bazilion 0.17.0 → 0.18.0

package/dist/daemon.js

@@ -21833,6 +21833,7 @@ __export(communicationApprovals_exports, {
   get: () => get9,
   getByAttempt: () => getByAttempt,
   grantSchedulerTrigger: () => grantSchedulerTrigger,
+  grantVerificationRequest: () => grantVerificationRequest,
   list: () => list6,
   request: () => request
 });
@@ -22093,6 +22094,29 @@ function claimDelivery(db, id, actor, revalidate, now = Date.now()) {
   return outcome.detail;
 }
 function grantSchedulerTrigger(db, id, actor, revalidate, validateDelivery, now = Date.now()) {
+  return grantDurableApproval(
+    db,
+    id,
+    actor,
+    { operation: "scheduler_trigger", payloadKind: "scheduler_trigger" },
+    revalidate,
+    validateDelivery,
+    now
+  );
+}
+function grantVerificationRequest(db, id, actor, revalidate, validateDelivery, onGranted, now = Date.now()) {
+  return grantDurableApproval(
+    db,
+    id,
+    actor,
+    { operation: "request_verification", payloadKind: "verification_request" },
+    revalidate,
+    validateDelivery,
+    now,
+    onGranted
+  );
+}
+function grantDurableApproval(db, id, actor, expected, revalidate, validateDelivery, now, onGranted) {
   expirePending(db, now);
   return db.raw.transaction(() => {
     const current = raw(db, id);
@@ -22100,8 +22124,10 @@ function grantSchedulerTrigger(db, id, actor, revalidate, validateDelivery, now
     const detail3 = detailFromRow(db, current);
     if (detail3.status !== "pending")
       throw new Error(`approval_state_conflict: current ${detail3.status}`);
-    if (detail3.operation !== "scheduler_trigger" || detail3.payloadKind !== "scheduler_trigger") {
-      throw new Error("approval_payload_conflict: not a scheduler trigger approval");
+    if (detail3.operation !== expected.operation || detail3.payloadKind !== expected.payloadKind) {
+      throw new Error(
+        `approval_payload_conflict: not a ${expected.operation}/${expected.payloadKind} approval`
+      );
     }
     const authorization = revalidate(detail3);
     const refsMatch = JSON.stringify(authorization.policyRefs) === JSON.stringify(detail3.policyRefs) && JSON.stringify(authorization.requiredEdgeIds) === JSON.stringify(detail3.requiredEdgeIds);
@@ -22154,6 +22180,7 @@ function grantSchedulerTrigger(db, id, actor, revalidate, validateDelivery, now
       [now, actor, now, id]
     ).changes;
     if (changed !== 1) throw new Error("approval_state_conflict: concurrent approval");
+    onGranted?.(detail3);
     appendEvent(db, id, "approved", actor, null, now);
     appendEvent(db, id, "delivery_started", actor, null, now);
     appendEvent(db, id, "delivered", actor, null, now);
@@ -25957,6 +25984,356 @@ function approvalReference(db, agentId, id) {
   return { agentId, itemId: id, inputDigest: row.input_digest };
 }
 
+// ../daemon/src/core/repos/verification-requests.ts
+import { randomUUID as randomUUID21 } from "crypto";
+var VERIFICATION_REQUEST_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var VERIFICATION_MAX_CHECKS = 8;
+var VERIFICATION_LIMITS = {
+  command: 2e3,
+  cwd: 1e3,
+  purpose: 500,
+  summary: 2e3,
+  error: 2e3,
+  minTimeoutMs: 1e3,
+  maxTimeoutMs: 3e5
+};
+var VERIFICATION_TERMINAL_REQUEST_STATES = [
+  "completed",
+  "failed",
+  "cancelled",
+  "uncertain"
+];
+var REQUEST_COLUMNS = "id, team_id, requester_kind, requester_agent_id, recipient_agent_id, message_id, source_session_id, snapshot_id, snapshot_complete, head, base_oid, environment_json, summary, state, created_at, expires_at";
+var CHECK_COLUMNS = "request_id, ordinal, command, cwd, purpose, timeout_ms";
+var OUTCOME_COLUMNS = "attempt_id, ordinal, state, command_id, exit_code, started_at, finished_at";
+var ATTEMPT_COLUMNS = "id, request_id, attempt_number, supersedes_attempt_id, state, lease_owner, lease_expires_at, started_at, finished_at, error, created_at";
+function toRequest(row) {
+  return {
+    id: row.id,
+    teamId: row.team_id,
+    requesterKind: row.requester_kind === "agent" ? "agent" : "operator",
+    requesterAgentId: row.requester_agent_id,
+    recipientAgentId: row.recipient_agent_id,
+    messageId: row.message_id,
+    sourceSessionId: row.source_session_id,
+    snapshotId: row.snapshot_id,
+    snapshotComplete: row.snapshot_complete === 1,
+    head: row.head,
+    baseOid: row.base_oid,
+    environment: JSON.parse(row.environment_json),
+    summary: row.summary,
+    state: row.state,
+    createdAt: row.created_at,
+    expiresAt: row.expires_at
+  };
+}
+function toCheck(row) {
+  return {
+    requestId: row.request_id,
+    ordinal: row.ordinal,
+    command: row.command,
+    cwd: row.cwd,
+    purpose: row.purpose,
+    timeoutMs: row.timeout_ms
+  };
+}
+function toOutcome(row) {
+  return {
+    attemptId: row.attempt_id,
+    ordinal: row.ordinal,
+    state: row.state,
+    commandId: row.command_id,
+    exitCode: row.exit_code,
+    startedAt: row.started_at,
+    finishedAt: row.finished_at
+  };
+}
+function toAttempt(row) {
+  return {
+    id: row.id,
+    requestId: row.request_id,
+    attemptNumber: row.attempt_number,
+    supersedesAttemptId: row.supersedes_attempt_id,
+    state: row.state,
+    leaseOwner: row.lease_owner,
+    leaseExpiresAt: row.lease_expires_at,
+    startedAt: row.started_at,
+    finishedAt: row.finished_at,
+    error: row.error,
+    createdAt: row.created_at
+  };
+}
+var VerificationRequestError = class extends Error {
+  status = 400;
+};
+function createVerificationRequest(db, input) {
+  const now = input.now ?? Date.now();
+  const id = input.id ?? randomUUID21();
+  if (input.checks.length < 1)
+    throw new VerificationRequestError("a request needs at least one check");
+  if (input.checks.length > VERIFICATION_MAX_CHECKS) {
+    throw new VerificationRequestError(
+      `a request captures at most ${VERIFICATION_MAX_CHECKS} checks`
+    );
+  }
+  for (const check of input.checks) validateCheck(check);
+  validateEnvironment(input.environment);
+  if (input.summary != null) {
+    if (!input.summary.trim()) throw new VerificationRequestError("a summary must not be empty");
+    assertLength(input.summary, VERIFICATION_LIMITS.summary, "summary");
+  }
+  if (!input.snapshotId)
+    throw new VerificationRequestError("a request requires a captured snapshot");
+  if (!input.baseOid) throw new VerificationRequestError("a request requires a captured base");
+  if (input.requesterKind === "agent") {
+    if (!input.requesterAgentId)
+      throw new VerificationRequestError("an Agent request names its requester");
+    if (input.requesterAgentId === input.recipientAgentId) {
+      throw new VerificationRequestError("a specialist cannot verify its own request");
+    }
+  } else if (input.requesterAgentId) {
+    throw new VerificationRequestError("an operator request has no requester Agent");
+  }
+  return inTx(db, () => {
+    db.raw.run(
+      `INSERT INTO verification_requests (${REQUEST_COLUMNS})
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)`,
+      [
+        id,
+        input.teamId,
+        input.requesterKind,
+        input.requesterAgentId,
+        input.recipientAgentId,
+        input.messageId ?? null,
+        input.sourceSessionId ?? null,
+        input.snapshotId,
+        input.snapshotComplete ? 1 : 0,
+        input.head,
+        input.baseOid,
+        JSON.stringify(input.environment),
+        input.summary ?? null,
+        now,
+        now + VERIFICATION_REQUEST_TTL_MS
+      ]
+    );
+    input.checks.forEach((check, ordinal) => {
+      db.raw.run(
+        `INSERT INTO verification_checks (request_id, ordinal, command, cwd, purpose, timeout_ms)
+         VALUES (?, ?, ?, ?, ?, ?)`,
+        [id, ordinal, check.command, check.cwd, check.purpose, check.timeoutMs]
+      );
+    });
+    const request2 = getVerificationRequest(db, input.teamId, id, now);
+    if (!request2) throw new VerificationRequestError("request was not stored");
+    return request2;
+  });
+}
+function getVerificationRequest(db, teamId, id, now = Date.now()) {
+  const row = db.raw.query(
+    `SELECT ${REQUEST_COLUMNS} FROM verification_requests
+       WHERE team_id = ? AND id = ? AND expires_at > ?`
+  ).get(teamId, id, now);
+  return row ? toRequest(row) : null;
+}
+function getVerificationRequestById(db, id, now = Date.now()) {
+  const row = db.raw.query(
+    `SELECT ${REQUEST_COLUMNS} FROM verification_requests WHERE id = ? AND expires_at > ?`
+  ).get(id, now);
+  return row ? toRequest(row) : null;
+}
+function listVerificationRequests(db, teamId, limit = 50, now = Date.now()) {
+  return db.raw.query(
+    `SELECT ${REQUEST_COLUMNS} FROM verification_requests
+       WHERE team_id = ? AND expires_at > ?
+       ORDER BY created_at DESC, id LIMIT ?`
+  ).all(teamId, now, limit).map(toRequest);
+}
+function listVerificationChecks(db, requestId2) {
+  return db.raw.query(
+    `SELECT ${CHECK_COLUMNS} FROM verification_checks WHERE request_id = ? ORDER BY ordinal`
+  ).all(requestId2).map(toCheck);
+}
+function listVerificationCheckOutcomes(db, attemptId) {
+  return db.raw.query(
+    `SELECT ${OUTCOME_COLUMNS} FROM verification_check_outcomes WHERE attempt_id = ?
+       ORDER BY ordinal`
+  ).all(attemptId).map(toOutcome);
+}
+function listVerificationAttempts(db, requestId2) {
+  return db.raw.query(
+    `SELECT ${ATTEMPT_COLUMNS} FROM verification_attempts WHERE request_id = ?
+       ORDER BY attempt_number`
+  ).all(requestId2).map(toAttempt);
+}
+function claimVerificationAttempt(db, input) {
+  const now = input.now ?? Date.now();
+  if (!input.leaseOwner) throw new VerificationRequestError("a claim requires an owner");
+  if (input.leaseMs <= 0) throw new VerificationRequestError("a claim requires a positive lease");
+  return inTx(db, () => {
+    const row = db.raw.query(
+      `SELECT ${REQUEST_COLUMNS} FROM verification_requests WHERE id = ? AND expires_at > ?`
+    ).get(input.requestId, now);
+    if (!row) return null;
+    const request2 = toRequest(row);
+    const terminal = VERIFICATION_TERMINAL_REQUEST_STATES.includes(request2.state);
+    if (!terminal && request2.state !== "pending") return null;
+    if (terminal && !input.rerun) return null;
+    const open = db.raw.query(
+      "SELECT id FROM verification_attempts WHERE request_id = ? AND finished_at IS NULL"
+    ).get(input.requestId);
+    if (open) return null;
+    const previous = db.raw.query(
+      `SELECT id, attempt_number FROM verification_attempts WHERE request_id = ?
+         ORDER BY attempt_number DESC LIMIT 1`
+    ).get(input.requestId);
+    const attemptId = randomUUID21();
+    db.raw.run(
+      `INSERT INTO verification_attempts
+        (id, request_id, attempt_number, supersedes_attempt_id, state, lease_owner,
+         lease_expires_at, created_at)
+       VALUES (?, ?, ?, ?, 'claimed', ?, ?, ?)`,
+      [
+        attemptId,
+        input.requestId,
+        (previous?.attempt_number ?? 0) + 1,
+        previous?.id ?? null,
+        input.leaseOwner,
+        now + input.leaseMs,
+        now
+      ]
+    );
+    db.raw.run(
+      `INSERT INTO verification_check_outcomes (attempt_id, ordinal, state)
+       SELECT ?, ordinal, 'not_executed' FROM verification_checks WHERE request_id = ?`,
+      [attemptId, input.requestId]
+    );
+    setRequestState(db, input.requestId, "running");
+    const attempt = db.raw.query(
+      `SELECT ${ATTEMPT_COLUMNS} FROM verification_attempts WHERE id = ?`
+    ).get(attemptId);
+    if (!attempt) throw new VerificationRequestError("attempt was not stored");
+    return { attempt: toAttempt(attempt), state: "running" };
+  });
+}
+function finishVerificationAttempt(db, input) {
+  const now = input.now ?? Date.now();
+  if (input.error != null) assertLength(input.error, VERIFICATION_LIMITS.error, "error");
+  return inTx(db, () => {
+    const row = db.raw.query(
+      `SELECT ${ATTEMPT_COLUMNS} FROM verification_attempts WHERE id = ? AND lease_owner = ?`
+    ).get(input.attemptId, input.leaseOwner);
+    if (!row) return false;
+    const attempt = toAttempt(row);
+    if (attempt.finishedAt !== null) return false;
+    db.raw.run(
+      `UPDATE verification_attempts
+       SET state = ?, finished_at = ?, lease_owner = NULL, lease_expires_at = NULL, error = ?
+       WHERE id = ?`,
+      [input.state, now, input.error ?? null, input.attemptId]
+    );
+    setRequestState(db, attempt.requestId, input.state === "uncertain" ? "uncertain" : input.state);
+    return true;
+  });
+}
+function setRequestState(db, requestId2, state3) {
+  db.raw.run("UPDATE verification_requests SET state = ? WHERE id = ?", [state3, requestId2]);
+}
+function recordVerificationCheckOutcome(db, input) {
+  if (input.state === "not_executed") {
+    throw new VerificationRequestError("a settled outcome cannot return to not_executed");
+  }
+  const executed = ["succeeded", "failed", "timed_out", "cancelled"].includes(input.state);
+  if (executed && !input.commandId) {
+    throw new VerificationRequestError(`${input.state} requires the receipt that produced it`);
+  }
+  if (!executed && input.commandId) {
+    throw new VerificationRequestError(`${input.state} cannot claim a command receipt`);
+  }
+  if (input.exitCode != null && input.state !== "succeeded" && input.state !== "failed") {
+    throw new VerificationRequestError("only an executed check records an exit code");
+  }
+  const attempt = db.raw.query(
+    "SELECT request_id FROM verification_attempts WHERE id = ?"
+  ).get(input.attemptId);
+  if (!attempt) return false;
+  const result = db.raw.run(
+    `UPDATE verification_check_outcomes
+     SET state = ?, command_id = ?, exit_code = ?, started_at = ?, finished_at = ?
+     WHERE attempt_id = ? AND ordinal = ? AND state = 'not_executed'
+       AND EXISTS (SELECT 1 FROM verification_checks
+                   WHERE request_id = ? AND ordinal = ?)`,
+    [
+      input.state,
+      input.commandId ?? null,
+      input.exitCode ?? null,
+      input.startedAt ?? null,
+      input.finishedAt ?? Date.now(),
+      input.attemptId,
+      input.ordinal,
+      attempt.request_id,
+      input.ordinal
+    ]
+  );
+  return Number(result.changes) === 1;
+}
+function recoverInterruptedVerificationAttempts(db, daemonIdentity, now = Date.now()) {
+  return inTx(db, () => {
+    const rows = db.raw.query(
+      `SELECT id, request_id, lease_owner FROM verification_attempts WHERE finished_at IS NULL`
+    ).all();
+    const recovered = [];
+    for (const row of rows) {
+      if (row.lease_owner === daemonIdentity) continue;
+      db.raw.run(
+        `UPDATE verification_attempts
+         SET state = 'uncertain', finished_at = ?, lease_owner = NULL, lease_expires_at = NULL,
+             error = 'execution was interrupted before it reported an outcome'
+         WHERE id = ?`,
+        [now, row.id]
+      );
+      db.raw.run(
+        `UPDATE verification_check_outcomes SET state = 'unknown', finished_at = ?
+         WHERE attempt_id = ? AND state = 'not_executed'`,
+        [now, row.id]
+      );
+      setRequestState(db, row.request_id, "uncertain");
+      recovered.push(row.request_id);
+    }
+    return recovered;
+  });
+}
+function pruneVerificationRequests(db, now = Date.now()) {
+  const result = db.raw.run("DELETE FROM verification_requests WHERE expires_at <= ?", [now]);
+  return Number(result.changes);
+}
+function validateCheck(check) {
+  if (!check.command.trim()) throw new VerificationRequestError("a check requires a command");
+  assertLength(check.command, VERIFICATION_LIMITS.command, "command");
+  if (check.cwd.length > VERIFICATION_LIMITS.cwd) {
+    throw new VerificationRequestError("cwd is outside its bounded contract");
+  }
+  if (!check.purpose.trim()) throw new VerificationRequestError("a check requires a purpose");
+  assertLength(check.purpose, VERIFICATION_LIMITS.purpose, "purpose");
+  if (!Number.isInteger(check.timeoutMs) || check.timeoutMs < VERIFICATION_LIMITS.minTimeoutMs || check.timeoutMs > VERIFICATION_LIMITS.maxTimeoutMs) {
+    throw new VerificationRequestError("timeout is outside its bounded contract");
+  }
+}
+function validateEnvironment(environment) {
+  if (!environment.image)
+    throw new VerificationRequestError("the admitted environment has no image");
+  if (environment.sandbox !== "off" && environment.sandbox !== "docker") {
+    throw new VerificationRequestError("the admitted environment has an unknown shell backend");
+  }
+  if (environment.env && Object.keys(environment.env).length > 32) {
+    throw new VerificationRequestError("the admitted environment carries too many variables");
+  }
+}
+function assertLength(value, limit, field) {
+  if (Buffer.byteLength(value) > limit) {
+    throw new VerificationRequestError(`${field} is outside its bounded contract`);
+  }
+}
+
 // ../daemon/src/lib/agent-cancel.ts
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("bazilion.agent-cancel.registry");
 var AgentTurnActiveError = class extends Error {
@@ -26054,14 +26431,14 @@ function reconcilePrivateResults(db, options = {}) {
 }
 
