codeharness 0.19.2 → 0.19.3

package/dist/index.js

@@ -1387,7 +1387,7 @@ function getInstallCommand(stack) {
 }
 
 // src/commands/init.ts
-var HARNESS_VERSION = true ? "0.19.2" : "0.0.0-dev";
+var HARNESS_VERSION = true ? "0.19.3" : "0.0.0-dev";
 function getProjectName(projectDir) {
   try {
     const pkgPath = join7(projectDir, "package.json");
@@ -2586,7 +2586,7 @@ function buildSpawnArgs(opts) {
   return args;
 }
 function registerRunCommand(program) {
-  program.command("run").description("Execute the autonomous coding loop").option("--max-iterations <n>", "Maximum loop iterations", "50").option("--timeout <seconds>", "Total loop timeout in seconds", "14400").option("--iteration-timeout <minutes>", "Per-iteration timeout in minutes", "30").option("--live", "Show live output streaming", false).option("--calls <n>", "Max API calls per hour", "100").option("--max-story-retries <n>", "Max retries per story before flagging", "10").option("--reset", "Clear retry counters, flagged stories, and circuit breaker before starting", false).action(async (options, cmd) => {
+  program.command("run").description("Execute the autonomous coding loop").option("--max-iterations <n>", "Maximum loop iterations", "50").option("--timeout <seconds>", "Total loop timeout in seconds", "43200").option("--iteration-timeout <minutes>", "Per-iteration timeout in minutes", "30").option("--live", "Show live output streaming", false).option("--calls <n>", "Max API calls per hour", "100").option("--max-story-retries <n>", "Max retries per story before flagging", "10").option("--reset", "Clear retry counters, flagged stories, and circuit breaker before starting", false).action(async (options, cmd) => {
     const globalOpts = cmd.optsWithGlobals();
     const isJson = !!globalOpts.json;
     const outputOpts = { json: isJson };
@@ -2668,12 +2668,12 @@ function registerRunCommand(program) {
         cwd: projectDir,
         env
       });
-      const exitCode = await new Promise((resolve2, reject) => {
+      const exitCode = await new Promise((resolve3, reject) => {
         child.on("error", (err) => {
           reject(err);
         });
         child.on("close", (code) => {
-          resolve2(code ?? 1);
+          resolve3(code ?? 1);
         });
       });
       if (isJson) {
@@ -2730,216 +2730,323 @@ function registerRunCommand(program) {
 }
 
 // src/commands/verify.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync14 } from "fs";
+import { join as join13 } from "path";
 
-// src/lib/verify-parser.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
-var UI_KEYWORDS = [
-  "agent-browser",
-  "screenshot",
-  "navigate",
-  "click",
-  "form",
-  "ui verification",
-  "ui acceptance"
-];
-var API_KEYWORDS = [
-  "http",
-  "api",
-  "endpoint",
-  "curl",
-  "rest",
-  "response bod"
-];
-var DB_KEYWORDS = [
-  "database",
-  "db state",
-  "db mcp",
-  "query",
-  "sql",
-  "table"
-];
-var INTEGRATION_KEYWORDS = [
-  "external system",
-  "real infrastructure",
-  "manual verification"
-];
-var ESCALATE_KEYWORDS = [
-  "physical hardware",
-  "manual human",
-  "visual inspection by human",
-  "paid external service"
-];
-function classifyVerifiability(description) {
-  const lower = description.toLowerCase();
-  for (const kw of INTEGRATION_KEYWORDS) {
-    if (lower.includes(kw)) return "integration-required";
-  }
-  return "cli-verifiable";
+// src/types/result.ts
+function ok2(data) {
+  return { success: true, data };
 }
-function classifyStrategy(description) {
-  const lower = description.toLowerCase();
-  for (const kw of ESCALATE_KEYWORDS) {
-    if (lower.includes(kw)) return "escalate";
+function fail2(error, context) {
+  if (context !== void 0) {
+    return { success: false, error, context };
   }
-  return "docker";
-}
-var VERIFICATION_TAG_PATTERN = /<!--\s*verification:\s*(cli-verifiable|integration-required)\s*-->/;
-function parseVerificationTag(text) {
-  const match = VERIFICATION_TAG_PATTERN.exec(text);
-  return match ? match[1] : null;
+  return { success: false, error };
 }
-function classifyAC(description) {
-  const lower = description.toLowerCase();
-  for (const kw of UI_KEYWORDS) {
-    if (lower.includes(kw)) return "ui";
-  }
-  for (const kw of API_KEYWORDS) {
-    if (lower.includes(kw)) return "api";
-  }
-  for (const kw of DB_KEYWORDS) {
-    if (lower.includes(kw)) return "db";
+
+// src/modules/verify/proof.ts
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+function classifyEvidenceCommands(proofContent) {
+  const results = [];
+  const codeBlockPattern = /```(?:bash|shell)\n([\s\S]*?)```/g;
+  for (const match of proofContent.matchAll(codeBlockPattern)) {
+    const block = match[1].trim();
+    const lines = block.split("\n").filter((l) => l.trim().length > 0);
+    for (const line of lines) {
+      const cmd = line.trim();
+      if (!cmd) continue;
+      results.push({ command: cmd, type: classifyCommand(cmd) });
+    }
   }
-  return "general";
+  return results;
 }
-function parseStoryACs(storyFilePath) {
-  if (!existsSync11(storyFilePath)) {
-    throw new Error(
-      `Story file not found: ${storyFilePath}. Ensure the story file exists at the expected path.`
-    );
-  }
-  const content = readFileSync10(storyFilePath, "utf-8");
-  const lines = content.split("\n");
-  let acSectionStart = -1;
-  for (let i = 0; i < lines.length; i++) {
-    if (/^##\s+Acceptance\s+Criteria/i.test(lines[i])) {
-      acSectionStart = i + 1;
-      break;
-    }
+function classifyCommand(cmd) {
+  if (/docker\s+exec\b/.test(cmd)) {
+    return "docker-exec";
   }
-  if (acSectionStart === -1) {
-    warn('No "## Acceptance Criteria" section found in story file');
-    return [];
+  if (/docker\s+(ps|logs|inspect|stats|top|port)\b/.test(cmd)) {
+    return "docker-host";
   }
-  let acSectionEnd = lines.length;
-  for (let i = acSectionStart; i < lines.length; i++) {
-    if (/^##\s+/.test(lines[i]) && i !== acSectionStart - 1) {
-      acSectionEnd = i;
-      break;
-    }
+  if (/curl\b/.test(cmd) && /localhost:(9428|8428|16686)\b/.test(cmd)) {
+    return "observability";
   }
-  const acSection = lines.slice(acSectionStart, acSectionEnd).join("\n");
-  const acPattern = /^\s*(\d+)\.\s+/;
-  const acs = [];
-  const acLines = acSection.split("\n");
-  let currentId = null;
-  let currentDesc = [];
-  const flushCurrent = () => {
-    if (currentId !== null && currentDesc.length > 0) {
-      const description = currentDesc.join(" ").trim();
-      if (description) {
-        const tag = parseVerificationTag(description);
-        const verifiability = tag ?? classifyVerifiability(description);
-        const strategy = classifyStrategy(description);
-        acs.push({
-          id: currentId,
-          description,
-          type: classifyAC(description),
-          verifiability,
-          strategy
-        });
-      } else {
-        warn(`Skipping malformed AC #${currentId}: empty description`);
-      }
-    }
-  };
-  for (const line of acLines) {
-    const match = acPattern.exec(line);
-    if (match) {
-      flushCurrent();
-      currentId = match[1];
-      currentDesc = [line.replace(acPattern, "").trim()];
-    } else if (currentId !== null && line.trim()) {
-      currentDesc.push(line.trim());
-    }
+  if (/\bgrep\b/.test(cmd) && /\bsrc\//.test(cmd)) {
+    return "grep-src";
   }
-  flushCurrent();
-  return acs;
+  return "other";
 }
-
-// src/lib/verify.ts
-import { execFileSync as execFileSync5 } from "child_process";
-import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "fs";
-import { join as join11 } from "path";
-
-// src/lib/doc-health.ts
-import { execSync } from "child_process";
-import {
-  existsSync as existsSync12,
-  mkdirSync as mkdirSync4,
-  readFileSync as readFileSync11,
-  readdirSync as readdirSync2,
-  statSync,
-  unlinkSync,
-  writeFileSync as writeFileSync7
-} from "fs";
-import { join as join10, relative } from "path";
-var DO_NOT_EDIT_HEADER2 = "<!-- DO NOT EDIT MANUALLY";
-var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".js", ".py"]);
-var DEFAULT_MODULE_THRESHOLD = 3;
-function findModules(dir, threshold) {
-  const limit = threshold ?? DEFAULT_MODULE_THRESHOLD;
-  const root = dir;
-  const modules = [];
-  function walk(current) {
-    let entries;
-    try {
-      entries = readdirSync2(current);
-    } catch {
-      return;
-    }
-    const dirName = current.split("/").pop() ?? "";
-    if (dirName === "node_modules" || dirName === ".git" || dirName === "dist" || dirName === "coverage" || dirName.startsWith(".") && current !== root) {
-      return;
-    }
-    let sourceCount = 0;
-    const subdirs = [];
-    for (const entry of entries) {
-      const fullPath = join10(current, entry);
-      let stat;
-      try {
-        stat = statSync(fullPath);
-      } catch {
-        continue;
-      }
-      if (stat.isDirectory()) {
-        subdirs.push(fullPath);
-      } else if (stat.isFile()) {
-        const ext = getExtension(entry);
-        if (SOURCE_EXTENSIONS.has(ext) && !isTestFile(entry)) {
-          sourceCount++;
-        }
-      }
-    }
-    if (sourceCount >= limit) {
-      const rel = relative(root, current);
-      if (rel !== "") {
-        modules.push(rel);
+function checkBlackBoxEnforcement(proofContent) {
+  const commands = classifyEvidenceCommands(proofContent);
+  const grepSrcCount = commands.filter((c) => c.type === "grep-src").length;
+  const dockerExecCount = commands.filter((c) => c.type === "docker-exec").length;
+  const observabilityCount = commands.filter((c) => c.type === "observability").length;
+  const otherCount = commands.filter((c) => c.type === "other").length;
+  const totalCommands = commands.length;
+  const grepRatio = totalCommands > 0 ? grepSrcCount / totalCommands : 0;
+  const acsMissingDockerExec = [];
+  const acHeaderPattern = /^## AC ?(\d+):/gm;
+  const acMatches = [...proofContent.matchAll(acHeaderPattern)];
+  if (acMatches.length > 0) {
+    for (let i = 0; i < acMatches.length; i++) {
+      const acNum = parseInt(acMatches[i][1], 10);
+      const start = acMatches[i].index;
+      const end = i + 1 < acMatches.length ? acMatches[i + 1].index : proofContent.length;
+      const section = proofContent.slice(start, end);
+      if (section.includes("[ESCALATE]")) continue;
+      const sectionCommands = classifyEvidenceCommands(section);
+      const hasBlackBoxEvidence = sectionCommands.some(
+        (c) => c.type === "docker-exec" || c.type === "docker-host" || c.type === "observability"
+      );
+      if (!hasBlackBoxEvidence) {
+        acsMissingDockerExec.push(acNum);
       }
     }
-    for (const subdir of subdirs) {
-      walk(subdir);
-    }
   }
-  walk(root);
-  return modules;
+  const grepTooHigh = grepRatio > 0.5;
+  const missingDockerExec = acsMissingDockerExec.length > 0;
+  const hasExtractableCommands = totalCommands > 0;
+  return {
+    blackBoxPass: !hasExtractableCommands || !grepTooHigh && !missingDockerExec,
+    grepSrcCount,
+    dockerExecCount,
+    observabilityCount,
+    otherCount,
+    grepRatio,
+    acsMissingDockerExec
+  };
 }
-function getExtension(filename) {
-  const dot = filename.lastIndexOf(".");
-  return dot >= 0 ? filename.slice(dot) : "";
+function hasFailVerdict(section) {
+  return section.replace(/```[\s\S]*?```/g, "").replace(/`[^`]+`/g, "").includes("[FAIL]");
 }
-function isTestFile(filename) {
+function validateProofQuality(proofPath) {
+  const emptyResult = {
+    verified: 0,
+    pending: 0,
+    escalated: 0,
+    total: 0,
+    passed: false,
+    grepSrcCount: 0,
+    dockerExecCount: 0,
+    observabilityCount: 0,
+    otherCount: 0,
+    blackBoxPass: false
+  };
+  if (!existsSync11(proofPath)) {
+    return emptyResult;
+  }
+  const content = readFileSync10(proofPath, "utf-8");
+  const bbTierMatch = /\*\*Tier:\*\*\s*(unit-testable|black-box)/i.exec(content);
+  const bbIsUnitTestable = bbTierMatch ? bbTierMatch[1].toLowerCase() === "unit-testable" : false;
+  const bbEnforcement = bbIsUnitTestable ? { blackBoxPass: true, grepSrcCount: 0, dockerExecCount: 0, observabilityCount: 0, otherCount: 0, grepRatio: 0, acsMissingDockerExec: [] } : checkBlackBoxEnforcement(content);
+  function buildResult(base) {
+    const basePassed = base.pending === 0 && base.verified > 0;
+    return {
+      ...base,
+      passed: basePassed && bbEnforcement.blackBoxPass,
+      grepSrcCount: bbEnforcement.grepSrcCount,
+      dockerExecCount: bbEnforcement.dockerExecCount,
+      observabilityCount: bbEnforcement.observabilityCount,
+      otherCount: bbEnforcement.otherCount,
+      blackBoxPass: bbEnforcement.blackBoxPass
+    };
+  }
+  const acHeaderPattern = /^## AC ?(\d+):/gm;
+  const matches = [...content.matchAll(acHeaderPattern)];
+  const nonAcHeadingPattern = /^## (?!AC ?\d+:)/gm;
+  const nonAcHeadings = [...content.matchAll(nonAcHeadingPattern)].map((m) => m.index);
+  let verified = 0;
+  let pending = 0;
+  let escalated = 0;
+  if (matches.length > 0) {
+    for (let i = 0; i < matches.length; i++) {
+      const start = matches[i].index;
+      const nextAcEnd = i + 1 < matches.length ? matches[i + 1].index : content.length;
+      const nextNonAcHeading = nonAcHeadings.find((h) => h > start);
+      const end = nextNonAcHeading !== void 0 && nextNonAcHeading < nextAcEnd ? nextNonAcHeading : nextAcEnd;
+      const section = content.slice(start, end);
+      if (section.includes("[ESCALATE]")) {
+        escalated++;
+        continue;
+      }
+      if (hasFailVerdict(section)) {
+        pending++;
+        continue;
+      }
+      const hasEvidence = section.includes("<!-- /showboat exec -->") || section.includes("<!-- showboat image:") || /```(?:bash|shell)\n[\s\S]*?```\n+```output\n/m.test(section);
+      if (hasEvidence) {
+        verified++;
+      } else {
+        pending++;
+      }
+    }
+  } else {
+    const inlineAcPattern = /--- AC ?(\d+):/g;
+    const inlineMatches = [...content.matchAll(inlineAcPattern)];
+    const acNumbers = new Set(inlineMatches.map((m) => m[1]));
+    if (acNumbers.size === 0) {
+      const narrativeAcPattern = /=== AC ?(\d+):/g;
+      const narrativeMatches = [...content.matchAll(narrativeAcPattern)];
+      const narrativeAcNumbers = new Set(narrativeMatches.map((m) => m[1]));
+      if (narrativeAcNumbers.size === 0) {
+        const bulletAcPattern = /^- AC ?(\d+)[^:\n]*:/gm;
+        const bulletMatches = [...content.matchAll(bulletAcPattern)];
+        const bulletAcNumbers = new Set(bulletMatches.map((m) => m[1]));
+        if (bulletAcNumbers.size === 0) {
+          return buildResult({ verified: 0, pending: 0, escalated: 0, total: 0 });
+        }
+        let bVerified = 0;
+        let bPending = 0;
+        let bEscalated = 0;
+        for (const acNum of bulletAcNumbers) {
+          const bulletPattern = new RegExp(`^- AC ?${acNum}[^:\\n]*:(.*)$`, "m");
+          const bulletMatch = content.match(bulletPattern);
+          if (!bulletMatch) {
+            bPending++;
+            continue;
+          }
+          const bulletText = bulletMatch[1].toLowerCase();
+          if (bulletText.includes("n/a") || bulletText.includes("escalat") || bulletText.includes("superseded")) {
+            bEscalated++;
+          } else if (bulletText.includes("fail")) {
+            bPending++;
+          } else {
+            bVerified++;
+          }
+        }
+        const hasAnyEvidence = /```output\n/m.test(content);
+        if (!hasAnyEvidence) {
+          bPending += bVerified;
+          bVerified = 0;
+        }
+        const bTotal = bVerified + bPending + bEscalated;
+        return buildResult({
+          verified: bVerified,
+          pending: bPending,
+          escalated: bEscalated,
+          total: bTotal
+        });
+      }
+      const sortedAcs = narrativeMatches.map((m) => ({ num: m[1], idx: m.index })).filter((v, i, a) => a.findIndex((x) => x.num === v.num) === i).sort((a, b) => a.idx - b.idx);
+      for (let i = 0; i < sortedAcs.length; i++) {
+        const regionStart = i > 0 ? sortedAcs[i - 1].idx : 0;
+        const regionEnd = i + 1 < sortedAcs.length ? sortedAcs[i + 1].idx : content.length;
+        const section = content.slice(regionStart, regionEnd);
+        if (section.includes("[ESCALATE]")) {
+          escalated++;
+        } else if (hasFailVerdict(section)) {
+          pending++;
+        } else if (/```output/m.test(section)) {
+          verified++;
+        } else {
+          pending++;
+        }
+      }
+      const narrativeTotal = verified + pending + escalated;
+      return buildResult({
+        verified,
+        pending,
+        escalated,
+        total: narrativeTotal
+      });
+    }
+    for (const acNum of acNumbers) {
+      const acPattern2 = new RegExp(`--- AC ?${acNum}:`, "g");
+      const acIdx = content.search(acPattern2);
+      if (acIdx === -1) {
+        pending++;
+        continue;
+      }
+      const nextAcPattern = new RegExp(`--- AC ?(?!${acNum})\\d+:`, "g");
+      nextAcPattern.lastIndex = acIdx + 1;
+      const nextMatch = nextAcPattern.exec(content);
+      const section = content.slice(acIdx, nextMatch ? nextMatch.index : content.length);
+      if (section.includes("[ESCALATE]")) {
+        escalated++;
+      } else if (hasFailVerdict(section)) {
+        pending++;
+      } else if (/```output\n/m.test(section)) {
+        verified++;
+      } else {
+        pending++;
+      }
+    }
+  }
+  const total = verified + pending + escalated;
+  return buildResult({ verified, pending, escalated, total });
+}
+
+// src/modules/verify/orchestrator.ts
+import { execFileSync as execFileSync5 } from "child_process";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "fs";
+import { join as join11 } from "path";
+
+// src/lib/doc-health.ts
+import { execSync } from "child_process";
+import {
+  existsSync as existsSync12,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync11,
+  readdirSync as readdirSync2,
+  statSync,
+  unlinkSync,
+  writeFileSync as writeFileSync7
+} from "fs";
+import { join as join10, relative } from "path";
+var DO_NOT_EDIT_HEADER2 = "<!-- DO NOT EDIT MANUALLY";
+var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".js", ".py"]);
+var DEFAULT_MODULE_THRESHOLD = 3;
+function findModules(dir, threshold) {
+  const limit = threshold ?? DEFAULT_MODULE_THRESHOLD;
+  const root = dir;
+  const modules = [];
+  function walk(current) {
+    let entries;
+    try {
+      entries = readdirSync2(current);
+    } catch {
+      return;
+    }
+    const dirName = current.split("/").pop() ?? "";
+    if (dirName === "node_modules" || dirName === ".git" || dirName === "dist" || dirName === "coverage" || dirName.startsWith(".") && current !== root) {
+      return;
+    }
+    let sourceCount = 0;
+    const subdirs = [];
+    for (const entry of entries) {
+      const fullPath = join10(current, entry);
+      let stat;
+      try {
+        stat = statSync(fullPath);
+      } catch {
+        continue;
+      }
+      if (stat.isDirectory()) {
+        subdirs.push(fullPath);
+      } else if (stat.isFile()) {
+        const ext = getExtension(entry);
+        if (SOURCE_EXTENSIONS.has(ext) && !isTestFile(entry)) {
+          sourceCount++;
+        }
+      }
+    }
+    if (sourceCount >= limit) {
+      const rel = relative(root, current);
+      if (rel !== "") {
+        modules.push(rel);
+      }
+    }
+    for (const subdir of subdirs) {
+      walk(subdir);
+    }
+  }
+  walk(root);
+  return modules;
+}
+function getExtension(filename) {
+  const dot = filename.lastIndexOf(".");
+  return dot >= 0 ? filename.slice(dot) : "";
+}
+function isTestFile(filename) {
   return filename.includes(".test.") || filename.includes(".spec.") || filename.includes("__tests__") || filename.startsWith("test_");
 }
 function isDocStale(docPath, codeDir) {
@@ -3408,105 +3515,31 @@ function showboatProofTemplate(config) {
   return sections.join("\n");
 }
 
