atris 3.57.3 → 3.58.5

package/lib/site-publish.js

@@ -0,0 +1,372 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { loadCredentials } = require('../utils/auth');
+const { getApiBaseUrl } = require('../utils/api');
+
+const MAX_PAGE_BYTES = 2 * 1024 * 1024;
+const MAX_PAGES = 200;
+const BUILD_DIRS = ['dist', 'build', 'out'];
+const SKIP_DIRS = new Set(['node_modules', '.git']);
+
+const TEXT_CONTENT_TYPES = Object.freeze({
+  '.html': 'text/html; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.json': 'application/json',
+  '.txt': 'text/plain; charset=utf-8',
+  '.xml': 'application/xml',
+  '.svg': 'image/svg+xml',
+  '.webmanifest': 'application/manifest+json',
+  '.map': 'application/json',
+  '.md': 'text/markdown; charset=utf-8',
+});
+
+const BINARY_CONTENT_TYPES = Object.freeze({
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif',
+  '.webp': 'image/webp',
+  '.ico': 'image/x-icon',
+  '.woff': 'font/woff',
+  '.woff2': 'font/woff2',
+  '.ttf': 'font/ttf',
+  '.otf': 'font/otf',
+  '.mp3': 'audio/mpeg',
+  '.mp4': 'video/mp4',
+  '.wasm': 'application/wasm',
+  '.pdf': 'application/pdf',
+});
+
+function normalizePagePath(value) {
+  return String(value || '').replace(/\\/g, '/').replace(/^\/+/, '');
+}
+
+function fileEncoding(filePath) {
+  const extension = path.extname(filePath).toLowerCase();
+  if (Object.prototype.hasOwnProperty.call(TEXT_CONTENT_TYPES, extension)) {
+    return { contentType: TEXT_CONTENT_TYPES[extension], isBase64: false };
+  }
+  return {
+    contentType: BINARY_CONTENT_TYPES[extension] || 'application/octet-stream',
+    isBase64: true,
+  };
+}
+
+function walkSiteFiles(root, deps = {}) {
+  const fileSystem = deps.fs || fs;
+  const files = [];
+
+  function walk(current) {
+    const entries = fileSystem.readdirSync(current, { withFileTypes: true })
+      .sort((a, b) => a.name.localeCompare(b.name));
+
+    for (const entry of entries) {
+      if (entry.name === '.DS_Store' || entry.name.startsWith('.')) continue;
+      if (entry.isDirectory() && SKIP_DIRS.has(entry.name)) continue;
+
+      const absolutePath = path.join(current, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        walk(absolutePath);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+
+      const pagePath = normalizePagePath(path.relative(root, absolutePath));
+      const { contentType, isBase64 } = fileEncoding(absolutePath);
+      files.push({
+        absolutePath,
+        path: pagePath,
+        size: fileSystem.statSync(absolutePath).size,
+        content_type: contentType,
+        is_base64: isBase64,
+      });
+    }
+  }
+
+  walk(root);
+  return files;
+}
+
+function validateFileLimits(files) {
+  const oversized = files.filter((file) => file.size > MAX_PAGE_BYTES);
+  const excess = files.slice(MAX_PAGES);
+  if (oversized.length === 0 && excess.length === 0) return;
+
+  const lines = ['site files exceed upload limits:'];
+  if (oversized.length > 0) {
+    lines.push(`pages over 2 mb: ${oversized.map((file) => file.path).join(', ')}`);
+  }
+  if (excess.length > 0) {
+    lines.push(`pages over the 200 page limit: ${excess.map((file) => file.path).join(', ')}`);
+  }
+  throw new Error(lines.join('\n'));
+}
+
+function collectPages(root, deps = {}) {
+  const fileSystem = deps.fs || fs;
+  const files = walkSiteFiles(root, deps);
+  validateFileLimits(files);
+
+  return files.map((file) => {
+    const content = fileSystem.readFileSync(file.absolutePath);
+    return {
+      path: file.path,
+      content: file.is_base64 ? content.toString('base64') : content.toString('utf8'),
+      content_type: file.content_type,
+      is_base64: file.is_base64,
+    };
+  });
+}
+
+function parseArgs(argv) {
+  const options = {
+    dir: null,
+    slug: null,
+    profile: null,
