+  const db = openDb();
+  let result;
+  try {
+    result = await runFastpath(db, { intentId, reason, verifyCommand });
+  } catch (err) {
+    console.error(`${red('Failed to fast-path:')} ${err.message}\n`);
+    process.exitCode = 1;
+    return;
+  } finally {
+    db.close();
+  }
+
+  const file = `${FASTPATH_DIR}/${result.record.intent.toLowerCase()}.json`;
+  console.log(
+    `  ${green('complete')}  ${bold(result.record.intent)} ${dim(`(${result.record.tasks.length} task(s), fast-pathed, not per-layer verified)`)}`,
+  );
+  for (const taskId of result.record.tasks) console.log(`  ${dim('closed')}   ${taskId}`);
+  console.log(`  ${green('recorded')}  ${file}`);
+  console.log(
+    `\n  ${bold('Commit that file.')} ${dim('The build graph is derived and gitignored — an')}\n` +
+      `  ${dim('uncommitted fast-path is reverted by the next `hedgehog db rebuild`.')}\n`,
+  );
+}
+
 // `hedgehog merge <intent-id>` — merges `hedgehog/<intent-id>` into trunk
 // with `git merge --no-ff`, rebuilds trunk's graph from what merged, then
 // removes the worktree and its branch. See src/db/worktree.mjs for why a
@@ -3844,28 +3974,61 @@ async function debtCommand(args) {
   }
 
   if (sub === 'list') {
-    const taskId = args[1];
+    const includeResolved = args.includes('--all') || args.includes('--resolved');
+    const taskId = args.slice(1).find((a) => !a.startsWith('--'));
     const db = openDb();
     let entries;
     try {
-      entries = listDebt(db, taskId);
+      entries = listDebt(db, taskId, { includeResolved });
     } finally {
       db.close();
     }
 
     if (entries.length === 0) {
-      console.log(`${dim('No debt declared.')}\n`);
+      console.log(`${dim(includeResolved ? 'No debt declared.' : 'No open debt.')}\n`);
       return;
     }
     for (const entry of entries) {
       console.log(`#${entry.id}  ${dim(entry.loggedAt)}  ${bold(entry.taskId)}`);
-      console.log(`  ${entry.note}\n`);
+      console.log(`  ${entry.note}`);
+      if (entry.resolvedAt) {
+        console.log(`  ${green('resolved')} ${dim(entry.resolvedAt)} — ${entry.resolvedReason}`);
+      }
+      console.log('');
+    }
+    return;
+  }
+
+  if (sub === 'resolve') {
+    const debtId = args[1];
+    const reasonIdx = args.indexOf('--reason');
+    const reason = reasonIdx !== -1 ? args[reasonIdx + 1] : undefined;
+
+    if (!debtId || debtId.startsWith('--') || !reason) {
+      console.error(`${red('Usage:')} hedgehog debt resolve <debt-id> --reason "<why>"\n`);
+      process.exitCode = 1;
+      return;
+    }
+
+    const db = openDb();
+    let result;
+    try {
+      result = await resolveDebt(db, { debtId: Number(debtId), reason });
+    } catch (err) {
+      console.error(`${red('Failed to resolve debt:')} ${err.message}\n`);
+      process.exitCode = 1;
+      return;
+    } finally {
+      db.close();
     }
+
+    console.log(`  ${green('resolved')}  #${result.id} ${bold(result.taskId)}`);
+    console.log(`  ${dim(result.note)}`);
     return;
   }
 
   console.error(
-    `${red('Unknown debt subcommand:')} ${sub ?? '(none)'}\n\nUsage: hedgehog debt add <task-id> "<note>"\n   or: hedgehog debt list [<task-id>]\n`,
+    `${red('Unknown debt subcommand:')} ${sub ?? '(none)'}\n\nUsage: hedgehog debt add <task-id> "<note>"\n   or: hedgehog debt list [<task-id>] [--all]\n   or: hedgehog debt resolve <debt-id> --reason "<why>"\n`,
   );
   process.exitCode = 1;
 }
@@ -4335,6 +4498,11 @@ async function main() {
     return;
   }
 
+  if (cmd === 'fast-path') {
+    await fastpathCommand(args.slice(1));
+    return;
+  }
+
   if (cmd === 'merge') {
     await mergeCommand(args.slice(1));
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyf0xx/hedgehog",
-  "version": "6.3.0",
+  "version": "6.3.2",
   "description": "Install the Hedgehog build discipline (agents + skills) into a repo, for Claude Code, Cursor, or Gemini CLI.",
   "type": "module",
   "repository": {

package/src/db/debt.mjs

@@ -58,14 +58,25 @@ export async function addDebt(db, { taskId, note }, notesDir = undefined) {
   return { id: Number(result.lastInsertRowid), taskId, note };
 }
 
-// Every debt row, oldest first, optionally narrowed to one task.
-export function listDebt(db, taskId) {
-  const where = taskId ? 'WHERE task_id = ?' : '';
-  const params = taskId ? [taskId] : [];
+// Every debt row, oldest first, optionally narrowed to one task. Resolved
+// rows are excluded by default — `debt list` is meant to answer "what's
+// still open", the same way `reconcile list` never re-surfaces a task once
+// it has closed — and included when `includeResolved` is set (`--all`).
+export function listDebt(db, taskId, { includeResolved = false } = {}) {
+  const conditions = [];
+  const params = [];
+  if (taskId) {
+    conditions.push('task_id = ?');
+    params.push(taskId);
+  }
+  if (!includeResolved) conditions.push('resolved_at IS NULL');
+  const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
   try {
     return db
       .prepare(
-        `SELECT id, task_id AS taskId, note, logged_at AS loggedAt FROM debt ${where} ORDER BY id ASC`,
+        `SELECT id, task_id AS taskId, note, logged_at AS loggedAt,
+                resolved_at AS resolvedAt, resolved_reason AS resolvedReason
+         FROM debt ${where} ORDER BY id ASC`,
       )
       .all(...params);
   } catch {
@@ -73,3 +84,54 @@ export function listDebt(db, taskId) {
     return [];
   }
 }
+
+// Count of open (unresolved) debt across the whole graph — the one-line
+// figure `hedgehog next`/`hedgehog claim` surface so debt doesn't
+// accumulate silently with nothing prompting a look at it.
+export function openDebtCount(db) {
+  try {
+    const row = db.prepare('SELECT COUNT(*) AS n FROM debt WHERE resolved_at IS NULL').get();
+    return row.n;
+  } catch {
+    return 0;
+  }
+}
+
+// Resolves one debt row by id: marks it resolved in the DB and writes the
+// committed record behind it — same ordering as addDebt (file before row)
+// and the same reason: if the write fails, nothing has been resolved on a
+// fact that would not survive the next rebuild.
+//
+// The committed note is keyed by the debt row's own (task_id, note,
+// logged_at) rather than its DB `id`, because that id is a fresh
+// autoincrement every time rebuild.mjs#replayNotes re-inserts debt rows —
+// it is not stable across a rebuild, so a resolution referencing it would
+// point at nothing once replayed. The triple already committed for the
+// debt note itself is the one part of its identity that *is* stable.
+export async function resolveDebt(db, { debtId, reason }, notesDir = undefined) {
+  applySchema(db);
+
+  if (!debtId) throw new Error('debt resolve requires a debt id');
+  if (!reason) throw new Error('debt resolve requires a --reason');
+
+  const row = db
+    .prepare('SELECT id, task_id AS taskId, note, logged_at AS loggedAt, resolved_at AS resolvedAt FROM debt WHERE id = ?')
+    .get(debtId);
+  if (!row) throw new Error(`no such debt: #${debtId}`);
+  if (row.resolvedAt) throw new Error(`debt #${debtId} is already resolved`);
+
+  const resolvedAt = new Date().toISOString();
+  await appendNote(
+    row.taskId,
+    { kind: 'debt-resolve', resolves: row.loggedAt, reason, loggedAt: resolvedAt },
+    notesDir,
+  );
+
+  db.prepare('UPDATE debt SET resolved_at = ?, resolved_reason = ? WHERE id = ?').run(
+    resolvedAt,
+    reason,
+    debtId,
+  );
+
+  return { id: row.id, taskId: row.taskId, note: row.note, resolvedAt, resolvedReason: reason };
+}

