atris 3.69.0 → 3.71.0

package/lib/known-commands.js

@@ -3,7 +3,7 @@
 const knownCommands = ['init', 'guide', 'doctor', 'doc-health', 'install', 'workspace', 'log', 'logs', 'later', 'done', 'wish', 'ask', 'approve', 'stop', 'ready', 'check', 'drill', 'dream', 'now', 'goal', 'wtf', 'founder', 'orb', 'radar', 'who', 'stream', 'ctop', 'launchpad', 'status', 'analytics', 'revisions', 'visualize', 'brain', 'brainstorm', 'autopilot', 'run', 'plan', 'do', 'review', 'release',
                        'activate', '_activate', 'agent', 'team', 'chat', 'fast', 'ax', 'console', 'serve', 'login', 'logout', 'whoami', 'switch', 'use', 'accounts', '_resolve', '_profile-email', '_switch-session', 'shell-init', 'update', 'upgrade', 'version', 'help', 'next', 'atris',
                        'clean', 'close', 'harvest', 'verify', 'recover', 'search', 'scout', 'skill', 'member', 'codex-goal', 'app', 'apps', 'learn', 'lesson', 'taste', 'teach', 'plugin', 'experiments', 'bench', 'router', 'tree', 'receipt', 'proof', 'openclaw', 'pull', 'push', 'watch', 'cloud', 'live', 'align', 'terminal', 'computer', 'diff', 'business', 'sync', 'youtube', 'x-search',
-                       'ingest', 'query', 'lint', 'loop', 'pulse', 'task', 'mission', 'decide', 'agents', 'probe', 'worktree', 'land', 'caretaker', 'autoland', 'drive', 'aeo', 'slop', 'voice', 'strings', 'write', 'security-review', 'secure', 'deck', 'site', 'theme', 'card', 'reel', 'improve', 'study', 'rainmaker', 'xp', 'play', 'gm', 'game', 'x', 'recap', 'report', 'signup', 'clarity', 'interview', 'meet', 'moves', 'unknowns', 'avail', 'scoreboard', 'sync-checkout',
+                       'ingest', 'query', 'lint', 'loop', 'pulse', 'task', 'mission', 'decide', 'campaign', 'agents', 'probe', 'worktree', 'land', 'caretaker', 'autoland', 'drive', 'aeo', 'slop', 'voice', 'strings', 'write', 'security-review', 'secure', 'deck', 'site', 'theme', 'card', 'reel', 'improve', 'study', 'rainmaker', 'xp', 'play', 'gm', 'game', 'x', 'recap', 'report', 'signup', 'clarity', 'interview', 'meet', 'moves', 'unknowns', 'avail', 'scoreboard', 'sync-checkout',
                        'ci', 'github', 'vercel', 'supabase', 'linear', 'stripe', 'balance', 'usage', 'api-key', 'agent-client', 'topup', 'buy', 'transactions', 'hire', 'hires', 'mail', 'design', 'mcp', 'gmail', 'calendar', 'twitter', 'slack', 'imessage', 'integrations', 'setup', 'clean-workspace', 'cw',
                        'fork', 'browse', 'publish', 'pack', 'sleep', 'wake', 'feedback', 'errors', 'wiki', 'code-review', 'cr', 'soul', 'fleet', 'fleet-report', 'loops', 'self-improve', 'compile', 'spaceship', 'truth', 'sign', 'engine', 'engines', 'link', 'playbook', 'feed', 'brief', 'social', 'host', 'people', 'follow', 'unfollow', 'friends', 'msg', 'inbox', 'invite', 'join', 'rsi'];
 

package/lib/land-green.js

@@ -20,6 +20,7 @@ const os = require('os');
 const path = require('path');
 const { spawnSync } = require('child_process');
 const { runGit } = require('./git-spawn');
+const { proveCheckBeforePublish, proveLanding } = require('./landing-proof');
 
 const DEFAULT_VERIFY = 'npm test';
 const DEFAULT_VERIFY_TIMEOUT_MS = 20 * 60 * 1000;
@@ -239,8 +240,15 @@ function landOneBranch(root, base, branch, {
   if (!scratch.ok) return verdictFor(branch, base, { action: 'error', reason: 'scratch_checkout_failed', detail: scratch.error });
   try {
     // Verify the merged state, not the branch tip: base may have moved since.
