bazilion 0.17.0 → 0.18.0

package/dist/web/server/assets/verifications-CUq_6ZqL.js

@@ -0,0 +1,26 @@
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
+import { createFileRoute, lazyRouteComponent, redirect } from "@tanstack/react-router";
+//#region src/lib/verification.ts
+var fetchTeamVerifications = createServerFn({ method: "POST" }).validator((input) => input).handler(createSsrRpc("2a72cbadf7e2fa943de062817aed454cd746f9ab8b95fce78f94d327756363b1"));
+/**
+* One request's detail, including current applicability. Kept separate from the list because
+* establishing applicability compares the live tree against the capture.
+*/
+var fetchVerification = createServerFn({ method: "POST" }).validator((input) => input).handler(createSsrRpc("9160671c06186ff835338f053559f4fad74360808e5cdb399e45c3a198f57f59"));
+var createVerification = createServerFn({ method: "POST" }).validator((input) => input).handler(createSsrRpc("74977c4474f1c4e67bbd844d3c182cb5ceeda6e70b71cda2ad0ba046bb53e67a"));
+var cancelVerification = createServerFn({ method: "POST" }).validator((input) => input).handler(createSsrRpc("8f81bc274b3fa565cdb912454629cacae4686a46b7e672331432b113484722c3"));
+//#endregion
+//#region src/routes/teams/$id/verifications.tsx
+var $$splitComponentImporter = () => import("./verifications-BfQsfwSE.js");
+var Route = createFileRoute("/teams/$id/verifications")({
+	loader: async ({ params }) => {
+		const data = await fetchTeamVerifications({ data: { id: params.id } });
+		if (!data) throw redirect({ to: "/teams" });
+		return data;
+	},
+	component: lazyRouteComponent($$splitComponentImporter, "component")
+});
+/** Three-valued and never a badge: "changed" proves the source moved, not that it was relevant. */
+//#endregion
+export { fetchVerification as a, fetchTeamVerifications as i, cancelVerification as n, createVerification as r, Route as t };

package/dist/web/server/server.js

@@ -3558,7 +3558,7 @@ var defaultSerovalPlugins = [
 * the dev styles URL for route-scoped CSS collection.
 */
 async function getStartManifest(matchedRoutes) {
-	const { tsrStartManifest } = await import("./assets/_tanstack-start-manifest_v-vOXRfKJD.js");
+	const { tsrStartManifest } = await import("./assets/_tanstack-start-manifest_v-B3M-dfRO.js");
 	const startManifest = tsrStartManifest();
 	let routes = startManifest.routes;
 	routes[rootRouteId];
@@ -3582,135 +3582,151 @@ async function getStartManifest(matchedRoutes) {
 var manifest = {
 	"00a157dd07824e1f126f06646effd1d876f280f6fc64c144d2f6429414a4e58a": {
 		functionName: "fetchTelegramConfig_createServerFn_handler",
-		importer: () => import("./assets/telegram-4kMxRtVZ.js")
+		importer: () => import("./assets/telegram-CGl_LFtJ.js")
 	},
 	"02c73d4452ed9650535784fb09231e39498bb4cb53c19ff2285bc964ee104fc4": {
 		functionName: "prepareReviewFeedback_createServerFn_handler",
-		importer: () => import("./assets/git-review-f_uta4Mx.js")
+		importer: () => import("./assets/git-review-Bf5ABFJg.js")
 	},
 	"032d74b7d41c718191dbdde6b06ba44993340ce1154af1fa6723a6d4f7a7236e": {
 		functionName: "fetchProfile_createServerFn_handler",
-		importer: () => import("./assets/_id-XkxlX036.js")
+		importer: () => import("./assets/_id--zoh1vv7.js")
 	},
 	"0a6e766d2b4ea526da34cefed5342a6ecc5ff35ad1ce38fba4129b8c24d8e6e5": {
 		functionName: "fetchMembers_createServerFn_handler",
-		importer: () => import("./assets/members-C2He8mrU.js")
+		importer: () => import("./assets/members-CvwEN9pm.js")
 	},
 	"1ab05a58944792f34ad279deeaa56f70e9360687856b18327f335b022e8d21a5": {
 		functionName: "fetchTeamsData_createServerFn_handler",
-		importer: () => import("./assets/teams--a956vWL.js")
+		importer: () => import("./assets/teams-D-yaAWLV.js")
 	},
 	"1bb12262aaa902fa208aafaa70b69c63da34c1fe523ab0322fe766903fc6b4c1": {
 		functionName: "fetchTeams_createServerFn_handler",