 // ../daemon/src/lib/coding-environment/lifecycle.ts
-import { randomUUID as randomUUID24 } from "crypto";
+import { randomUUID as randomUUID25 } from "crypto";
 
 // ../daemon/src/lib/coding-environment/resources.ts
-import { randomUUID as randomUUID22 } from "crypto";
+import { randomUUID as randomUUID23 } from "crypto";
 
 // ../daemon/src/runtime/shell/docker.ts
 import { spawn } from "child_process";
-import { randomUUID as randomUUID21 } from "crypto";
+import { randomUUID as randomUUID22 } from "crypto";
 import { closeSync as closeSync2, constants as constants2, mkdtempSync as mkdtempSync2, openSync as openSync2, rmSync as rmSync9, writeFileSync as writeFileSync6 } from "fs";
 import { access, lstat, realpath, stat } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
@@ -26551,7 +26928,7 @@ function createPreparedDockerBashOperations(runtime, lifecycle) {
       }
       await assertDockerExecutableIdentity(runtime.dockerPath, runtime.executableIdentity);
       if (signal?.aborted) throw new Error("aborted");
-      const containerName = lifecycle?.name("bash") ?? `bazilion-bash-${process.pid}-${randomUUID21().replaceAll("-", "")}`;
+      const containerName = lifecycle?.name("bash") ?? `bazilion-bash-${process.pid}-${randomUUID22().replaceAll("-", "")}`;
       const spec = buildDockerRunSpec({
         image: runtime.image,
         resolvedImage: runtime.imageId,
@@ -26600,7 +26977,7 @@ async function preflightProtectedDockerEngine(input) {
 }
 async function proveProtectedContainerCreation(engine, workspace, readOnlyMounts, lifecycle, signal) {
   if (signal?.aborted) throw new Error("aborted");
-  const containerName = lifecycle?.name("preflight") ?? `bazilion-preflight-${process.pid}-${randomUUID21().replaceAll("-", "")}`;
+  const containerName = lifecycle?.name("preflight") ?? `bazilion-preflight-${process.pid}-${randomUUID22().replaceAll("-", "")}`;
   const dockerClientEnv = { DOCKER_HOST: engine.endpoint };
   const spec = buildDockerRunSpec({
     image: engine.image,
@@ -26932,7 +27309,7 @@ function createDockerBashOperations(options) {
       const dockerClientEnv = await resolveLocalDockerClientEnv(dockerPath, hostEnv);
       const resolvedImage = await inspectSandboxImage(dockerPath, image, dockerClientEnv);
       if (signal?.aborted) throw new Error("aborted");
-      const containerName = options.lifecycle?.name("bash") ?? `bazilion-bash-${process.pid}-${randomUUID21().replaceAll("-", "")}`;
+      const containerName = options.lifecycle?.name("bash") ?? `bazilion-bash-${process.pid}-${randomUUID22().replaceAll("-", "")}`;
       const spec = buildDockerRunSpec({
         image,
         env,
@@ -27588,7 +27965,7 @@ var WorkspaceResources = class {
   }
   register(lease, resource) {
     return inTx(this.db, () => {
-      const id = randomUUID22();
+      const id = randomUUID23();
       lease.attach({ id, kind: resource.kind });
       this.db.raw.run(
         "INSERT INTO workspace_resources (id, writer_id, kind, identity_json) VALUES (?, ?, ?, ?)",
@@ -27626,7 +28003,7 @@ var WorkspaceResources = class {
 };
 
 // ../daemon/src/lib/coding-environment/workspace.ts
-import { randomUUID as randomUUID23 } from "crypto";
+import { randomUUID as randomUUID24 } from "crypto";
 import { realpathSync as realpathSync3 } from "fs";
 import { isAbsolute as isAbsolute3, relative as relative2 } from "path";
 var WorkspaceBusyError = class extends Error {
@@ -27670,7 +28047,7 @@ var WorkspaceCoordinator = class {
     this.db = db;
   }
   db;
-  identity = randomUUID23();
+  identity = randomUUID24();
   leases = /* @__PURE__ */ new Set();
   issued = /* @__PURE__ */ new WeakSet();
   claim(teamId, registeredRoot, kind) {
@@ -27684,7 +28061,7 @@ var WorkspaceCoordinator = class {
         const recovery = row.daemon_identity !== this.identity || row.state === "recovery";
         if (recovery || exclusive || row.exclusive === 1) throw new WorkspaceBusyError(recovery);
       }
-      const id = randomUUID23();
+      const id = randomUUID24();
       this.db.raw.run(
         `INSERT INTO workspace_writers
         (id, team_id, root_path, root_identity, daemon_identity, kind, exclusive, state, created_at)
@@ -27803,7 +28180,7 @@ var WorkspaceLifecycle = class {
     const prefix = `bazilion-${lease.writer.id}-`;
     const records2 = /* @__PURE__ */ new Map();
     return {
-      name: (kind) => `${prefix}${kind}-${randomUUID24()}`,
+      name: (kind) => `${prefix}${kind}-${randomUUID25()}`,
       beforeCreate: async (identity2) => {
         if (!identity2.containerName.startsWith(prefix) || !/^bazilion-[a-z0-9-]{1,160}$/.test(identity2.containerName) || records2.has(identity2.containerName))
           throw new Error("Invalid turn container identity");
@@ -27838,7 +28215,7 @@ var WorkspaceLifecycle = class {
 };
 
 // ../daemon/src/lib/conversation-target.ts
-import { randomUUID as randomUUID26 } from "crypto";
+import { randomUUID as randomUUID27 } from "crypto";
 
 // ../daemon/src/core/repos/conversations.ts
 var columns = "id, agent_id AS agentId, title, title_revision AS titleRevision, created_at AS createdAt, updated_at AS updatedAt";
@@ -27960,7 +28337,7 @@ function rename(db, agentId, id, value, expectedRevision) {
 }
 
 // ../daemon/src/lib/conversation-file.ts
-import { randomUUID as randomUUID25 } from "crypto";
+import { randomUUID as randomUUID26 } from "crypto";
 import {
   closeSync as closeSync4,
   constants as constants4,
@@ -28025,7 +28402,7 @@ function createConversationFile(paths, agentId, conversationId, cwd) {
   if (realpathSync5(directory) !== directory) throw new Error("Conversation escaped its Agent");
   const filename2 = `${conversationId}.jsonl`;
   const destination = join16(directory, filename2);
-  const staging = join16(directory, `.conversation-${randomUUID25()}.tmp`);
+  const staging = join16(directory, `.conversation-${randomUUID26()}.tmp`);
   const header = SessionManager.inMemory(cwd, { id: conversationId }).getHeader();
   const fd = openSync4(staging, constants4.O_WRONLY | constants4.O_CREAT | constants4.O_EXCL, 384);
   try {
@@ -28063,7 +28440,7 @@ function resolveConversationTarget(db, paths, agentId, pinnedId) {
       db,
       agentId,
       {
-        requestId: randomUUID26(),
+        requestId: randomUUID27(),
         expectedSelection: { conversationId: null, revision: 0 }
       },
       (newId) => createConversationFile(paths, agentId, newId, agent.team.path)
@@ -28130,7 +28507,7 @@ async function runAgentLifecycleMutation(agentId, mutation) {
 }
 
 // ../daemon/src/lib/agent-loop-guard.ts
-import { randomUUID as randomUUID27 } from "crypto";
+import { randomUUID as randomUUID28 } from "crypto";
 var DEFAULT_MAX_HOPS = 8;
 function toEvent(row) {
   return {
@@ -28182,8 +28559,8 @@ function enforceMessageCausality(db, input) {
   const target = agents_exports.get(db, input.to);
   if (!source || !target) return null;
   const event2 = {
-    id: randomUUID27(),
-    causalChainId: input.causality.causalChainId ?? input.causality.parentMessageId ?? randomUUID27(),
+    id: randomUUID28(),
+    causalChainId: input.causality.causalChainId ?? input.causality.parentMessageId ?? randomUUID28(),
     parentMessageId: input.causality.parentMessageId,
     fromAgentId: input.from,
     toAgentId: input.to,
@@ -29610,8 +29987,8 @@ function assertRepositoryContext(value, teamId) {
     ]) && string(candidate.source) && digest3(candidate.sha256) && string(candidate.location) && string(candidate.cwd) && string(candidate.command) && ["script", "excerpt"].includes(String(candidate.kind)) && [null, "npm", "pnpm", "yarn"].includes(candidate.packageManager)
   ) || !["available", "unavailable", "not_repository"].includes(String(git.state)) || ![null, "branch", "detached", "unborn"].includes(git.headState) || ![git.root, git.branch, git.head].every((value2) => value2 === null || string(value2)) || ![git.staged, git.unstaged, git.untracked, git.conflicted].every(count2) || !list15(git.issues, 128, issue))
     throw new Error("Invalid repository context report");
-  const report = value;
-  if (report.instructions.files.reduce((bytes, file) => bytes + Buffer.byteLength(file.content), 0) > 128 * 1024 || report.instructions.state === "complete" && (report.rootIdentity === null || report.instructions.issues.length > 0))
+  const report2 = value;
+  if (report2.instructions.files.reduce((bytes, file) => bytes + Buffer.byteLength(file.content), 0) > 128 * 1024 || report2.instructions.state === "complete" && (report2.rootIdentity === null || report2.instructions.issues.length > 0))
     throw new Error("Invalid repository instruction completeness");
 }
 