+    const before = gitOut(['rev-parse', target.target], scratch.dir);
     const merged = gitOut(['merge', '--no-edit', '--no-ff', target.target, '-m', `land: ${branch} onto ${base} after a green verify`], scratch.dir);
     if (!merged.ok) return verdictFor(branch, base, { action: 'error', reason: 'merge_failed', detail: merged.err || merged.out });
+    // A branch of empty commits (a "Start flight" marker, a change already on
+    // base) merges clean and passes every check. Landing it would record a
+    // landing over nothing, so it is named a no-op and never pushed.
+    if (gitOut(['diff', '--quiet', target.target, 'HEAD'], scratch.dir).ok) {
+      return verdictFor(branch, base, { action: 'no_op', reason: 'empty_diff', detail: `${branch} changes nothing on ${base}` });
+    }
     const deps = installDeps(scratch.dir);
     if (!deps.ok) return verdictFor(branch, base, { action: 'error', reason: 'install_failed', detail: deps.detail });
     const verify = runVerifyFn(verifyCommand, scratch.dir, { timeoutMs: verifyTimeoutMs, env });
@@ -254,6 +262,18 @@ function landOneBranch(root, base, branch, {
     }
     const sha = gitOut(['rev-parse', 'HEAD'], scratch.dir);
     if (!sha.ok) return verdictFor(branch, base, { action: 'error', reason: 'merged_sha_unreadable' });
+    const checkCommand = verify.command || verifyCommand;
+    // Nothing is published on a check that could not have caught a break: it
+    // must be one that can fail, and it must have run on this merged commit
+    // with every changed file committed and tracked. Otherwise hold.
+    const unbacked = proveCheckBeforePublish(scratch.dir, {
+      commit: sha.out,
+      base: before.ok ? before.out : target.target,
+      verify: checkCommand,
+    });
+    if (unbacked) {
+      return verdictFor(branch, base, { action: 'skipped', reason: unbacked.reason, detail: unbacked.detail, verify });
+    }
     const local = localBaseName(base);
     const pushed = push ? pushBase(root, local, sha.out) : { attempted: false, ok: false, reason: 'push_disabled' };
     if (pushed.attempted && !pushed.ok) {
@@ -262,8 +282,35 @@ function landOneBranch(root, base, branch, {
       return verdictFor(branch, base, { action: 'skipped', reason: 'push_rejected', detail: pushed.detail, verify });
     }
     const advanced = advanceBase(root, local, sha.out);
-    if (!advanced.ok) return verdictFor(branch, base, { action: 'landed', sha: sha.out, verify, push: pushed, local_base: advanced.reason });
-    return verdictFor(branch, base, { action: 'landed', sha: sha.out, verify, push: pushed });
+    // "landed" is a fact about the target branch, checked after the fact by
+    // the same rule every receipt uses: the commit must be on origin's copy.
+    // A local branch only counts in a repo with no remote at all; with a
+    // remote, an unpushed merge is not landed however the local ref moved.
+    const noRemote = !gitOut(['remote'], root).out;
+    const landing = proveLanding(root, {
+      commit: sha.out,
+      base: before.ok ? before.out : '',
+      target: noRemote ? `refs/heads/${local}` : `refs/remotes/origin/${local}`,
+      verify: checkCommand,
+      localTargetOk: noRemote,
+    });
+    if (landing.status !== 'landed') {
+      // Once pushed, the merge is on origin whatever the check says; the
+      // record names both facts instead of a bare "unverified".
+      return verdictFor(branch, base, {
+        action: pushed.ok ? 'pushed' : landing.status,
+        reason: landing.reason,
+        detail: landing.detail,
+        landing_check: landing.status,
+        sha: sha.out,
+        verify,
+        push: pushed,
+        local_base: advanced.ok ? undefined : advanced.reason,
+        landing,
+      });
+    }
+    if (!advanced.ok) return verdictFor(branch, base, { action: 'landed', sha: sha.out, verify, push: pushed, local_base: advanced.reason, landing });
+    return verdictFor(branch, base, { action: 'landed', sha: sha.out, verify, push: pushed, landing });
   } finally {
     dropScratch(root, scratch.dir);
   }
@@ -311,10 +358,12 @@ function landStaleGreenBranches(root, {
     .filter((b) => b.state === 'active' && b.stale)
     .sort((a, b) => b.activityHours - a.activityHours);
   const verdicts = [];
-  // Only landed and red verdicts spend the per-tick budget: an erroring or
-  // ineligible branch must not starve the rest of the queue. A bounded run of
-  // misses still stops the walk so a fully broken queue does not burn a
-  // scratch checkout per branch per tick.