-// src/lib/verify.ts
-function classifyEvidenceCommands(proofContent) {
-  const results = [];
-  const codeBlockPattern = /```(?:bash|shell)\n([\s\S]*?)```/g;
-  for (const match of proofContent.matchAll(codeBlockPattern)) {
-    const block = match[1].trim();
-    const lines = block.split("\n").filter((l) => l.trim().length > 0);
-    for (const line of lines) {
-      const cmd = line.trim();
-      if (!cmd) continue;
-      results.push({ command: cmd, type: classifyCommand(cmd) });
-    }
+// src/modules/verify/orchestrator.ts
+function checkPreconditions(dir, storyId) {
+  const state = readState(dir);
+  const failures = [];
+  if (!state.session_flags.tests_passed) {
+    failures.push("tests_passed is false \u2014 run tests first");
   }
-  return results;
-}
-function classifyCommand(cmd) {
-  if (/docker\s+exec\b/.test(cmd)) {
-    return "docker-exec";
+  if (!state.session_flags.coverage_met) {
+    failures.push("coverage_met is false \u2014 ensure coverage target is met");
   }
-  if (/docker\s+(ps|logs|inspect|stats|top|port)\b/.test(cmd)) {
-    return "docker-host";
-  }
-  if (/curl\b/.test(cmd) && /localhost:(9428|8428|16686)\b/.test(cmd)) {
-    return "observability";
-  }
-  if (/\bgrep\b/.test(cmd) && /\bsrc\//.test(cmd)) {
-    return "grep-src";
-  }
-  return "other";
-}
-function checkBlackBoxEnforcement(proofContent) {
-  const commands = classifyEvidenceCommands(proofContent);
-  const grepSrcCount = commands.filter((c) => c.type === "grep-src").length;
-  const dockerExecCount = commands.filter((c) => c.type === "docker-exec").length;
-  const observabilityCount = commands.filter((c) => c.type === "observability").length;
-  const otherCount = commands.filter((c) => c.type === "other").length;
-  const totalCommands = commands.length;
-  const grepRatio = totalCommands > 0 ? grepSrcCount / totalCommands : 0;
-  const acsMissingDockerExec = [];
-  const acHeaderPattern = /^## AC ?(\d+):/gm;
-  const acMatches = [...proofContent.matchAll(acHeaderPattern)];
-  if (acMatches.length > 0) {
-    for (let i = 0; i < acMatches.length; i++) {
-      const acNum = parseInt(acMatches[i][1], 10);
-      const start = acMatches[i].index;
-      const end = i + 1 < acMatches.length ? acMatches[i + 1].index : proofContent.length;
-      const section = proofContent.slice(start, end);
-      if (section.includes("[ESCALATE]")) continue;
-      const sectionCommands = classifyEvidenceCommands(section);
-      const hasBlackBoxEvidence = sectionCommands.some(
-        (c) => c.type === "docker-exec" || c.type === "docker-host" || c.type === "observability"
-      );
-      if (!hasBlackBoxEvidence) {
-        acsMissingDockerExec.push(acNum);
-      }
-    }
-  }
-  const grepTooHigh = grepRatio > 0.5;
-  const missingDockerExec = acsMissingDockerExec.length > 0;
-  const hasExtractableCommands = totalCommands > 0;
-  return {
-    blackBoxPass: !hasExtractableCommands || !grepTooHigh && !missingDockerExec,
-    grepSrcCount,
-    dockerExecCount,
-    observabilityCount,
-    otherCount,
-    grepRatio,
-    acsMissingDockerExec
-  };
-}
-function hasFailVerdict(section) {
-  const withoutCodeBlocks = section.replace(/```[\s\S]*?```/g, "");
-  const withoutInlineCode = withoutCodeBlocks.replace(/`[^`]+`/g, "");
-  return withoutInlineCode.includes("[FAIL]");
-}
-function checkPreconditions(dir, storyId) {
-  const state = readState(dir);
-  const failures = [];
-  if (!state.session_flags.tests_passed) {
-    failures.push("tests_passed is false \u2014 run tests first");
-  }
-  if (!state.session_flags.coverage_met) {
-    failures.push("coverage_met is false \u2014 ensure coverage target is met");
-  }
-  if (storyId) {
-    try {
-      const docReport = checkStoryDocFreshness(storyId, dir);
-      if (!docReport.passed) {
-        for (const doc of docReport.documents) {
-          if (doc.grade === "stale") {
-            failures.push(doc.reason);
-          } else if (doc.grade === "missing") {
-            failures.push(doc.reason);
-          }
-        }
-      }
-    } catch {
-      warn("Doc health check failed \u2014 skipping");
-    }
+  if (storyId) {
+    try {
+      const docReport = checkStoryDocFreshness(storyId, dir);
+      if (!docReport.passed) {
+        for (const doc of docReport.documents) {
+          if (doc.grade === "stale") {
+            failures.push(doc.reason);
+          } else if (doc.grade === "missing") {
+            failures.push(doc.reason);
+          }
+        }
+      }
+    } catch {
+      warn("Doc health check failed \u2014 skipping");
+    }
   }
   return {
     passed: failures.length === 0,
@@ -3551,194 +3584,455 @@ function runShowboatVerify(proofPath) {
     return { passed: false, output: stdout || stderr || message };
   }
 }
-function validateProofQuality(proofPath) {
-  const emptyResult = {
-    verified: 0,
-    pending: 0,
-    escalated: 0,
-    total: 0,
-    passed: false,
-    grepSrcCount: 0,
-    dockerExecCount: 0,
-    observabilityCount: 0,
-    otherCount: 0,
-    blackBoxPass: false
-  };
-  if (!existsSync13(proofPath)) {
-    return emptyResult;
+function updateVerificationState(storyId, result, dir) {
+  const { state, body } = readStateWithBody(dir);
+  state.session_flags.verification_run = true;
+  const status = result.success ? "pass" : "fail";
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  state.verification_log.push(`${storyId}: ${status} at ${timestamp}`);
+  writeState(state, dir, body);
+}
+function closeBeadsIssue(storyId, dir) {
+  const root = dir ?? process.cwd();
+  if (!isBeadsInitialized(root)) {
+    warn("Beads not initialized \u2014 skipping issue close");
+    return;
   }
-  const content = readFileSync12(proofPath, "utf-8");
-  const bbEnforcement = checkBlackBoxEnforcement(content);
-  function buildResult(base) {
-    const basePassed = base.pending === 0 && base.verified > 0;
-    return {
-      ...base,
-      passed: basePassed && bbEnforcement.blackBoxPass,
-      grepSrcCount: bbEnforcement.grepSrcCount,
-      dockerExecCount: bbEnforcement.dockerExecCount,
-      observabilityCount: bbEnforcement.observabilityCount,
-      otherCount: bbEnforcement.otherCount,
-      blackBoxPass: bbEnforcement.blackBoxPass
-    };
+  try {
+    const issues = listIssues();
+    const issue = issues.find((i) => {
+      const desc = i.description ?? "";
+      return desc.includes(storyId);
+    });
+    if (!issue) {
+      warn(`No beads issue found for story ${storyId} \u2014 skipping issue close`);
+      return;
+    }
+    syncClose(issue.id, { closeIssue, listIssues }, root);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    warn(`Failed to close beads issue: ${message}`);
   }
-  const acHeaderPattern = /^## AC ?(\d+):/gm;
-  const matches = [...content.matchAll(acHeaderPattern)];
-  let verified = 0;
-  let pending = 0;
-  let escalated = 0;
-  if (matches.length > 0) {
-    for (let i = 0; i < matches.length; i++) {
-      const start = matches[i].index;
-      const end = i + 1 < matches.length ? matches[i + 1].index : content.length;
-      const section = content.slice(start, end);
-      if (section.includes("[ESCALATE]")) {
-        escalated++;
-        continue;
-      }
-      if (hasFailVerdict(section)) {
-        pending++;
-        continue;
-      }
-      const hasEvidence = section.includes("<!-- /showboat exec -->") || section.includes("<!-- showboat image:") || /```(?:bash|shell)\n[\s\S]*?```\n+```output\n/m.test(section);
-      if (hasEvidence) {
-        verified++;
-      } else {
-        pending++;
-      }
+}
+
+// src/modules/verify/parser.ts
+import { existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
+var UI_KEYWORDS = [
+  "agent-browser",
+  "screenshot",
+  "navigate",
+  "click",
+  "form",
+  "ui verification",
+  "ui acceptance"
+];
+var API_KEYWORDS = [
+  "http",
+  "api",
+  "endpoint",
+  "curl",
+  "rest",
+  "response bod"
+];
+var DB_KEYWORDS = [
+  "database",
+  "db state",
+  "db mcp",
+  "query",
+  "sql",
+  "table"
+];
+var INTEGRATION_KEYWORDS = [
+  "external system",
+  "real infrastructure",
+  "manual verification"
+];
+var ESCALATE_KEYWORDS = [
+  "physical hardware",
+  "manual human",
+  "visual inspection by human",
+  "paid external service"
+];
+function classifyVerifiability(description) {
+  const lower = description.toLowerCase();
+  for (const kw of INTEGRATION_KEYWORDS) {
+    if (lower.includes(kw)) return "integration-required";
+  }
+  return "cli-verifiable";
+}
+function classifyStrategy(description) {
+  const lower = description.toLowerCase();
+  for (const kw of ESCALATE_KEYWORDS) {
+    if (lower.includes(kw)) return "escalate";
+  }
+  return "docker";
+}
+var VERIFICATION_TAG_PATTERN = /<!--\s*verification:\s*(cli-verifiable|integration-required)\s*-->/;
+function parseVerificationTag(text) {
+  const match = VERIFICATION_TAG_PATTERN.exec(text);
+  return match ? match[1] : null;
+}
+function classifyAC(description) {
+  const lower = description.toLowerCase();
+  for (const kw of UI_KEYWORDS) {
+    if (lower.includes(kw)) return "ui";
+  }
+  for (const kw of API_KEYWORDS) {
+    if (lower.includes(kw)) return "api";
+  }
+  for (const kw of DB_KEYWORDS) {
+    if (lower.includes(kw)) return "db";
+  }
+  return "general";
+}
+function parseStoryACs(storyFilePath) {
+  if (!existsSync14(storyFilePath)) {
+    throw new Error(
+      `Story file not found: ${storyFilePath}. Ensure the story file exists at the expected path.`
+    );
+  }
+  const content = readFileSync12(storyFilePath, "utf-8");
+  const lines = content.split("\n");
+  let acSectionStart = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (/^##\s+Acceptance\s+Criteria/i.test(lines[i])) {
+      acSectionStart = i + 1;
+      break;
     }
-  } else {
-    const inlineAcPattern = /--- AC ?(\d+):/g;
-    const inlineMatches = [...content.matchAll(inlineAcPattern)];
-    const acNumbers = new Set(inlineMatches.map((m) => m[1]));
-    if (acNumbers.size === 0) {
-      const narrativeAcPattern = /=== AC ?(\d+):/g;
-      const narrativeMatches = [...content.matchAll(narrativeAcPattern)];
-      const narrativeAcNumbers = new Set(narrativeMatches.map((m) => m[1]));
-      if (narrativeAcNumbers.size === 0) {
-        const bulletAcPattern = /^- AC ?(\d+)[^:\n]*:/gm;
-        const bulletMatches = [...content.matchAll(bulletAcPattern)];
-        const bulletAcNumbers = new Set(bulletMatches.map((m) => m[1]));
-        if (bulletAcNumbers.size === 0) {
-          return buildResult({ verified: 0, pending: 0, escalated: 0, total: 0 });
-        }
-        let bVerified = 0;
-        let bPending = 0;
-        let bEscalated = 0;
-        for (const acNum of bulletAcNumbers) {
-          const bulletPattern = new RegExp(`^- AC ?${acNum}[^:\\n]*:(.*)$`, "m");
-          const bulletMatch = content.match(bulletPattern);
-          if (!bulletMatch) {
-            bPending++;
-            continue;
-          }
-          const bulletText = bulletMatch[1].toLowerCase();
-          if (bulletText.includes("n/a") || bulletText.includes("escalat") || bulletText.includes("superseded")) {
-            bEscalated++;
-          } else if (bulletText.includes("fail")) {
-            bPending++;
-          } else {
-            bVerified++;
-          }
-        }
-        const hasAnyEvidence = /```output\n/m.test(content);
-        if (!hasAnyEvidence) {
-          bPending += bVerified;
-          bVerified = 0;
-        }
-        const bTotal = bVerified + bPending + bEscalated;
-        return buildResult({
-          verified: bVerified,
-          pending: bPending,
-          escalated: bEscalated,
-          total: bTotal
-        });
-      }
-      const sortedAcs = narrativeMatches.map((m) => ({ num: m[1], idx: m.index })).filter((v, i, a) => a.findIndex((x) => x.num === v.num) === i).sort((a, b) => a.idx - b.idx);
-      for (let i = 0; i < sortedAcs.length; i++) {
-        const { num: acNum, idx: acIdx } = sortedAcs[i];
-        const regionStart = i > 0 ? sortedAcs[i - 1].idx : 0;
-        const regionEnd = i + 1 < sortedAcs.length ? sortedAcs[i + 1].idx : content.length;
-        const section = content.slice(regionStart, regionEnd);
-        if (section.includes("[ESCALATE]")) {
-          escalated++;
-        } else if (hasFailVerdict(section)) {
-          pending++;
-        } else if (/```output/m.test(section)) {
-          verified++;
-        } else {
-          pending++;
-        }
-      }
-      const narrativeTotal = verified + pending + escalated;
-      return buildResult({
-        verified,
-        pending,
-        escalated,
-        total: narrativeTotal
-      });
+  }
+  if (acSectionStart === -1) {
+    warn('No "## Acceptance Criteria" section found in story file');
+    return [];
+  }
+  let acSectionEnd = lines.length;
+  for (let i = acSectionStart; i < lines.length; i++) {
+    if (/^##\s+/.test(lines[i]) && i !== acSectionStart - 1) {
+      acSectionEnd = i;
+      break;
     }
-    for (const acNum of acNumbers) {
-      const acPattern = new RegExp(`--- AC ?${acNum}:`, "g");
-      const acIdx = content.search(acPattern);
-      if (acIdx === -1) {
-        pending++;
-        continue;
-      }
-      const nextAcPattern = new RegExp(`--- AC ?(?!${acNum})\\d+:`, "g");
-      nextAcPattern.lastIndex = acIdx + 1;
-      const nextMatch = nextAcPattern.exec(content);
-      const section = content.slice(acIdx, nextMatch ? nextMatch.index : content.length);
-      if (section.includes("[ESCALATE]")) {
-        escalated++;
-      } else if (hasFailVerdict(section)) {
-        pending++;
-      } else if (/```output\n/m.test(section)) {
-        verified++;
+  }
+  const acSection = lines.slice(acSectionStart, acSectionEnd).join("\n");
+  const acPattern = /^\s*(\d+)\.\s+/;
+  const acs = [];
+  const acLines = acSection.split("\n");
+  let currentId = null;
+  let currentDesc = [];
+  const flushCurrent = () => {
+    if (currentId !== null && currentDesc.length > 0) {
+      const description = currentDesc.join(" ").trim();
+      if (description) {
+        const tag = parseVerificationTag(description);
+        const verifiability = tag ?? classifyVerifiability(description);
+        const strategy = classifyStrategy(description);
+        acs.push({
+          id: currentId,
+          description,
+          type: classifyAC(description),
+          verifiability,
+          strategy
+        });
       } else {
-        pending++;
+        warn(`Skipping malformed AC #${currentId}: empty description`);
       }
     }
+  };
+  for (const line of acLines) {
+    const match = acPattern.exec(line);
+    if (match) {
+      flushCurrent();
+      currentId = match[1];
+      currentDesc = [line.replace(acPattern, "").trim()];
+    } else if (currentId !== null && line.trim()) {
+      currentDesc.push(line.trim());
+    }
+  }
+  flushCurrent();
+  return acs;
+}
+
+// src/modules/verify/env.ts
+import { execFileSync as execFileSync6 } from "child_process";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync13, cpSync, rmSync, statSync as statSync2 } from "fs";
+import { join as join12, basename as basename3 } from "path";
+import { createHash } from "crypto";
+var IMAGE_TAG = "codeharness-verify";
+var STORY_DIR = "_bmad-output/implementation-artifacts";
+var TEMP_PREFIX = "/tmp/codeharness-verify-";
+var STATE_KEY_DIST_HASH = "verify_env_dist_hash";
+function isValidStoryKey(storyKey) {
+  if (!storyKey || storyKey.includes("..") || storyKey.includes("/") || storyKey.includes("\\")) {
+    return false;
+  }
+  return /^[a-zA-Z0-9_-]+$/.test(storyKey);
+}
+function computeDistHash(projectDir) {
+  const distDir = join12(projectDir, "dist");
+  if (!existsSync15(distDir)) return null;
+  const hash = createHash("sha256");
+  const files = collectFiles(distDir).sort();
+  for (const file of files) {
+    hash.update(file.slice(distDir.length));
+    hash.update(readFileSync13(file));
+  }
+  return hash.digest("hex");
+}
+function collectFiles(dir) {
+  const results = [];
+  for (const entry of readdirSync3(dir, { withFileTypes: true })) {
+    const fullPath = join12(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...collectFiles(fullPath));
+    } else {
+      results.push(fullPath);
+    }
   }
-  const total = verified + pending + escalated;
-  return buildResult({ verified, pending, escalated, total });
+  return results;
 }
-function updateVerificationState(storyId, result, dir) {
-  const { state, body } = readStateWithBody(dir);
-  state.session_flags.verification_run = true;
-  const status = result.success ? "pass" : "fail";
-  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  state.verification_log.push(`${storyId}: ${status} at ${timestamp}`);
-  writeState(state, dir, body);
+function getStoredDistHash(projectDir) {
+  try {
+    const { state } = readStateWithBody(projectDir);
+    return state[STATE_KEY_DIST_HASH] ?? null;
+  } catch {
+    return null;
+  }
 }
-function closeBeadsIssue(storyId, dir) {
-  const root = dir ?? process.cwd();
-  if (!isBeadsInitialized(root)) {
-    warn("Beads not initialized \u2014 skipping issue close");
-    return;
+function storeDistHash(projectDir, hash) {
+  try {
+    const { state, body } = readStateWithBody(projectDir);
+    state[STATE_KEY_DIST_HASH] = hash;
+    writeState(state, projectDir, body);
+  } catch {
+    info("Could not persist dist hash to state file \u2014 cache will not be available until state is initialized");
+  }
+}
+function detectProjectType(projectDir) {
+  if (existsSync15(join12(projectDir, ".claude-plugin", "plugin.json"))) return "plugin";
+  const stack = detectStack(projectDir);
+  if (stack === "nodejs") return "nodejs";
+  if (stack === "python") return "python";
+  return "generic";
+}
+function buildVerifyImage(options = {}) {
+  const projectDir = options.projectDir ?? process.cwd();
+  if (!isDockerAvailable()) {
+    throw new Error("Docker is not available. Install Docker and ensure the daemon is running.");
+  }
+  const projectType = detectProjectType(projectDir);
+  const currentHash = computeDistHash(projectDir);
+  if (projectType === "generic" || projectType === "plugin") {
+  } else if (!currentHash) {
+    throw new Error("No dist/ directory found. Run your build command first (e.g., npm run build).");
+  }
+  if (currentHash) {
+    const storedHash = getStoredDistHash(projectDir);
+    if (storedHash === currentHash && dockerImageExists(IMAGE_TAG)) {
+      return { imageTag: IMAGE_TAG, imageSize: getImageSize(IMAGE_TAG), buildTimeMs: 0, cached: true };
+    }
+  }
+  const startTime = Date.now();
+  if (projectType === "nodejs") {
+    buildNodeImage(projectDir);
+  } else if (projectType === "python") {
+    buildPythonImage(projectDir);
+  } else if (projectType === "plugin") {
+    buildPluginImage(projectDir);
+  } else {
+    buildGenericImage(projectDir);
   }
+  if (currentHash) {
+    storeDistHash(projectDir, currentHash);
+  }
+  return { imageTag: IMAGE_TAG, imageSize: getImageSize(IMAGE_TAG), buildTimeMs: Date.now() - startTime, cached: false };
+}
+function buildNodeImage(projectDir) {
+  const packOutput = execFileSync6("npm", ["pack", "--pack-destination", "/tmp"], {
+    cwd: projectDir,
+    stdio: "pipe",
+    timeout: 6e4
+  }).toString().trim();
+  const lastLine = packOutput.split("\n").pop()?.trim();
+  if (!lastLine) throw new Error("npm pack produced no output \u2014 cannot determine tarball filename.");
+  const tarballName = basename3(lastLine);
+  const tarballPath = join12("/tmp", tarballName);
+  const buildContext = join12("/tmp", `codeharness-verify-build-${Date.now()}`);
+  mkdirSync6(buildContext, { recursive: true });
   try {
-    const issues = listIssues();
-    const issue = issues.find((i) => {
-      const desc = i.description ?? "";
-      return desc.includes(storyId);
+    cpSync(tarballPath, join12(buildContext, tarballName));
+    cpSync(resolveDockerfileTemplate(projectDir), join12(buildContext, "Dockerfile"));
+    execFileSync6("docker", ["build", "-t", IMAGE_TAG, "--build-arg", `TARBALL=${tarballName}`, "."], {
+      cwd: buildContext,
+      stdio: "pipe",
+      timeout: 12e4
     });
-    if (!issue) {
-      warn(`No beads issue found for story ${storyId} \u2014 skipping issue close`);
-      return;
+  } finally {
+    rmSync(buildContext, { recursive: true, force: true });
+    rmSync(tarballPath, { force: true });
+  }
+}
+function buildPythonImage(projectDir) {
+  const distDir = join12(projectDir, "dist");
+  const distFiles = readdirSync3(distDir).filter((f) => f.endsWith(".tar.gz") || f.endsWith(".whl"));
+  if (distFiles.length === 0) {
+    throw new Error("No distribution files found in dist/. Run your build command first (e.g., python -m build).");
+  }
+  const distFile = distFiles.filter((f) => f.endsWith(".tar.gz"))[0] ?? distFiles[0];
+  const buildContext = join12("/tmp", `codeharness-verify-build-${Date.now()}`);
+  mkdirSync6(buildContext, { recursive: true });
+  try {
+    cpSync(join12(distDir, distFile), join12(buildContext, distFile));
+    cpSync(resolveDockerfileTemplate(projectDir), join12(buildContext, "Dockerfile"));
+    execFileSync6("docker", ["build", "-t", IMAGE_TAG, "--build-arg", `TARBALL=${distFile}`, "."], {
+      cwd: buildContext,
+      stdio: "pipe",
+      timeout: 12e4
+    });
+  } finally {
+    rmSync(buildContext, { recursive: true, force: true });
+  }
+}
+function prepareVerifyWorkspace(storyKey, projectDir) {
+  const root = projectDir ?? process.cwd();
+  if (!isValidStoryKey(storyKey)) {
+    throw new Error(`Invalid story key: ${storyKey}. Keys must contain only alphanumeric characters, hyphens, and underscores.`);
+  }
+  const storyFile = join12(root, STORY_DIR, `${storyKey}.md`);
+  if (!existsSync15(storyFile)) throw new Error(`Story file not found: ${storyFile}`);
+  const workspace = `${TEMP_PREFIX}${storyKey}`;
+  if (existsSync15(workspace)) rmSync(workspace, { recursive: true, force: true });
+  mkdirSync6(workspace, { recursive: true });
+  cpSync(storyFile, join12(workspace, "story.md"));
+  const readmePath = join12(root, "README.md");
+  if (existsSync15(readmePath)) cpSync(readmePath, join12(workspace, "README.md"));
+  const docsDir = join12(root, "docs");
+  if (existsSync15(docsDir) && statSync2(docsDir).isDirectory()) {
+    cpSync(docsDir, join12(workspace, "docs"), { recursive: true });
+  }
+  mkdirSync6(join12(workspace, "verification"), { recursive: true });
+  return workspace;
+}
+function checkVerifyEnv() {
+  let imageExists = false;
+  let cliWorks = false;
+  let otelReachable = false;
+  imageExists = dockerImageExists(IMAGE_TAG);
+  if (!imageExists) return { imageExists, cliWorks, otelReachable };
+  try {
+    execFileSync6("docker", ["run", "--rm", IMAGE_TAG, "codeharness", "--help"], {
+      stdio: "pipe",
+      timeout: 3e4
+    });
+    cliWorks = true;
+  } catch {
+    cliWorks = false;
+  }
+  try {
+    execFileSync6("docker", [
+      "run",
+      "--rm",
+      "--add-host=host.docker.internal:host-gateway",
+      IMAGE_TAG,
+      "curl",
+      "-sf",
+      "--max-time",
+      "5",
+      "http://host.docker.internal:4318/v1/status"
+    ], { stdio: "pipe", timeout: 3e4 });
+    otelReachable = true;
+  } catch {
+    otelReachable = false;
+  }
+  return { imageExists, cliWorks, otelReachable };
+}
+function cleanupVerifyEnv(storyKey) {
+  if (!isValidStoryKey(storyKey)) {
+    throw new Error(`Invalid story key: ${storyKey}. Keys must contain only alphanumeric characters, hyphens, and underscores.`);
+  }
+  const workspace = `${TEMP_PREFIX}${storyKey}`;
+  const containerName = `codeharness-verify-${storyKey}`;
+  if (existsSync15(workspace)) rmSync(workspace, { recursive: true, force: true });
+  try {
+    execFileSync6("docker", ["stop", containerName], { stdio: "pipe", timeout: 15e3 });
+  } catch {
+  }
+  try {
+    execFileSync6("docker", ["rm", "-f", containerName], { stdio: "pipe", timeout: 15e3 });
+  } catch {
+  }
+}
+function buildPluginImage(projectDir) {
+  const buildContext = join12("/tmp", `codeharness-verify-build-${Date.now()}`);
+  mkdirSync6(buildContext, { recursive: true });
+  try {
+    const pluginDir = join12(projectDir, ".claude-plugin");
+    cpSync(pluginDir, join12(buildContext, ".claude-plugin"), { recursive: true });
+    for (const dir of ["commands", "hooks", "knowledge", "skills"]) {
+      const src = join12(projectDir, dir);
+      if (existsSync15(src) && statSync2(src).isDirectory()) {
+        cpSync(src, join12(buildContext, dir), { recursive: true });
+      }
     }
-    syncClose(issue.id, { closeIssue, listIssues }, root);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    warn(`Failed to close beads issue: ${message}`);
+    cpSync(resolveDockerfileTemplate(projectDir, "generic"), join12(buildContext, "Dockerfile"));
+    execFileSync6("docker", ["build", "-t", IMAGE_TAG, "."], {
+      cwd: buildContext,
+      stdio: "pipe",
+      timeout: 12e4
+    });
+  } finally {
+    rmSync(buildContext, { recursive: true, force: true });
+  }
+}
+function buildGenericImage(projectDir) {
+  const buildContext = join12("/tmp", `codeharness-verify-build-${Date.now()}`);
+  mkdirSync6(buildContext, { recursive: true });
+  try {
+    cpSync(resolveDockerfileTemplate(projectDir, "generic"), join12(buildContext, "Dockerfile"));
+    execFileSync6("docker", ["build", "-t", IMAGE_TAG, "."], {
+      cwd: buildContext,
+      stdio: "pipe",
+      timeout: 12e4
+    });
+  } finally {
+    rmSync(buildContext, { recursive: true, force: true });
+  }
+}
+function resolveDockerfileTemplate(projectDir, variant) {
+  const filename = variant === "generic" ? "Dockerfile.verify.generic" : "Dockerfile.verify";
+  const local = join12(projectDir, "templates", filename);
+  if (existsSync15(local)) return local;
+  const pkgDir = new URL("../../", import.meta.url).pathname;
+  const pkg = join12(pkgDir, "templates", filename);
+  if (existsSync15(pkg)) return pkg;
+  throw new Error(`${filename} not found. Ensure templates/${filename} exists.`);
+}
+function dockerImageExists(tag) {
+  try {
+    execFileSync6("docker", ["image", "inspect", tag], { stdio: "pipe", timeout: 1e4 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getImageSize(tag) {
+  try {
+    const output = execFileSync6("docker", ["image", "inspect", tag, "--format", "{{.Size}}"], {
+      stdio: "pipe",
+      timeout: 1e4
+    }).toString().trim();
+    const bytes = parseInt(output, 10);
+    if (isNaN(bytes)) return output;
+    if (bytes >= 1e9) return `${(bytes / 1e9).toFixed(1)}GB`;
+    if (bytes >= 1e6) return `${(bytes / 1e6).toFixed(1)}MB`;
+    if (bytes >= 1e3) return `${(bytes / 1e3).toFixed(1)}KB`;
+    return `${bytes}B`;
+  } catch {
+    return "unknown";
   }
 }
 