@@ -31192,6 +31569,16 @@ var PROTECTED_REQUIRED_KEYS = new Set(
     (key3) => key3 !== "images" && key3 !== "questionEnabled" && key3 !== "containerNamespace"
   )
 );
+var VERIFICATION_KEYS = /* @__PURE__ */ new Set([
+  "kind",
+  "agentId",
+  "message",
+  "turnId",
+  "runtime",
+  "verification",
+  "apiKeyRefreshEnabled",
+  "scratch"
+]);
 var REVIEW_KEYS = /* @__PURE__ */ new Set([
   "kind",
   "agentId",
@@ -31326,6 +31713,27 @@ function parseWorkerInput(value) {
     assertMinimalWorkerScratch(input.scratch);
     return value;
   }
+  if (kind === "specialist_verification") {
+    assertExactKeys(input, VERIFICATION_KEYS, "verification worker input", VERIFICATION_KEYS);
+    requireString(input.agentId, "agentId");
+    requireString(input.message, "message");
+    requireString(input.turnId, "turnId");
+    assertProtectedProviderRuntime(input.runtime);
+    if (input.apiKeyRefreshEnabled !== true) {
+      throw new Error("worker: verification input requires bound API key refresh");
+    }
+    assertMinimalWorkerScratch(input.scratch);
+    const verification = objectRecord(input.verification, "verification metadata");
+    assertExactKeys(
+      verification,
+      /* @__PURE__ */ new Set(["requestId", "attemptId"]),
+      "verification metadata",
+      /* @__PURE__ */ new Set(["requestId", "attemptId"])
+    );
+    requireString(verification.requestId, "requestId");
+    requireString(verification.attemptId, "attemptId");
+    return value;
+  }
   if (kind === "restricted_review") {
     assertExactKeys(input, REVIEW_KEYS, "restricted review worker input", REVIEW_KEYS);
     requireString(input.agentId, "agentId");
@@ -33766,6 +34174,9 @@ async function spawnReviewWorker(spec, opts) {
   }
   throw new Error("review worker exited without a result");
 }
+function spawnVerificationWorker(spec, opts) {
+  return spawnWorker(spec, opts);
+}
 function spawnWorkerTurn(spec, opts) {
   return spawnWorker(spec, opts);
 }
@@ -33813,7 +34224,7 @@ async function* spawnWorker(spec, opts) {
   }
   const accessTokens = spec.kind === "configured_operator_http" ? spec.apiKey ? [spec.apiKey] : [] : protectedRuntimeSecrets(spec.runtime);
   const stderrRedactor = accessTokens.length > 0 ? new ExactValueStreamRedactor(accessTokens) : void 0;
-  const resourceLifecycle = spec.kind === "restricted_review" ? void 0 : opts.resourceLifecycle;
+  const resourceLifecycle = isRestrictedWorkerKind(spec) ? void 0 : opts.resourceLifecycle;
   let resourceCleanup;
   const cleanupResources = () => resourceCleanup ??= resourceLifecycle?.afterExit(child.exitCode !== null && child.signalCode === null).catch(() => false) ?? Promise.resolve(true);
   let child;
@@ -33989,9 +34400,12 @@ async function* spawnWorker(spec, opts) {
       throw new Error("Worker cleanup could not be confirmed; workspace recovery required");
   }
 }
+function isRestrictedWorkerKind(spec) {
+  return spec.kind === "restricted_review" || spec.kind === "specialist_verification";
+}
 function assertSpawnCombination(spec, opts) {
   const record3 = opts;
-  if (spec.kind !== "restricted_review" && (Boolean(spec.questionEnabled) !== Boolean(record3.questionHost) || record3.questionHost && !hostHasMethods(record3.questionHost, ["ask", "close", "subscribe", "consumed"])))
+  if (!isRestrictedWorkerKind(spec) && (Boolean(spec.questionEnabled) !== Boolean(record3.questionHost) || record3.questionHost && !hostHasMethods(record3.questionHost, ["ask", "close", "subscribe", "consumed"])))
     throw new Error("Question capability requires its bound host");
   if (spec.kind === "configured_operator_http") {
     if (!("env" in record3) || !record3.env || typeof record3.env !== "object") {
@@ -34025,9 +34439,20 @@ function assertSpawnCombination(spec, opts) {
       "userMdHost",
       "bashApprovalHost",
       "browserHost",
-      "mcpHost"
+      "mcpHost",
+      "codingHost",
+      "containerHost",
+      "repositoryContextHost",
+      "resultHost",
+      "resourceLifecycle"
     ]) {
-      if (forbidden in record3) throw new Error(`restricted review rejects ${forbidden}`);
+      if (forbidden in record3) throw new Error(`${spec.kind} rejects ${forbidden}`);
+    }
+    const wantsCapability = spec.kind === "specialist_verification";
+    if (wantsCapability !== "verificationHost" in record3) {
+      throw new Error(
+        wantsCapability ? "verification turn requires its bound capability host" : `${spec.kind} rejects verificationHost`
+      );
     }
   }
 }
@@ -34054,16 +34479,20 @@ function spawnHosts(spec, opts, signal, onBashApproval, onQuestion, onApiKeyRefr
     );
     if (signal.aborted) questionHost.close();
   }
+  const restricted = isRestrictedWorkerKind(spec);
   return {
-    questionHost,
-    containerHost: spec.kind === "restricted_review" ? void 0 : opts.containerHost,
-    codingHost: spec.kind === "restricted_review" ? void 0 : opts.codingHost,
-    repositoryContextHost: spec.kind === "restricted_review" ? void 0 : opts.repositoryContextHost,
-    resultHost: spec.kind === "restricted_review" ? void 0 : opts.resultHost,
-    messagingHost: configuredOpts?.messagingHost ?? protectedOpts?.messagingHost,
-    userMdHost: configuredOpts?.userMdHost ?? protectedOpts?.userMdHost,
-    browserHost: configuredOpts?.browserHost,
-    mcpHost: configuredOpts?.mcpHost,
+    questionHost: restricted ? void 0 : questionHost,
+    containerHost: restricted ? void 0 : opts.containerHost,
+    codingHost: restricted ? void 0 : opts.codingHost,
+    repositoryContextHost: restricted ? void 0 : opts.repositoryContextHost,
+    resultHost: restricted ? void 0 : opts.resultHost,
+    // A verification turn reads its request and runs captured checks; it does not message peers,
+    // edit USER.md, drive a browser or call MCP. Cleared here rather than trusting the caller.
+    messagingHost: restricted ? void 0 : configuredOpts?.messagingHost ?? protectedOpts?.messagingHost,
+    userMdHost: restricted ? void 0 : configuredOpts?.userMdHost ?? protectedOpts?.userMdHost,
+    browserHost: restricted ? void 0 : configuredOpts?.browserHost,
+    mcpHost: restricted ? void 0 : configuredOpts?.mcpHost,
+    verificationHost: spec.kind === "specialist_verification" ? opts.verificationHost : void 0,
     bashApprovalHost: configuredOpts?.bashApprovalHost ?? protectedOpts?.bashApprovalHost,
     apiKeyRefreshHost: opts.apiKeyRefreshHost,
     apiKeyRefreshContext: {
@@ -34216,6 +34645,19 @@ async function dispatch(req, hosts) {
           req.args.args
         );
         break;
+      case "verificationRead":
+        result = await require2(hosts.verificationHost, "verification", req.method).read(
+          req.args.requestId,
+          req.args.attemptId
+        );
+        break;
+      case "verificationRun":
+        result = await require2(hosts.verificationHost, "verification", req.method).run(
+          req.args.requestId,
+          req.args.attemptId,
+          req.args.ordinal
+        );
+        break;
       case "refreshApiKey":
         result = await refreshApiKeyForTurn(
           req.args,
@@ -35058,7 +35500,7 @@ function createBrowserHost(config2) {
 }
 
 // ../daemon/src/lib/coding-environment/agent-host.ts
-import { createHash as createHash10, randomUUID as randomUUID30 } from "crypto";
+import { createHash as createHash10, randomUUID as randomUUID31 } from "crypto";
 
 // ../daemon/src/core/repos/coding-command-logs.ts
 var CODING_LOG_BYTES = 2 * 1024 * 1024;
@@ -35278,7 +35720,7 @@ function pruneCodingCommandLogs(db, now = Date.now(), budgetBytes = CODING_LOG_H
 }
 
 // ../daemon/src/lib/communication.ts
-import { randomUUID as randomUUID29 } from "crypto";
+import { randomUUID as randomUUID30 } from "crypto";
 
 // ../daemon/src/lib/question-approval.ts
 function questionApprovalReference(snapshot, kind) {
@@ -35373,7 +35815,7 @@ function questionVisible(db, item) {
 }
 
 // ../daemon/src/core/repos/results.ts
-import { createHash as createHash9, randomUUID as randomUUID28 } from "crypto";
+import { createHash as createHash9, randomUUID as randomUUID29 } from "crypto";
 var MAX_RESULT_BYTES = 25 * 1024 * 1024;
 var MAX_RETAINED_RESULT_BYTES = 1024 * 1024 * 1024;
 var columns2 = `id, team_id AS teamId, agent_id AS agentId, session_id AS sessionId,
@@ -35420,7 +35862,7 @@ function publish(db, input) {
         "Result storage is full (1 GiB). Delete saved results before delivering more files."
       );
     }
-    const id = randomUUID28();
+    const id = randomUUID29();
     db.raw.run(
       `INSERT INTO agent_results
       (id, team_id, agent_id, session_id, tool_call_id, name, mime_type, byte_length, sha256, created_at, bytes)
@@ -35649,6 +36091,39 @@ function authorizeAgentEgress(db, agentId, attempt) {
     "agent_to_user"
   );
 }
+function authorizeOperatorVerification(db, input) {
+  const agent = agents_exports.get(db, input.agentId);
+  return authorizeBoundary(
+    db,
+    {
+      source: { kind: "user", teamId: agent?.teamId ?? "__missing__" },
+      target: { kind: "agent", id: input.agentId },
+      origin: "verification_request",
+      attemptKind: "verification_request",
+      attemptId: input.requestId,
+      approvalPayloadKind: "verification_request",
+      approvalPayload: { requestId: input.requestId },
+      requester: "user"
+    },
+    "request_verification"
+  );
+}
+function authorizeVerificationRequest(db, input) {
+  return authorizeBoundary(
+    db,
+    {
+      source: { kind: "agent", id: input.from },
+      target: { kind: "agent", id: input.to },
+      origin: "verification_request",
+      attemptKind: "verification_request",
+      attemptId: input.requestId,
+      approvalPayloadKind: "verification_request",
+      approvalPayload: { requestId: input.requestId },
+      requester: input.from
+    },
+    "request_verification"
+  );
+}
 function authorizeHttpChatFrame(db, agentId, requestAttemptId, frameIndex, frame) {
   if (frame.kind === "event" && frame.event.type === "agent_question") {
     const current = get18(db, agentId, frame.event.question.id);
@@ -35687,7 +36162,7 @@ function isUserFacingFrame(frame) {
 }
 function sendAgentMessage(db, input) {
   const attemptKind = input.attemptKind ?? "agent_tool";
-  const attemptId = input.attemptId ?? randomUUID29();
+  const attemptId = input.attemptId ?? randomUUID30();
   const outcome = db.raw.transaction(
     () => {
       const causality = resolveMessageCausality(db, input);
@@ -36555,11 +37030,11 @@ async function readChangePatch(captured, base, change, patchBytes = REVIEW_LIMIT
     omitted: null
   };
 }
-async function attachPatches(captured, report, limits = REVIEW_LIMITS, onlyPath) {
+async function attachPatches(captured, report2, limits = REVIEW_LIMITS, onlyPath) {
   let total = 0;
   let tooLarge = 0;
   const changes = [];
-  for (const change of report.changes) {
+  for (const change of report2.changes) {
     if (onlyPath !== void 0 && change.path !== onlyPath) {
       changes.push(change);
       continue;
@@ -36572,7 +37047,7 @@ async function attachPatches(captured, report, limits = REVIEW_LIMITS, onlyPath)
       changes.push({ ...change, contentOmitted: "total_limit" });
       continue;
     }
-    const read = await readChangePatch(captured, report.base, change, limits.patchBytes);
+    const read = await readChangePatch(captured, report2.base, change, limits.patchBytes);
     const bytes = read.patch ? Buffer.byteLength(read.patch) : 0;
     if (bytes > limits.fileBytes && !read.truncated) {
       tooLarge++;
@@ -36587,7 +37062,7 @@ async function attachPatches(captured, report, limits = REVIEW_LIMITS, onlyPath)
       contentOmitted: read.omitted
     });
   }
-  return { ...report, changes, withheld: { ...report.withheld, tooLarge } };
+  return { ...report2, changes, withheld: { ...report2.withheld, tooLarge } };
 }
 async function readDiff(captured, base, args) {
   return captured.runGit(["diff", base.resolvedOid, ...args]);
@@ -37103,13 +37578,13 @@ var emptyGit = () => ({
   issues: []
 });
 async function inspectGit(ancestry) {
-  const report = emptyGit();
+  const report2 = emptyGit();
   let capture2 = null;
   try {
     const root = findRepositoryRoot(ancestry);
-    if (!root) return report;
-    report.root = root.label;
-    report.state = "unavailable";
+    if (!root) return report2;
+    report2.root = root.label;
+    report2.state = "unavailable";
     capture2 = await captureRepositoryGit(root);
     const output = await capture2.runGit([
       "status",
@@ -37125,32 +37600,32 @@ async function inspectGit(ancestry) {
       const line = records2[i] ?? "";
       if (line.startsWith("# branch.oid ")) {
         const oid = line.slice(13);
-        report.head = /^[0-9a-f]{40,64}$/.test(oid) ? oid : null;
+        report2.head = /^[0-9a-f]{40,64}$/.test(oid) ? oid : null;
       } else if (line.startsWith("# branch.head ")) {
         const branch = line.slice(14);
         if (branch.length > 4096) throw new ContextReadError("git_output_limit");
-        report.branch = branch === "(detached)" ? null : branch;
-      } else if (line.startsWith("? ")) report.untracked++;
-      else if (line.startsWith("u ")) report.conflicted++;
+        report2.branch = branch === "(detached)" ? null : branch;
+      } else if (line.startsWith("? ")) report2.untracked++;
+      else if (line.startsWith("u ")) report2.conflicted++;
       else if (line.startsWith("1 ") || line.startsWith("2 ")) {
-        if (line[2] !== ".") report.staged++;
-        if (line[3] !== ".") report.unstaged++;
+        if (line[2] !== ".") report2.staged++;
+        if (line[3] !== ".") report2.unstaged++;
         if (line.startsWith("2 ")) i++;
       }
     }
-    report.headState = report.head ? report.branch ? "branch" : "detached" : "unborn";
-    report.state = "available";
+    report2.headState = report2.head ? report2.branch ? "branch" : "detached" : "unborn";
+    report2.state = "available";
   } catch (error2) {
-    report.state = "unavailable";
+    report2.state = "unavailable";
     const code = error2 instanceof ContextReadError ? error2.code : error2.code === "ENOENT" ? "git_missing" : error2.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" ? "git_output_limit" : error2.killed || error2.code === "ETIMEDOUT" ? "git_timeout" : "git_inspection_failed";
-    report.issues.push({
+    report2.issues.push({
       code,
       message: `Git inspection is unavailable (${code.replaceAll("_", " ")}); repository instructions are evaluated separately.`
     });
   } finally {
     capture2?.cleanup();
   }
-  return report;
+  return report2;
 }
 