+  // Any verdict that ran the verify suite spends the per-tick budget, landed
+  // or not: a run of pushed-but-unproven or no-landing verdicts must not run
+  // four 20-minute suites in one tick. An erroring or ineligible branch that
+  // never reached the suite does not starve the rest of the queue. A bounded
+  // run of misses still stops the walk so a fully broken queue does not burn
+  // a scratch checkout per branch per tick.
   let spent = 0;
   let misses = 0;
   for (const candidate of candidates) {
@@ -328,7 +377,7 @@ function landStaleGreenBranches(root, {
     } catch (err) {
       verdict = verdictFor(candidate.name, live.base, { action: 'error', reason: 'exception', detail: String((err && err.message) || err).slice(0, 300) });
     }
-    if (verdict.action === 'landed' || verdict.action === 'red') {
+    if (verdict.action === 'landed' || verdict.action === 'red' || verdict.verify) {
       spent += 1;
       misses = 0;
     } else {
@@ -362,6 +411,8 @@ function summaryLine(result) {
   for (const v of result.verdicts) {
     if (v.action === 'skipped' && v.reason !== 'per_tick_limit') parts.push(`${v.branch} held (${v.reason.replace(/_/g, ' ')}${v.detail ? `: ${v.detail}` : ''})`);
     if (v.action === 'error') parts.push(`${v.branch} error (${v.reason.replace(/_/g, ' ')})`);
+    if (v.action === 'pushed') parts.push(`${v.branch} pushed, landing check: ${String(v.landing_check).replace(/_/g, ' ')} (${v.reason.replace(/_/g, ' ')})`);
+    if (['no_op', 'not_landed', 'unverified'].includes(v.action)) parts.push(`${v.branch} not landed (${v.reason.replace(/_/g, ' ')})`);
   }
   const waiting = result.verdicts.filter((v) => v.reason === 'per_tick_limit').length;
   if (waiting) parts.push(`${waiting} more waiting for the next tick`);

package/lib/landing-proof.js

@@ -0,0 +1,352 @@
+'use strict';
+
+// The one rule for the word "landed".
+//
+// Before this module, "landed" meant whatever the writer had in hand. The
+// autoland receipt called every accepted task landed. On 2026-10-14 the 07:14
+// tick receipt listed AIT-5..AIT-8 as landed; their commits (50282f7c,
+// bcb20291, ...) sat on a worktree branch and never reached origin/master.
+// OBL-3213 "landed" after its verifier ran a test file out of a different
+// worktree (executor-operate) while the repo's own checkout never had the
+// change. Across the 537 auto-accepts in the last 30 days that recorded the
+// commit their check ran on, 72 ran on a commit that never reached the target
+// branch and 137 more ran on a commit older than the task itself, so the check
+// could not have seen the work. 80 more were "verified" by `git diff --check`,
+// which passes on an empty diff.
+//
+// So a receipt may say "landed" only when all of this holds:
+//   1. the work's own commit has a non-empty change from its base, and every
+//      file it changed reads the same on origin's target branch right now (or
+//      a later edit made after the target carried it). Content, not commit
+//      ids: squash, rebase and merge-queue merges rewrite ids. A file the
+//      target went back to its old version of is a revert, not a landing;
+//   2. the change touches every tracked file the work claims;
+//   3. the check behind it can fail, and ran on a checkout that held the work
+//      with those files committed.
+// Anything else is recorded as what it is: not_landed, no_op, or unverified.
+// A repo with no fetched origin target is unverified: a local branch is not
+// somewhere anyone else can see the work.
+
+const fs = require('fs');
+const path = require('path');
+const { runGit } = require('./git-spawn');
+const { nonFalsifyingIssue } = require('./accept-verify-gate');
+
+const SHA = /^[0-9a-f]{40}$/;
+const MAX_HISTORY_SCAN = 50;
+
+function git(root, args) {
+  const result = runGit(args, { cwd: root, check: false });
+  return { ok: result.status === 0, out: String(result.stdout || '').trim() };
+}
+
+// Answers about fixed commit ids never change, so they are cached for the
+// life of the process. One heartbeat proves hundreds of tasks against the
+// same few commits; without this a 500-task sweep cost ~7,000 git spawns.