+    spa: false,
+    claimSubdomain: true,
+    build: false,
+    json: false,
+    help: false,
+  };
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === '--help' || arg === '-h' || arg === 'help') {
+      options.help = true;
+    } else if (arg === '--spa') {
+      options.spa = true;
+    } else if (arg === '--no-claim') {
+      options.claimSubdomain = false;
+    } else if (arg === '--build') {
+      options.build = true;
+    } else if (arg === '--json') {
+      options.json = true;
+    } else if (arg === '--slug' || arg === '--profile') {
+      const value = argv[i + 1];
+      if (!value || value.startsWith('-')) throw new Error(`${arg} needs a value`);
+      if (arg === '--slug') options.slug = value;
+      else options.profile = value;
+      i += 1;
+    } else if (arg.startsWith('-')) {
+      throw new Error(`unknown option: ${arg}`);
+    } else if (!options.dir) {
+      options.dir = arg;
+    } else {
+      throw new Error(`unexpected argument: ${arg}`);
+    }
+  }
+
+  return options;
+}
+
+function printHelp(log = console.log) {
+  log(`
+  atris site publish: upload a built web folder to atris.ai
+
+    atris site publish <dir> --slug <slug> [--profile strict|app] [--spa] [--no-claim] [--build] [--json]
+
+  --build runs npm run build in <dir>, then publishes dist, build, or out.
+  each page is capped at 2 mb, and each site is capped at 200 pages.
+`);
+}
+
+function validateOptions(options) {
+  if (!options.dir) return 'site publish needs a directory';
+  if (!options.slug) return '--slug is required';
+  if (!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(options.slug)) {
+    return 'slug must use lowercase letters, digits, and hyphens, with no hyphen at either end';
+  }
+  if (options.profile && options.profile !== 'strict' && options.profile !== 'app') {
+    return '--profile must be strict or app';
+  }
+  return null;
+}
+
+function requireDirectory(dir, fileSystem = fs) {
+  const root = path.resolve(dir);
+  let stat;
+  try {
+    stat = fileSystem.statSync(root);
+  } catch {
+    throw new Error(`site directory does not exist: ${root}`);
+  }
+  if (!stat.isDirectory()) throw new Error(`site path is not a directory: ${root}`);
+  return root;
+}
+
+function buildSite(root, deps = {}) {
+  const fileSystem = deps.fs || fs;
+  const packagePath = path.join(root, 'package.json');
+  let packageJson;
+  try {
+    packageJson = JSON.parse(fileSystem.readFileSync(packagePath, 'utf8'));
+  } catch {
+    throw new Error('--build needs package.json with a build script');
+  }
+  if (!packageJson.scripts || typeof packageJson.scripts.build !== 'string' || !packageJson.scripts.build.trim()) {
+    throw new Error('--build needs package.json with a build script');
+  }
+
+  const spawn = deps.spawnSync || spawnSync;
+  const result = spawn('npm', ['run', 'build'], { cwd: root, stdio: 'inherit' });
+  if (result.error) throw new Error(`build failed: ${result.error.message}`);
+  if (result.status !== 0) throw new Error(`build failed with exit code ${result.status}`);
+
+  for (const name of BUILD_DIRS) {
+    const candidate = path.join(root, name);
+    try {
+      if (fileSystem.statSync(candidate).isDirectory()) return candidate;
+    } catch {
+      // Try the next conventional build directory.
+    }
+  }
+  throw new Error('build finished but no dist, build, or out directory exists');
+}
+
+async function readResponse(response) {
+  if (response && typeof response.text === 'function') {
+    const text = await response.text();
+    if (!text) return { data: null, text: '' };
+    try { return { data: JSON.parse(text), text }; } catch { return { data: null, text }; }
+  }
+  if (response && typeof response.json === 'function') {
+    try {
+      const data = await response.json();