-		importer: () => import("./assets/teams-BbRfuVXY.js")
+		importer: () => import("./assets/teams-8zEIo08E.js")
 	},
 	"26dbbcbe40063e8aedfd343cf1dfd4dfe5589f24591c0ba35e80c611d7c57c7c": {
 		functionName: "fetchHomeData_createServerFn_handler",
-		importer: () => import("./assets/routes-BgMvLvS-.js")
+		importer: () => import("./assets/routes-CVKkvFVv.js")
 	},
 	"278849457893891c3d22806d15e11a0a42cc3630b30e9e62b74cf2d3b982ded7": {
 		functionName: "fetchServers_createServerFn_handler",
-		importer: () => import("./assets/mcp-DCBDmNtQ.js")
+		importer: () => import("./assets/mcp-D5dmBT82.js")
+	},
+	"2a72cbadf7e2fa943de062817aed454cd746f9ab8b95fce78f94d327756363b1": {
+		functionName: "fetchTeamVerifications_createServerFn_handler",
+		importer: () => import("./assets/verification-B5QjcpIo.js")
 	},
 	"2cd8c6ec40e2e2d9518b5f127a518ecd83a2222d85665cc61d5144bcf59ed4fb": {
 		functionName: "fetchInbox_createServerFn_handler",
-		importer: () => import("./assets/inbox-BBZiOOQs.js")
+		importer: () => import("./assets/inbox-Dw4pTevh.js")
 	},
 	"46e35c9f1afc79423cb49703b454ef684344db08ec19775efd70a8768c7837f1": {
 		functionName: "fetchTokens_createServerFn_handler",
-		importer: () => import("./assets/tokens-BYwTN9JZ.js")
+		importer: () => import("./assets/tokens-cB-uf7qm.js")
 	},
 	"4773184b3ddd3656fb80ec74375a6d304e25acb56b79f1d349dcabf9f0914359": {
 		functionName: "fetchGroup_createServerFn_handler",
-		importer: () => import("./assets/_id-Dw3gKOGv.js")
+		importer: () => import("./assets/_id-6p-mDmI8.js")
 	},
 	"57ebf437fdb3fcfc63b176e796a55f04bdfec0b230059673196e98d413d15c4d": {
 		functionName: "fetchTriggers_createServerFn_handler",
-		importer: () => import("./assets/triggers-BM6mzLuH.js")
+		importer: () => import("./assets/triggers-CtSj79L0.js")
 	},
 	"5cdb81f2b930818ee9ab1d626ac99828ea652ff447fcbfc21b24dea415f8b39e": {
 		functionName: "fetchActivity_createServerFn_handler",
-		importer: () => import("./assets/activity-pYQPT3QT.js")
+		importer: () => import("./assets/activity-C5jpoEQI.js")
 	},
 	"6650438083b26964e4d4f7bf27caa6fe94c74a008e5b37a4d609180a9bf98b59": {
 		functionName: "fetchTeam_createServerFn_handler",
-		importer: () => import("./assets/results-C6H42tjq.js")
+		importer: () => import("./assets/results-BWnu3gXP.js")
 	},
 	"6afd81bef0ee381d6e3641cd8e269968429c874e2f9d56c8f818cc9d180ee477": {
 		functionName: "fetchServices_createServerFn_handler",
-		importer: () => import("./assets/services-yHZroxsi.js")
+		importer: () => import("./assets/services-CEr61xb5.js")
 	},
 	"6e1e5dbdf3d8a469dbabab94d492969e688abf38413493d78eea220588e1c6c1": {
 		functionName: "fetchFileDiff_createServerFn_handler",
-		importer: () => import("./assets/git-review-f_uta4Mx.js")
+		importer: () => import("./assets/git-review-Bf5ABFJg.js")
 	},
 	"735ff1d3cd2b2c166114532550a784f626afc1b26f9dea3aea17796bc9e08124": {
 		functionName: "captureTeamSnapshot_createServerFn_handler",
-		importer: () => import("./assets/git-review-f_uta4Mx.js")
+		importer: () => import("./assets/git-review-Bf5ABFJg.js")
+	},
+	"74977c4474f1c4e67bbd844d3c182cb5ceeda6e70b71cda2ad0ba046bb53e67a": {
+		functionName: "createVerification_createServerFn_handler",
+		importer: () => import("./assets/verification-B5QjcpIo.js")
 	},
 	"816fcbc7b3c7f2952660d3a2c8f49bb0c91084627a284c185b333b1d418fadf8": {
 		functionName: "loadApprovals_createServerFn_handler",
-		importer: () => import("./assets/approvals-C3ya6B6U.js")
+		importer: () => import("./assets/approvals-DhHxIDrL.js")
 	},
 	"846c9081aed17057351730985f133b0aab67a5dabfca9562552829a90ff30849": {
 		functionName: "fetchAgent_createServerFn_handler",
-		importer: () => import("./assets/_id-CPfILjMa.js")
+		importer: () => import("./assets/_id-DptBl3X8.js")
 	},
 	"883b401299422096ee31ee824f9a24b49d06bdcedce398789778c4c549a92f3a": {