package/src/db/engineState.mjs

@@ -0,0 +1,53 @@
+// The set of paths every scope-facing check in this engine excludes
+// before judging what an agent (or a fast-path) actually touched: the
+// build graph file and its sidecars, the commit lock, the star-prompt
+// state file, and every directory a build-graph command writes its own
+// committed record into (`friction add`, `override add`, `intent add`/
+// `db rebuild`, `reconcile confirm`, `debt add`/`decision add`, a no-op
+// completion, a fast-path). None of these is ever a layer's own work, so
+// a path under one of them is never attributable to whatever task or
+// intent happened to be active when it changed.
+//
+// verify.mjs's scope gate and fastpath.mjs's scope check both need
+// exactly this predicate; this module exists so it has one definition
+// instead of two that could drift apart.
+
+import { DB_PATH } from './init.mjs';
+import { LOCK_PATH } from './commitLock.mjs';
+import { FRICTION_DIR } from './friction.mjs';
+import { OVERRIDES_DIR } from './overrides.mjs';
+import { INTENTS_DIR } from './intent.mjs';
+import { RECONCILED_DIR } from './reconcile.mjs';
+import { NOTES_DIR } from './notes.mjs';
+import { NOOP_DIR } from './noop.mjs';
+import { COMMUNITY_PATH } from './community.mjs';
+
+// `FASTPATH_DIR` is deliberately not imported here: fastpath.mjs needs
+// this module's predicates for its own scope check, and importing
+// FASTPATH_DIR from fastpath.mjs here would make that a cycle. Its caller
+// there passes it in instead (see fastpath.mjs's own use of
+// isBuildGraphStatePath).
+export const BUILD_GRAPH_STATE_DIRS = [
+  FRICTION_DIR,
+  OVERRIDES_DIR,
+  INTENTS_DIR,
+  RECONCILED_DIR,
+  NOTES_DIR,
+  NOOP_DIR,
+];
+
+export function isBuildGraphStatePath(path, extraDirs = []) {
+  return [...BUILD_GRAPH_STATE_DIRS, ...extraDirs].some(
+    (dir) => path === dir || path.startsWith(`${dir}/`),
+  );
+}
+
+export function isEngineStatePath(path, extraDirs = []) {
+  return (
+    path === DB_PATH ||
+    path.startsWith(`${DB_PATH}-`) ||
+    path === LOCK_PATH ||
+    path === COMMUNITY_PATH ||
+    isBuildGraphStatePath(path, extraDirs)
+  );
+}