+      return { data, text: data == null ? '' : JSON.stringify(data) };
+    } catch {
+      return { data: null, text: '' };
+    }
+  }
+  return { data: null, text: '' };
+}
+
+function responsePageCount(value) {
+  if (Array.isArray(value)) return value.length;
+  return value == null ? 0 : value;
+}
+
+function printPublishResult(data, log) {
+  const urls = data && data.urls && typeof data.urls === 'object' ? data.urls : {};
+  log(`pages uploaded: ${responsePageCount(data && data.pages)}`);
+  log(`verified: ${data && data.verified === true ? 'yes' : 'no'}`);
+  log(`site url: ${urls.site || ''}`);
+  log(`preview url: ${urls.preview || ''}`);
+  log(`publish id: ${(data && data.publish_id) || ''}`);
+}
+
+async function run(argv, deps = {}) {
+  const log = deps.log || console.log;
+  const errorLog = deps.error || console.error;
+  let options;
+  try {
+    options = parseArgs(argv);
+  } catch (error) {
+    errorLog(error.message);
+    return 2;
+  }
+
+  if (options.help) {
+    printHelp(log);
+    return 0;
+  }
+  const optionError = validateOptions(options);
+  if (optionError) {
+    errorLog(optionError);
+    return 2;
+  }
+
+  const fileSystem = deps.fs || fs;
+  let root;
+  let pages;
+  try {
+    root = requireDirectory(options.dir, fileSystem);
+    if (options.build) root = buildSite(root, deps);
+    pages = collectPages(root, deps);
+  } catch (error) {
+    errorLog(error.message);
+    return 2;
+  }
+
+  if (!pages.some((page) => page.path === 'index.html')) {
+    errorLog('site home page is missing: index.html');
+    return 2;
+  }
+
+  const readCredentials = deps.loadCredentials || loadCredentials;
+  const credentials = readCredentials();
+  const token = credentials && typeof credentials.token === 'string' ? credentials.token.trim() : '';
+  if (!token) {
+    errorLog('not logged in. run atris login first.');
+    return 1;
+  }
+
+  const body = { pages, claim_subdomain: options.claimSubdomain };
+  if (options.spa) body.spa = true;
+  if (options.profile) body.csp_profile = options.profile;
+
+  const fetchFn = deps.fetch || globalThis.fetch;
+  if (typeof fetchFn !== 'function') {
+    errorLog('site publish needs Node.js 18 or newer');
+    return 1;
+  }
+  const apiBase = String(deps.apiBase || getApiBaseUrl()).replace(/\/+$/, '');
+  const url = `${apiBase}/sites/${encodeURIComponent(options.slug)}/publish`;
+
+  let response;
+  let parsed;
+  try {
+    response = await fetchFn(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: 'application/json',
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(body),
+    });
+    parsed = await readResponse(response);
+  } catch (error) {
+    errorLog(`publish failed: ${error.message}`);
+    return 1;
+  }
+
+  const status = Number(response && response.status) || 0;
+  const ok = response && typeof response.ok === 'boolean'
+    ? response.ok
+    : status >= 200 && status < 300;
+  if (!ok) {
+    const detail = parsed.data && typeof parsed.data === 'object' && parsed.data.detail
+      ? String(parsed.data.detail)
+      : parsed.text.trim() || `request failed with status ${status}`;
+    errorLog(detail);
+    if (status === 503 && detail === 'subdomain_grant_unavailable') {
+      errorLog(`could not claim ${options.slug}.atris.ai (server has no Render credentials); retry with --no-claim if the subdomain already exists`);
+    }
+    return 1;
+  }
+
+  const data = parsed.data && typeof parsed.data === 'object' ? parsed.data : {};
+  if (options.json) log(JSON.stringify(data));
+  else printPublishResult(data, log);
+
+  if (data.verified !== true) {
+    errorLog('site is not live: verified no');
+    return 1;
+  }
+  return 0;
+}
+
+module.exports = {
+  MAX_PAGE_BYTES,
+  MAX_PAGES,
+  collectPages,
+  normalizePagePath,
+  run,
+};