 // ../daemon/src/lib/repository-context/index.ts
@@ -37176,7 +37651,7 @@ function issue2(error2, path) {
   };
 }
 async function resolveRepositoryContext(input) {
-  const report = {
+  const report2 = {
     version: 1,
     teamId: input.teamId,
     rootIdentity: null,
@@ -37190,9 +37665,9 @@ async function resolveRepositoryContext(input) {
   let root;
   try {
     root = new ContextDirectory(input.root);
-    report.rootIdentity = root.identity;
+    report2.rootIdentity = root.identity;
     const parts = relativeParts(input.target ?? ".");
-    report.target = parts.join("/") || ".";
+    report2.target = parts.join("/") || ".";
     if (input.expectedRootIdentity && root.identity !== input.expectedRootIdentity)
       throw new ContextReadError("root_changed");
     const ancestry = [root];
@@ -37220,17 +37695,17 @@ async function resolveRepositoryContext(input) {
           instructionBytes += bytes.length;
           if (instructionBytes > CONTEXT_LIMITS.instructionTotal)
             throw new ContextReadError("instruction_total_limit");
-          report.instructions.files.push({
+          report2.instructions.files.push({
             path,
             scope: directory.label,
-            precedence: report.instructions.files.length,
+            precedence: report2.instructions.files.length,
             content: decode3(bytes),
             sha256: hash3(bytes)
           });
         }
       } catch (error2) {
-        report.instructions.state = "incomplete";
-        report.instructions.issues.push(issue2(error2, path));
+        report2.instructions.state = "incomplete";
+        report2.instructions.issues.push(issue2(error2, path));
       }
       const memory = input.memoryPath ?? "memory";
       if (directory.label === memory || directory.label.startsWith(`${memory}/`) || directory.label.split("/").some((part) => discoveryExcluded.has(part)))
@@ -37247,14 +37722,14 @@ async function resolveRepositoryContext(input) {
           if (sourceBytes > CONTEXT_LIMITS.sourceTotal)
             throw new ContextReadError("source_total_limit");
           const sha256 = hash3(bytes);
-          report.commands.sources.push({ path: path2, sha256 });
+          report2.commands.sources.push({ path: path2, sha256 });
           const content = decode3(bytes);
           const add2 = (candidate) => {
-            if (report.commands.candidates.length >= CONTEXT_LIMITS.candidates)
+            if (report2.commands.candidates.length >= CONTEXT_LIMITS.candidates)
               throw new ContextReadError("candidate_limit");
             if (candidate.command.length > 4096 || candidate.location.length > 4096)
               throw new ContextReadError("command_limit");
-            report.commands.candidates.push({
+            report2.commands.candidates.push({
               ...candidate,
               source: path2,
               sha256,
@@ -37301,50 +37776,50 @@ async function resolveRepositoryContext(input) {
             }
           }
         } catch (error2) {
-          report.commands.state = "incomplete";
-          report.commands.issues.push(issue2(error2, path2));
+          report2.commands.state = "incomplete";
+          report2.commands.issues.push(issue2(error2, path2));
         }
       }
     }
-    report.git = await inspectGit(ancestry);
+    report2.git = await inspectGit(ancestry);
     root.validate(true, /* @__PURE__ */ new Set(["AGENTS.md"]));
     try {
       root.validate(true, new Set(sourceNames));
     } catch (error2) {
-      report.commands = { state: "incomplete", sources: [], candidates: [], issues: [issue2(error2)] };
+      report2.commands = { state: "incomplete", sources: [], candidates: [], issues: [issue2(error2)] };
     }
   } catch (error2) {
-    report.instructions.state = "incomplete";
-    report.instructions.files = [];
-    report.instructions.issues.push(issue2(error2));
-    report.commands.state = "incomplete";
-    report.commands.sources = [];
-    report.commands.candidates = [];
-    report.commands.issues.push(issue2(error2));
-    report.git = { ...emptyGit(), state: "unavailable", issues: [issue2(error2)] };
+    report2.instructions.state = "incomplete";
+    report2.instructions.files = [];
+    report2.instructions.issues.push(issue2(error2));
+    report2.commands.state = "incomplete";
+    report2.commands.sources = [];
+    report2.commands.candidates = [];
+    report2.commands.issues.push(issue2(error2));
+    report2.git = { ...emptyGit(), state: "unavailable", issues: [issue2(error2)] };
   } finally {
     root?.close();
   }
-  if (Buffer.byteLength(JSON.stringify(report)) > CONTEXT_LIMITS.report - 128) {
-    report.instructions = {
+  if (Buffer.byteLength(JSON.stringify(report2)) > CONTEXT_LIMITS.report - 128) {
+    report2.instructions = {
       state: "incomplete",
       files: [],
       issues: [issue2(new ContextReadError("report_limit"))]
     };
-    report.commands = {
+    report2.commands = {
       state: "incomplete",
       sources: [],
       candidates: [],
       issues: [issue2(new ContextReadError("report_limit"))]
     };
   }
-  report.fingerprint = hash3(JSON.stringify({ ...report, capturedAt: 0, fingerprint: "" }));
-  return report;
+  report2.fingerprint = hash3(JSON.stringify({ ...report2, capturedAt: 0, fingerprint: "" }));
+  return report2;
 }
-function requireCompleteRepositoryContext(report) {
-  if (report.instructions.state !== "complete") {
+function requireCompleteRepositoryContext(report2) {
+  if (report2.instructions.state !== "complete") {
     throw new Error(
-      `Repository instructions incomplete (${report.instructions.issues.map((i) => i.code).join(", ")}). Inspect Team repository context before coding.`
+      `Repository instructions incomplete (${report2.instructions.issues.map((i) => i.code).join(", ")}). Inspect Team repository context before coding.`
     );
   }
 }
@@ -37371,14 +37846,14 @@ function createCodingHost(input) {
     input.assertActive();
     codingRelativePath(target);
     resolveCodingDirectory(input.root, target);
-    const report = await input.context(target);
-    requireCompleteRepositoryContext(report);
+    const report2 = await input.context(target);
+    requireCompleteRepositoryContext(report2);
     let fingerprint2 = null;
     const dir = new ContextDirectory(input.root);
     try {
       const sources2 = [
-        report.instructions.files.map((file) => [file.path, file.sha256]),
-        report.commands.sources,
+        report2.instructions.files.map((file) => [file.path, file.sha256]),
+        report2.commands.sources,
         input.values
       ];
       let current = dir;
@@ -37406,7 +37881,7 @@ function createCodingHost(input) {
       posture: input.posture,
       imageId: input.imageId,
       cwd: target,
-      rootIdentity: report.rootIdentity ?? "unavailable",
+      rootIdentity: report2.rootIdentity ?? "unavailable",
       inputFingerprint: fingerprint2,
       capturedAt: Date.now(),
       restrictions: input.posture === "host" ? [
@@ -37463,7 +37938,7 @@ function createCodingHost(input) {
         try {
           const environment = await snapshot(command.cwd);
           const receipt = {
-            id: randomUUID30(),
+            id: randomUUID31(),
             agentId: input.agentId,
             teamId: input.teamId,
             turnId: input.turnId,
@@ -37798,7 +38273,7 @@ function createDbMessagingHost(db, opts = {}) {
 }
 
 // ../daemon/src/lib/question-service.ts
-import { randomUUID as randomUUID32 } from "crypto";
+import { randomUUID as randomUUID33 } from "crypto";
 
 // ../daemon/src/lib/question-consumption.ts
 import { isDeepStrictEqual } from "util";
@@ -38326,7 +38801,7 @@ function parseTelegramQuestionReply(db, authToken, update3) {
 }
 
 // ../daemon/src/lib/attachments.ts
-import { randomUUID as randomUUID31 } from "crypto";
+import { randomUUID as randomUUID32 } from "crypto";
 import { closeSync as closeSync9, constants as constants10, fstatSync as fstatSync7, openSync as openSync9, writeFileSync as writeFileSync13 } from "fs";
 import { join as join26, posix } from "path";
 var MAX_FILE_BYTES = 25 * 1024 * 1024;
@@ -38353,7 +38828,7 @@ function saveInputFiles(agentDir, files, options = {}) {
       lines.push(`[attachment "${label}" skipped: too large (${fmtBytes(buf.byteLength)} > 25 MB)]`);
       continue;
     }
-    const filename2 = `${randomUUID31().slice(0, 8)}-${safeName(label)}`;
+    const filename2 = `${randomUUID32().slice(0, 8)}-${safeName(label)}`;
     const path = join26(dir, filename2);
     let fd;
     try {
@@ -38685,9 +39160,11 @@ function deepFreezePreparedProtectedExecution(value, seen = /* @__PURE__ */ new
 // ../daemon/src/lib/turn-invocation.ts
 var trustedTurnBrand = /* @__PURE__ */ Symbol("bazilion.trusted-turn-invocation");
 var trustedReviewBrand = /* @__PURE__ */ Symbol("bazilion.trusted-review-invocation");
+var trustedVerificationBrand = /* @__PURE__ */ Symbol("bazilion.trusted-verification-invocation");
 var preclaimedTurnBrand = /* @__PURE__ */ Symbol("bazilion.preclaimed-turn");
 var trustedTurns = /* @__PURE__ */ new WeakSet();
 var trustedReviews = /* @__PURE__ */ new WeakSet();
+var trustedVerifications = /* @__PURE__ */ new WeakSet();
 var trustedClaims = /* @__PURE__ */ new WeakSet();
 var consumedClaims = /* @__PURE__ */ new WeakSet();
 function createPreclaimedTurn(input) {
@@ -38722,6 +39199,32 @@ function createTrustedReviewInvocation(value) {
   trustedReviews.add(candidate);
   return Object.freeze(candidate);
 }
+function createTrustedVerificationInvocation(value) {
+  validateVerificationInvocation(value);
+  const candidate = {
+    ...value,
+    authorization: Object.freeze({ ...value.authorization })
+  };
+  validateVerificationInvocation(candidate);
+  Object.defineProperty(candidate, trustedVerificationBrand, { value: true });
+  trustedVerifications.add(candidate);
+  return Object.freeze(candidate);
+}
+function assertTrustedVerificationInvocation(value) {
+  if (!isRecord2(value) || !trustedVerifications.has(value)) throw invalidInvocation();
+  validateVerificationInvocation(value);
+}
+function validateVerificationInvocation(value) {
+  if (!isRecord2(value)) throw invalidInvocation();
+  assertExactKeys2(value, ["kind", "authorization", "bashApprovalMode"]);
+  if (value.kind !== "restricted_verification" || value.bashApprovalMode !== "auto_deny" || !isRecord2(value.authorization)) {
+    throw invalidInvocation();
+  }
+  assertExactKeys2(value.authorization, ["kind", "requestId", "attemptId"]);
+  if (value.authorization.kind !== "request" || !isNonEmptyString2(value.authorization.requestId) || !isNonEmptyString2(value.authorization.attemptId)) {
+    throw invalidInvocation();
+  }
+}
 function executionSurfaceForInvocation(invocation) {
   return invocation.kind === "operator_http" && !process.env.BAZILION_PUBLIC_ORIGIN ? "configured_operator_http" : "protected";
 }
@@ -39170,7 +39673,7 @@ var QuestionService = class {
       turn.conversation.id
     ).length;
     this.#attached.add(turn);
-    const turnId = randomUUID32();
+    const turnId = randomUUID33();
     const listeners = /* @__PURE__ */ new Set();
     if (onQuestion) listeners.add(onQuestion);
     this.#turns.set(turnId, {
@@ -41445,7 +41948,7 @@ async function* runAgentTurn(turn) {
         throw new Error("Repository context unavailable for this turn");
       contextBusy = true;
       try {
-        const report = await resolveRepositoryContext({
+        const report2 = await resolveRepositoryContext({
           teamId: agent.team.id,
           root: agent.team.path,
           target,
@@ -41454,7 +41957,7 @@ async function* runAgentTurn(turn) {
         turn.controller.signal.throwIfAborted();
         if (!ownsActiveAgent(agent.agent.id, turn.controller))
           throw new Error("Repository context turn ended");
-        return report;
+        return report2;
       } finally {
         contextBusy = false;
       }
@@ -42003,46 +42506,809 @@ async function dispatchClaimableReviews(now = Date.now()) {
   );
 }
 