package/src/db/fastpath.mjs

@@ -0,0 +1,287 @@
+// `hedgehog fast-path <intent-id> --reason "<why>"` — a sanctioned way to
+// close every remaining task of an intent below the normal claim/verify
+// ceremony, for a change small enough that walking it through every
+// remaining layer costs more than the risk the loop exists to catch.
+//
+// This is not a second way to skip verification. It is a narrower,
+// explicit substitute for it:
+//
+//   - The working tree must be clean (everything already committed) —
+//     fast-pathing an intent whose fix is still sitting uncommitted has
+//     nothing for the scope check below to check.
+//   - The union of every remaining task's own scope_globs still gates the
+//     diff, exactly the way `hedgehog verify`'s own scope gate does: a
+//     commit that touched anything outside that union blocks the
+//     fast-path the same way it would block a normal verify. Discretion
+//     over ceremony never extends to discretion over the one guarantee
+//     that matters — a layer only writes inside its own boundary.
+//   - `--verify` names one real command that must pass before anything
+//     completes; the caller states it explicitly (the union of the
+//     skipped layers' own verify_commands is the honest default, but a
+//     narrower substitute is allowed, per that call being the same kind
+//     of judgment call `hedgehog verify` doesn't need a human for).
+//   - The decision is a committed record under `.hedgehog/fastpath/`, the
+//     same file-before-row shape reconcile.mjs uses, and for the same
+//     reason: without it, `hedgehog db rebuild` has nothing to replay and
+//     silently reintroduces every task this closed.
+//
+// A fast-pathed task is functionally identical to a reconciled one from
+// markCompletedTasks's point of view — no commit_message of its own to
+// match, closed by a committed decision instead — so rebuild.mjs seeds it
+// into the same `reconciledTaskIds`-shaped set reconciliation uses.
+
+import { execFileSync, execSync } from 'node:child_process';
+import { readdir, readFile, mkdir, writeFile, rename, rm } from 'node:fs/promises';
+import { pathInScope, newestGraphCommit, commitsSince } from './reconcile.mjs';
+import { isEngineStatePath } from './engineState.mjs';
+
+export const FASTPATH_DIR = '.hedgehog/fastpath';
+
+function fastpathFilePath(intentId, fastpathDir = FASTPATH_DIR) {
+  return `${fastpathDir}/${intentId.toLowerCase()}.json`;
+}
+
+function git(args, options = {}) {
+  return execFileSync('git', args, { encoding: 'utf8', ...options });
+}
+
+function validateFastpath(record, path) {
+  if (record === null || typeof record !== 'object') {
+    throw new Error(`${path}: fast-path record must be a JSON object`);
+  }
+  const { intent, reason, verify_command: verifyCommand, confirmed_at: confirmedAt, tasks } = record;
+
+  // Not upper-cased: an intent id, unlike a task id, is stored exactly as
+  // given at `intent add` time (intent.mjs#normalizeIntent never cases
+  // it) — casing this would make the record's own lookup key disagree
+  // with `intents.id`.
+  if (!intent || typeof intent !== 'string') {
+    throw new Error(`${path}: fast-path record requires an "intent" id (string)`);
+  }
+
+  if (!reason || typeof reason !== 'string') {
+    throw new Error(`${path}: fast-path "${intent}" requires a "reason" (string)`);
+  }
+  if (!verifyCommand || typeof verifyCommand !== 'string') {
+    throw new Error(`${path}: fast-path "${intent}" requires a "verify_command" (string)`);
+  }
+  if (!confirmedAt || typeof confirmedAt !== 'string') {
+    throw new Error(`${path}: fast-path "${intent}" requires a "confirmed_at" timestamp (string)`);
+  }
+  if (!Array.isArray(tasks) || tasks.length === 0) {
+    throw new Error(`${path}: fast-path "${intent}" requires a non-empty "tasks" array`);
+  }
+  for (const t of tasks) {
+    if (typeof t !== 'string' || t.trim() === '') {
+      throw new Error(`${path}: fast-path "${intent}" has a non-string or empty entry in tasks`);
+    }
+  }
+
+  return {
+    intent,
+    reason,
+    verify_command: verifyCommand,
+    confirmed_at: confirmedAt,
+    tasks: tasks.map((t) => t.toUpperCase()),
+  };
+}
+
+// Every *.json in `fastpathDir`, validated, as a Map from intent id to its
+// record — same convention as reconcile.mjs#loadReconciliations.
+export async function loadFastpaths(fastpathDir = FASTPATH_DIR) {
+  let entries;
+  try {
+    entries = await readdir(fastpathDir);
+  } catch {
+    return new Map();
+  }
+
+  const byIntent = new Map();
+  for (const name of entries.filter((n) => n.endsWith('.json')).sort()) {
+    const path = `${fastpathDir}/${name}`;
+    let parsed;
+    try {
+      parsed = JSON.parse(await readFile(path, 'utf8'));
+    } catch (err) {
+      throw new Error(`could not read fast-path record ${path}: ${err.message}`, { cause: err });
+    }
+    const record = validateFastpath(parsed, path);
+    byIntent.set(record.intent, record);
+  }
+  return byIntent;
+}
+
+// Fast-pathed task ids matching no row in `tasks` — same read-side hygiene
+// as reconcile.mjs#orphanedReconciliations.
+export function orphanedFastpathTasks(db, fastpaths) {
+  const known = new Set(db.prepare('SELECT id FROM tasks').all().map((r) => r.id));
+  const orphaned = [];
+  for (const record of fastpaths.values()) {
+    for (const taskId of record.tasks) {
+      if (!known.has(taskId)) orphaned.push(taskId);
+    }
+  }
+  return orphaned.sort();
+}
+
+export async function writeFastpathFile(record, fastpathDir = FASTPATH_DIR) {
+  const path = fastpathFilePath(record.intent, fastpathDir);
+  try {
+    await readFile(path, 'utf8');
+    throw new Error(`${path} already exists — ${record.intent} is already recorded as fast-pathed.`);
+  } catch (err) {
+    if (!err || err.code !== 'ENOENT') throw err;
+  }
+
+  await mkdir(fastpathDir, { recursive: true });
+  const tempPath = `${path}.tmp-${process.pid}`;
+  try {
+    await writeFile(tempPath, `${JSON.stringify(record, null, 2)}\n`);
+    await rename(tempPath, path);
+  } catch (err) {
+    await rm(tempPath, { force: true }).catch(() => {});
+    throw err;
+  }
+  return record;
+}
+
+// Every task belonging to `intentId` that isn't already `complete` —
+// exactly the set a fast-path is closing.
+function loadRemainingTasks(db, intentId) {
+  return db
+    .prepare("SELECT id, scope_globs, verify_command FROM tasks WHERE intent_id = ? AND status <> 'complete'")
+    .all(intentId);
+}
+
+// The provenance note fast-pathing writes into `decisions`, rendered into
+// every dependent task's packet the same way reconcile.mjs#reconciledNote
+// is — a dependent must be told outright that its prerequisite closed by
+// explicit fast-path, not by a normal verify run.
+export function fastpathNote(record) {
+  return (
+    `Closed by fast-path, not per-layer verification: ${record.reason} ` +
+    `(verified with: ${record.verify_command}; ${record.tasks.length} task(s) closed together)`
+  );
+}
+
+// Runs `hedgehog fast-path <intent-id> --reason "<why>"`.
+//
+// Refuses when the working tree is dirty — a fast-pathed intent's fix must
+// already be committed, or there is nothing for the scope check below to
+// check against. Refuses when any commit since the graph's own newest
+// credited commit touched a path outside the union of the remaining
+// tasks' own scope_globs — a fast-path is not a way around the one
+// guarantee `hedgehog verify` exists to hold. Runs `verifyCommand` for
+// real and refuses on a nonzero exit, exactly like `hedgehog verify`
+// refuses to complete a task whose verify_command fails.
+export async function runFastpath(
+  db,
+  { intentId, reason, verifyCommand },
+  fastpathDir = FASTPATH_DIR,
+) {
+  if (!intentId) throw new Error('fast-path requires an intent id');
+  if (!reason) throw new Error('fast-path requires a --reason');
+  if (!verifyCommand) throw new Error('fast-path requires a --verify command');
+
+  // Unlike a task id (always upper-cased — plan.mjs#taskId), an intent id
+  // is stored exactly as given at `intent add` time (intent.mjs#normalizeIntent
+  // never cases it), so it is looked up verbatim here too.
+  const id = intentId;
+  const intent = db.prepare('SELECT id FROM intents WHERE id = ?').get(id);
+  if (!intent) throw new Error(`no such intent: ${id}`);
+
+  const remaining = loadRemainingTasks(db, id);
+  if (remaining.length === 0) {
+    throw new Error(`Intent ${id} has no remaining tasks — there is nothing to fast-path.`);
+  }
+
+  const dirty = git(['status', '--porcelain']).trim();
+  if (dirty !== '') {
+    throw new Error(
+      `The working tree has uncommitted changes. Fast-pathing requires the fix to already be ` +
+        `committed, so the scope check below has something real to check:\n\n${dirty}`,
+    );
+  }
+
+  const scopeGlobs = remaining.flatMap((t) => JSON.parse(t.scope_globs));
+  const since = newestGraphCommit(db);
+  const commits = commitsSince(since);
+  // Excludes the same build-graph/engine state every scope-facing check
+  // in this engine excludes (engineState.mjs) — the bootstrap commit that
+  // first added core.yaml, .gitignore, or a committed intent file sits
+  // inside this window on a project with nothing verified yet
+  // (newestGraphCommit returns null there), and none of that is this
+  // fast-path's own fix to be judged against.
+  const offending = [];
+  for (const commit of commits) {
+    for (const path of commit.paths) {
+      if (isEngineStatePath(path)) continue;
+      if (!pathInScope(path, scopeGlobs)) offending.push(path);
+    }
+  }
+  if (offending.length > 0) {
+    throw new Error(
+      `Scope violation. The following path(s) touched since the graph's last credited commit ` +
+        `fall outside the union of ${id}'s remaining tasks' scope:\n\n` +
+        [...new Set(offending)].map((p) => `  ${p}`).join('\n') +
+        `\n\nA fast-path cannot close tasks whose scope wasn't actually where the change landed.`,
+    );
+  }
+
+  let exitCode = 0;
+  let output;
+  try {
+    output = execSync(verifyCommand, { encoding: 'utf8', stdio: 'pipe' });
+  } catch (err) {
+    exitCode = err.status ?? 1;
+    output = `${err.stdout ?? ''}${err.stderr ?? ''}` || err.message;
+  }
+  if (exitCode !== 0) {
+    throw new Error(`Fast-path verification failed (exit ${exitCode}):\n\n${output}`);
+  }
+
+  const record = validateFastpath(
+    {
+      intent: id,
+      reason,
+      verify_command: verifyCommand,
+      confirmed_at: new Date().toISOString(),
+      tasks: remaining.map((t) => t.id),
+    },
+    '(new fast-path)',
+  );
+
+  await writeFastpathFile(record, fastpathDir);
+  applyFastpath(db, record);
+  return { record, output };
+}
+
+// Applies a confirmed fast-path record to the graph: every task it names
+// goes `complete`, a provenance note lands on each, and the intent closes
+// once nothing remains — the same bookkeeping reconcile.mjs#applyReconciliation
+// does for a single task, run here over the whole set at once.
+export function applyFastpath(db, record) {
+  const note = fastpathNote(record);
+  db.exec('BEGIN IMMEDIATE');
+  try {
+    const setComplete = db.prepare(
+      "UPDATE tasks SET status = 'complete', blocked_reason = NULL WHERE id = ?",
+    );
+    const insertNote = db.prepare('INSERT INTO decisions (task_id, note) VALUES (?, ?)');
+    for (const taskId of record.tasks) {
+      setComplete.run(taskId);
+      insertNote.run(taskId, note);
+    }
+    db.prepare(
+      "UPDATE intents SET status = 'complete' WHERE id = ? AND NOT EXISTS (SELECT 1 FROM tasks WHERE intent_id = ? AND status <> 'complete')",
+    ).run(record.intent, record.intent);
+    db.exec('COMMIT');
+  } catch (err) {
+    try {
+      db.exec('ROLLBACK');
+    } catch {
+      // Rollback failing must not mask the original error.
+    }
+    throw err;
+  }
+}