package/lib/site.js

@@ -1,4 +1,4 @@
-// Static site generator — point it at a folder of markdown (docs, your wiki,
+// Static site generator: point it at a folder of markdown (docs, your wiki,
 // memory) and get a beautiful, navigable HTML site in the design system.
 // Builds on lib/deck-from-md (parse) + lib/html-render (render).
 //

package/lib/slides-deck.js

@@ -1,4 +1,4 @@
-// Atris deck engine — turn a plain content spec into a premium, anti-slop
+// Atris deck engine: turn a plain content spec into a premium, anti-slop
 // Google Slides deck. Pure: spec -> batch-update requests (no network here).
 //
 // The product idea: PMs open Slides and get Arial-on-white slop by default.
@@ -55,7 +55,7 @@ function rgb(hex) { const n = parseInt(String(hex).slice(1), 16);
 // strip the AI tells the engine refuses to ship. Returns sanitized text.
 function sanitize(t) {
   return String(t == null ? '' : t)
-    .replace(/\s*[—]\s*/g, ', ')   // em dash -> comma (top AI-writing tell)
+    .replace(/\s*\u2014\s*/g, ', ')   // em dash -> comma (top AI-writing tell)
     .replace(/\s-\s/g, ', ')         // spaced hyphen used as a dash
     .replace(/\bAI-powered\b/gi, 'built for')
     .replace(/\s{2,}/g, ' ');

package/lib/state-detection.js

@@ -149,7 +149,7 @@ function getTasksFromDbBucket(atrisDir, bucketName) {
 
 // Single-read task lane counts for boot/status surfaces.
 // Prefers the task DB (source of truth); falls back to TODO.md parsing.
-// Review counts only exist on the DB path — markdown views don't carry the lane.
+// Review counts only exist on the DB path, markdown views don't carry the lane.
 function getTaskCounts(atrisDir) {
   try {
     const taskDb = require('./task-db');
@@ -167,7 +167,7 @@ function getTaskCounts(atrisDir) {
             try {
               const meta = typeof row.metadata === 'string' ? JSON.parse(row.metadata || '{}') : (row.metadata || {});
               if (meta.agent_certified && meta.approval_status !== 'accepted') counts.reviewCertified++;
-            } catch { /* unreadable metadata — count as uncertified */ }
+            } catch { /* unreadable metadata, count as uncertified */ }
           }
         }
         return counts;

package/lib/sync-telemetry.js

@@ -1,10 +1,10 @@
-// Atris sync telemetry — emit one event per `atris push` / `atris pull`.
+// Atris sync telemetry, emit one event per `atris push` / `atris pull`.
 //
 // Why awaited (not fire-and-forget): push.js / pull.js call process.exit(1)
 // on most failure paths. A fire-and-forget POST gets killed mid-flight and
 // the RL loop loses signals on the exact failures it most needs to learn.
 //
-// Best-effort: any error swallowed silently — telemetry never blocks UX.
+// Best-effort: any error swallowed silently, telemetry never blocks UX.
 // Hard 2s timeout so a flaky control plane can't slow real operations.
 
 const { apiRequestJson } = require('../utils/api');

package/lib/task-db.js

@@ -9,7 +9,7 @@
 'use strict';
 