 		functionName: "loadAttention_createServerFn_handler",
-		importer: () => import("./assets/attention-l28hGCHS.js")
+		importer: () => import("./assets/attention-CBWzWRni.js")
+	},
+	"8f81bc274b3fa565cdb912454629cacae4686a46b7e672331432b113484722c3": {
+		functionName: "cancelVerification_createServerFn_handler",
+		importer: () => import("./assets/verification-B5QjcpIo.js")
+	},
+	"9160671c06186ff835338f053559f4fad74360808e5cdb399e45c3a198f57f59": {
+		functionName: "fetchVerification_createServerFn_handler",
+		importer: () => import("./assets/verification-B5QjcpIo.js")
 	},
 	"9a8661a3c685ee418f1fcc86715772f45831c758764baa8a0a5a7e071797b17e": {
 		functionName: "sendReviewFeedback_createServerFn_handler",
-		importer: () => import("./assets/git-review-f_uta4Mx.js")
+		importer: () => import("./assets/git-review-Bf5ABFJg.js")
 	},
 	"a0bbbee5d0c1240a05e35c04d56a0e95ec78f05265e4e937eec48c8ac2041e58": {
 		functionName: "fetchTeam_createServerFn_handler",
-		importer: () => import("./assets/_id-DSPFJMzf.js")
+		importer: () => import("./assets/_id-dUnXL-My2.js")
 	},
 	"a5d3825fc69573bb55bab6df578c750ebb0240dd394c3acee3adea02918a5dc2": {
 		functionName: "fetchAuthState_createServerFn_handler",
-		importer: () => import("./assets/auth-AvDFNeOv.js")
+		importer: () => import("./assets/auth-tB3i6cFd.js")
 	},
 	"aafdc541f3ce0218b08e13928281a9422b3917d8bcedc687e73a9fec2984124c": {
 		functionName: "fetchTeamSnapshot_createServerFn_handler",
-		importer: () => import("./assets/git-review-f_uta4Mx.js")
+		importer: () => import("./assets/git-review-Bf5ABFJg.js")
 	},
 	"abd437df3a2fa92f958ae178941f5c068556ee48f7236d50b56e400013023cf9": {
 		functionName: "fetchSnapshotApplicability_createServerFn_handler",
-		importer: () => import("./assets/git-review-f_uta4Mx.js")
+		importer: () => import("./assets/git-review-Bf5ABFJg.js")
 	},
 	"ae1d30575b229c1e2622fbaf2252800a9a7acc84afdd68cba025ca890b8d52c5": {
 		functionName: "fetchSkills_createServerFn_handler",
-		importer: () => import("./assets/skills--bIKID1Q.js")
+		importer: () => import("./assets/skills-BImC3LTO.js")
 	},
 	"b18a227687dba45b99ea5a2ac7a5bf8efcd9bc54387bc279cd87510fd2f83f7e": {
 		functionName: "fetchProvidersData_createServerFn_handler",
-		importer: () => import("./assets/config-BWKn4XII.js")
+		importer: () => import("./assets/config-D1k_tTAw.js")
 	},
 	"b96a98e3ed6c8a3ab5f6a4ed8458e93da753ffd74e2912ef1724bb6e58030cb5": {
 		functionName: "fetchMemory_createServerFn_handler",
-		importer: () => import("./assets/memory-rmiFNj7T.js")
+		importer: () => import("./assets/memory-CcPK7um7.js")
 	},
 	"bb4ccf9a1b372d6a1a53bd79690c50e3e1af2e641a96eead1f906da580df8656": {
 		functionName: "fetchTeamReview_createServerFn_handler",
-		importer: () => import("./assets/git-review-f_uta4Mx.js")
+		importer: () => import("./assets/git-review-Bf5ABFJg.js")
 	},
 	"bc31355f2be9889a616d03c35062d483ea77c3f967af9432d721626a81078ef3": {
 		functionName: "fetchProfiles_createServerFn_handler",
-		importer: () => import("./assets/agents-BKBfW700.js")
+		importer: () => import("./assets/agents-RE6aYOb-.js")
 	},
 	"f715bab0037380aa3db7e237e7cf1e74168c363f48a960bb1ddfa5560de3a74e": {
 		functionName: "fetchAgents_createServerFn_handler",
-		importer: () => import("./assets/agents-CVCfxnE2.js")
+		importer: () => import("./assets/agents-nAOx_H7s.js")
 	},
 	"fc940d6dec5305aa64bdb9b9f5f7d4f925b2ba0608cb6d39af854a94872fc867": {
 		functionName: "fetchPolicy_createServerFn_handler",
-		importer: () => import("./assets/policy-DS7LGe--.js")
+		importer: () => import("./assets/policy-Dh6wd2wN.js")
 	},
 	"fcdd0f08b635c7c501caa840d01d1376ace6683e26cc5ac7dead28d7870f98b9": {
 		functionName: "fetchLearning_createServerFn_handler",
-		importer: () => import("./assets/learning-CheVay1i.js")
+		importer: () => import("./assets/learning-CF8ZzFVD.js")