package/src/db/next.mjs

@@ -105,7 +105,9 @@ function loadInheritedDebt(db, taskId) {
   try {
     return db
       .prepare(
-        `SELECT task_id AS taskId, note FROM debt WHERE task_id IN (${placeholders}) ORDER BY id ASC`,
+        `SELECT task_id AS taskId, note FROM debt
+         WHERE task_id IN (${placeholders}) AND resolved_at IS NULL
+         ORDER BY id ASC`,
       )
       .all(...upstream);
   } catch {
@@ -113,6 +115,20 @@ function loadInheritedDebt(db, taskId) {
   }
 }
 
+// Total open (unresolved) debt across the whole graph — not just this
+// task's ancestors — so a packet can say plainly that debt exists even
+// where none of it happens to be inherited here. Tolerates a `debt` table
+// or `resolved_at` column that doesn't exist yet, the same way
+// loadInheritedDebt does.
+function loadOpenDebtCount(db) {
+  try {
+    const row = db.prepare('SELECT COUNT(*) AS n FROM debt WHERE resolved_at IS NULL').get();
+    return row.n;
+  } catch {
+    return 0;
+  }
+}
+
 // Decisions declared by anything this task inherits from (see
 // decision.mjs) — same upstream walk as loadInheritedDebt, same tolerance
 // for a `decisions` table that doesn't exist yet on an older graph.
@@ -181,6 +197,7 @@ function assemblePacket(db, task) {
   const incompleteDeps = incompleteDependencies(db, task.id);
   const inheritedDebt = loadInheritedDebt(db, task.id);
   const inheritedDecisions = loadInheritedDecisions(db, task.id);
+  const openDebtCount = loadOpenDebtCount(db);
 
   return {
     task,
@@ -190,6 +207,7 @@ function assemblePacket(db, task) {
     incompleteDeps,
     inheritedDebt,
     inheritedDecisions,
+    openDebtCount,
   };
 }
 
@@ -484,6 +502,7 @@ export function formatPacket(packet, statusLine, coreId = null, exists = null) {
     incompleteDeps = [],
     inheritedDebt = [],
     inheritedDecisions = [],
+    openDebtCount = 0,
   } = packet;
   const scopeGlobs = JSON.parse(task.scope_globs);
   const firstArrival = firstArrivalPackages(task, exists);
@@ -521,6 +540,11 @@ export function formatPacket(packet, statusLine, coreId = null, exists = null) {
       lines.push(`  ! ${entry.taskId}  ${entry.note}`);
     }
   }
+  if (openDebtCount > 0) {
+    lines.push(
+      `  ${openDebtCount} open debt note(s) across the whole graph — \`hedgehog debt list --all\` to see them all`,
+    );
+  }
   lines.push('');
   lines.push('INHERITED DECISIONS');
   if (inheritedDecisions.length === 0) {