 // node:sqlite emits an ExperimentalWarning. Suppress only that exact class by
-// monkey-patching process.emit at this narrow filter — other warnings (and
+// monkey-patching process.emit at this narrow filter, other warnings (and
 // any pre-existing listeners installed by host code) are untouched.
 {
   const originalEmit = process.emit;
@@ -32,6 +32,7 @@ const { isGenericScratchRoot } = require('./scratch-root');
 const { isDecisionTask } = require('./task-decision');
 const { parseVerifyCommand } = require('./auto-accept-certified');
 const { taskExplanation } = require('./task-explanation');
+const { treeHashFor } = require('./tree-hash');
 
 const DEFAULT_DB_PATH = path.join(os.homedir(), '.atris', 'tasks.db');
 const TASK_EPISODES_FILE = path.join('.atris', 'state', 'task_episodes.jsonl');
@@ -208,7 +209,7 @@ function open(dbPath) {
   // Concurrency: WAL gives readers + one writer concurrency; busy_timeout
   // makes contended writers wait instead of returning SQLITE_BUSY at the
   // C library level. We additionally wrap the setup PRAGMAs + DDL in our
-  // own retry — under heavy spawn-storm contention, node:sqlite leaks
+  // own retry, under heavy spawn-storm contention, node:sqlite leaks
   // SQLITE_BUSY past the busy_timeout for `db.exec()` calls.
   withBusyRetry(() => db.exec('PRAGMA journal_mode = WAL'));
   withBusyRetry(() => db.exec('PRAGMA busy_timeout = 30000'));
@@ -249,7 +250,7 @@ function newId() {
 // Resolve the canonical workspace root so `atris task` from any subdirectory
 // keys the SAME store as the repo root. Precedence (nearest ancestor wins per
 // pass):
-//   1. A deliberate workspace spine — .atris/business.json (a bound customer
+//   1. A deliberate workspace spine, .atris/business.json (a bound customer
 //      sub-workspace) or atris/atris.md (the framework protocol file). These are
 //      intentional nested workspaces INSIDE a repo and must stay isolated.
 //   2. The git toplevel (.git). One git repo == one workspace; this rescues a
@@ -630,7 +631,7 @@ function doneTask(db, { id, status, actor, allowReview = false, action, proof, a
   const final = status || 'done';
   if (!['done', 'failed'].includes(final)) throw new Error('status must be done|failed');
   // 'archived' is a distinct terminal status written by archiveTask(), never
-  // by this function — a bulk sweep of duplicate/off-roadmap tasks must not
+  // by this function, a bulk sweep of duplicate/off-roadmap tasks must not
   // read as a real failure. See archiveTask() below.
   const now = Date.now();
   const allowedStatuses = allowReview ? "'open', 'claimed', 'review'" : "'open', 'claimed'";
@@ -699,12 +700,12 @@ function reapMissionBlockerTasks(db, { workspaceRoot: ws, missions = [], actor }
 
 // Distinct terminal status for housekeeping sweeps (duplicate loop-ticks,
 // off-roadmap backlog resets, synthetic-test cleanup). Never conflate this
-// with `failed` — 'failed' means the work itself did not succeed, 'archived'
+// with `failed`, 'failed' means the work itself did not succeed, 'archived'
 // means the work was swept off the board for reasons unrelated to whether it
 // succeeded. Reward/RSI signal readers must treat the two differently.
 // `fromFailed: true` is an explicit opt-in for sanctioned historical cleanup
 // (e.g. the 109 duplicate "Loop tick:" orphans fail-closed before 'archived'
-// existed — cluster 1 of failed-tasks-analysis-2026-07-03). It permits the
+// existed, cluster 1 of failed-tasks-analysis-2026-07-03). It permits the
 // failed→archived transition and records the prior status in
 // metadata.archived_from. Individual archive commands never archive 'done'
 // rows. The clear-done sweep opts in through fromDone after selecting only the
@@ -761,7 +762,7 @@ function archiveTask(db, { id, actor, reason, fromFailed = false, fromDone = fal
 }
 