+// Anything that reads a ref or the working tree is never cached.
+const immutable = new Map();
+function gitFixed(top, args) {
+  const key = `${top}\u0000${args.join('\u0000')}`;
+  if (immutable.has(key)) return immutable.get(key);
+  const result = git(top, args);
+  if (immutable.size > 20000) immutable.clear();
+  immutable.set(key, result);
+  return result;
+}
+
+const toplevels = new Map();
+function toplevel(root) {
+  const key = path.resolve(root);
+  if (!toplevels.has(key)) {
+    const top = git(root, ['rev-parse', '--show-toplevel']);
+    toplevels.set(key, top.ok && top.out ? top.out : null);
+  }
+  return toplevels.get(key);
+}
+
+function resolveCommit(top, ref) {
+  const text = String(ref || '').trim();
+  if (!text) return null;
+  const args = ['rev-parse', '--verify', '--quiet', `${text}^{commit}`];
+  const result = SHA.test(text) ? gitFixed(top, args) : git(top, args);
+  return result.ok && result.out ? result.out : null;
+}
+
+function isAncestor(top, older, newer) {
+  return gitFixed(top, ['merge-base', '--is-ancestor', older, newer]).ok;
+}
+
+function blobAt(top, sha, file) {
+  const result = gitFixed(top, ['rev-parse', '--verify', '--quiet', `${sha}:${file}`]);
+  return result.ok && result.out ? result.out : null;
+}
+
+// Only origin's copy counts. A local branch (refs/heads/*) is only a target
+// when the caller says so: the green lander in a repo with no remote at all.
+function resolveTarget(top, target, { localTargetOk = false } = {}) {
+  const name = String(target || '').trim();
+  if (name.startsWith('refs/heads/') && !localTargetOk) return null;
+  if (name.startsWith('refs/')) return resolveCommit(top, name) ? name : null;
+  const branch = name.replace(/^origin\//, '');
+  const candidates = branch ? [`origin/${branch}`] : ['origin/HEAD', 'origin/master', 'origin/main'];
+  return candidates.find((ref) => resolveCommit(top, ref)) || null;
+}
+
+function verdict(status, reason, detail, extra = {}) {
+  return { status, reason, detail, ...extra };
+}
+
+// Judge each changed file by what the target holds right now.
+//   theirs === mine                      -> landed
+//   theirs === base (or a file the work deleted is back, or a file it added
+//   is gone again), after the target once carried mine -> reverted
+//   anything else, after the target once carried mine -> landed, edited since
+//   the target never carried mine        -> missing
+// "Once carried" is free when the commit is an ancestor of the target;
+// otherwise it is a content match somewhere in the target's history of the
+// file (squash, rebase and merge-queue merges rewrite commit ids).
+function judgeFile(top, base, sha, targetSha, file, onTarget) {
+  const mine = blobAt(top, sha, file);
+  const before = blobAt(top, base, file);
+  const theirs = blobAt(top, targetSha, file);
+  if (theirs === mine) return 'landed';
+  let carried = onTarget;
+  if (!carried) {
+    const history = gitFixed(top, ['log', '--format=%H', `-${MAX_HISTORY_SCAN}`, `${base}..${targetSha}`, '--', file]);
+    carried = history.ok && history.out.split('\n').filter(Boolean).some((commit) => blobAt(top, commit, file) === mine);
+  }
+  if (!carried) return 'missing';
+  return theirs === before ? 'reverted' : 'edited_since';
+}
+
+// With no recorded start and the commit already on the target (a real merge
+// or fast-forward), the fork point is the commit itself. Find the merge that
+// brought it onto the target's mainline instead; the task's commits are the
+// ones that merge added, and the base is the first parent of the oldest one.
+// A commit sitting directly on the mainline gives no such boundary.