 // src/commands/verify.ts
-var STORY_DIR = "_bmad-output/implementation-artifacts";
+var STORY_DIR2 = "_bmad-output/implementation-artifacts";
 function isValidStoryId(storyId) {
-  if (!storyId || storyId.includes("..") || storyId.includes("/") || storyId.includes("\\")) {
-    return false;
-  }
+  if (!storyId || storyId.includes("..") || storyId.includes("/") || storyId.includes("\\")) return false;
   return /^[a-zA-Z0-9_-]+$/.test(storyId);
 }
 function registerVerifyCommand(program) {
@@ -3771,8 +4065,8 @@ function verifyRetro(opts, isJson, root) {
     return;
   }
   const retroFile = `epic-${epicNum}-retrospective.md`;
-  const retroPath = join12(root, STORY_DIR, retroFile);
-  if (!existsSync14(retroPath)) {
+  const retroPath = join13(root, STORY_DIR2, retroFile);
+  if (!existsSync16(retroPath)) {
     if (isJson) {
       jsonOutput({ status: "fail", epic: epicNum, retroFile, message: `${retroFile} not found` });
     } else {
@@ -3789,7 +4083,7 @@ function verifyRetro(opts, isJson, root) {
     warn(`Failed to update sprint status: ${message}`);
   }
   if (isJson) {
-    jsonOutput({ status: "ok", epic: epicNum, retroFile: join12(STORY_DIR, retroFile) });
+    jsonOutput({ status: "ok", epic: epicNum, retroFile: join13(STORY_DIR2, retroFile) });
   } else {
     ok(`Epic ${epicNum} retrospective: marked done`);
   }
@@ -3800,8 +4094,8 @@ function verifyStory(storyId, isJson, root) {
     process.exitCode = 1;
     return;
   }
-  const readmePath = join12(root, "README.md");
-  if (!existsSync14(readmePath)) {
+  const readmePath = join13(root, "README.md");
+  if (!existsSync16(readmePath)) {
     if (isJson) {
       jsonOutput({ status: "fail", message: "No README.md found \u2014 verification requires user documentation" });
     } else {
@@ -3810,8 +4104,8 @@ function verifyStory(storyId, isJson, root) {
     process.exitCode = 1;
     return;
   }
-  const storyFilePath = join12(root, STORY_DIR, `${storyId}.md`);
-  if (!existsSync14(storyFilePath)) {
+  const storyFilePath = join13(root, STORY_DIR2, `${storyId}.md`);
+  if (!existsSync16(storyFilePath)) {
     fail(`Story file not found: ${storyFilePath}`, { json: isJson });
     process.exitCode = 1;
     return;
@@ -3851,8 +4145,8 @@ function verifyStory(storyId, isJson, root) {
     return;
   }
   const storyTitle = extractStoryTitle(storyFilePath);
-  const expectedProofPath = join12(root, "verification", `${storyId}-proof.md`);
-  const proofPath = existsSync14(expectedProofPath) ? expectedProofPath : createProofDocument(storyId, storyTitle, acs, root);
+  const expectedProofPath = join13(root, "verification", `${storyId}-proof.md`);
+  const proofPath = existsSync16(expectedProofPath) ? expectedProofPath : createProofDocument(storyId, storyTitle, acs, root);
   const proofQuality = validateProofQuality(proofPath);
   if (!proofQuality.passed) {
     if (isJson) {
@@ -3946,7 +4240,7 @@ function verifyStory(storyId, isJson, root) {
 }
 function extractStoryTitle(filePath) {
   try {
-    const content = readFileSync13(filePath, "utf-8");
+    const content = readFileSync14(filePath, "utf-8");
     const match = /^#\s+(.+)$/m.exec(content);
     return match ? match[1] : "Unknown Story";
   } catch {
@@ -3955,14 +4249,14 @@ function extractStoryTitle(filePath) {
 }
 