package/src/db/noop.mjs

@@ -0,0 +1,108 @@
+// `.hedgehog/noop/<task-id>.json` — the committed record behind a task
+// verify.mjs closes `complete` without a git commit, because its scope had
+// nothing left to touch before verify_command even ran.
+//
+// A completed task is normally recoverable on `hedgehog db rebuild`
+// because its own commit's subject matches its `commit_message`
+// (rebuild.mjs#markCompletedTasks). A task closed with no commit at all
+// has nothing there to match, so — the same gap reconcile.mjs closes for a
+// hand-written commit that doesn't match — this file is the committed
+// source rebuild.mjs replays instead.
+//
+// One file per task, written once: a task closes as a no-op at most once,
+// the same reason reconcile.mjs's record refuses to overwrite rather than
+// growing like notes.mjs's does.
+
+import { readdir, readFile, mkdir, writeFile, rename, rm } from 'node:fs/promises';
+
+export const NOOP_DIR = '.hedgehog/noop';
+
+function noopFilePath(taskId, noopDir = NOOP_DIR) {
+  return `${noopDir}/${taskId.toLowerCase()}.json`;
+}
+
+function validateNoop(record, path) {
+  if (record === null || typeof record !== 'object') {
+    throw new Error(`${path}: no-op record must be a JSON object`);
+  }
+  let { task } = record;
+  const { commit_message: commitMessage, verified_at: verifiedAt } = record;
+
+  if (!task || typeof task !== 'string') {
+    throw new Error(`${path}: no-op record requires a "task" id (string)`);
+  }
+  task = task.toUpperCase();
+
+  if (!commitMessage || typeof commitMessage !== 'string') {
+    throw new Error(`${path}: no-op record "${task}" requires a "commit_message" (string)`);
+  }
+  if (!verifiedAt || typeof verifiedAt !== 'string') {
+    throw new Error(`${path}: no-op record "${task}" requires a "verified_at" timestamp (string)`);
+  }
+
+  return { task, commit_message: commitMessage, verified_at: verifiedAt };
+}
+
+// Every *.json in `noopDir`, validated, as a Map from task id to its
+// record. Absent directory reads as "nothing closed no-op" — the same
+// convention overrides.mjs#loadOverrides and reconcile.mjs#loadReconciliations
+// use for their own missing directories.
+export async function loadNoopRecords(noopDir = NOOP_DIR) {
+  let entries;
+  try {
+    entries = await readdir(noopDir);
+  } catch {
+    return new Map();
+  }
+
+  const byTask = new Map();
+  for (const name of entries.filter((n) => n.endsWith('.json')).sort()) {
+    const path = `${noopDir}/${name}`;
+    let parsed;
+    try {
+      parsed = JSON.parse(await readFile(path, 'utf8'));
+    } catch (err) {
+      throw new Error(`could not read no-op record ${path}: ${err.message}`, { cause: err });
+    }
+    const record = validateNoop(parsed, path);
+    byTask.set(record.task, record);
+  }
+  return byTask;
+}
+
+// Writes one no-op record via temp file + rename, so a crash mid-write
+// never leaves a half-written file for loadNoopRecords to trip on —
+// reconcile.mjs#writeReconciledFile's pattern, applied to the same
+// one-shot-per-task shape.
+//
+// Refuses to overwrite silently: a task closes no-op once, and a second
+// attempt for the same id is a wrong id or a re-run worth stopping for,
+// not a second distinct fact.
+export async function writeNoopFile(record, noopDir = NOOP_DIR) {
+  const path = noopFilePath(record.task, noopDir);
+  try {
+    await readFile(path, 'utf8');
+    throw new Error(`${path} already exists — ${record.task} is already recorded as a no-op completion.`);
+  } catch (err) {
+    if (!err || err.code !== 'ENOENT') throw err;
+  }
+
+  await mkdir(noopDir, { recursive: true });
+  const tempPath = `${path}.tmp-${process.pid}`;
+  try {
+    await writeFile(tempPath, `${JSON.stringify(record, null, 2)}\n`);
+    await rename(tempPath, path);
+  } catch (err) {
+    await rm(tempPath, { force: true }).catch(() => {});
+    throw err;
+  }
+  return record;
+}
+
+// No-op-record task ids matching no row in `tasks` — same read-side
+// hygiene as reconcile.mjs#orphanedReconciliations: a dead record must
+// stay discoverable rather than silently completing nothing forever.
+export function orphanedNoopRecords(db, records) {
+  const known = new Set(db.prepare('SELECT id FROM tasks').all().map((r) => r.id));
+  return [...records.keys()].filter((taskId) => !known.has(taskId)).sort();
+}

package/src/db/notes.mjs

@@ -45,12 +45,21 @@ function validateNotesFile(record, path) {
     if (entry === null || typeof entry !== 'object') {
       throw new Error(`${path}: notes file "${task}" has a non-object entry in notes`);
     }
-    if (entry.kind !== 'debt' && entry.kind !== 'decision') {
+    if (entry.kind !== 'debt' && entry.kind !== 'decision' && entry.kind !== 'debt-resolve') {
       throw new Error(
-        `${path}: notes file "${task}" has an entry with kind "${entry.kind}" — expected "debt" or "decision"`,
+        `${path}: notes file "${task}" has an entry with kind "${entry.kind}" — expected "debt", "decision", or "debt-resolve"`,
       );
     }
-    if (!entry.note || typeof entry.note !== 'string') {
+    if (entry.kind === 'debt-resolve') {
+      if (!entry.resolves || typeof entry.resolves !== 'string') {
+        throw new Error(
+          `${path}: notes file "${task}" has a "debt-resolve" entry with no "resolves" (the logged_at of the debt note it closes)`,
+        );
+      }
+      if (!entry.reason || typeof entry.reason !== 'string') {
+        throw new Error(`${path}: notes file "${task}" has a "debt-resolve" entry with no "reason"`);
+      }
+    } else if (!entry.note || typeof entry.note !== 'string') {
       throw new Error(`${path}: notes file "${task}" has an entry with no "note" (string)`);
     }
     if (!entry.logged_at || typeof entry.logged_at !== 'string') {
@@ -92,7 +101,7 @@ export async function loadNotes(notesDir = NOTES_DIR) {
 // never leaves a half-written file for loadNotes to trip on —
 // reconcile.mjs#writeReconciledFile's pattern, applied to a file that
 // grows instead of one written once.
-export async function appendNote(taskId, { kind, note, loggedAt }, notesDir = NOTES_DIR) {
+export async function appendNote(taskId, { kind, note, loggedAt, resolves, reason }, notesDir = NOTES_DIR) {
   const path = notesFilePath(taskId, notesDir);
 
   let existing = [];
@@ -103,9 +112,17 @@ export async function appendNote(taskId, { kind, note, loggedAt }, notesDir = NO
     if (!err || err.code !== 'ENOENT') throw err;
   }
 