 	}
 };
 async function getServerFnById(id, access) {
@@ -5588,7 +5604,7 @@ var getBaseManifest = getProdBaseManifest;
 var createEarlyHintsForRequest = createEarlyHintsCollector;
 async function loadEntries() {
 	const [routerEntry, startEntry, pluginAdapters] = await Promise.all([
-		import("./assets/router-ElARvZzI.js"),
+		import("./assets/router-Deq94UJQ.js"),
 		import("./assets/start-D4Wq9iTa.js"),
 		import("./assets/empty-plugin-adapters-Cq4--YW-.js")
 	]);

package/dist/worker.js

@@ -4046,6 +4046,16 @@ var PROTECTED_REQUIRED_KEYS = new Set(
     (key) => key !== "images" && key !== "questionEnabled" && key !== "containerNamespace"
   )
 );
+var VERIFICATION_KEYS = /* @__PURE__ */ new Set([
+  "kind",
+  "agentId",
+  "message",
+  "turnId",
+  "runtime",
+  "verification",
+  "apiKeyRefreshEnabled",
+  "scratch"
+]);
 var REVIEW_KEYS = /* @__PURE__ */ new Set([
   "kind",
   "agentId",
@@ -4169,6 +4179,27 @@ function parseWorkerInput(value) {
     assertMinimalWorkerScratch(input.scratch);
     return value;
   }
+  if (kind === "specialist_verification") {
+    assertExactKeys(input, VERIFICATION_KEYS, "verification worker input", VERIFICATION_KEYS);
+    requireString(input.agentId, "agentId");
+    requireString(input.message, "message");
+    requireString(input.turnId, "turnId");
+    assertProtectedProviderRuntime(input.runtime);
+    if (input.apiKeyRefreshEnabled !== true) {
+      throw new Error("worker: verification input requires bound API key refresh");
+    }
+    assertMinimalWorkerScratch(input.scratch);
+    const verification = objectRecord(input.verification, "verification metadata");
+    assertExactKeys(
+      verification,
+      /* @__PURE__ */ new Set(["requestId", "attemptId"]),
+      "verification metadata",
+      /* @__PURE__ */ new Set(["requestId", "attemptId"])
+    );
+    requireString(verification.requestId, "requestId");
+    requireString(verification.attemptId, "attemptId");
+    return value;
+  }
   if (kind === "restricted_review") {
     assertExactKeys(input, REVIEW_KEYS, "restricted review worker input", REVIEW_KEYS);
     requireString(input.agentId, "agentId");
@@ -6576,6 +6607,111 @@ function explicitConversationFile(directory, target) {
   return file;
 }
 
+// ../daemon/src/runtime/tools/verification.ts
+var VerificationCapabilityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "VerificationCapabilityError";
+  }
+};
+function verificationTools(host) {
+  const attempted = /* @__PURE__ */ new Set();
+  const request = {
+    def: {
+      name: "verification_request",
+      description: "Read the captured verification request: the exact change under verification, the environment the checks were admitted into, and every declared check with its timeout and any outcome so far. A check you were not asked to run cannot be added here \u2014 a different or additional command needs a new request.",
+      parameters: { type: "object", properties: {}, additionalProperties: false }
+    },
+    async invoke() {
+      return renderBrief(await host.read());
+    }
+  };
+  const check = {
+    def: {
+      name: "verification_check",
+      description: "Invoke exactly one declared check, identified by its ordinal from verification_request. Each check runs at most once: a check that already reported its outcome cannot be run again, and you cannot change its command, cwd, timeout or environment. Report what actually happened, including failures, skips and blockers. A successful exit is evidence about the commands that ran, never proof about later code.",
+      parameters: {
+        type: "object",
+        properties: {
+          ordinal: {
+            type: "integer",
+            minimum: 0,
+            description: "Ordinal of a declared check, as listed by verification_request."