 // Marks metadata written by the 2026-06-10 "first-principles backlog reset"
-// (see atris/logs/2026/2026-06-10.md) — a bulk pass that closed off-roadmap
+// (see atris/logs/2026/2026-06-10.md), a bulk pass that closed off-roadmap
 // tasks, including certified/proof-backed done work, by writing status
 // 'failed' because no distinct 'archived' status existed yet. This
 // identifies exactly those rows so relabelArchivedTasks() can fix the label
@@ -1202,6 +1203,7 @@ function stageTask(db, {
   goal,
   summary,
   owner,
+  ownerExplicit = false,
   exit,
   proofNeeded,
   firstMove,
@@ -1361,7 +1363,10 @@ function stageTask(db, {
   metadata.stage_updated_by = cleanStageText(actor) || null;
   if (stageOwner) {
     metadata.stage_owner = stageOwner;
-    metadata.assigned_to = targetStage === 'do' ? stageOwner : (metadata.assigned_to || stageOwner);
+    // Plan keeps an existing delegated assignee unless the caller named an
+    // owner on purpose; do always records the worker who is doing it.
+    const reassign = targetStage === 'do' || Boolean(ownerExplicit && requestedOwner);
+    metadata.assigned_to = reassign ? stageOwner : (metadata.assigned_to || stageOwner);
   }
   if (hasConfidence && Number.isFinite(confidenceValue)) metadata.stage_confidence = Math.max(0, Math.min(1, confidenceValue));
 
@@ -1524,7 +1529,7 @@ function normalizeTagToken(value) {
 // Update a task's flag list (`metadata.tags`) on an already-created task.
 // Tags are only settable at creation elsewhere; this is the after-the-fact
 // escape hatch so an open task that becomes an owner decision can be marked
-// `needs-human` — which sweep and fleet staffing both honor — instead of
+// `needs-human`, which sweep and fleet staffing both honor, instead of
 // being restaffed forever (CLI-879). Every change appends a
 // `task_tags_updated` event so the trail shows who flagged it and when.
 function tagTask(db, { id, actor, add = [], remove = [] } = {}) {
@@ -1833,6 +1838,7 @@ function taskEpisodeFromReview(row, event, payload) {
   const humanFeedback = humanFeedbackFromMetadata(metadata, label, payload);
   return {
     schema: 'atris.task_episode.v1',
+    tree_hash: treeHashFor(row.workspace_root),
     episode_id: event.event_id,
     task_id: row.id,
     workspace_root: row.workspace_root,
@@ -1885,6 +1891,7 @@ function taskEpisodeFromRevision(row, event, payload) {
   const humanFeedback = humanFeedbackFromMetadata(metadata, 'revise', payload);
   return {
     schema: 'atris.task_episode.v1',
+    tree_hash: treeHashFor(row.workspace_root),
     episode_id: event.event_id,
     task_id: row.id,
     workspace_root: row.workspace_root,
@@ -2196,7 +2203,7 @@ function withBusyRetry(fn, attempts = 8) {
       const code = e && (e.code || e.errcode);
       const busy = /SQLITE_BUSY|database is locked/i.test(msg) || code === 'SQLITE_BUSY' || code === 5;
       if (!busy) throw e;
-      // Sleep synchronously — node:sqlite is sync; matches the rest of the API
+      // Sleep synchronously, node:sqlite is sync; matches the rest of the API
       const end = Date.now() + delay + Math.floor(Math.random() * delay);
       while (Date.now() < end) {} // tight loop is fine, delay is small
       delay = Math.min(delay * 2, 500);

package/lib/task-explanation.js

@@ -52,7 +52,7 @@ function endSentence(value) {
 // here without weakening or rewriting the durable task record.
 function plainText(value) {
   let text = cleanText(value)
-    .replace(/\s*[—–]\s*/g, ', ')
+    .replace(/\s*[\u2014\u2013]\s*/g, ', ')
     .replace(/--([a-z][a-z-]*)/g, (_match, flag) => flag.replace(/-/g, ' '))
     .replace(/\b[a-z0-9]+(?:_[a-z0-9]+)+\b/gi, match => match.replace(/_/g, ' '))
     .replace(/\b[a-z]+(?:[A-Z][A-Za-z0-9]*)+\b/g, match => match.replace(/([a-z0-9])([A-Z])/g, '$1 $2'))