+  // `debt-resolve` entries carry `resolves`/`reason` instead of `note` —
+  // omit `note` entirely rather than writing it as undefined/null, so a
+  // resolve entry's shape matches what validateNotesFile expects back.
+  const entry =
+    kind === 'debt-resolve'
+      ? { kind, resolves, reason, logged_at: loggedAt }
+      : { kind, note, logged_at: loggedAt };
+
   const record = {
     task: taskId.toUpperCase(),
-    notes: [...existing, { kind, note, logged_at: loggedAt }],
+    notes: [...existing, entry],
   };
 
   await mkdir(notesDir, { recursive: true });

package/src/db/rebuild.mjs

@@ -41,6 +41,8 @@ import {
   RECONCILED_DIR,
 } from './reconcile.mjs';
 import { loadNotes, NOTES_DIR } from './notes.mjs';
+import { loadNoopRecords, orphanedNoopRecords, NOOP_DIR } from './noop.mjs';
+import { loadFastpaths, orphanedFastpathTasks, fastpathNote, FASTPATH_DIR } from './fastpath.mjs';
 import {
   loadAbandoned,
   replayAbandonments,
@@ -110,23 +112,40 @@ function replayNotes(db, notesByTask) {
   const insertDecision = db.prepare(
     'INSERT INTO decisions (task_id, note, logged_at) VALUES (?, ?, ?)',
   );
+  const resolveDebtRow = db.prepare(
+    'UPDATE debt SET resolved_at = ?, resolved_reason = ? WHERE task_id = ? AND logged_at = ? AND resolved_at IS NULL',
+  );
 
   const orphaned = [];
+  // Two passes: every `debt`/`decision` entry inserted first, then every
+  // `debt-resolve` entry applied — a resolve entry can appear anywhere
+  // after its debt entry in the same file, but the row it references must
+  // already exist for the UPDATE to find it.
   for (const [taskId, notes] of notesByTask) {
     if (taskExists.get(taskId) === undefined) {
       for (const entry of notes) {
-        orphaned.push({ kind: entry.kind, taskId, note: entry.note });
+        if (entry.kind !== 'debt-resolve') orphaned.push({ kind: entry.kind, taskId, note: entry.note });
       }
       continue;
     }
     for (const entry of notes) {
       if (entry.kind === 'debt') {
         insertDebt.run(taskId, entry.note, entry.logged_at);
-      } else {
+      } else if (entry.kind === 'decision') {
         insertDecision.run(taskId, entry.note, entry.logged_at);
       }
     }
   }
+  for (const [taskId, notes] of notesByTask) {
+    if (taskExists.get(taskId) === undefined) continue;
+    for (const entry of notes) {
+      if (entry.kind !== 'debt-resolve') continue;
+      const result = resolveDebtRow.run(entry.logged_at, entry.reason, taskId, entry.resolves);
+      if (result.changes === 0) {
+        orphaned.push({ kind: entry.kind, taskId, note: `resolve for ${entry.resolves}` });
+      }
+    }
+  }
   return orphaned;
 }
 
@@ -477,6 +496,57 @@ function replayReconciliations(db, reconciliations) {
   return replayed;
 }
 
+// Replays `.hedgehog/fastpath/*.json` — the committed record of every
+// intent a user closed below the normal per-layer ceremony (fastpath.mjs).
+// Same shape and same reason as replayReconciliations: a fast-pathed task
+// has no commit_message of its own to match in commitSubjects (the fix it
+// covers landed as one real commit, not a per-layer one), so without this
+// replay a rebuild would silently revert every fast-pathed task back to
+// its pre-completion status.
+function replayFastpaths(db, fastpaths) {
+  const setComplete = db.prepare(
+    "UPDATE tasks SET status = 'complete', blocked_reason = NULL WHERE id = ?",
+  );
+  const insertNote = db.prepare('INSERT INTO decisions (task_id, note) VALUES (?, ?)');
+  const taskExists = db.prepare('SELECT 1 FROM tasks WHERE id = ?');
+
+  let replayed = 0;
+  for (const record of fastpaths.values()) {
+    const note = fastpathNote(record);
+    for (const taskId of record.tasks) {
+      if (taskExists.get(taskId) === undefined) continue;
+      setComplete.run(taskId);
+      insertNote.run(taskId, note);
+      replayed++;
+    }
+  }
+  return replayed;
+}
+
+// Replays `.hedgehog/noop/*.json` — the committed record of every task
+// verify.mjs closed `complete` with no commit, because its scope had
+// nothing left to touch before verify_command even ran (noop.mjs).
+//
+// Same shape and same reason as replayReconciliations above: a task
+// recorded here has no commit for markCompletedTasks to match by
+// construction, so without this replay a rebuild would leave it (and
+// everything depending on it) stuck `planned` forever, silently reverting
+// a completion that already happened.
+function replayNoopRecords(db, records) {
+  const setComplete = db.prepare(
+    "UPDATE tasks SET status = 'complete', blocked_reason = NULL WHERE id = ?",
+  );
+  const taskExists = db.prepare('SELECT 1 FROM tasks WHERE id = ?');
+
+  let replayed = 0;
+  for (const taskId of records.keys()) {
+    if (taskExists.get(taskId) === undefined) continue;
+    setComplete.run(taskId);
+    replayed++;
+  }
+  return replayed;
+}
+
 // Rebuilds `db` from scratch: schema, then every committed intent
 // replayed in dependency order, then planTasks to re-derive tasks +
 // dependencies, then git history to reconcile which tasks already
@@ -503,6 +573,8 @@ export async function rebuildDb(
     overridesDir = OVERRIDES_DIR,
     reconciledDir = RECONCILED_DIR,
     notesDir = NOTES_DIR,
+    noopDir = NOOP_DIR,
+    fastpathDir = FASTPATH_DIR,
     abandonedDir = ABANDONED_DIR,
     // `hedgehog merge <id>`'s own rebuild call (bin/cli.mjs#mergeCommand):
     // at the point it calls rebuildDb, `git merge --no-ff` has already
@@ -527,6 +599,8 @@ export async function rebuildDb(
   const overrides = await loadOverrides(overridesDir);
   const reconciliations = await loadReconciliations(reconciledDir);
   const notesByTask = await loadNotes(notesDir);
+  const noopRecords = await loadNoopRecords(noopDir);
+  const fastpaths = await loadFastpaths(fastpathDir);
   const abandonments = await loadAbandoned(abandonedDir);
 