 // src/lib/onboard-checks.ts
-import { existsSync as existsSync16 } from "fs";
-import { join as join14, dirname as dirname4 } from "path";
+import { existsSync as existsSync18 } from "fs";
+import { join as join15, dirname as dirname4 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/lib/coverage.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
+import { join as join14 } from "path";
 function detectCoverageTool(dir) {
   const baseDir = dir ?? process.cwd();
   const stateHint = getStateToolHint(baseDir);
@@ -3985,16 +4279,16 @@ function getStateToolHint(dir) {
   }
 }
 function detectNodeCoverageTool(dir, stateHint) {
-  const hasVitestConfig = existsSync15(join13(dir, "vitest.config.ts")) || existsSync15(join13(dir, "vitest.config.js"));
-  const pkgPath = join13(dir, "package.json");
+  const hasVitestConfig = existsSync17(join14(dir, "vitest.config.ts")) || existsSync17(join14(dir, "vitest.config.js"));
+  const pkgPath = join14(dir, "package.json");
   let hasVitestCoverageV8 = false;
   let hasVitestCoverageIstanbul = false;
   let hasC8 = false;
   let hasJest = false;
   let pkgScripts = {};
-  if (existsSync15(pkgPath)) {
+  if (existsSync17(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
+      const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
       const allDeps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
       hasVitestCoverageV8 = "@vitest/coverage-v8" in allDeps;
       hasVitestCoverageIstanbul = "@vitest/coverage-istanbul" in allDeps;
@@ -4047,10 +4341,10 @@ function getNodeTestCommand(scripts, runner) {
   return "npm test";
 }
 function detectPythonCoverageTool(dir) {
-  const reqPath = join13(dir, "requirements.txt");
-  if (existsSync15(reqPath)) {
+  const reqPath = join14(dir, "requirements.txt");
+  if (existsSync17(reqPath)) {
     try {
-      const content = readFileSync14(reqPath, "utf-8");
+      const content = readFileSync15(reqPath, "utf-8");
       if (content.includes("pytest-cov") || content.includes("coverage")) {
         return {
           tool: "coverage.py",
@@ -4061,10 +4355,10 @@ function detectPythonCoverageTool(dir) {
     } catch {
     }
   }
-  const pyprojectPath = join13(dir, "pyproject.toml");
-  if (existsSync15(pyprojectPath)) {
+  const pyprojectPath = join14(dir, "pyproject.toml");
+  if (existsSync17(pyprojectPath)) {
     try {
-      const content = readFileSync14(pyprojectPath, "utf-8");
+      const content = readFileSync15(pyprojectPath, "utf-8");
       if (content.includes("pytest-cov") || content.includes("coverage")) {
         return {
           tool: "coverage.py",
@@ -4146,7 +4440,7 @@ function parseVitestCoverage(dir) {
     return 0;
   }
   try {
-    const report = JSON.parse(readFileSync14(reportPath, "utf-8"));
+    const report = JSON.parse(readFileSync15(reportPath, "utf-8"));
     return report.total?.statements?.pct ?? 0;
   } catch {
     warn("Failed to parse coverage report");
@@ -4154,13 +4448,13 @@ function parseVitestCoverage(dir) {
   }
 }
 function parsePythonCoverage(dir) {
-  const reportPath = join13(dir, "coverage.json");
-  if (!existsSync15(reportPath)) {
+  const reportPath = join14(dir, "coverage.json");
+  if (!existsSync17(reportPath)) {
     warn("Coverage report not found at coverage.json");
     return 0;
   }
   try {
-    const report = JSON.parse(readFileSync14(reportPath, "utf-8"));
+    const report = JSON.parse(readFileSync15(reportPath, "utf-8"));
     return report.totals?.percent_covered ?? 0;
   } catch {
     warn("Failed to parse coverage report");
@@ -4261,7 +4555,7 @@ function checkPerFileCoverage(floor, dir) {
   }
   let report;
   try {
-    report = JSON.parse(readFileSync14(reportPath, "utf-8"));
+    report = JSON.parse(readFileSync15(reportPath, "utf-8"));
   } catch {
     warn("Failed to parse coverage-summary.json");
     return { floor, violations: [], totalFiles: 0 };
@@ -4291,11 +4585,11 @@ function checkPerFileCoverage(floor, dir) {
 }
 function findCoverageSummary(dir) {
   const candidates = [
-    join13(dir, "coverage", "coverage-summary.json"),
-    join13(dir, "src", "coverage", "coverage-summary.json")
+    join14(dir, "coverage", "coverage-summary.json"),
+    join14(dir, "src", "coverage", "coverage-summary.json")
   ];
   for (const p of candidates) {
-    if (existsSync15(p)) return p;
+    if (existsSync17(p)) return p;
   }
   return null;
 }
@@ -4320,7 +4614,7 @@ function printCoverageOutput(result, evaluation) {
 // src/lib/onboard-checks.ts
 function checkHarnessInitialized(dir) {
   const statePath2 = getStatePath(dir ?? process.cwd());
-  return { ok: existsSync16(statePath2) };
+  return { ok: existsSync18(statePath2) };
 }
 function checkBmadInstalled(dir) {
   return { ok: isBmadInstalled(dir) };
@@ -4328,8 +4622,8 @@ function checkBmadInstalled(dir) {
 function checkHooksRegistered(dir) {
   const __filename = fileURLToPath3(import.meta.url);
   const __dirname2 = dirname4(__filename);
-  const hooksPath = join14(__dirname2, "..", "..", "hooks", "hooks.json");
-  return { ok: existsSync16(hooksPath) };
+  const hooksPath = join15(__dirname2, "..", "..", "hooks", "hooks.json");
+  return { ok: existsSync18(hooksPath) };
 }
 function runPreconditions(dir) {
   const harnessCheck = checkHarnessInitialized(dir);
@@ -4369,8 +4663,8 @@ function findVerificationGaps(dir) {
   for (const [key, status] of Object.entries(statuses)) {
     if (status !== "done") continue;
     if (!STORY_KEY_PATTERN2.test(key)) continue;
-    const proofPath = join14(root, "verification", `${key}-proof.md`);
-    if (!existsSync16(proofPath)) {
+    const proofPath = join15(root, "verification", `${key}-proof.md`);
+    if (!existsSync18(proofPath)) {
       unverified.push(key);
     }
   }
@@ -4497,24 +4791,13 @@ function filterTrackedGaps(stories, beadsFns) {
   return { untracked, trackedCount };
 }
 