-// ../daemon/src/lib/scheduler.ts
-var SCHEDULER_KEY = /* @__PURE__ */ Symbol.for("bazilion.scheduler");
-var TICK_MS = Number(process.env.BAZILION_SCHEDULER_TICK_MS ?? 5e3);
-function state2() {
-  const g2 = globalThis;
-  let s = g2[SCHEDULER_KEY];
-  if (!s) {
-    s = { timer: null, firing: /* @__PURE__ */ new Set(), cronCache: /* @__PURE__ */ new Map(), stopped: false };
-    g2[SCHEDULER_KEY] = s;
-  }
-  return s;
-}
-function floorToMinute(ms) {
-  return Math.floor(ms / 6e4) * 6e4;
-}
-function isDue(t, now, cronCache) {
-  if (!t.enabled) return false;
-  if (t.kind === "interval") {
-    const every = (t.intervalSec ?? 0) * 1e3;
-    if (every <= 0) return false;
-    const baseline = t.lastFiredAt ?? t.createdAt;
-    return now - baseline >= every;
-  }
-  if (t.kind === "cron") {
-    if (!t.cronExpr) return false;
-    let parsed = cronCache.get(t.cronExpr);
-    if (!parsed) {
-      try {
-        parsed = parseCron(t.cronExpr);
-      } catch {
-        return false;
-      }
-      cronCache.set(t.cronExpr, parsed);
+// ../daemon/src/lib/verification/admission.ts
+import { randomUUID as randomUUID34 } from "crypto";
+var VERIFICATION_LEASE_MS = 10 * 60 * 1e3;
+var VERIFICATION_DISPATCH_OWNER = randomUUID34();
+async function admitVerificationRequest(db, paths, requestId2, now = Date.now()) {
+  const request2 = getVerificationRequestById(db, requestId2, now);
+  if (!request2) return { kind: "deferred", requestId: requestId2, reason: "unknown_or_expired" };
+  const blockedReason = async () => {
+    const team = safeTeam(db, paths, request2.teamId);
+    if (!team) return blocker("unsupported", "the request no longer names a known Team");
+    const recipient = get(db, request2.recipientAgentId);
+    if (!recipient || recipient.status === "archived") {
+      return blocker("recipient_unavailable", "the selected specialist is missing or archived");
+    }
+    if (recipient.teamId !== team.id) {
+      return blocker("recipient_not_same_team", "the selected specialist left this Team");
+    }
+    if (!getSourceSnapshot(db, team.id, request2.snapshotId, now)) {
+      return blocker(
+        "snapshot_evidence_gone",
+        "the captured change is no longer inside its retention window"
+      );
     }
-    const nowFloor = floorToMinute(now);
-    if (t.lastFiredAt && floorToMinute(t.lastFiredAt) === nowFloor) return false;
-    return matchesCron(parsed, new Date(nowFloor));
+    return null;
+  };
+  const refusal = await blockedReason();
+  if (refusal) {
+    setRequestState(db, requestId2, "blocked");
+    return { kind: "blocked", requestId: requestId2, blocker: refusal };
+  }
+  const decision = teamPolicyEnforcementEnabled() ? authorizeCommunication(db, authorizationFor(request2, requestId2)) : { decision: "allow" };
+  if (decision.decision === "deny") {
+    setRequestState(db, requestId2, "blocked");
+    return {
+      kind: "blocked",
+      requestId: requestId2,
+      blocker: blocker("policy_denied", "the current Team policy no longer permits this request")
+    };
   }
-  return false;
-}
+  if (decision.decision === "approval_required") {
+    try {
+      if (request2.requesterKind === "agent" && request2.requesterAgentId) {
+        authorizeVerificationRequest(db, {
+          from: request2.requesterAgentId,
+          to: request2.recipientAgentId,
+          requestId: requestId2
+        });
+      } else {
+        authorizeOperatorVerification(db, {
+          agentId: request2.recipientAgentId,
+          requestId: requestId2
+        });
+      }
+      setRequestState(db, requestId2, "blocked");
+      return {
+        kind: "blocked",
+        requestId: requestId2,
+        blocker: blocker("approval_required", "the request was not captured for approval")
+      };
+    } catch {
+      setRequestState(db, requestId2, "awaiting_approval");
+      return { kind: "held", requestId: requestId2 };
+    }
+  }
+  let workspace;
+  try {
+    const team = requireTeam(db, paths, request2.teamId);
+    workspace = await workspaceLifecycle(db).claim(team.id, team.path, "agent");
+  } catch (error2) {
+    if (error2 instanceof WorkspaceBusyError) {
+      return { kind: "deferred", requestId: requestId2, reason: "workspace_busy" };
+    }
+    throw error2;
+  }
+  const claim5 = claimVerificationAttempt(db, {
+    requestId: requestId2,
+    leaseOwner: VERIFICATION_DISPATCH_OWNER,
+    leaseMs: VERIFICATION_LEASE_MS,
+    now
+  });
+  if (!claim5) {
+    await workspaceLifecycle(db).release(workspace);
+    return { kind: "deferred", requestId: requestId2, reason: "already_owned" };
+  }
+  const applicability = await readSnapshotApplicability(
+    db,
+    paths,
+    request2.teamId,
+    request2.snapshotId
+  );
+  if (applicability.comparison !== "identical") {
+    await workspaceLifecycle(db).release(workspace);
+    const reason = applicability.comparison === "changed" ? "source_changed" : "source_unverifiable";
+    const detail3 = applicability.comparison === "changed" ? "the workspace changed after the capture, so a fresh capture is required" : "the workspace could not be shown to match the captured change";
+    settleUnstarted(db, claim5, detail3);
+    setRequestState(db, requestId2, "blocked");
+    return { kind: "blocked", requestId: requestId2, blocker: blocker(reason, detail3) };
+  }
+  return { kind: "admitted", requestId: requestId2, claim: claim5, workspace };
+}
+function authorizationFor(request2, requestId2) {
+  const attempt = {
+    origin: "verification_request",
+    attemptKind: "verification_request",
+    attemptId: requestId2
+  };
+  return request2.requesterKind === "agent" && request2.requesterAgentId ? {
+    source: { kind: "agent", id: request2.requesterAgentId },
+    target: { kind: "agent", id: request2.recipientAgentId },
+    ...attempt
+  } : {
+    source: { kind: "user", teamId: request2.teamId },
+    target: { kind: "agent", id: request2.recipientAgentId },
+    ...attempt
+  };
+}
+function settleUnstarted(db, claim5, error2) {
+  db.raw.run(
+    `UPDATE verification_attempts
+     SET state = 'failed', finished_at = ?, lease_owner = NULL, lease_expires_at = NULL, error = ?
+     WHERE id = ? AND lease_owner IS NOT NULL AND finished_at IS NULL`,
+    [Date.now(), error2, claim5.attempt.id]
+  );
+  db.raw.run(
+    `UPDATE verification_check_outcomes SET state = 'blocked', finished_at = ?
+     WHERE attempt_id = ? AND state = 'not_executed'`,
+    [Date.now(), claim5.attempt.id]
+  );
+}
+function blocker(reason, detail3) {
+  return { reason, detail: detail3 };
+}
+function safeTeam(db, paths, teamId) {
+  try {
+    return requireTeam(db, paths, teamId);
+  } catch {
+    return null;
+  }
+}
+
+// ../daemon/src/lib/verification/executor.ts
+import { randomUUID as randomUUID35 } from "crypto";
+import { createLocalBashOperations as createLocalBashOperations3 } from "@earendil-works/pi-coding-agent";
+function createProtectedCheckExecutor(input) {
+  const env = input.env ?? process.env;
+  return {
+    async run({ command, cwd, timeoutMs }) {
+      const config2 = resolveShellSecurityConfig(env);
+      const wantsContainer = input.request.environment.sandbox === "docker";
+      const isContainer = config2.sandboxMode === "docker";
+      if (wantsContainer !== isContainer) {
+        return blocked(
+          "environment_unavailable",
+          wantsContainer ? "this request was captured against a container, but shell isolation is not active" : "this request was captured for host execution, but shell isolation is active"
+        );
+      }
+      if (config2.approvalMode === "dangerous" && classifyBashCommand(command).length > 0) {
+        return blocked(
+          "approval_required",
+          "this check needs a command approval that an unattended verification turn cannot obtain"
+        );
+      }
+      const relative8 = codingRelativePath(cwd || ".");
+      const { path: absoluteCwd } = resolveCodingDirectory(input.teamPath, relative8);
+      const secrets = input.secrets();
+      if (secrets.some((secret) => secret && command.includes(secret))) {
+        return blocked("unsupported", "the captured command contains protected credential material");
+      }
+      const commandId = randomUUID35();
+      const startedAt = Date.now();
+      const receipt = {
+        id: commandId,
+        agentId: input.request.recipientAgentId,
+        teamId: input.request.teamId,
+        turnId: input.attemptId,
+        toolCallId: `verification:${input.attemptId}:${randomUUID35()}`,
+        input: {
+          command,
+          cwd: relative8,
+          purpose: "verification",
+          timeoutSeconds: Math.max(1, Math.round(timeoutMs / 1e3))
+        },
+        environment: {
+          posture: "protected",
+          imageId: isContainer ? input.request.environment.image : null,
+          cwd: relative8,
+          rootIdentity: workspaceIdentity(input.teamPath).rootIdentity,
+          // No repository-context fingerprint is computed for a verification check, so it is absent
+          // rather than invented. Unknown applicability is reported as unknown.
+          inputFingerprint: null,
+          capturedAt: startedAt,
+          // Declared output paths name where a check is expected to write; they do not confine it in
+          // host mode, and the receipt must not imply otherwise. Any write still makes the tree differ
+          // from the captured snapshot, which is reported as `changed` rather than as a pass.
+          restrictions: [
+            ...isContainer ? ["network_disabled", "read_only_memory"] : [],
+            "declared_output_paths_are_advisory"
+          ]
+        },
+        startedAt,
+        finishedAt: null,
+        state: "running",
+        exitCode: null,
+        diagnostic: "",
+        truncated: false,
+        reason: null,
+        sourceBefore: {
+          id: input.request.snapshotId,
+          complete: input.request.snapshotComplete,
+          capturedAt: input.request.createdAt
+        },
+        sourceAfter: null
+      };
+      saveCodingCommand(input.db, receipt);
+      let observed = "";
+      let observedBytes = 0;
+      let truncatedStream = false;
+      const operations = buildOperations(input, env, config2.envAllowlist);
+      const hostEnv = {
+        ...buildScrubbedShellEnv(env, config2.envAllowlist),
+        ...input.request.environment.env ?? {}
+      };
+      let exitCode = null;
+      let failure;
+      try {
+        const result = await operations.exec(command, absoluteCwd, {
+          signal: input.signal,
+          timeout: timeoutMs,
+          // Host mode runs with the scrubbed environment above; container mode supplies its own.
+          ...isContainer ? {} : { env: hostEnv },
+          onData: (chunk) => {
+            if (observedBytes >= CODING_OUTPUT_BYTES * 4) return;
+            const text3 = chunk.toString("utf8");
+            observed += text3;
+            observedBytes += Buffer.byteLength(text3);
+          }
+        });
+        exitCode = result.exitCode;
+        if (observedBytes > CODING_OUTPUT_BYTES) truncatedStream = true;
+      } catch (error2) {
+        failure = error2;
+      }
+      const finishedAt = Date.now();
+      const redaction = redactJsonValue(observed, secrets);
+      const redacted = redaction !== observed;
+      const tail = diagnosticTail(redaction, CODING_OUTPUT_BYTES);
+      const state3 = resolveState(exitCode, failure, input.signal);
+      receipt.finishedAt = finishedAt;
+      receipt.state = state3;
+      receipt.exitCode = state3 === "succeeded" || state3 === "failed" ? exitCode : null;
+      receipt.diagnostic = tail.text;
+      receipt.truncated = truncatedStream || tail.truncated;
+      receipt.reason = state3 === "blocked" ? "check could not start" : state3 === "timed_out" ? "check exceeded its captured timeout" : state3 === "cancelled" ? "check was cancelled with its turn" : null;
+      saveCodingCommand(input.db, receipt);
+      saveCodingCommandLog(input.db, {
+        commandId,
+        teamId: input.request.teamId,
+        agentId: input.request.recipientAgentId,
+        turnId: input.attemptId,
+        toolCallId: receipt.toolCallId,
+        diagnostic: redaction,
+        observedBytes,
+        redacted,
+        truncated: receipt.truncated
+      });
+      if (state3 === "blocked") {
+        return blocked(
+          "unsupported",
+          failure instanceof Error ? failure.message : "the captured check could not start"
+        );
+      }
+      return {
+        commandId,
+        state: state3,
+        exitCode: state3 === "succeeded" || state3 === "failed" ? exitCode : null,
+        output: tail.text,
+        truncated: receipt.truncated
+      };
+    }
+  };
+}
+function buildOperations(input, env, envAllowlist) {
+  if (input.request.environment.sandbox !== "docker") return createLocalBashOperations3();
+  return createDockerBashOperations({
+    image: input.request.environment.image,
+    env: buildSandboxContainerEnv(env, envAllowlist)
+  });
+}
+function resolveState(exitCode, failure, signal) {
+  if (signal?.aborted) return "cancelled";
+  if (failure) return "blocked";
+  if (exitCode === null) return "timed_out";
+  return exitCode === 0 ? "succeeded" : "failed";
+}
+function blocked(reason, detail3) {
+  return {
+    commandId: null,
+    state: "blocked",
+    exitCode: null,
+    output: detail3,
+    truncated: false,
+    blocker: { reason, detail: detail3 }
+  };
+}
+
+// ../daemon/src/lib/verification/preparation.ts
+async function prepareVerificationTurn(input) {
+  const { db, paths, authToken } = getCtx();
+  const resolved = resolveAgent(db, paths, input.request.recipientAgentId);
+  if (resolved.agent.id !== input.request.recipientAgentId) {
+    throw new Error("verification request does not match the resolved specialist");
+  }
+  const invocation = createTrustedVerificationInvocation({
+    kind: "restricted_verification",
+    authorization: {
+      kind: "request",
+      requestId: input.request.id,
+      attemptId: input.attemptId
+    },
+    bashApprovalMode: "auto_deny"
+  });
+  assertTrustedVerificationInvocation(invocation);
+  const provider = await resolveProtectedProviderRuntime(
+    db,
+    authToken,
+    resolved,
+    resolved.agent.reasoningLevel
+  );
+  return {
+    invocation,
+    spec: {
+      kind: "specialist_verification",
+      agentId: input.request.recipientAgentId,
+      message: verificationPrompt(input.request),
+      turnId: input.attemptId,
+      runtime: provider.runtime,
+      verification: { requestId: input.request.id, attemptId: input.attemptId }
+    },
+    refreshApiKey: provider.refreshApiKey
+  };
+}
+function verificationPrompt(request2) {
+  return `Verify the captured change for verification request ${request2.id}.
+
+Call verification_request to read the captured change, its environment and the checks your requester selected. Then run each declared check with verification_check, using its ordinal. Each check runs once; report failures as failures and blockers as blockers.`;
+}
+function bindVerificationCapability(host2, identity2) {
+  const assertBound = (requestId2, attemptId) => {
+    if (requestId2 !== identity2.requestId || attemptId !== identity2.attemptId) {
+      throw new Error("verification capability is bound to a different request attempt");
+    }
+  };
+  return {
+    read: async (requestId2, attemptId) => {
+      assertBound(requestId2, attemptId);
+      return host2.read();
+    },
+    run: async (requestId2, attemptId, ordinal) => {
+      assertBound(requestId2, attemptId);
+      return host2.invoke(ordinal);
+    }
+  };
+}
+function executePreparedVerification(prepared, opts) {
+  assertTrustedVerificationInvocation(prepared.invocation);
+  return spawnVerificationWorker(prepared.spec, {
+    signal: opts.signal,
+    apiKeyRefreshHost: { refresh: prepared.refreshApiKey },
+    verificationHost: opts.verificationHost,
+    ...opts.workerEntryPath ? { workerEntryPath: opts.workerEntryPath } : {}
+  });
+}
+
+// ../daemon/src/lib/verification/result.ts
+var MAX_RESULT_CHARACTERS = 4e3;
+function deliverVerificationResult(input) {
+  const { request: request2 } = input;
+  if (request2.requesterKind !== "agent" || !request2.requesterAgentId) return false;
+  const payload = renderResult(input);
+  try {
+    sendAgentMessage(input.db, {
+      from: request2.recipientAgentId,