+          }
+        },
+        required: ["ordinal"],
+        additionalProperties: false
+      }
+    },
+    async invoke(args, context) {
+      const ordinal = readOrdinal(args);
+      const brief = await host.read();
+      const declared = brief.checks.find((entry) => entry.ordinal === ordinal);
+      if (!declared) {
+        throw new VerificationCapabilityError(
+          `check ${ordinal} was not captured with this request; only ${brief.checks.map((entry) => entry.ordinal).join(", ")} exist`
+        );
+      }
+      if (declared.state !== "not_executed") {
+        throw new VerificationCapabilityError(
+          `check ${ordinal} already reported '${declared.state}' and cannot be run again`
+        );
+      }
+      if (attempted.has(ordinal)) {
+        throw new VerificationCapabilityError(`check ${ordinal} is already running`);
+      }
+      attempted.add(ordinal);
+      try {
+        const run = await host.invoke(ordinal, { toolCallId: context?.toolCallId ?? "" });
+        return renderRun(run);
+      } catch (error) {
+        attempted.delete(ordinal);
+        throw error;
+      }
+    }
+  };
+  return [request, check];
+}
+function readOrdinal(args) {
+  const keys2 = Object.keys(args).sort();
+  if (keys2.length !== 1 || keys2[0] !== "ordinal") {
+    throw new VerificationCapabilityError("verification_check takes only a declared ordinal");
+  }
+  const ordinal = args.ordinal;
+  if (!Number.isInteger(ordinal) || ordinal < 0) {
+    throw new VerificationCapabilityError("ordinal must be a non-negative integer");
+  }
+  return ordinal;
+}
+function renderBrief(brief) {
+  const lines = [
+    `Verification request ${brief.requestId}`,
+    `Change: snapshot ${brief.snapshot.id} (base ${brief.snapshot.baseOid.slice(0, 12)}${brief.snapshot.complete ? "" : ", INCOMPLETE COVERAGE"})`,
+    `Environment: image ${brief.environment.image}, shell ${brief.environment.sandbox}${brief.environment.cwd ? `, cwd ${brief.environment.cwd}` : ""}`,
+    `Applicability: ${brief.applicability === "identical" ? "unchanged since capture" : brief.applicability}`
+  ];
+  if (brief.summary) lines.push(`Requested by the requester: ${brief.summary}`);
+  if (brief.writablePaths.length > 0) {
+    lines.push(
+      `Declared generated-output paths (where a check is expected to write; this does not confine writes): ${brief.writablePaths.join(", ")}`
+    );
+  }
+  lines.push("", "Captured checks:");
+  for (const entry of brief.checks) {
+    const outcome = entry.state === "not_executed" ? "not run yet" : `${entry.state}${entry.exitCode === null ? "" : ` (exit ${entry.exitCode})`}${entry.commandId ? ` receipt ${entry.commandId}` : ""}`;
+    lines.push(
+      `  [${entry.ordinal}] ${entry.command} (cwd ${entry.cwd}, ${entry.timeoutMs} ms, ${entry.purpose}) \u2014 ${outcome}`
+    );
+  }
+  lines.push("", "Run each captured check with verification_check. Report failures as failures.");
+  return lines.join("\n");
+}
+function renderRun(run) {
+  const head = `Check ${run.ordinal}: ${run.state}${run.exitCode === null ? "" : ` (exit ${run.exitCode})`}${run.commandId ? ` \u2014 receipt ${run.commandId}` : ""}${run.truncated ? " [output truncated]" : ""}`;
+  return run.output.trim() ? `${head}
+${run.output}` : head;
+}
+
 // ../daemon/src/runtime/worker/api-key-refresh.ts
 function createIpcApiKeyRefresher(call, context) {
   return async (providerName) => {
@@ -6799,8 +6935,16 @@ function createReviewState(evidenceItems) {
     tools
   };
 }
+function createIpcVerificationHost(ipcCall, identity2) {
+  return {
+    // The request identity is bound here from the worker's own input, so a tool call cannot address
+    // another request's attempt: only an ordinal travels.