-// src/types/result.ts
-function ok2(data) {
-  return { success: true, data };
-}
-function fail2(error, context) {
-  if (context !== void 0) {
-    return { success: false, error, context };
-  }
-  return { success: false, error };
-}
-
 // src/modules/sprint/state.ts
-import { readFileSync as readFileSync16, writeFileSync as writeFileSync9, renameSync, existsSync as existsSync18 } from "fs";
-import { join as join16 } from "path";
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync9, renameSync, existsSync as existsSync20 } from "fs";
+import { join as join17 } from "path";
 
 // src/modules/sprint/migration.ts
-import { readFileSync as readFileSync15, existsSync as existsSync17 } from "fs";
-import { join as join15 } from "path";
+import { readFileSync as readFileSync16, existsSync as existsSync19 } from "fs";
+import { join as join16 } from "path";
 var OLD_FILES = {
   storyRetries: "ralph/.story_retries",
   flaggedStories: "ralph/.flagged_stories",
@@ -4523,13 +4806,13 @@ var OLD_FILES = {
   sessionIssues: "_bmad-output/implementation-artifacts/.session-issues.md"
 };
 function resolve(relative3) {
-  return join15(process.cwd(), relative3);
+  return join16(process.cwd(), relative3);
 }
 function readIfExists(relative3) {
   const p = resolve(relative3);
-  if (!existsSync17(p)) return null;
+  if (!existsSync19(p)) return null;
   try {
-    return readFileSync15(p, "utf-8");
+    return readFileSync16(p, "utf-8");
   } catch {
     return null;
   }
@@ -4629,7 +4912,7 @@ function parseSessionIssues(content) {
   return items;
 }
 function migrateFromOldFormat() {
-  const hasAnyOldFile = Object.values(OLD_FILES).some((rel) => existsSync17(resolve(rel)));
+  const hasAnyOldFile = Object.values(OLD_FILES).some((rel) => existsSync19(resolve(rel)));
   if (!hasAnyOldFile) return fail2("No old format files found for migration");
   try {
     const stories = {};
@@ -4670,10 +4953,10 @@ function projectRoot() {
   return process.cwd();
 }
 function statePath() {
-  return join16(projectRoot(), "sprint-state.json");
+  return join17(projectRoot(), "sprint-state.json");
 }
 function tmpPath() {
-  return join16(projectRoot(), ".sprint-state.json.tmp");
+  return join17(projectRoot(), ".sprint-state.json.tmp");
 }
 function defaultState() {
   return {
@@ -4712,9 +4995,9 @@ function writeStateAtomic(state) {
 }
 function getSprintState() {
   const fp = statePath();
-  if (existsSync18(fp)) {
+  if (existsSync20(fp)) {
     try {
-      const raw = readFileSync16(fp, "utf-8");
+      const raw = readFileSync17(fp, "utf-8");
       const parsed = JSON.parse(raw);
       return ok2(parsed);
     } catch (err) {
@@ -4964,9 +5247,9 @@ function generateReport(state, now) {
 }
 