+      to: request2.requesterAgentId,
+      payload,
+      origin: "verification_result",
+      attemptKind: "verification_result",
+      // Per attempt, not per request: a rerun's result is its own delivery, and reusing the request id
+      // would collide with the first attempt's approval identity if the edge requires approval.
+      attemptId: `${request2.id}:${input.attempt.id}`
+    });
+    return true;
+  } catch (error2) {
+    console.warn(
+      JSON.stringify({
+        event: "verification_result_not_delivered",
+        requestId: request2.id,
+        errorName: error2 instanceof Error ? error2.name : "unknown"
+      })
+    );
+    return false;
+  }
+}
+function renderResult(input) {
+  const { request: request2, attempt } = input;
+  const checks = listVerificationChecks(input.db, request2.id);
+  const outcomes = new Map(
+    listVerificationCheckOutcomes(input.db, attempt.id).map((outcome) => [
+      outcome.ordinal,
+      outcome
+    ])
+  );
+  const lines = [
+    `Verification ${request2.id}: ${input.outcome}.`,
+    `Change: snapshot ${request2.snapshotId} (base ${request2.baseOid.slice(0, 12)}${request2.snapshotComplete ? "" : ", INCOMPLETE COVERAGE"}).`,
+    `Environment: image ${request2.environment.image}, shell ${request2.environment.sandbox}.`,
+    input.applicability === null ? "Applicability: not checked." : `Applicability: ${input.applicability === "identical" ? "unchanged since capture" : input.applicability}.`,
+    "",
+    "Checks:"
+  ];
+  for (const check of checks) {
+    const outcome = outcomes.get(check.ordinal);
+    const state3 = outcome?.state ?? "not_executed";
+    const exit = outcome?.exitCode === null || outcome?.exitCode === void 0 ? "" : ` exit ${outcome.exitCode}`;
+    const receipt = outcome?.commandId ? ` coding-receipt:${outcome.commandId}` : outcome && ["succeeded", "failed", "timed_out", "cancelled"].includes(outcome.state) ? " (receipt no longer available)" : "";
+    lines.push(`  [${check.ordinal}] ${state3}${exit} \u2014 ${check.command}${receipt}`);
+  }
+  if (attempt.error) lines.push("", `Limitation: ${attempt.error}`);
+  lines.push(
+    "",
+    "Facts above are executor-owned. A non-zero exit is a result about the commands that ran, never",
+    "proof about later code, and this is not an approval to publish, merge or deploy."
+  );
+  const payload = lines.join("\n");
+  return payload.length > MAX_RESULT_CHARACTERS ? `${payload.slice(0, MAX_RESULT_CHARACTERS)}
+[result truncated]` : payload;
+}
+
+// ../daemon/src/runtime/tools/verification.ts
+var VerificationCapabilityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "VerificationCapabilityError";
+  }
+};
+
+// ../daemon/src/lib/verification/runner.ts
+function createVerificationHost(input) {
+  const { db, request: request2, attemptId, executor } = input;
+  return {
+    async read() {
+      const declared = listVerificationChecks(db, request2.id);
+      const outcomes = new Map(
+        listVerificationCheckOutcomes(db, attemptId).map((outcome) => [outcome.ordinal, outcome])
+      );
+      const checks = declared.map((check) => {
+        const outcome = outcomes.get(check.ordinal);
+        return {
+          ordinal: check.ordinal,
+          command: check.command,
+          cwd: check.cwd,
+          purpose: check.purpose,
+          timeoutMs: check.timeoutMs,
+          state: outcome?.state ?? "not_executed",
+          commandId: outcome?.commandId ?? null,
+          exitCode: outcome?.exitCode ?? null
+        };
+      });
+      return {
+        requestId: request2.id,
+        summary: request2.summary,
+        snapshot: {
+          id: request2.snapshotId,
+          complete: request2.snapshotComplete,
+          head: request2.head,
+          baseOid: request2.baseOid
+        },
+        environment: {
+          image: request2.environment.image,
+          sandbox: request2.environment.sandbox,
+          ...request2.environment.cwd ? { cwd: request2.environment.cwd } : {}
+        },
+        writablePaths: request2.environment.writablePaths ?? [],
+        checks,
+        applicability: input.applicability
+      };
+    },
+    async invoke(ordinal) {
+      const declared = listVerificationChecks(db, request2.id).find(
+        (check) => check.ordinal === ordinal
+      );
+      if (!declared) {
+        throw new VerificationCapabilityError(`check ${ordinal} was not captured with this request`);
+      }
+      const settled = listVerificationCheckOutcomes(db, attemptId).find(
+        (outcome) => outcome.ordinal === ordinal
+      );
+      if (settled && settled.state !== "not_executed") {
+        throw new VerificationCapabilityError(
+          `check ${ordinal} already reported '${settled.state}' and cannot be run again`
+        );
+      }
+      const startedAt = Date.now();
+      let result;
+      try {
+        result = await executor.run({
+          command: declared.command,
+          cwd: declared.cwd,
+          timeoutMs: declared.timeoutMs,
+          purpose: "verification",
+          writablePaths: request2.environment.writablePaths ?? []
+        });
+      } catch (error2) {
+        throw error2 instanceof Error ? error2 : new Error("verification check failed to start");
+      }
+      const state3 = normalizeState(result.state);
+      if (state3 !== "blocked" && !result.commandId) {
+        throw new VerificationCapabilityError(
+          `a ${state3} check must report the receipt that produced it`
+        );
+      }
+      const recorded = recordVerificationCheckOutcome(db, {
+        attemptId,
+        ordinal,
+        state: state3,
+        commandId: state3 === "blocked" ? null : result.commandId,
+        exitCode: state3 === "succeeded" || state3 === "failed" ? result.exitCode : null,
+        startedAt,
+        finishedAt: Date.now()
+      });
+      if (!recorded) {
+        throw new VerificationCapabilityError(`check ${ordinal} was already settled`);
+      }
+      return {
+        ordinal,
+        state: state3,
+        commandId: state3 === "blocked" ? null : result.commandId,
+        exitCode: state3 === "succeeded" || state3 === "failed" ? result.exitCode : null,
+        output: result.output,
+        truncated: result.truncated
+      };
+    }
+  };
+}
+function normalizeState(state3) {
+  return state3;
+}
+function settleVerificationAttempt(db, input) {
+  const now = input.now ?? Date.now();
+  const owned = db.raw.query(
+    `SELECT id FROM verification_attempts
+       WHERE id = ? AND lease_owner = ? AND finished_at IS NULL`
+  ).get(input.attemptId, input.leaseOwner);
+  if (!owned) return "uncertain";
+  const declared = listVerificationChecks(db, input.requestId);
+  const outcomes = new Map(
+    listVerificationCheckOutcomes(db, input.attemptId).map((outcome) => [outcome.ordinal, outcome])
+  );
+  for (const check of declared) {
+    const outcome = outcomes.get(check.ordinal);
+    if (!outcome || outcome.state === "not_executed") {
+      db.raw.run(
+        `UPDATE verification_check_outcomes SET state = 'skipped', finished_at = ?
+         WHERE attempt_id = ? AND ordinal = ? AND state = 'not_executed'`,
+        [now, input.attemptId, check.ordinal]
+      );
+    }
+  }
+  const settled = listVerificationCheckOutcomes(db, input.attemptId);
+  const executed = settled.filter(
+    (outcome) => ["succeeded", "failed"].includes(outcome.state)
+  ).length;
+  const state3 = executed > 0 ? "completed" : "failed";
+  const error2 = state3 === "failed" ? "no captured check executed" : null;
+  const finished = finishVerificationAttempt(db, {
+    attemptId: input.attemptId,
+    leaseOwner: input.leaseOwner,
+    state: state3,
+    error: error2,
+    now
+  });
+  if (!finished) {
+    return "uncertain";
+  }
+  setRequestState(db, input.requestId, state3);
+  return state3;
+}
+function abandonVerificationAttempt(db, input) {
+  const now = input.now ?? Date.now();
+  const finished = finishVerificationAttempt(db, {
+    attemptId: input.attemptId,
+    leaseOwner: input.leaseOwner,
+    state: input.state,
+    error: input.error,
+    now
+  });
+  if (!finished) return false;
+  db.raw.run(
+    `UPDATE verification_check_outcomes
+     SET state = 'unknown', finished_at = ?
+     WHERE attempt_id = ? AND state = 'not_executed'`,
+    [now, input.attemptId]
+  );
+  setRequestState(db, input.requestId, input.state);
+  return true;
+}
+
+// ../daemon/src/lib/verification/dispatch.ts
+var DISPATCH_REGISTRY_KEY = /* @__PURE__ */ Symbol.for("bazilion.verification.dispatch");
+function dispatchRegistry() {
+  const host2 = globalThis;
+  host2[DISPATCH_REGISTRY_KEY] ??= { controllers: /* @__PURE__ */ new Map() };
+  return host2[DISPATCH_REGISTRY_KEY];
+}
+function cancelVerificationDispatch(requestId2) {
+  const controller = dispatchRegistry().controllers.get(requestId2);
+  if (!controller) return false;
+  controller.abort();
+  return true;
+}
+async function dispatchVerificationRequest(requestId2, opts = {}) {
+  const { db, paths } = getCtx();
+  const request2 = getVerificationRequestById(db, requestId2);
+  if (!request2) return "not_dispatchable";
+  if (isActiveAgent(request2.recipientAgentId)) return "agent_busy";
+  const releaseLease = await acquireAgentLifecycleLease(request2.recipientAgentId);
+  const controller = new AbortController();
+  let registered = false;
+  try {
+    if (isActiveAgent(request2.recipientAgentId)) return "agent_busy";
+    registerAgent(request2.recipientAgentId, controller);
+    registered = true;
+  } finally {
+    releaseLease();
+  }
+  if (opts.signal) opts.signal.addEventListener("abort", () => controller.abort(), { once: true });
+  dispatchRegistry().controllers.set(requestId2, controller);
+  let admission;
+  try {
+    admission = await admitVerificationRequest(db, paths, requestId2);
+    if (admission.kind !== "admitted") return "not_dispatchable";
+    const admitted = admission;
+    const live2 = getVerificationRequest(db, request2.teamId, requestId2);
+    if (!live2) {
+      await workspaceLifecycle(db).release(admitted.workspace);
+      settleVerificationAttempt(db, {
+        attemptId: admitted.claim.attempt.id,
+        requestId: requestId2,
+        leaseOwner: VERIFICATION_DISPATCH_OWNER
+      });
+      return "settled";
+    }
+    const prepared = await prepareVerificationTurn({
+      request: live2,
+      attemptId: admitted.claim.attempt.id
+    });
+    const capability = bindVerificationCapability(
+      createVerificationHost({
+        db,
+        request: live2,
+        attemptId: admitted.claim.attempt.id,
+        applicability: "identical",
+        executor: createProtectedCheckExecutor({
+          db,
+          paths,
+          request: live2,
+          attemptId: admitted.claim.attempt.id,
+          teamPath: paths.teamDir(live2.teamId),
+          secrets: () => currentSecrets(),
+          signal: controller.signal
+        })
+      }),
+      { requestId: requestId2, attemptId: admitted.claim.attempt.id }
+    );
+    let failure = null;
+    for await (const frame of executePreparedVerification(prepared, {
+      verificationHost: capability,
+      signal: controller.signal,
+      ...opts.workerEntryPath ? { workerEntryPath: opts.workerEntryPath } : {}
+    })) {
+      if (frame.kind === "fatal") failure ??= frame.error;
+      else if (frame.kind === "event" && frame.event.type === "error") failure ??= frame.event.error;
+    }
+    if (controller.signal.aborted) {
+      const abandoned = abandonVerificationAttempt(db, {
+        attemptId: admitted.claim.attempt.id,
+        requestId: requestId2,
+        leaseOwner: VERIFICATION_DISPATCH_OWNER,
+        state: "cancelled",
+        error: "verification was cancelled before it reported"
+      });
+      if (abandoned) await handBackResult(db, paths, requestId2, "cancelled");
+      return "settled";
+    }
+    if (failure) {
+      const abandoned = abandonVerificationAttempt(db, {
+        attemptId: admitted.claim.attempt.id,
+        requestId: requestId2,
+        leaseOwner: VERIFICATION_DISPATCH_OWNER,
+        state: "failed",
+        error: failure
+      });
+      if (abandoned) await handBackResult(db, paths, requestId2, "failed");
+      return "settled";
+    }
+    const settled = settleVerificationAttempt(db, {
+      attemptId: admitted.claim.attempt.id,
+      requestId: requestId2,
+      leaseOwner: VERIFICATION_DISPATCH_OWNER
+    });
+    if (settled !== "uncertain") await handBackResult(db, paths, requestId2, settled);
+    return "dispatched";
+  } catch (error2) {
+    if (admission?.kind === "admitted") {
+      abandonVerificationAttempt(db, {
+        attemptId: admission.claim.attempt.id,
+        requestId: requestId2,
+        leaseOwner: VERIFICATION_DISPATCH_OWNER,
+        state: controller.signal.aborted ? "cancelled" : "failed",
+        error: protectedFailureMessage(error2, "Verification")
+      });
+    }
+    return "settled";
+  } finally {
+    if (admission?.kind === "admitted") await workspaceLifecycle(db).release(admission.workspace);
+    dispatchRegistry().controllers.delete(requestId2);
+    if (registered) unregisterAgent(request2.recipientAgentId);
+  }
+}
+async function handBackResult(db, paths, requestId2, outcome) {
+  const request2 = getVerificationRequestById(db, requestId2);
+  if (!request2) return;
+  const attempt = listVerificationAttempts(db, requestId2).at(-1);
+  if (!attempt) return;
+  let applicability = null;
+  try {
+    const comparison = await readSnapshotApplicability(
+      db,
+      paths,
+      request2.teamId,
+      request2.snapshotId
+    );
+    applicability = comparison.comparison;
+  } catch {
+    applicability = null;
+  }
+  deliverVerificationResult({ db, paths, request: request2, attempt, outcome, applicability });
+}
+async function dispatchPendingVerifications(now = Date.now()) {
+  const { db, paths } = getCtx();
+  pruneVerificationRequests(db, now);
+  const pending = db.raw.query(
+    `SELECT id FROM verification_requests
+       WHERE state = 'pending' AND expires_at > ?
+       ORDER BY created_at LIMIT 20`
+  ).all(now);
+  void paths;
+  await Promise.allSettled(pending.map((row) => dispatchVerificationRequest(row.id)));
+}
+function currentSecrets() {
+  const { db, authToken } = getCtx();
+  return codingSecrets(mergeSecretsIntoEnv(db, authToken));
+}
+
+// ../daemon/src/lib/scheduler.ts
+var SCHEDULER_KEY = /* @__PURE__ */ Symbol.for("bazilion.scheduler");
+var TICK_MS = Number(process.env.BAZILION_SCHEDULER_TICK_MS ?? 5e3);
+function state2() {
+  const g2 = globalThis;
+  let s = g2[SCHEDULER_KEY];
+  if (!s) {
+    s = { timer: null, firing: /* @__PURE__ */ new Set(), cronCache: /* @__PURE__ */ new Map(), stopped: false };
+    g2[SCHEDULER_KEY] = s;
+  }
+  return s;
+}
+function floorToMinute(ms) {
+  return Math.floor(ms / 6e4) * 6e4;
+}
+function isDue(t, now, cronCache) {
+  if (!t.enabled) return false;
+  if (t.kind === "interval") {
+    const every = (t.intervalSec ?? 0) * 1e3;
+    if (every <= 0) return false;
+    const baseline = t.lastFiredAt ?? t.createdAt;
+    return now - baseline >= every;
+  }
+  if (t.kind === "cron") {
+    if (!t.cronExpr) return false;
+    let parsed = cronCache.get(t.cronExpr);
+    if (!parsed) {
+      try {
+        parsed = parseCron(t.cronExpr);
+      } catch {
+        return false;
+      }
+      cronCache.set(t.cronExpr, parsed);
+    }
+    const nowFloor = floorToMinute(now);
+    if (t.lastFiredAt && floorToMinute(t.lastFiredAt) === nowFloor) return false;
+    return matchesCron(parsed, new Date(nowFloor));
+  }
+  return false;
+}
 function scheduledOccurrence(t, now) {
   if (t.kind === "cron") return floorToMinute(now);
   const baseline = t.lastFiredAt ?? t.createdAt;
@@ -42404,6 +43670,7 @@ async function tick() {
     work.push(fireInboxWake(agentId));
   }
   work.push(dispatchClaimableReviews(now));
+  work.push(dispatchPendingVerifications(now));
   await Promise.allSettled(work);
 }
 function startScheduler() {
@@ -42463,6 +43730,7 @@ function bootstrap(paths) {
     recoverInterrupted2(db);
     recoverInterrupted(db);
     interruptCodingCommands(db);
+    recoverInterruptedVerificationAttempts(db, VERIFICATION_DISPATCH_OWNER);
     reconcileApprovalHolds(db);
     recoverInterruptedResultDeliveries(db);
     reconcilePrivateResults(db);
@@ -42630,7 +43898,7 @@ async function authMiddleware(c, next) {
 }
 