   // Mirrors bin/cli.mjs#planCommand's own exclusion set: an intent still
@@ -571,11 +645,25 @@ export async function rebuildDb(
   // (below) still runs afterward to write the provenance note and cover
   // any reconciled task markCompletedTasks doesn't touch (module = CORE_MODULE
   // edge cases aside, every reconciled id ends up here either way).
-  const reconciledTaskIds = new Set(reconciliations.keys());
+  // A no-op-completed task and a fast-pathed task have no commit of their
+  // own either, for the same reason a reconciled task doesn't — all
+  // seeded into the same set, before the same fixpoint walk, so each
+  // satisfies its dependents' "every prerequisite complete" check exactly
+  // like a reconciled task does.
+  const fastpathTaskIds = [...fastpaths.values()].flatMap((record) => record.tasks);
+  const reconciledTaskIds = new Set([
+    ...reconciliations.keys(),
+    ...noopRecords.keys(),
+    ...fastpathTaskIds,
+  ]);
   const tasksMarkedComplete = markCompletedTasks(db, commitSubjects, reconciledTaskIds);
 
   const tasksReconciled = replayReconciliations(db, reconciliations);
   const orphanedReconciled = orphanedReconciliations(db, reconciliations);
+  const tasksNoop = replayNoopRecords(db, noopRecords);
+  const orphanedNoop = orphanedNoopRecords(db, noopRecords);
+  const tasksFastpathed = replayFastpaths(db, fastpaths);
+  const orphanedFastpath = orphanedFastpathTasks(db, fastpaths);
 
   // After every task-status recovery path above (history-matched commits,
   // then reconciliation) — either can close an intent's last open task,
@@ -608,6 +696,10 @@ export async function rebuildDb(
     intentsMarkedComplete,
     tasksReconciled,
     orphanedReconciled,
+    tasksNoop,
+    orphanedNoop,
+    tasksFastpathed,
+    orphanedFastpath,
     orphanedNotes,
     abandonmentsReplayed,
     orphanedAbandonments,

package/src/db/reconcile.mjs

@@ -202,7 +202,7 @@ export function orphanedReconciliations(db, reconciliations) {
 // forward-scanning window (commitsSince) needs the wider net, to catch a
 // hand-written commit that landed elsewhere; the floor it scans from stays
 // anchored to what this branch itself has already credited.
-function newestGraphCommit(db) {
+export function newestGraphCommit(db) {
   const messages = new Set(
     db.prepare('SELECT commit_message FROM tasks').all().map((r) => r.commit_message),
   );
@@ -236,7 +236,7 @@ function newestGraphCommit(db) {
 // `claim`/`ready`/`status`. A project that has never opened a worktree has
 // exactly one branch with any commits, so `--all` and `HEAD` name the
 // same set there and this is a no-op for it.
-function commitsSince(sinceSha) {
+export function commitsSince(sinceSha) {
   const range = sinceSha ? [`${sinceSha}..`, '--all'] : ['--all'];
   let output;
   try {

package/src/db/schema.mjs

@@ -103,10 +103,12 @@ CREATE TABLE IF NOT EXISTS verifications (
 -- every task that (transitively) depends on task_id, so the limitation
 -- travels down the chain the same way the dependency does.
 CREATE TABLE IF NOT EXISTS debt (
-  id        INTEGER PRIMARY KEY,
-  task_id   TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
-  note      TEXT NOT NULL,
-  logged_at TEXT NOT NULL DEFAULT (datetime('now'))
+  id               INTEGER PRIMARY KEY,
+  task_id          TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+  note             TEXT NOT NULL,
+  logged_at        TEXT NOT NULL DEFAULT (datetime('now')),
+  resolved_at      TEXT,
+  resolved_reason  TEXT
 );
 
 -- Declared decision: a note one task leaves for the tasks that inherit
@@ -176,7 +178,7 @@ export function ensureTaskColumns(db) {
 // hand-set past what MIGRATIONS actually covers, since runMigrations
 // trusts this number to mean "every migration through this version has
 // run."
-export const CURRENT_SCHEMA_VERSION = 2;
+export const CURRENT_SCHEMA_VERSION = 3;
 
 // Forward migrations, applied in order to bring a graph's user_version up
 // to CURRENT_SCHEMA_VERSION. Unlike the CREATE TABLE IF NOT EXISTS /
@@ -209,6 +211,18 @@ const MIGRATIONS = [
       `);
     },
   },
+  {
+    version: 3,
+    // A `debt` row with no `resolved_at` reads back as unresolved, so an
+    // existing graph's rows default to open the moment this column exists.
+    migrate: (db) => {
+      const existing = new Set(db.prepare('PRAGMA table_info(debt)').all().map((row) => row.name));
+      if (!existing.has('resolved_at')) db.exec('ALTER TABLE debt ADD COLUMN resolved_at TEXT');
+      if (!existing.has('resolved_reason')) {
+        db.exec('ALTER TABLE debt ADD COLUMN resolved_reason TEXT');
+      }
+    },
+  },
 ];
 
 // Brings a graph's `PRAGMA user_version` up to CURRENT_SCHEMA_VERSION,

package/src/db/verify.mjs

@@ -23,12 +23,18 @@
 //      verification at all — the task moves to `blocked` with
 //      blocked_reason `scope_violation`, no `verifications` row written,
 //      lease released. This is a scope violation, not a failing check.
-//   2. Only once every touched path matches scope does verify_command run.
-//      Exit 0: verifications row (passed) → artifacts recorded → git
-//      commit with commit_message → complete, lease released → direct
-//      dependents re-evaluated (a dependent is ready once every
-//      dependency is complete — same check as the readiness SELECT in
-//      next.mjs).
+//   2. Once every touched path matches scope, gate 1's own scan already
+//      knows whether this task's scope has anything touched at all. If
+//      not — a genuine no-op, the layer's work already satisfied upstream
+//      — verify_command never runs and no commit is made: the task closes
+//      `complete` directly, and a committed record under `.hedgehog/noop/`
+//      is what `hedgehog db rebuild` replays to recover it (noop.mjs),
+//      since there is no commit for rebuild to match against.
+//      Otherwise verify_command runs. Exit 0: verifications row (passed)
+//      → artifacts recorded → git commit with commit_message → complete,
+//      lease released → direct dependents re-evaluated (a dependent is
+//      ready once every dependency is complete — same check as the
+//      readiness SELECT in next.mjs).
 //      Nonzero: verifications row (failed, output retained) → blocked
 //      with blocked_reason `verification_failed`, lease released,
 //      dependents stay blocked.
@@ -57,46 +63,25 @@
 // verify_command that is a shell command by definition.
 