 // src/modules/sprint/timeout.ts
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync10, existsSync as existsSync19, mkdirSync as mkdirSync6 } from "fs";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync10, existsSync as existsSync21, mkdirSync as mkdirSync7 } from "fs";
 import { execSync as execSync3 } from "child_process";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 var GIT_TIMEOUT_MS = 5e3;
 var DEFAULT_MAX_LINES = 100;
 function captureGitDiff() {
@@ -4995,14 +5278,14 @@ function captureGitDiff() {
 }
 function captureStateDelta(beforePath, afterPath) {
   try {
-    if (!existsSync19(beforePath)) {
+    if (!existsSync21(beforePath)) {
       return fail2(`State snapshot not found: ${beforePath}`);
     }
-    if (!existsSync19(afterPath)) {
+    if (!existsSync21(afterPath)) {
       return fail2(`Current state file not found: ${afterPath}`);
     }
-    const beforeRaw = readFileSync17(beforePath, "utf-8");
-    const afterRaw = readFileSync17(afterPath, "utf-8");
+    const beforeRaw = readFileSync18(beforePath, "utf-8");
+    const afterRaw = readFileSync18(afterPath, "utf-8");
     const before = JSON.parse(beforeRaw);
     const after = JSON.parse(afterRaw);
     const beforeStories = before.stories ?? {};
@@ -5027,10 +5310,10 @@ function captureStateDelta(beforePath, afterPath) {
 }
 function capturePartialStderr(outputFile, maxLines = DEFAULT_MAX_LINES) {
   try {
-    if (!existsSync19(outputFile)) {
+    if (!existsSync21(outputFile)) {
       return fail2(`Output file not found: ${outputFile}`);
     }
-    const content = readFileSync17(outputFile, "utf-8");
+    const content = readFileSync18(outputFile, "utf-8");
     const lines = content.split("\n");
     if (lines.length > 0 && lines[lines.length - 1] === "") {
       lines.pop();
@@ -5072,50 +5355,182 @@ function captureTimeoutReport(opts) {
     if (opts.iteration < 1 || !Number.isInteger(opts.iteration)) {
       return fail2(`Invalid iteration number: ${opts.iteration}`);
     }
-    if (opts.durationMinutes < 0) {
-      return fail2(`Invalid duration: ${opts.durationMinutes}`);
+    if (opts.durationMinutes < 0) {
+      return fail2(`Invalid duration: ${opts.durationMinutes}`);
+    }
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const gitResult = captureGitDiff();
+    const gitDiff = gitResult.success ? gitResult.data : `(unavailable: ${gitResult.error})`;
+    const statePath2 = join18(process.cwd(), "sprint-state.json");
+    const deltaResult = captureStateDelta(opts.stateSnapshotPath, statePath2);
+    const stateDelta = deltaResult.success ? deltaResult.data : `(unavailable: ${deltaResult.error})`;
+    const stderrResult = capturePartialStderr(opts.outputFile);
+    const partialStderr = stderrResult.success ? stderrResult.data : `(unavailable: ${stderrResult.error})`;
+    const capture = {
+      storyKey: opts.storyKey,
+      iteration: opts.iteration,
+      durationMinutes: opts.durationMinutes,
+      gitDiff,
+      stateDelta,
+      partialStderr,
+      timestamp
+    };
+    const reportDir = join18(process.cwd(), "ralph", "logs");
+    const safeStoryKey = opts.storyKey.replace(/[^a-zA-Z0-9._-]/g, "_");
+    const reportFileName = `timeout-report-${opts.iteration}-${safeStoryKey}.md`;
+    const reportPath = join18(reportDir, reportFileName);
+    if (!existsSync21(reportDir)) {
+      mkdirSync7(reportDir, { recursive: true });
+    }
+    const reportContent = formatReport(capture);
+    writeFileSync10(reportPath, reportContent, "utf-8");
+    return ok2({
+      filePath: reportPath,
+      capture
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return fail2(`Failed to capture timeout report: ${msg}`);
+  }
+}
+
+// src/modules/sprint/feedback.ts
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync22 } from "fs";
+import { join as join19 } from "path";
+
+// src/modules/sprint/validator.ts
+import { readFileSync as readFileSync20, existsSync as existsSync23 } from "fs";
+var VALID_STATUSES = /* @__PURE__ */ new Set([
+  "backlog",
+  "ready",
+  "in-progress",
+  "review",
+  "verifying",
+  "done",
+  "failed",
+  "blocked"
+]);
+var STALE_THRESHOLD_MS = 24 * 60 * 60 * 1e3;
+function parseSprintStatusKeys(content) {
+  try {
+    const keys = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const match = line.match(/^([a-zA-Z0-9][a-zA-Z0-9._-]*):$/);
+      if (match) {
+        keys.push(match[1]);
+      }
+    }
+    return ok2(keys);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return fail2(`Failed to parse sprint-status.yaml: ${msg}`);
+  }
+}
+function parseStateFile(statePath2) {
+  try {
+    if (!existsSync23(statePath2)) {
+      return fail2(`State file not found: ${statePath2}`);
+    }
+    const raw = readFileSync20(statePath2, "utf-8");
+    const parsed = JSON.parse(raw);
+    return ok2(parsed);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return fail2(`Failed to parse state file: ${msg}`);
+  }
+}
+function validateStateConsistency(statePath2, sprintStatusPath) {
+  try {
+    const stateResult = parseStateFile(statePath2);
+    if (!stateResult.success) {
+      return fail2(stateResult.error);
+    }
+    const state = stateResult.data;
+    if (!existsSync23(sprintStatusPath)) {
+      return fail2(`Sprint status file not found: ${sprintStatusPath}`);
+    }
+    const statusContent = readFileSync20(sprintStatusPath, "utf-8");
+    const keysResult = parseSprintStatusKeys(statusContent);
+    if (!keysResult.success) {
+      return fail2(keysResult.error);
+    }
+    const expectedKeys = keysResult.data;
+    const issues = [];
+    const missingKeys = [];
+    for (const key of expectedKeys) {
+      if (!(key in state.stories)) {
+        missingKeys.push(key);
+        issues.push({
+          storyKey: key,
+          field: "entry",
+          message: `Story "${key}" in sprint-status.yaml has no entry in sprint-state.json`
+        });
+      }
+    }
+    const actualStoryCount = Object.keys(state.stories).length;
+    if (state.sprint.total !== actualStoryCount) {
+      issues.push({
+        storyKey: "_sprint",
+        field: "sprint.total",
+        message: `sprint.total is ${state.sprint.total} but state has ${actualStoryCount} stories`
+      });
+    }
+    for (const key of Object.keys(state.stories)) {
+      if (!expectedKeys.includes(key)) {
+        issues.push({
+          storyKey: key,
+          field: "entry",
+          message: `Story "${key}" in sprint-state.json has no entry in sprint-status.yaml`
+        });
+      }
     }
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-    const gitResult = captureGitDiff();
-    const gitDiff = gitResult.success ? gitResult.data : `(unavailable: ${gitResult.error})`;
-    const statePath2 = join17(process.cwd(), "sprint-state.json");
-    const deltaResult = captureStateDelta(opts.stateSnapshotPath, statePath2);
-    const stateDelta = deltaResult.success ? deltaResult.data : `(unavailable: ${deltaResult.error})`;
-    const stderrResult = capturePartialStderr(opts.outputFile);
-    const partialStderr = stderrResult.success ? stderrResult.data : `(unavailable: ${stderrResult.error})`;
-    const capture = {
-      storyKey: opts.storyKey,
-      iteration: opts.iteration,
-      durationMinutes: opts.durationMinutes,
-      gitDiff,
-      stateDelta,
-      partialStderr,
-      timestamp
-    };
-    const reportDir = join17(process.cwd(), "ralph", "logs");
-    const safeStoryKey = opts.storyKey.replace(/[^a-zA-Z0-9._-]/g, "_");
-    const reportFileName = `timeout-report-${opts.iteration}-${safeStoryKey}.md`;
-    const reportPath = join17(reportDir, reportFileName);
-    if (!existsSync19(reportDir)) {
-      mkdirSync6(reportDir, { recursive: true });
+    for (const [key, story] of Object.entries(state.stories)) {
+      if (!VALID_STATUSES.has(story.status)) {
+        issues.push({
+          storyKey: key,
+          field: "status",
+          message: `Invalid status "${story.status}" (expected one of: ${[...VALID_STATUSES].join(", ")})`
+        });
+      }
+      if (typeof story.attempts !== "number" || !Number.isInteger(story.attempts) || story.attempts < 0) {
+        issues.push({
+          storyKey: key,
+          field: "attempts",
+          message: `Invalid attempts value "${story.attempts}" (must be non-negative integer)`
+        });
+      }
+      if (story.lastError !== null && story.lastAttempt !== null) {
+        const attemptTime = new Date(story.lastAttempt).getTime();
+        const now = Date.now();
+        if (!isNaN(attemptTime) && now - attemptTime > STALE_THRESHOLD_MS) {
+          issues.push({
+            storyKey: key,
+            field: "lastError",
+            message: `Stale lastError: lastAttempt was "${story.lastAttempt}" (>24h ago)`
+          });
+        }
+      }
     }
-    const reportContent = formatReport(capture);
-    writeFileSync10(reportPath, reportContent, "utf-8");
+    const allKeys = /* @__PURE__ */ new Set([...expectedKeys, ...Object.keys(state.stories)]);
+    const totalStories = allKeys.size;
+    const invalidCount = new Set(issues.map((i) => i.storyKey)).size;
+    const validCount = totalStories - invalidCount;
     return ok2({
-      filePath: reportPath,
-      capture
+      totalStories,
+      validCount,
+      invalidCount,
+      missingKeys,
+      issues
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    return fail2(`Failed to capture timeout report: ${msg}`);
+    return fail2(`Validation failed: ${msg}`);
   }
 }
 
-// src/modules/sprint/feedback.ts
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync11 } from "fs";
-import { existsSync as existsSync20 } from "fs";
-import { join as join18 } from "path";
-
 // src/modules/sprint/index.ts
 function generateReport2() {
   const stateResult = getSprintState();
@@ -5134,6 +5549,9 @@ function getStoryDrillDown2(key) {
 function captureTimeoutReport2(opts) {
   return captureTimeoutReport(opts);
 }
+function validateStateConsistency2(statePath2, sprintStatusPath) {
+  return validateStateConsistency(statePath2, sprintStatusPath);
+}
 
 // src/commands/status.ts
 function buildScopedEndpoints(endpoints, serviceName) {
@@ -5699,16 +6117,16 @@ function getBeadsData() {
 }
 
 // src/commands/onboard.ts
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 
 // src/lib/scanner.ts
 import {
-  existsSync as existsSync21,
-  readdirSync as readdirSync3,
-  readFileSync as readFileSync19,
-  statSync as statSync2
+  existsSync as existsSync24,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync21,
+  statSync as statSync3
 } from "fs";
-import { join as join19, relative as relative2 } from "path";
+import { join as join20, relative as relative2 } from "path";
 var SOURCE_EXTENSIONS2 = /* @__PURE__ */ new Set([".ts", ".js", ".py"]);
 var DEFAULT_MIN_MODULE_SIZE = 3;
 function getExtension2(filename) {
@@ -5726,17 +6144,17 @@ function countSourceFiles(dir) {
   function walk(current) {
     let entries;
     try {
-      entries = readdirSync3(current);
+      entries = readdirSync4(current);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (isSkippedDir(entry)) continue;
       if (entry.startsWith(".") && current !== dir) continue;
-      const fullPath = join19(current, entry);
+      const fullPath = join20(current, entry);
       let stat;
       try {
-        stat = statSync2(fullPath);
+        stat = statSync3(fullPath);
       } catch {
         continue;
       }
@@ -5756,22 +6174,22 @@ function countSourceFiles(dir) {
   return count;
 }
 function countModuleFiles(modulePath, rootDir) {
-  const fullModulePath = join19(rootDir, modulePath);
+  const fullModulePath = join20(rootDir, modulePath);
   let sourceFiles = 0;
   let testFiles = 0;
   function walk(current) {
     let entries;
     try {
-      entries = readdirSync3(current);
+      entries = readdirSync4(current);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (isSkippedDir(entry)) continue;
-      const fullPath = join19(current, entry);
+      const fullPath = join20(current, entry);
       let stat;
       try {
-        stat = statSync2(fullPath);
+        stat = statSync3(fullPath);
       } catch {
         continue;
       }
@@ -5793,8 +6211,8 @@ function countModuleFiles(modulePath, rootDir) {
   return { sourceFiles, testFiles };
 }
 function detectArtifacts(dir) {
-  const bmadPath = join19(dir, "_bmad");
-  const hasBmad = existsSync21(bmadPath);
+  const bmadPath = join20(dir, "_bmad");
+  const hasBmad = existsSync24(bmadPath);
   return {
     hasBmad,
     bmadPath: hasBmad ? relative2(dir, bmadPath) || "_bmad" : null
@@ -5876,10 +6294,10 @@ function readPerFileCoverage(dir, format) {
   return null;
 }
 function readVitestPerFileCoverage(dir) {
-  const reportPath = join19(dir, "coverage", "coverage-summary.json");
-  if (!existsSync21(reportPath)) return null;
+  const reportPath = join20(dir, "coverage", "coverage-summary.json");
+  if (!existsSync24(reportPath)) return null;
   try {
-    const report = JSON.parse(readFileSync19(reportPath, "utf-8"));
+    const report = JSON.parse(readFileSync21(reportPath, "utf-8"));
     const result = /* @__PURE__ */ new Map();
     for (const [key, value] of Object.entries(report)) {
       if (key === "total") continue;
@@ -5891,10 +6309,10 @@ function readVitestPerFileCoverage(dir) {
   }
 }
 function readPythonPerFileCoverage(dir) {
-  const reportPath = join19(dir, "coverage.json");
-  if (!existsSync21(reportPath)) return null;
+  const reportPath = join20(dir, "coverage.json");
+  if (!existsSync24(reportPath)) return null;
   try {
-    const report = JSON.parse(readFileSync19(reportPath, "utf-8"));
+    const report = JSON.parse(readFileSync21(reportPath, "utf-8"));
     if (!report.files) return null;
     const result = /* @__PURE__ */ new Map();
     for (const [key, value] of Object.entries(report.files)) {
@@ -5910,13 +6328,13 @@ function auditDocumentation(dir) {
   const root = dir ?? process.cwd();
   const documents = [];
   for (const docName of AUDIT_DOCUMENTS) {
-    const docPath = join19(root, docName);
-    if (!existsSync21(docPath)) {
+    const docPath = join20(root, docName);
+    if (!existsSync24(docPath)) {
       documents.push({ name: docName, grade: "missing", path: null });
       continue;
     }
-    const srcDir = join19(root, "src");
-    const codeDir = existsSync21(srcDir) ? srcDir : root;
+    const srcDir = join20(root, "src");
+    const codeDir = existsSync24(srcDir) ? srcDir : root;
     const stale = isDocStale(docPath, codeDir);
     documents.push({
       name: docName,
@@ -5924,10 +6342,10 @@ function auditDocumentation(dir) {
       path: docName
     });
   }
-  const docsDir = join19(root, "docs");
-  if (existsSync21(docsDir)) {
+  const docsDir = join20(root, "docs");
+  if (existsSync24(docsDir)) {
     try {
-      const stat = statSync2(docsDir);
+      const stat = statSync3(docsDir);
       if (stat.isDirectory()) {
         documents.push({ name: "docs/", grade: "present", path: "docs/" });
       }
@@ -5937,10 +6355,10 @@ function auditDocumentation(dir) {
   } else {
     documents.push({ name: "docs/", grade: "missing", path: null });
   }
-  const indexPath = join19(root, "docs", "index.md");
-  if (existsSync21(indexPath)) {
-    const srcDir = join19(root, "src");
-    const indexCodeDir = existsSync21(srcDir) ? srcDir : root;
+  const indexPath = join20(root, "docs", "index.md");
+  if (existsSync24(indexPath)) {
+    const srcDir = join20(root, "src");
+    const indexCodeDir = existsSync24(srcDir) ? srcDir : root;
     const indexStale = isDocStale(indexPath, indexCodeDir);
     documents.push({
       name: "docs/index.md",
@@ -5957,8 +6375,8 @@ function auditDocumentation(dir) {
 