 // ../daemon/src/routes/agents.ts
-import { randomUUID as randomUUID34 } from "crypto";
+import { randomUUID as randomUUID37 } from "crypto";
 import { existsSync as existsSync18, readFileSync as readFileSync12 } from "fs";
 import { join as join28 } from "path";
 import { Hono } from "hono";
@@ -43955,7 +45223,7 @@ async function notifyTelegramQueueStatus(db, agentId, itemId) {
 }
 
 // ../daemon/src/lib/user-queue-admission.ts
-import { randomUUID as randomUUID33 } from "crypto";
+import { randomUUID as randomUUID36 } from "crypto";
 async function enqueueTelegramInput(binding, message, attachments2, context = getCtx()) {
   validateInput(message, attachments2);
   const { db, paths, authToken } = context;
@@ -43974,7 +45242,7 @@ async function enqueueTelegramInput(binding, message, attachments2, context = ge
     const existing = findAttempt(db, "telegram", binding.authorization.attemptId);
     return db.raw.transaction(() => {
       const item = accept(db, {
-        id: existing?.id ?? randomUUID33(),
+        id: existing?.id ?? randomUUID36(),
         agentId,
         teamId: existing?.teamId ?? agent.team.id,
         conversationId,
@@ -45794,7 +47062,7 @@ agentsRouter.post("/:id/chat", async (c) => {
   if (!message && attachments2.length === 0) {
     return c.json({ error: "message or an attachment is required" }, 400);
   }
-  const requestAttemptId = c.req.header("x-request-id") ?? randomUUID34();
+  const requestAttemptId = c.req.header("x-request-id") ?? randomUUID37();
   let preparedTurn;
   try {
     preparedTurn = await prepareAgentTurn({
@@ -46257,6 +47525,9 @@ import { Bot as Bot2, InputFile as InputFile2 } from "grammy";
 import { Hono as Hono2 } from "hono";
 
 // ../daemon/src/lib/approval-delivery-plan.ts
+function isTelegramDeliveryPlan(plan) {
+  return plan.kind === "telegram_text" || plan.kind === "telegram_typing" || plan.kind === "telegram_image" || plan.kind === "telegram_file";
+}
 var ApprovalDeliveryValidationError = class extends Error {
   constructor(code) {
     super(`approval_delivery_invalid: ${code}`);
@@ -46297,6 +47568,14 @@ function planApprovalDelivery(approval, context = {}) {
       return invalid3("question_binding");
     }
   }
+  if (approval.payloadKind === "verification_request") {
+    const payload = approval.payload;
+    if (approval.operation !== "request_verification" || approval.origin !== "verification_request" || !isRecord3(payload) || Object.keys(payload).sort().join(",") !== "requestId" || typeof payload.requestId !== "string" || !/^[0-9a-f-]{36}$/i.test(payload.requestId))
+      return invalid3("verification_request_payload");
+    requireAttemptKind(approval, "verification_request");
+    if (approval.attemptId !== payload.requestId) return invalid3("verification_request_attempt");
+    return { kind: "verification_request", approval, payload: { requestId: payload.requestId } };
+  }
   if (approval.payloadKind === "queued_user") {
     const payload = validateQueuedUserApproval(approval, context.queuedInput ?? (() => null));
     return { kind: "queued_user", approval, payload };
@@ -46678,6 +47957,40 @@ async function deliverQueuedApproval(approval) {
   }
 }
 
+// ../daemon/src/lib/verification/approval.ts
+function validateVerificationGrant(db, paths, requestId2) {
+  const request2 = getVerificationRequestByIdSafe(db, requestId2);
+  if (!request2) return "verification request is unknown or past its retention window";
+  if (request2.state !== "awaiting_approval") {
+    return `verification request is ${request2.state}, not awaiting approval`;
+  }
+  const team = safeTeam2(db, paths, request2.teamId);
+  if (!team) return "verification request no longer names a known Team";
+  const recipient = get(db, request2.recipientAgentId);
+  if (!recipient || recipient.status === "archived") {
+    return "the selected specialist is missing or archived";
+  }
+  if (recipient.teamId !== team.id) return "the selected specialist left this Team";
+  if (!getSourceSnapshot(db, team.id, request2.snapshotId)) {
+    return "the captured change is no longer inside its retention window";
+  }
+  return null;
+}
+function releaseVerificationGrant(db, requestId2) {
+  const request2 = getVerificationRequestByIdSafe(db, requestId2);
+  if (request2?.state === "awaiting_approval") setRequestState(db, requestId2, "pending");
+}
+function getVerificationRequestByIdSafe(db, requestId2) {
+  return getVerificationRequestById(db, requestId2);
+}
+function safeTeam2(db, paths, teamId) {
+  try {
+    return requireTeam(db, paths, teamId);
+  } catch {
+    return null;
+  }
+}
+
 // ../daemon/src/routes/approvals.ts
 var approvalsRouter = new Hono2();
 approvalsRouter.use("*", async (_c, next) => {
@@ -46799,6 +48112,33 @@ approvalsRouter.post("/:id/approve", async (c) => {
       );
       return c.json({ error: "approval delivery failed", detail: error2.message }, 500);
     }
+    if (pendingPlan.kind === "verification_request") {
+      const { paths } = getCtx();
+      const granted = communicationApprovals_exports.grantVerificationRequest(
+        db,
+        id,
+        "authenticated_operator",
+        (approval) => authorizeInSnapshot(db, {
+          source: approval.source,
+          target: approval.target,
+          origin: approval.origin,
+          attemptKind: approval.attemptKind,
+          attemptId: approval.attemptId
+        }),
+        () => validateVerificationGrant(db, paths, pendingPlan.payload.requestId),
+        () => releaseVerificationGrant(db, pendingPlan.payload.requestId)
+      );
+      if (!granted.granted) {
+        return c.json(
+          {
+            error: granted.failureKind === "revalidation" ? "approval revalidation failed" : "approval delivery failed",
+            detail: granted.error
+          },
+          409
+        );
+      }
+      return c.json(granted.approval);
+    }
     if (pendingPlan.kind === "scheduler_trigger") {
       const granted = communicationApprovals_exports.grantSchedulerTrigger(
         db,
@@ -46921,6 +48261,9 @@ async function deliver(plan) {
   if (plan.kind === "scheduler_trigger") {
     return;
   }
+  if (plan.kind === "verification_request") {
+    return;
+  }
   if (plan.kind === "agent_turn") {
     const preparedTurn = await prepareAgentTurn({
       invocation: createTrustedTurnInvocation({
@@ -47025,6 +48368,9 @@ async function deliver(plan) {
     if (failure) throw new Error(failure);
     return;
   }
+  if (!isTelegramDeliveryPlan(plan)) {
+    throw new Error("approval_delivery_invalid: no delivery handler for this plan kind");
+  }
   const { db, authToken } = getCtx();
   if (plan.kind === "telegram_file" && plan.payload.result) {
     if (plan.approval.source.kind !== "agent") throw new Error("Missing result producer");
@@ -48078,7 +49424,7 @@ function createBackupArchive(paths, snapshot) {
 }
 