+function baseFromMerge(top, sha, targetSha) {
+  const mainline = gitFixed(top, ['rev-list', '--first-parent', '--ancestry-path', `${sha}..${targetSha}`]);
+  const entry = mainline.ok ? mainline.out.split('\n').filter(Boolean).pop() : '';
+  if (!entry) return { reason: `${sha.slice(0, 9)} is the target's tip and the work recorded no start` };
+  const parents = gitFixed(top, ['rev-list', '--parents', '-n', '1', entry]);
+  const [, mainParent, ...merged] = parents.ok ? parents.out.split(/\s+/) : [];
+  if (!mainParent || mainParent === sha || !merged.length || isAncestor(top, sha, mainParent)) {
+    return { reason: `${sha.slice(0, 9)} sits directly on the target's mainline and the work recorded no start, so nothing marks where its change began` };
+  }
+  const own = gitFixed(top, ['rev-list', '--reverse', '--topo-order', `${mainParent}..${sha}`]);
+  const first = own.ok ? own.out.split('\n').filter(Boolean)[0] : '';
+  const firstParent = first ? resolveCommit(top, `${first}^1`) : null;
+  if (!firstParent) {
+    return { reason: `the merge ${entry.slice(0, 9)} that brought ${sha.slice(0, 9)} in has no parent to measure the change from` };
+  }
+  return { base: firstParent, merge: entry };
+}
+
+// Paths a verify command names, checked against what git actually tracks.
+// A check that runs a file outside this checkout, or a file git does not
+// have committed, proves nothing about the commit. The program itself
+// (node, a venv python) is a tool, not the work, so it is not checked.
+function verifyPathIssue(command, cwd, top) {
+  let dir = cwd;
+  for (const segment of String(command || '').split('&&')) {
+    const argv = segment.trim().split(/\s+/)
+      .map((token) => token.replace(/^['"`]|['"`;]$/g, ''))
+      .filter(Boolean);
+    while (argv.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(argv[0])) argv.shift();
+    if (argv[0] === 'cd') {
+      if (argv[1]) dir = path.resolve(dir, argv[1]);
+      continue;
+    }
+    for (const token of argv.slice(1)) {
+      if (token.startsWith('-') || token.includes('=')) continue;
+      if (!(path.isAbsolute(token) || token.startsWith('~') || token.includes('/') || /\.[A-Za-z0-9]+$/.test(token))) continue;
+      const named = token.startsWith('~')
+        ? path.join(process.env.HOME || '', token.slice(1))
+        : path.resolve(dir, token);
+      if (!fs.existsSync(named)) continue;
+      const relative = path.relative(top, fs.realpathSync(named));
+      if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        return `the check runs ${token}, which lives outside this checkout`;
+      }
+      if (!relative) continue;
+      if (!git(top, ['ls-files', '--error-unmatch', '--', relative]).ok) {
+        return `the check runs ${relative}, which git does not track`;
+      }
+      if (!git(top, ['diff', '--quiet', 'HEAD', '--', relative]).ok) {
+        return `the check runs ${relative}, which has uncommitted changes`;
+      }
+    }
+  }
+  return '';
+}
+
+// Artifact paths a task names (receipts, run logs) are often gitignored or
+// never committed. They cannot be part of a landing, so they are not held
+// against one.
+function trackableClaims(top, cwd, sha, changed, files) {
+  const claimed = [];
+  for (const file of files) {
+    const relative = path.relative(top, path.resolve(cwd, String(file))).replace(/\\/g, '/');
+    if (!relative || relative.startsWith('..')) continue;
+    if (changed.some((c) => c === relative || c.startsWith(`${relative}/`))) {
+      claimed.push(relative);
+      continue;
+    }
+    if (git(top, ['check-ignore', '-q', '--', relative]).ok) continue;
+    const known = gitFixed(top, ['ls-tree', '--name-only', sha, '--', relative]);
+    if (!known.ok || !known.out) continue;
+    claimed.push(relative);
+  }
+  return claimed;
+}
+
+// The check behind a change: it must be one that can fail, and when it ran
+// in a working tree, that tree must hold the work, committed and tracked.
+// Returns a verdict when the check does not back the change, else null.
+function checkVerdict(top, cwd, { sha, baseSha, changed, claimed = [], verify, checkedWorkingTree }, facts = {}) {
+  const command = String(verify || '').trim();
+  if (!command) return verdict('unverified', 'no_check', 'no check ran on this change', facts);
+  const hollow = nonFalsifyingIssue(command);
+  if (hollow) return verdict('unverified', 'check_cannot_fail', hollow, facts);
+  if (!checkedWorkingTree) return null;
+  // The checkout holds the work when every changed file reads as the work
+  // wrote it, or the work is in its history and no file went back to base.