 // src/lib/epic-generator.ts
 import { createInterface } from "readline";
-import { existsSync as existsSync22, mkdirSync as mkdirSync7, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname6, join as join20 } from "path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync8, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname6, join as join21 } from "path";
 var PRIORITY_BY_TYPE = {
   observability: 1,
   coverage: 2,
@@ -5996,8 +6414,8 @@ function generateOnboardingEpic(scan, coverage, audit, rootDir) {
     storyNum++;
   }
   for (const mod of scan.modules) {
-    const agentsPath = join20(root, mod.path, "AGENTS.md");
-    if (!existsSync22(agentsPath)) {
+    const agentsPath = join21(root, mod.path, "AGENTS.md");
+    if (!existsSync25(agentsPath)) {
       stories.push({
         key: `0.${storyNum}`,
         title: `Create ${mod.path}/AGENTS.md`,
@@ -6063,7 +6481,7 @@ function generateOnboardingEpic(scan, coverage, audit, rootDir) {
   };
 }
 function writeOnboardingEpic(epic, outputPath) {
-  mkdirSync7(dirname6(outputPath), { recursive: true });
+  mkdirSync8(dirname6(outputPath), { recursive: true });
   const lines = [];
   lines.push(`# ${epic.title}`);
   lines.push("");
@@ -6106,7 +6524,7 @@ function formatEpicSummary(epic) {
   return `Onboarding plan: ${totalStories} stories (${coverageStories} coverage, ${docStories} documentation, ${verificationStories} verification, ${observabilityStories} observability)`;
 }
 function promptApproval() {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     let answered = false;
     const rl = createInterface({
       input: process.stdin,
@@ -6115,14 +6533,14 @@ function promptApproval() {
     rl.on("close", () => {
       if (!answered) {
         answered = true;
-        resolve2(false);
+        resolve3(false);
       }
     });
     rl.question("Review the onboarding plan. Approve? [Y/n] ", (answer) => {
       answered = true;
       rl.close();
       const trimmed = answer.trim().toLowerCase();
-      resolve2(trimmed === "" || trimmed === "y");
+      resolve3(trimmed === "" || trimmed === "y");
     });
   });
 }
@@ -6195,29 +6613,29 @@ function getGapIdFromTitle(title) {
 }
 
 // src/lib/scan-cache.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync8, readFileSync as readFileSync20, writeFileSync as writeFileSync13 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync9, readFileSync as readFileSync22, writeFileSync as writeFileSync13 } from "fs";
+import { join as join22 } from "path";
 var CACHE_DIR = ".harness";
 var CACHE_FILE = "last-onboard-scan.json";
 var DEFAULT_MAX_AGE_MS = 864e5;
 function saveScanCache(entry, dir) {
   try {
     const root = dir ?? process.cwd();
-    const cacheDir = join21(root, CACHE_DIR);
-    mkdirSync8(cacheDir, { recursive: true });
-    const cachePath = join21(cacheDir, CACHE_FILE);
+    const cacheDir = join22(root, CACHE_DIR);
+    mkdirSync9(cacheDir, { recursive: true });
+    const cachePath = join22(cacheDir, CACHE_FILE);
     writeFileSync13(cachePath, JSON.stringify(entry, null, 2), "utf-8");
   } catch {
   }
 }
 function loadScanCache(dir) {
   const root = dir ?? process.cwd();
-  const cachePath = join21(root, CACHE_DIR, CACHE_FILE);
-  if (!existsSync23(cachePath)) {
+  const cachePath = join22(root, CACHE_DIR, CACHE_FILE);
+  if (!existsSync26(cachePath)) {
     return null;
   }
   try {
-    const raw = readFileSync20(cachePath, "utf-8");
+    const raw = readFileSync22(cachePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -6390,7 +6808,7 @@ function registerOnboardCommand(program) {
     }
     coverage = lastCoverageResult ?? runCoverageAnalysis(scan);
     audit = lastAuditResult ?? runAudit();
-    const epicPath = join22(process.cwd(), "ralph", "onboarding-epic.md");
+    const epicPath = join23(process.cwd(), "ralph", "onboarding-epic.md");
     const epic = generateOnboardingEpic(scan, coverage, audit);
     mergeExtendedGaps(epic);
     if (!isFull) {
@@ -6463,7 +6881,7 @@ function registerOnboardCommand(program) {
       coverage,
       audit
     });
-    const epicPath = join22(process.cwd(), "ralph", "onboarding-epic.md");
+    const epicPath = join23(process.cwd(), "ralph", "onboarding-epic.md");
     const epic = generateOnboardingEpic(scan, coverage, audit);
     mergeExtendedGaps(epic);
     if (!isFull) {
@@ -6571,8 +6989,8 @@ function printEpicOutput(epic) {
 }
 
 // src/commands/teardown.ts
-import { existsSync as existsSync24, unlinkSync as unlinkSync2, readFileSync as readFileSync21, writeFileSync as writeFileSync14, rmSync } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync27, unlinkSync as unlinkSync2, readFileSync as readFileSync23, writeFileSync as writeFileSync14, rmSync as rmSync2 } from "fs";
+import { join as join24 } from "path";
 function buildDefaultResult() {
   return {
     status: "ok",
@@ -6675,16 +7093,16 @@ function registerTeardownCommand(program) {
           info("Docker stack: not running, skipping");
         }
       }
-      const composeFilePath = join23(projectDir, composeFile);
-      if (existsSync24(composeFilePath)) {
+      const composeFilePath = join24(projectDir, composeFile);
+      if (existsSync27(composeFilePath)) {
         unlinkSync2(composeFilePath);
         result.removed.push(composeFile);
         if (!isJson) {
           ok(`Removed: ${composeFile}`);
         }
       }
-      const otelConfigPath = join23(projectDir, "otel-collector-config.yaml");
-      if (existsSync24(otelConfigPath)) {
+      const otelConfigPath = join24(projectDir, "otel-collector-config.yaml");
+      if (existsSync27(otelConfigPath)) {
         unlinkSync2(otelConfigPath);
         result.removed.push("otel-collector-config.yaml");
         if (!isJson) {
@@ -6694,8 +7112,8 @@ function registerTeardownCommand(program) {
     }
     let patchesRemoved = 0;
     for (const [patchName, relativePath] of Object.entries(PATCH_TARGETS)) {
-      const filePath = join23(projectDir, "_bmad", relativePath);
-      if (!existsSync24(filePath)) {
+      const filePath = join24(projectDir, "_bmad", relativePath);
+      if (!existsSync27(filePath)) {
         continue;
       }
       try {
@@ -6715,10 +7133,10 @@ function registerTeardownCommand(program) {
       }
     }
     if (state.otlp?.enabled && state.stack === "nodejs") {
-      const pkgPath = join23(projectDir, "package.json");
-      if (existsSync24(pkgPath)) {
+      const pkgPath = join24(projectDir, "package.json");
+      if (existsSync27(pkgPath)) {
         try {
-          const raw = readFileSync21(pkgPath, "utf-8");
+          const raw = readFileSync23(pkgPath, "utf-8");
           const pkg = JSON.parse(raw);
           const scripts = pkg["scripts"];
           if (scripts) {
@@ -6758,16 +7176,16 @@ function registerTeardownCommand(program) {
         }
       }
     }
-    const harnessDir = join23(projectDir, ".harness");
-    if (existsSync24(harnessDir)) {
-      rmSync(harnessDir, { recursive: true, force: true });
+    const harnessDir = join24(projectDir, ".harness");
+    if (existsSync27(harnessDir)) {
+      rmSync2(harnessDir, { recursive: true, force: true });
       result.removed.push(".harness/");
       if (!isJson) {
         ok("Removed: .harness/");
       }
     }
     const statePath2 = getStatePath(projectDir);
-    if (existsSync24(statePath2)) {
+    if (existsSync27(statePath2)) {
       unlinkSync2(statePath2);
       result.removed.push(".claude/codeharness.local.md");
       if (!isJson) {
@@ -7511,8 +7929,8 @@ function registerQueryCommand(program) {
 }
 
 // src/commands/retro-import.ts
-import { existsSync as existsSync25, readFileSync as readFileSync22 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync28, readFileSync as readFileSync24 } from "fs";
+import { join as join25 } from "path";
 
 // src/lib/retro-parser.ts
 var KNOWN_TOOLS = ["showboat", "ralph", "beads", "bmad"];
@@ -7569,7 +7987,7 @@ function derivePriority(item) {
 }
 
 // src/lib/github.ts
-import { execFileSync as execFileSync6 } from "child_process";
+import { execFileSync as execFileSync7 } from "child_process";
 var GitHubError = class extends Error {
   constructor(command, originalMessage) {
     super(`GitHub CLI failed: ${originalMessage}. Command: ${command}`);
@@ -7580,7 +7998,7 @@ var GitHubError = class extends Error {
 };
 function isGhAvailable() {
   try {
-    execFileSync6("which", ["gh"], { stdio: "pipe", timeout: 5e3 });
+    execFileSync7("which", ["gh"], { stdio: "pipe", timeout: 5e3 });
     return true;
   } catch {
     return false;
@@ -7594,7 +8012,7 @@ function ghIssueCreate(repo, title, body, labels) {
   args.push("--json", "number,url");
   const cmdStr = `gh ${args.join(" ")}`;
   try {
-    const output = execFileSync6("gh", args, {
+    const output = execFileSync7("gh", args, {
       stdio: "pipe",
       timeout: 3e4
     });
@@ -7609,7 +8027,7 @@ function ghIssueSearch(repo, query) {
   const args = ["issue", "list", "--repo", repo, "--search", query, "--state", "all", "--json", "number,title,body,url,labels"];
   const cmdStr = `gh ${args.join(" ")}`;
   try {
-    const output = execFileSync6("gh", args, {
+    const output = execFileSync7("gh", args, {
       stdio: "pipe",
       timeout: 3e4
     });
@@ -7631,7 +8049,7 @@ function findExistingGhIssue(repo, gapId) {
 }
 function getRepoFromRemote() {
   try {
-    const output = execFileSync6("git", ["remote", "get-url", "origin"], {
+    const output = execFileSync7("git", ["remote", "get-url", "origin"], {
       stdio: "pipe",
       timeout: 5e3
     });
@@ -7651,7 +8069,7 @@ function parseRepoFromUrl(url) {
 function ensureLabels(repo, labels) {
   for (const label of labels) {
     try {
-      execFileSync6("gh", ["label", "create", label, "--repo", repo], {
+      execFileSync7("gh", ["label", "create", label, "--repo", repo], {
         stdio: "pipe",
         timeout: 1e4
       });
@@ -7661,7 +8079,7 @@ function ensureLabels(repo, labels) {
 }
 
 // src/commands/retro-import.ts
-var STORY_DIR2 = "_bmad-output/implementation-artifacts";
+var STORY_DIR3 = "_bmad-output/implementation-artifacts";
 var MAX_TITLE_LENGTH = 120;
 function classificationToString(c) {
   if (c.type === "tool") {
@@ -7681,15 +8099,15 @@ function registerRetroImportCommand(program) {
       return;
     }
     const retroFile = `epic-${epicNum}-retrospective.md`;
-    const retroPath = join24(root, STORY_DIR2, retroFile);
-    if (!existsSync25(retroPath)) {
+    const retroPath = join25(root, STORY_DIR3, retroFile);
+    if (!existsSync28(retroPath)) {
       fail(`Retro file not found: ${retroFile}`, { json: isJson });
       process.exitCode = 1;
       return;
     }
     let content;
     try {
-      content = readFileSync22(retroPath, "utf-8");
+      content = readFileSync24(retroPath, "utf-8");
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       fail(`Failed to read retro file: ${message}`, { json: isJson });
@@ -7955,292 +8373,6 @@ function registerGithubImportCommand(program) {
   });
 }
 