 // ../daemon/src/lib/daemon-liveness.ts
-import { createHash as createHash17, randomUUID as randomUUID35 } from "crypto";
+import { createHash as createHash17, randomUUID as randomUUID38 } from "crypto";
 import {
   chmodSync as chmodSync2,
   closeSync as closeSync10,
@@ -48248,7 +49594,7 @@ function acquireDaemonLiveness(paths) {
   mkdirSync11(dirname6(resolve7(paths.home)), { recursive: true });
   const path = daemonLivenessPath(paths.home);
   mkdirSync11(dirname6(path), { recursive: true });
-  const instanceId = randomUUID35();
+  const instanceId = randomUUID38();
   const startedAt = Date.now();
   let fd = null;
   let reclaimClaim = null;
@@ -48613,7 +49959,7 @@ miscRouter.get("/health/details", async (c) => {
       }
     }
   });
-  const report = {
+  const report2 = {
     // Structural install health only. Protected work has an explicit, independent signal below.
     ok: pathChecks.home && pathChecks.db && pathChecks.auth && pathChecks.profiles && pathChecks.agents && pathChecks.skills && (database === null || database.ok) && parseErrors === 0 && shellSecurity.ok,
     protectedWorkBaselineReady: executionSecurity.protectedUnattendedTurns.baseRuntimeReady,
@@ -48647,7 +49993,7 @@ miscRouter.get("/health/details", async (c) => {
       decisions: { ...communicationDecisionMetrics }
     }
   };
-  return c.json(report);
+  return c.json(report2);
 });
 function publicShellSecurityError(error2) {
   const message = error2 instanceof Error ? error2.message : String(error2);
@@ -48763,7 +50109,7 @@ import { bodyLimit } from "hono/body-limit";
 import { HTTPException } from "hono/http-exception";
 
 // ../daemon/src/lib/notification-control.ts
-import { randomUUID as randomUUID36 } from "crypto";
+import { randomUUID as randomUUID39 } from "crypto";
 
 // ../daemon/src/lib/notification-authorization.ts
 function authorizeAttentionNotification(db, item, captured) {
@@ -48928,7 +50274,7 @@ var NotificationControl = class {
     );
     for (const item of items) byKind[item.kind]++;
     const value = {
-      id: randomUUID36(),
+      id: randomUUID39(),
       settingsRevision: revision4,
       destinationId: binding.id,
       kinds,
@@ -49838,7 +51184,7 @@ async function parseImportInput(request2) {
 }
 
 // ../daemon/src/routes/team-templates.ts
-import { randomUUID as randomUUID37 } from "crypto";
+import { randomUUID as randomUUID40 } from "crypto";
 import { Hono as Hono17 } from "hono";
 var teamTemplatesRouter = new Hono17();
 teamTemplatesRouter.get("/", (c) => {
@@ -49878,7 +51224,7 @@ teamTemplatesRouter.post("/import", async (c) => {
       if (!profiles_exports.get(db, parsed.profileId)) {
         throw new Error(`profile not found: ${parsed.profileId}`);
       }
-      const slotId = randomUUID37();
+      const slotId = randomUUID40();
       keyToSlot.set(clientKey, slotId);
       return { ...parsed, slotId };
     });
@@ -50326,6 +51672,194 @@ function lineRange(request2, _captured) {
   return { start, end };
 }
 
+// ../daemon/src/lib/verification/capture.ts
+function captureVerificationRequest(db, paths, intent, env = process.env) {
+  const team = safeTeam3(db, paths, intent.teamId);
+  if (!team) return blocked2("unsupported", "the request does not name a known Team");
+  const recipient = get(db, intent.recipientAgentId);
+  if (!recipient) return blocked2("recipient_unavailable", "the selected specialist does not exist");
+  if (recipient.teamId !== team.id) {
+    return blocked2("recipient_not_same_team", "the selected specialist belongs to another Team");
+  }
+  if (recipient.status === "archived") {
+    return blocked2("recipient_unavailable", "the selected specialist is archived");
+  }
+  if (intent.requesterKind === "agent") {
+    const requester = get(db, intent.requesterAgentId);
+    if (!requester) return blocked2("requester_unavailable", "the requesting Agent does not exist");
+    if (requester.teamId !== team.id) {
+      return blocked2("requester_unavailable", "the requesting Agent belongs to another Team");
+    }
+    if (requester.id === recipient.id) {
+      return blocked2("unsupported", "a specialist cannot verify its own request");
+    }
+  }
+  const snapshot = getSourceSnapshot(db, team.id, intent.snapshotId);
+  if (!snapshot) {
+    return blocked2(
+      "snapshot_unavailable",
+      "the captured change is unknown in this Team or past its retention window"
+    );
+  }
+  if (!snapshot.complete) {
+    return blocked2(
+      "snapshot_incomplete",
+      "the captured change has incomplete coverage, so a result could not be tied to it"
+    );
+  }
+  const environment = admittedEnvironment(db, team.id, env);
+  if (!environment) {
+    return blocked2(
+      "environment_unavailable",
+      "the Team has no usable admitted environment to freeze with the request"
+    );
+  }
+  if (intent.writablePaths && intent.writablePaths.length > 0) {
+    const bounded3 = [];
+    for (const path of intent.writablePaths) {
+      if (typeof path !== "string" || path.length === 0 || path.length > 1e3) {
+        return blocked2("unsupported", "declared writable paths are outside their bounded contract");
+      }
+      if (path.startsWith("/") || path.startsWith("~") || path.includes("\\")) {
+        return blocked2("unsupported", `declared writable path must be Team-relative: ${path}`);
+      }
+      const parts = path.split("/").filter((part) => part && part !== ".");
+      if (parts.length === 0 || parts.some((part) => part === "..")) {
+        return blocked2(
+          "unsupported",
+          `declared writable path must be inside the workspace: ${path}`
+        );
+      }
+      bounded3.push(parts.join("/"));
+    }
+    if (bounded3.length > 16) {
+      return blocked2("unsupported", "too many declared writable paths");
+    }
+    environment.writablePaths = bounded3;
+  }
+  try {
+    const request2 = createVerificationRequest(db, {
+      teamId: team.id,
+      requesterKind: intent.requesterKind,
+      requesterAgentId: intent.requesterKind === "agent" ? intent.requesterAgentId : null,
+      recipientAgentId: recipient.id,
+      messageId: intent.messageId ?? null,
+      sourceSessionId: intent.sourceSessionId ?? null,
+      snapshotId: snapshot.snapshotId,
+      snapshotComplete: snapshot.complete,
+      head: snapshot.head,
+      baseOid: snapshot.baseOid,
+      environment,
+      summary: intent.summary ?? null,
+      checks: intent.checks
+    });
+    return { kind: "captured", request: request2 };
+  } catch (error2) {
+    return blocked2("unsupported", error2 instanceof Error ? error2.message : "invalid request");
+  }
+}
+function admittedEnvironment(db, teamId, env) {
+  try {
+    const security = resolveShellSecurityConfig(env);
+    const resolved = resolveTeamCodingEnvironment(db, teamId, env);
+    if (!resolved.image) return null;
+    return {
+      image: resolved.image,
+      sandbox: security.sandboxMode === "docker" ? "docker" : "off",
+      ...resolved.coding ? { cwd: resolved.coding.cwd } : {},
+      ...resolved.coding ? { env: { ...resolved.coding.env } } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function readVerificationSummary(db, paths, teamId, requestId2) {
+  const team = safeTeam3(db, paths, teamId);
+  if (!team) return null;
+  const record3 = getVerificationRequest(db, team.id, requestId2);
+  if (!record3) return null;
+  const checks = listVerificationChecks(db, record3.id);
+  const attempts = listVerificationAttempts(db, record3.id).map((attempt) => ({
+    id: attempt.id,
+    attemptNumber: attempt.attemptNumber,
+    supersedesAttemptId: attempt.supersedesAttemptId,
+    state: attempt.state,
+    startedAt: attempt.startedAt,
+    finishedAt: attempt.finishedAt,
+    error: attempt.error,
+    outcomes: listVerificationCheckOutcomes(db, attempt.id).map((outcome) => ({
+      ordinal: outcome.ordinal,
+      state: outcome.state,
+      commandId: outcome.commandId,
+      // Executed, but no receipt pointer: the receipt was pruned or expired, which is different from
+      // never having recorded one.
+      receiptUnavailable: outcome.commandId === null && ["succeeded", "failed", "timed_out", "cancelled"].includes(outcome.state),
+      exitCode: outcome.exitCode,
+      startedAt: outcome.startedAt,
+      finishedAt: outcome.finishedAt
+    }))
+  }));
+  return {
+    request: toWireRequest(record3),
+    checks: checks.map((check) => ({
+      ordinal: check.ordinal,
+      command: check.command,
+      cwd: check.cwd,
+      purpose: check.purpose,
+      timeoutMs: check.timeoutMs
+    })),
+    attempts
+  };
+}
+async function readVerificationReport(db, paths, teamId, requestId2) {
+  const summary = readVerificationSummary(db, paths, teamId, requestId2);
+  if (!summary) return null;
+  const applicability = await readSnapshotApplicability(
+    db,
+    paths,
+    summary.request.teamId,
+    summary.request.snapshot.id
+  );
+  return {
+    ...summary,
+    applicability: {
+      comparison: applicability.comparison,
+      testedSnapshotId: applicability.comparison === "unknown" ? null : summary.request.snapshot.id
+    }
+  };
+}
+function toWireRequest(record3) {
+  return {
+    id: record3.id,
+    teamId: record3.teamId,
+    requester: record3.requesterKind === "agent" && record3.requesterAgentId ? { kind: "agent", agentId: record3.requesterAgentId } : { kind: "operator" },
+    recipientAgentId: record3.recipientAgentId,
+    messageId: record3.messageId,
+    sourceSessionId: record3.sourceSessionId,
+    snapshot: {
+      id: record3.snapshotId,
+      complete: record3.snapshotComplete,
+      head: record3.head,
+      baseOid: record3.baseOid
+    },
+    environment: record3.environment,
+    summary: record3.summary,
+    state: record3.state,
+    createdAt: record3.createdAt,
+    expiresAt: record3.expiresAt
+  };
+}
+function blocked2(reason, detail3) {
+  return { kind: "blocked", blocker: { reason, detail: detail3 } };
+}
+function safeTeam3(db, paths, teamId) {
+  try {
+    return requireTeam(db, paths, teamId);
+  } catch {
+    return null;
+  }
+}
+
 // ../daemon/src/routes/teams.ts
 var USER_MD_MAX_BYTES2 = 12e3;
 var teamsRouter = new Hono18();
@@ -50949,6 +52483,91 @@ function teamPolicyError(c, error2) {
   }
   return c.json({ error: message, code: "team_policy_invalid" }, 400);
 }
+teamsRouter.get("/:id/verifications", async (c) => {
+  const { db, paths } = getCtx();
+  c.header("Cache-Control", "no-store");
+  try {
+    const team = requireTeam(db, paths, c.req.param("id"));
+    const requests = listVerificationRequests(db, team.id);
+    const reports = requests.map((record3) => readVerificationSummary(db, paths, team.id, record3.id)).filter((summary) => summary !== null);
+    return c.json({ requests: reports });
+  } catch (error2) {
+    return reviewFailure(c, error2);
+  }
+});
+teamsRouter.post("/:id/verifications", async (c) => {
+  const { db, paths } = getCtx();
+  c.header("Cache-Control", "no-store");
+  const body = await c.req.json().catch(() => null);
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return c.json({ error: "Invalid verification request" }, 400);
+  }
+  const input = body;
+  if (typeof input.recipientAgentId !== "string" || typeof input.snapshotId !== "string" || !Array.isArray(input.checks) || input.checks.some(
+    (check) => !check || typeof check.command !== "string" || typeof check.cwd !== "string" || typeof check.purpose !== "string" || !Number.isInteger(check.timeoutMs)
+  )) {
+    return c.json({ error: "Invalid verification request" }, 400);
+  }
+  try {
+    const result = captureVerificationRequest(db, paths, {
+      teamId: c.req.param("id"),
+      requesterKind: "operator",
+      requesterAgentId: null,
+      recipientAgentId: input.recipientAgentId,
+      snapshotId: input.snapshotId,
+      checks: input.checks,
+      summary: typeof input.summary === "string" ? input.summary : null,
+      sourceSessionId: typeof input.sourceSessionId === "string" ? input.sourceSessionId : null,
+      ...Array.isArray(input.writablePaths) ? { writablePaths: input.writablePaths } : {}
+    });
+    if (result.kind === "blocked") return c.json({ blocked: result.blocker }, 409);
+    return c.json({ request: await report(db, paths, result.request) }, 201);
+  } catch (error2) {
+    return reviewFailure(c, error2);
+  }
+});
+teamsRouter.get("/:id/verifications/:requestId", async (c) => {
+  const { db, paths } = getCtx();
+  c.header("Cache-Control", "no-store");
+  try {
+    const report2 = await readVerificationReport(
+      db,
+      paths,
+      c.req.param("id"),
+      c.req.param("requestId")
+    );
+    if (!report2) return c.json({ error: "Verification request not found" }, 404);
+    return c.json({ request: report2 });
+  } catch (error2) {
+    return reviewFailure(c, error2);
+  }
+});
+teamsRouter.post("/:id/verifications/:requestId/cancel", async (c) => {
+  const { db, paths } = getCtx();
+  c.header("Cache-Control", "no-store");
+  try {
+    const team = requireTeam(db, paths, c.req.param("id"));
+    const record3 = getVerificationRequest(db, team.id, c.req.param("requestId"));
+    if (!record3) return c.json({ error: "Verification request not found" }, 404);
+    if (record3.state !== "pending" && record3.state !== "awaiting_approval" && record3.state !== "running") {
+      return c.json({ error: `Verification request is already ${record3.state}` }, 409);
+    }
+    if (record3.state === "pending" || record3.state === "awaiting_approval") {
+      setRequestState(db, record3.id, "cancelled");
+    } else {
+      const aborted2 = cancelVerificationDispatch(record3.id);
+      if (!aborted2) {
+        return c.json({ error: "Verification request is not cancelled yet; retry" }, 409);
+      }
+    }
+    return c.json({ request: await readVerificationReport(db, paths, team.id, record3.id) });
+  } catch (error2) {
+    return reviewFailure(c, error2);
+  }
+});
+async function report(db, paths, record3) {
+  return readVerificationReport(db, paths, record3.teamId, record3.id);
+}
 
 // ../daemon/src/routes/telegram.ts
 import { Hono as Hono19 } from "hono";