+  const head = resolveCommit(top, 'HEAD');
+  const holdsWork = head && (
+    changed.every((file) => blobAt(top, head, file) === blobAt(top, sha, file))
+    || (isAncestor(top, sha, head) && changed.every((file) => blobAt(top, head, file) !== blobAt(top, baseSha, file)))
+  );
+  if (!holdsWork) {
+    return verdict('unverified', 'check_ran_without_the_work', `the check ran on ${head ? head.slice(0, 9) : 'an unknown commit'}, which does not hold this work`, facts);
+  }
+  const scope = [...new Set([...changed, ...claimed])];
+  const dirty = git(top, ['status', '--porcelain', '--untracked-files=all', '--', ...scope]);
+  if (dirty.ok && dirty.out) {
+    const names = dirty.out.split('\n').map((line) => line.slice(3));
+    return verdict('unverified', 'checked_uncommitted_files', `the check ran with uncommitted edits to ${names.slice(0, 5).join(', ')}`, facts);
+  }
+  const pathIssue = verifyPathIssue(command, cwd, top);
+  if (pathIssue) return verdict('unverified', 'checked_untracked_content', pathIssue, facts);
+  return null;
+}
+
+// For a lander about to publish a commit it just built: did a check that can
+// fail run on this checkout with the commit's change committed? Returns null
+// when it did, else the unverified verdict saying why not. Nothing is
+// published on a check that cannot back the change.
+function proveCheckBeforePublish(root, { commit = 'HEAD', base, verify = '' } = {}) {
+  const top = toplevel(root);
+  if (!top) return verdict('unverified', 'not_a_git_checkout', `${root} is not a git checkout`);
+  const sha = resolveCommit(top, commit);
+  const baseSha = resolveCommit(top, base);
+  if (!sha || !baseSha) return verdict('unverified', 'commit_missing', 'the commit or its base does not exist here');
+  const diff = gitFixed(top, ['diff', '--name-only', '--no-renames', `${baseSha}..${sha}`]);
+  const changed = diff.ok ? diff.out.split('\n').filter(Boolean) : [];
+  if (!changed.length) return verdict('no_op', 'empty_diff', `${sha.slice(0, 9)} carries no change past ${baseSha.slice(0, 9)}`);
+  return checkVerdict(top, fs.realpathSync(root), { sha, baseSha, changed, verify, checkedWorkingTree: true }, { commit: sha, base: baseSha });
+}
+
+// root: where the check ran. commit: the work's own commit. start: the
+// commit the work began from, when recorded. base: an explicit base (the
+// green lander knows the target it merged onto). files: what the work claims
+// to change. verify: the check command. checkedWorkingTree: the check ran in
+// root's working tree, so that tree must hold the work, committed.
+function proveLanding(root, { commit = 'HEAD', start = '', base = '', target = '', files = [], verify = '', checkedWorkingTree = false, localTargetOk = false } = {}) {
+  const top = toplevel(root);
+  if (!top) return verdict('unverified', 'not_a_git_checkout', `${root} is not a git checkout`);
+  // git reports the resolved path (/private/var on macOS); compare like with like.
+  const cwd = fs.realpathSync(root);
+  const sha = resolveCommit(top, commit);
+  if (!sha) return verdict('unverified', 'commit_missing', `commit ${commit} does not exist here`);
+  if (String(target || '').trim().startsWith('refs/heads/') && !localTargetOk) {
+    return verdict('unverified', 'local_target', `${target} is a local branch; only origin's copy shows the work landed where others can see it`, { commit: sha });
+  }
+  const targetRef = resolveTarget(top, target, { localTargetOk });
+  if (!targetRef) {
+    return verdict('unverified', 'no_remote_target', `no fetched origin branch${target ? ` for ${target}` : ''} to prove the landing against`, { commit: sha });
+  }
+  const targetSha = resolveCommit(top, targetRef);
+  const facts = { commit: sha, target: targetRef };
+
+  const startSha = start ? resolveCommit(top, start) : null;
+  let baseSha = base ? resolveCommit(top, base) : null;
+  if (!baseSha && startSha && isAncestor(top, startSha, sha)) baseSha = startSha;
+  if (!baseSha) {
+    const forked = gitFixed(top, ['merge-base', sha, targetSha]);
+    baseSha = forked.ok && forked.out && forked.out !== sha ? forked.out : null;
+  }
+  if (!baseSha) {
+    const merged = baseFromMerge(top, sha, targetSha);
+    if (!merged.base) {
+      return verdict('unverified', 'no_base', `${merged.reason}, so its own change cannot be measured`, facts);
+    }
+    baseSha = merged.base;
+    facts.base_from = `merge ${merged.merge}`;
+  }
+  // No rename folding: a rename is a delete plus an add, and both must land.