package/lib/task-proof.js

@@ -18,7 +18,7 @@ const LOCAL_SUCCESS_PROOF_EXAMPLE = 'local success example: atris task ready <id
 const FETCHED_PROOF_URL_RE = /\[(?:fetched|i-fetched)\]\s*https?:\/\/github[.]com\/[^/\s]+\/[^/\s]+\/actions\/runs\/\d+\b/i;
 const HUMAN_PROOF_RE = /\b(?:team human approved|human approved|human approval|approved by|accepted by|reviewed by|customer replied|customer approved|customer accepted|replied)\b/i;
 const FILE_ACTION_RE = /\b(?:changed|updated|edited|created|deleted|saved|wrote|patched|reviewed|verified|validated|opened|read)\b/i;
-const VERIFIED_PROOF_RE = /^\[verified\]\s+`[^`]+`\s+passed\s+\(exit 0\)(?:\s|$)/im;
+const VERIFIED_PROOF_RE = /^\[verified\]\s+`[^`]+`\s+passed\s+\(exit 0\)(?:[\s,]|$)/im;
 const LOCAL_RECEIPT_PATH_RE = /(?:^|[\s])(?:Receipt:\s*)?(?:atris\/runs\/|\.atris\/state\/)[^\s'"`,;)]+\.json\b/i;
 const SECOND_ACTOR_EXECUTED_PROOF_RE = /^Second-actor check:\s+`[^`]+`\s+re-run by [^,]+,\s+exited 0(?:[.\s]|$)/i;
 // Ready/receipt prose may name these. If this process did not run the named
@@ -168,7 +168,7 @@ function buildVerifiedProof(verifyCmd, baseProof = '', runner, options = {}) {
   }
   const base = compactWhitespace(baseProof);
   // Phrase so the result also satisfies taskProofState ("verified ... passed").
-  const proof = `[verified] \`${cmd}\` passed (exit 0)${base ? ` — ${base}` : ''}${output ? `\n${output}` : ''}`;
+  const proof = `[verified] \`${cmd}\` passed (exit 0)${base ? `, ${base}` : ''}${output ? `\n${output}` : ''}`;
   return { ok: true, exit: 0, output, cmd, proof };
 }
 

package/lib/task-receipt.js

@@ -3,7 +3,7 @@
 // Receipt writer for task proofs. Mirrors the mission receipt shape
 // (commands/mission.js writeReceipt) so lib/receipt-evidence.js can validate
 // paths named in a proof at the review gate: schema tag, `at` timestamp,
-// result.passed. Every call writes a receipt file, pass or fail — a failing
+// result.passed. Every call writes a receipt file, pass or fail, a failing
 // verifier still leaves a record, it just can't be cited to move a task to
 // ready.
 
@@ -26,7 +26,7 @@ function gitCommitHash(root) {
     const result = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' });
     if (result.status === 0) return String(result.stdout || '').trim() || null;
   } catch {
-    // ignore — not every workspace is a git repo
+    // ignore, not every workspace is a git repo
   }
   return null;
 }
@@ -45,7 +45,7 @@ function slugifyTaskId(taskId) {
 
 // Runs `command` for `taskId`, writes atris/runs/<date>-task-<id>-<time>.json,
 // and returns { ok, passed, receiptPath, exit, signal, output }. `ok` mirrors
-// `passed` — kept as a separate field so callers reading either name work.
+// `passed`, kept as a separate field so callers reading either name work.
 function writeTaskReceipt({ taskId, command, root = process.cwd(), runner } = {}) {
   const cmd = String(command || '').trim();
   if (!taskId) return { ok: false, passed: false, reason: 'task_id_required' };