 import { execSync, execFileSync } from 'node:child_process';
-import { DB_PATH } from './init.mjs';
-import { withCommitLock, LOCK_PATH } from './commitLock.mjs';
+import { withCommitLock } from './commitLock.mjs';
 import { reapExpiredLeases, pathFingerprint } from './claim.mjs';
 import { ensureTaskColumns } from './schema.mjs';
-import { FRICTION_DIR } from './friction.mjs';
-import { OVERRIDES_DIR, composeScope } from './overrides.mjs';
-import { RECONCILED_DIR } from './reconcile.mjs';
-import { INTENTS_DIR } from './intent.mjs';
-import { COMMUNITY_PATH } from './community.mjs';
-import { NOTES_DIR } from './notes.mjs';
-
-// Build-graph state directories: written by their own command
-// (`friction add`, `override add`, `intent add`/`db rebuild`, `reconcile
-// confirm`, `debt add`/`decision add`), committed by that command's own
-// next step, never by a layer's verify_command. A
-// layer's own work never lands here, so a path under one of these is
-// never this task's doing regardless of when it changed relative to
-// claim time — unlike attributedToTask's fingerprint check, which only
-// excludes a path unchanged since claim and so still attributes a
-// friction note logged mid-layer (exactly what the loop skill instructs)
-// to whichever task happened to be building when it was logged.
-const BUILD_GRAPH_STATE_DIRS = [FRICTION_DIR, OVERRIDES_DIR, INTENTS_DIR, RECONCILED_DIR, NOTES_DIR];
-
-function isBuildGraphStatePath(path) {
-  return BUILD_GRAPH_STATE_DIRS.some((dir) => path === dir || path.startsWith(`${dir}/`));
-}
-
-// The build graph file, the commit lock, and the star-prompt state file
-// are engine state, written only by this CLI, never by an agent — all
-// are excluded from every task's scope check (and from artifacts/
-// commits), or verify's own writes would trip the very check they're
-// performing. Covers SQLite's journal/WAL/SHM sidecars too.
+import { composeScope } from './overrides.mjs';
+import { FASTPATH_DIR } from './fastpath.mjs';
+import { writeNoopFile } from './noop.mjs';
+import { isEngineStatePath as isEngineStatePathShared } from './engineState.mjs';
+
+// The build graph file, the commit lock, the star-prompt state file, and
+// every build-graph-state directory (friction, overrides, intents,
+// reconciled, notes, noop, fast-path) are engine state, written only by
+// their own command, never by a layer's verify_command — all excluded
+// from every task's scope check (and from artifacts/commits), or a
+// build-graph command's own writes would trip the very check it's
+// performing. `FASTPATH_DIR` isn't part of engineState.mjs's own list
+// (importing it there from fastpath.mjs would cycle back here — see that
+// module's header), so it's passed in as this call's own extra dir.
 function isEngineStatePath(path) {
-  return (
-    path === DB_PATH ||
-    path.startsWith(`${DB_PATH}-`) ||
-    path === LOCK_PATH ||
-    path === COMMUNITY_PATH ||
-    isBuildGraphStatePath(path)
-  );
+  return isEngineStatePathShared(path, [FASTPATH_DIR]);
 }
 
 // Runs git with an argv array and no shell, so every element of `args`
@@ -476,7 +461,7 @@ function claimForVerify(db, taskId, owner) {
 // planRecompileCommand, so it does the same here and passes the
 // resulting Map in — defaulting to an empty Map keeps every other/test
 // caller's behavior unchanged.
-export function verifyTask(db, taskId, owner, overrides = new Map()) {
+export async function verifyTask(db, taskId, owner, overrides = new Map()) {
   const task = claimForVerify(db, taskId, owner);
 
   const scopeGlobs = JSON.parse(composeScope({ scope_globs: task.scope_globs }, taskId, overrides).scope_globs);
@@ -490,7 +475,7 @@ export function verifyTask(db, taskId, owner, overrides = new Map()) {
   // in between) can itself touch files inside this task's own scope
   // (generated lockfiles, formatted output), and committing a stale
   // pre-verify_command snapshot would silently drop those.
-  const { offending } = withCommitLock(() => {
+  const { offending, inScope: inScopeBeforeVerify } = withCommitLock(() => {
     // Only what changed during this task's lease is this task's to answer
     // for; everything else in the shared working tree was already there
     // when the task was handed out. The commit set below is deliberately
@@ -517,6 +502,47 @@ export function verifyTask(db, taskId, owner, overrides = new Map()) {
     return { outcome: 'scope_violation', offending };
   }
 
+  // Genuine no-op: nothing this task's scope claims has changed even
+  // before verify_command runs — the layer's work was already satisfied
+  // by an earlier layer, or this intent never touches this module at all.
+  // verify_command has nothing to check here, so it never runs, and no
+  // commit is made. The completion still needs to survive `hedgehog db
+  // rebuild`, which recovers completion from a matching commit subject;
+  // with no commit to match, the committed record under NOOP_DIR is what
+  // rebuild replays instead (see noop.mjs, rebuild.mjs#replayNoopRecords).
+  if (inScopeBeforeVerify.length === 0) {
+    const verifiedAt = new Date().toISOString();
+    await writeNoopFile({ task: task.id, commit_message: task.commit_message, verified_at: verifiedAt });
+
+    let unlocked;
+    let completedIntent;
+    db.exec('BEGIN IMMEDIATE');
+    try {
+      setTaskStatus(db, task.id, 'complete');
+      unlocked = unlockReadyDependents(db, task.id);
+      completedIntent = completeIntentIfDone(db, task.intent_id);
+      db.exec('COMMIT');
+    } catch (err) {
+      try {
+        db.exec('ROLLBACK');
+      } catch {
+        // Rollback failing must not mask the original error.
+      }
+      throw err;
+    }
+
+    return {
+      outcome: 'complete',
+      exitCode: null,
+      output: null,
+      commitSha: null,
+      noop: true,
+      unlocked,
+      intentComplete: completedIntent !== null,
+      completedIntent: completedIntent ?? null,
+    };
+  }
+
   const { exitCode, output } = runVerifyCommand(task.verify_command);
 
   if (exitCode !== 0) {

package/src/hosts/gemini/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "hedgehog",
-  "version": "6.3.0",
+  "version": "6.3.2",
   "description": "Hedgehog build discipline: ordered, tested, verified build steps.",
   "contextFileName": "GEMINI.md"
 }