+  const diff = gitFixed(top, ['diff', '--name-only', '--no-renames', `${baseSha}..${sha}`]);
+  const changed = diff.ok ? diff.out.split('\n').filter(Boolean) : [];
+  if (changed.length === 0 || isAncestor(top, sha, baseSha)) {
+    return verdict('no_op', 'empty_diff', `${sha.slice(0, 9)} carries no change past ${baseSha.slice(0, 9)}`, { ...facts, base: baseSha });
+  }
+  Object.assign(facts, { base: baseSha, changed_files: changed.slice(0, 50) });
+
+  // Ancestry only says the target once carried the commit. What counts is
+  // what the target holds now, so every changed file is judged either way.
+  const onTarget = isAncestor(top, sha, targetSha);
+  if (!onTarget) facts.matched_by = 'content';
+  const judged = { landed: [], reverted: [], edited_since: [], missing: [] };
+  for (const file of changed) judged[judgeFile(top, baseSha, sha, targetSha, file, onTarget)].push(file);
+  if (judged.missing.length) {
+    return verdict('not_landed', 'content_not_on_target', `${targetRef} does not hold this work's version of ${judged.missing.slice(0, 5).join(', ')}`, facts);
+  }
+  if (judged.reverted.length) {
+    return verdict('not_landed', 'reverted', `${targetRef} carried this work, then went back to the old ${judged.reverted.slice(0, 5).join(', ')}`, { ...facts, reverted_files: judged.reverted.slice(0, 50) });
+  }
+  if (judged.edited_since.length) facts.edited_since = judged.edited_since.slice(0, 50);
+
+  const claimed = trackableClaims(top, cwd, sha, changed, files);
+  const untouched = claimed.filter((file) => !changed.some((c) => c === file || c.startsWith(`${file}/`)));
+  if (untouched.length) {
+    return verdict('unverified', 'claimed_files_untouched', `the change does not touch ${untouched.slice(0, 5).join(', ')}`, facts);
+  }
+
+  const unbacked = checkVerdict(top, cwd, { sha, baseSha, changed, claimed, verify, checkedWorkingTree }, facts);
+  if (unbacked) return unbacked;
+  if (facts.edited_since) {
+    return verdict('landed', 'edited_since', `landed, edited since: ${facts.edited_since.slice(0, 5).join(', ')}`, facts);
+  }
+  return verdict('landed', 'proven', '', facts);
+}
+
+// A task proves its landing from its own commits: start_commit is stamped
+// at claim, work_commit when the builder marks it ready. With no commit of
+// its own there is nothing to prove, whatever the checkout's HEAD says.
+// verify: the check that actually ran (the verifier's cached run or the
+// proof's named check). metadata.verify is the builder's claim and is only
+// the fallback.
+function proveTaskLanding(task, { files = [], verify = '' } = {}) {
+  const metadata = task.metadata || {};
+  const work = String(metadata.work_commit || '').trim();
+  const start = String(metadata.start_commit || '').trim();
+  if (!work) {
+    return verdict('unverified', 'no_task_commit', 'the task recorded no commit of its own, so nothing can be proven landed');
+  }
+  if (start && work === start) {
+    return verdict('no_op', 'no_commit_made', 'the task finished on the same commit it started from', { commit: work });
+  }
+  return proveLanding(task.workspace_root || process.cwd(), {
+    commit: work,
+    start,
+    target: metadata.target_branch || metadata.base_ref || '',
+    files,
+    verify: String(verify || '').trim() || metadata.verify,
+    checkedWorkingTree: true,
+  });
+}
+
+module.exports = {
+  proveCheckBeforePublish,
+  proveLanding,
+  proveTaskLanding,
+};