+    read: () => ipcCall("verificationRead", identity2),
+    invoke: (ordinal) => ipcCall("verificationRun", { ...identity2, ordinal })
+  };
+}
 async function createSessionForInput(input, ipcCall) {
-  if (input.kind !== "restricted_review" && !input.repositoryContext)
+  if (input.kind !== "restricted_review" && input.kind !== "specialist_verification" && !input.repositoryContext)
     throw new Error("Coding turn requires daemon-prepared repository context");
   if (input.kind === "configured_operator_http") {
     const paths = resolvePaths();
@@ -6858,6 +7002,18 @@ async function createSessionForInput(input, ipcCall) {
     agentId: input.kind === "protected" ? input.agent.agent.id : input.agentId,
     turnId: input.turnId
   });
+  if (input.kind === "specialist_verification") {
+    const handle2 = await createRestrictedReviewSession({
+      runtime: input.runtime,
+      scratch: input.scratch,
+      systemPrompt: VERIFICATION_SYSTEM_PROMPT,
+      tools: verificationTools(createIpcVerificationHost(ipcCall, input.verification)).map(
+        ourToolToPiTool
+      ),
+      refreshApiKey
+    });
+    return { handle: handle2 };
+  }
   if (input.kind === "restricted_review") {
     const reviewState = createReviewState(input.review.evidence);
     const handle2 = await createRestrictedReviewSession({
@@ -6934,7 +7090,7 @@ async function main() {
   session = handle.session;
   const consumptionAcks = /* @__PURE__ */ new Set();
   const unsubscribe = session.subscribe((piEvent) => {
-    if (input.kind !== "restricted_review" && input.questionEnabled && piEvent.type === "message_end" && piEvent.message.role === "toolResult" && piEvent.message.toolName === "ask_user" && !piEvent.message.isError) {
+    if (input.kind !== "restricted_review" && input.kind !== "specialist_verification" && input.questionEnabled && piEvent.type === "message_end" && piEvent.message.role === "toolResult" && piEvent.message.toolName === "ask_user" && !piEvent.message.isError) {
       const message = piEvent.message;
       const content = message.content[0];
       if (content?.type === "text") {
@@ -6964,8 +7120,8 @@ async function main() {
   });
   try {
     const promptMessage = redactJsonValue(input.message, activeAccessTokens);
-    const sanitizedImages = input.kind === "restricted_review" ? [] : redactJsonValue(input.images ?? [], activeAccessTokens);
-    const promptImages = input.kind === "restricted_review" ? [] : sanitizedImages.map((image) => ({
+    const sanitizedImages = input.kind === "restricted_review" || input.kind === "specialist_verification" ? [] : redactJsonValue(input.images ?? [], activeAccessTokens);
+    const promptImages = input.kind === "restricted_review" || input.kind === "specialist_verification" ? [] : sanitizedImages.map((image) => ({
       type: "image",
       data: image.data,
       mimeType: image.mimeType
@@ -7008,6 +7164,24 @@ main().catch((error) => {
   }
   process.exit(1);
 });
+var VERIFICATION_SYSTEM_PROMPT = `You are a restricted verification specialist. You verify one
+captured change against the checks your requester selected. Call verification_request to read the
+request, then verification_check once per declared check, in order.
+
+Boundaries you cannot cross, and must not try to:
+- Only the declared ordinal of a captured check can run, once. You cannot change its command, cwd,
+  timeout or environment, add a check, or retry a check that already reported.
+- You have no shell, no editor, no browser, no network tool and no deployment credential. A missing
+  toolchain, service or approval is an explicit blocker to report, never something to work around.
+- Generated output may only be written to the declared writable paths.
+
+Report what actually happened. A non-zero exit is a failure of that check; say so plainly. An exit
+code is evidence about the commands that ran, never proof about later code, and never a statement
+that the change is ready to merge. Distinguish a failure from a check you did not run, and never
+describe an unrun check as passing.
+
+Finish with a short summary: the snapshot you verified, each check with its outcome and receipt, and
+any blocker or limitation that stopped a check. Do not recommend deployment.`;
 var REVIEW_SYSTEM_PROMPT = `You are a restricted learning reviewer. Analyze only the supplied
 transcript digest and approved-lesson index. You cannot act on the world. Call propose_lesson once
 with zero to five proposals, then stop.