-// src/lib/verify-env.ts
-import { execFileSync as execFileSync7 } from "child_process";
-import { existsSync as existsSync26, mkdirSync as mkdirSync9, readdirSync as readdirSync4, readFileSync as readFileSync23, cpSync, rmSync as rmSync2, statSync as statSync3 } from "fs";
-import { join as join25, basename as basename3 } from "path";
-import { createHash } from "crypto";
-var IMAGE_TAG = "codeharness-verify";
-var STORY_DIR3 = "_bmad-output/implementation-artifacts";
-var TEMP_PREFIX = "/tmp/codeharness-verify-";
-var STATE_KEY_DIST_HASH = "verify_env_dist_hash";
-function isValidStoryKey(storyKey) {
-  if (!storyKey || storyKey.includes("..") || storyKey.includes("/") || storyKey.includes("\\")) {
-    return false;
-  }
-  return /^[a-zA-Z0-9_-]+$/.test(storyKey);
-}
-function computeDistHash(projectDir) {
-  const distDir = join25(projectDir, "dist");
-  if (!existsSync26(distDir)) {
-    return null;
-  }
-  const hash = createHash("sha256");
-  const files = collectFiles(distDir).sort();
-  for (const file of files) {
-    const content = readFileSync23(file);
-    hash.update(file.slice(distDir.length));
-    hash.update(content);
-  }
-  return hash.digest("hex");
-}
-function collectFiles(dir) {
-  const results = [];
-  const entries = readdirSync4(dir, { withFileTypes: true });
-  for (const entry of entries) {
-    const fullPath = join25(dir, entry.name);
-    if (entry.isDirectory()) {
-      results.push(...collectFiles(fullPath));
-    } else {
-      results.push(fullPath);
-    }
-  }
-  return results;
-}
-function getStoredDistHash(projectDir) {
-  try {
-    const { state } = readStateWithBody(projectDir);
-    const raw = state;
-    return raw[STATE_KEY_DIST_HASH] ?? null;
-  } catch {
-    return null;
-  }
-}
-function storeDistHash(projectDir, hash) {
-  try {
-    const { state, body } = readStateWithBody(projectDir);
-    const raw = state;
-    raw[STATE_KEY_DIST_HASH] = hash;
-    writeState(state, projectDir, body);
-  } catch {
-    info("Could not persist dist hash to state file \u2014 cache will not be available until state is initialized");
-  }
-}
-function buildVerifyImage(options = {}) {
-  const projectDir = options.projectDir ?? process.cwd();
-  if (!isDockerAvailable()) {
-    throw new Error("Docker is not available. Install Docker and ensure the daemon is running.");
-  }
-  const stack = detectStack(projectDir);
-  if (!stack) {
-    throw new Error("Cannot detect project stack. Ensure package.json (Node.js) or requirements.txt/pyproject.toml (Python) exists.");
-  }
-  const currentHash = computeDistHash(projectDir);
-  if (!currentHash) {
-    throw new Error("No dist/ directory found. Run your build command first (e.g., npm run build).");
-  }
-  const storedHash = getStoredDistHash(projectDir);
-  if (storedHash === currentHash) {
-    if (dockerImageExists(IMAGE_TAG)) {
-      const imageSize2 = getImageSize(IMAGE_TAG);
-      return { imageTag: IMAGE_TAG, imageSize: imageSize2, buildTimeMs: 0, cached: true };
-    }
-  }
-  const startTime = Date.now();
-  if (stack === "nodejs") {
-    buildNodeImage(projectDir);
-  } else if (stack === "python") {
-    buildPythonImage(projectDir);
-  } else {
-    throw new Error(`Unsupported stack for verify-env: ${stack}`);
-  }
-  const buildTimeMs = Date.now() - startTime;
-  storeDistHash(projectDir, currentHash);
-  const imageSize = getImageSize(IMAGE_TAG);
-  return { imageTag: IMAGE_TAG, imageSize, buildTimeMs, cached: false };
-}
-function buildNodeImage(projectDir) {
-  const packOutput = execFileSync7("npm", ["pack", "--pack-destination", "/tmp"], {
-    cwd: projectDir,
-    stdio: "pipe",
-    timeout: 6e4
-  }).toString().trim();
-  const lastLine = packOutput.split("\n").pop()?.trim();
-  if (!lastLine) {
-    throw new Error("npm pack produced no output \u2014 cannot determine tarball filename.");
-  }
-  const tarballName = basename3(lastLine);
-  const tarballPath = join25("/tmp", tarballName);
-  const buildContext = join25("/tmp", `codeharness-verify-build-${Date.now()}`);
-  mkdirSync9(buildContext, { recursive: true });
-  try {
-    cpSync(tarballPath, join25(buildContext, tarballName));
-    const dockerfileSrc = resolveDockerfileTemplate(projectDir);
-    cpSync(dockerfileSrc, join25(buildContext, "Dockerfile"));
-    execFileSync7("docker", [
-      "build",
-      "-t",
-      IMAGE_TAG,
-      "--build-arg",
-      `TARBALL=${tarballName}`,
-      "."
-    ], {
-      cwd: buildContext,
-      stdio: "pipe",
-      timeout: 12e4
-    });
-  } finally {
-    rmSync2(buildContext, { recursive: true, force: true });
-    rmSync2(tarballPath, { force: true });
-  }
-}
-function buildPythonImage(projectDir) {
-  const distDir = join25(projectDir, "dist");
-  const distFiles = readdirSync4(distDir).filter(
-    (f) => f.endsWith(".tar.gz") || f.endsWith(".whl")
-  );
-  if (distFiles.length === 0) {
-    throw new Error("No distribution files found in dist/. Run your build command first (e.g., python -m build).");
-  }
-  const distFile = distFiles.filter((f) => f.endsWith(".tar.gz"))[0] ?? distFiles[0];
-  const buildContext = join25("/tmp", `codeharness-verify-build-${Date.now()}`);
-  mkdirSync9(buildContext, { recursive: true });
-  try {
-    cpSync(join25(distDir, distFile), join25(buildContext, distFile));
-    const dockerfileSrc = resolveDockerfileTemplate(projectDir);
-    cpSync(dockerfileSrc, join25(buildContext, "Dockerfile"));
-    execFileSync7("docker", [
-      "build",
-      "-t",
-      IMAGE_TAG,
-      "--build-arg",
-      `TARBALL=${distFile}`,
-      "."
-    ], {
-      cwd: buildContext,
-      stdio: "pipe",
-      timeout: 12e4
-    });
-  } finally {
-    rmSync2(buildContext, { recursive: true, force: true });
-  }
-}
-function prepareVerifyWorkspace(storyKey, projectDir) {
-  const root = projectDir ?? process.cwd();
-  if (!isValidStoryKey(storyKey)) {
-    throw new Error(`Invalid story key: ${storyKey}. Keys must contain only alphanumeric characters, hyphens, and underscores.`);
-  }
-  const storyFile = join25(root, STORY_DIR3, `${storyKey}.md`);
-  if (!existsSync26(storyFile)) {
-    throw new Error(`Story file not found: ${storyFile}`);
-  }
-  const workspace = `${TEMP_PREFIX}${storyKey}`;
-  if (existsSync26(workspace)) {
-    rmSync2(workspace, { recursive: true, force: true });
-  }
-  mkdirSync9(workspace, { recursive: true });
-  cpSync(storyFile, join25(workspace, "story.md"));
-  const readmePath = join25(root, "README.md");
-  if (existsSync26(readmePath)) {
-    cpSync(readmePath, join25(workspace, "README.md"));
-  }
-  const docsDir = join25(root, "docs");
-  if (existsSync26(docsDir) && statSync3(docsDir).isDirectory()) {
-    cpSync(docsDir, join25(workspace, "docs"), { recursive: true });
-  }
-  mkdirSync9(join25(workspace, "verification"), { recursive: true });
-  return workspace;
-}
-function checkVerifyEnv() {
-  const result = {
-    imageExists: false,
-    cliWorks: false,
-    otelReachable: false
-  };
-  result.imageExists = dockerImageExists(IMAGE_TAG);
-  if (!result.imageExists) {
-    return result;
-  }
-  try {
-    execFileSync7("docker", ["run", "--rm", IMAGE_TAG, "codeharness", "--help"], {
-      stdio: "pipe",
-      timeout: 3e4
-    });
-    result.cliWorks = true;
-  } catch {
-    result.cliWorks = false;
-  }
-  try {
-    execFileSync7("docker", [
-      "run",
-      "--rm",
-      "--add-host=host.docker.internal:host-gateway",
-      IMAGE_TAG,
-      "curl",
-      "-sf",
-      "--max-time",
-      "5",
-      "http://host.docker.internal:4318/v1/status"
-    ], {
-      stdio: "pipe",
-      timeout: 3e4
-    });
-    result.otelReachable = true;
-  } catch {
-    result.otelReachable = false;
-  }
-  return result;
-}
-function cleanupVerifyEnv(storyKey) {
-  if (!isValidStoryKey(storyKey)) {
-    throw new Error(`Invalid story key: ${storyKey}. Keys must contain only alphanumeric characters, hyphens, and underscores.`);
-  }
-  const workspace = `${TEMP_PREFIX}${storyKey}`;
-  const containerName = `codeharness-verify-${storyKey}`;
-  if (existsSync26(workspace)) {
-    rmSync2(workspace, { recursive: true, force: true });
-  }
-  try {
-    execFileSync7("docker", ["stop", containerName], {
-      stdio: "pipe",
-      timeout: 15e3
-    });
-  } catch {
-  }
-  try {
-    execFileSync7("docker", ["rm", "-f", containerName], {
-      stdio: "pipe",
-      timeout: 15e3
-    });
-  } catch {
-  }
-}
-function resolveDockerfileTemplate(projectDir) {
-  const local = join25(projectDir, "templates", "Dockerfile.verify");
-  if (existsSync26(local)) return local;
-  const pkgDir = new URL("../../", import.meta.url).pathname;
-  const pkg = join25(pkgDir, "templates", "Dockerfile.verify");
-  if (existsSync26(pkg)) return pkg;
-  throw new Error("Dockerfile.verify not found. Ensure templates/Dockerfile.verify exists in the project or installed package.");
-}
-function dockerImageExists(tag) {
-  try {
-    execFileSync7("docker", ["image", "inspect", tag], {
-      stdio: "pipe",
-      timeout: 1e4
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function getImageSize(tag) {
-  try {
-    const output = execFileSync7("docker", ["image", "inspect", tag, "--format", "{{.Size}}"], {
-      stdio: "pipe",
-      timeout: 1e4
-    }).toString().trim();
-    const bytes = parseInt(output, 10);
-    if (isNaN(bytes)) return output;
-    if (bytes >= 1e9) return `${(bytes / 1e9).toFixed(1)}GB`;
-    if (bytes >= 1e6) return `${(bytes / 1e6).toFixed(1)}MB`;
-    if (bytes >= 1e3) return `${(bytes / 1e3).toFixed(1)}KB`;
-    return `${bytes}B`;
-  } catch {
-    return "unknown";
-  }
-}
-
 // src/commands/verify-env.ts
 function registerVerifyEnvCommand(program) {
   const verifyEnv = program.command("verify-env").description("Manage verification environment (Docker image + clean workspace)");
@@ -8359,7 +8491,7 @@ function registerVerifyEnvCommand(program) {
 import { join as join27 } from "path";
 
 // src/lib/retry-state.ts
-import { existsSync as existsSync27, readFileSync as readFileSync24, writeFileSync as writeFileSync15 } from "fs";
+import { existsSync as existsSync29, readFileSync as readFileSync25, writeFileSync as writeFileSync15 } from "fs";
 import { join as join26 } from "path";
 var RETRIES_FILE = ".story_retries";
 var FLAGGED_FILE = ".flagged_stories";
@@ -8372,10 +8504,10 @@ function flaggedPath(dir) {
 }
 function readRetries(dir) {
   const filePath = retriesPath(dir);
-  if (!existsSync27(filePath)) {
+  if (!existsSync29(filePath)) {
     return /* @__PURE__ */ new Map();
   }
-  const raw = readFileSync24(filePath, "utf-8");
+  const raw = readFileSync25(filePath, "utf-8");
   const result = /* @__PURE__ */ new Map();
   for (const line of raw.split("\n")) {
     const trimmed = line.trim();
@@ -8412,10 +8544,10 @@ function resetRetry(dir, storyKey) {
 }
 function readFlaggedStories(dir) {
   const filePath = flaggedPath(dir);
-  if (!existsSync27(filePath)) {
+  if (!existsSync29(filePath)) {
     return [];
   }
-  const raw = readFileSync24(filePath, "utf-8");
+  const raw = readFileSync25(filePath, "utf-8");
   return raw.split("\n").map((l) => l.trim()).filter((l) => l !== "");
 }
 function writeFlaggedStories(dir, stories) {
@@ -8558,8 +8690,56 @@ function registerTimeoutReportCommand(program) {
   });
 }
 
+// src/commands/validate-state.ts
+import { resolve as resolve2 } from "path";
+function registerValidateStateCommand(program) {
+  program.command("validate-state").description("Validate sprint-state.json consistency against sprint-status.yaml").option("--state <path>", "Path to sprint-state.json", "sprint-state.json").option("--sprint-status <path>", "Path to sprint-status.yaml", "sprint-status.yaml").action((options, cmd) => {
+    const opts = cmd.optsWithGlobals();
+    const isJson = opts.json === true;
+    const statePath2 = resolve2(process.cwd(), options.state);
+    const sprintStatusPath = resolve2(process.cwd(), options.sprintStatus);
+    const result = validateStateConsistency2(statePath2, sprintStatusPath);
+    if (!result.success) {
+      if (isJson) {
+        jsonOutput({ status: "fail", message: result.error });
+      } else {
+        fail(result.error);
+      }
+      process.exitCode = 1;
+      return;
+    }
+    const report = result.data;
+    if (isJson) {
+      jsonOutput({
+        status: report.invalidCount === 0 ? "ok" : "fail",
+        totalStories: report.totalStories,
+        validCount: report.validCount,
+        invalidCount: report.invalidCount,
+        missingKeys: report.missingKeys,
+        issues: report.issues
+      });
+    } else {
+      console.log(`Total stories: ${report.totalStories}`);
+      console.log(`Valid: ${report.validCount}`);
+      console.log(`Invalid: ${report.invalidCount}`);
+      if (report.missingKeys.length > 0) {
+        console.log(`Missing keys: ${report.missingKeys.join(", ")}`);
+      }
+      for (const issue of report.issues) {
+        console.log(`  [${issue.storyKey}] ${issue.field}: ${issue.message}`);
+      }
+      if (report.invalidCount === 0) {
+        ok("All stories valid");
+      } else {
+        fail(`${report.invalidCount} story/stories have issues`);
+      }
+    }
+    process.exitCode = report.invalidCount === 0 ? 0 : 1;
+  });
+}
+
 // src/index.ts
-var VERSION = true ? "0.19.2" : "0.0.0-dev";
+var VERSION = true ? "0.19.3" : "0.0.0-dev";
 function createProgram() {
   const program = new Command();
   program.name("codeharness").description("Makes autonomous coding agents produce software that actually works").version(VERSION).option("--json", "Output in machine-readable JSON format");
@@ -8581,6 +8761,7 @@ function createProgram() {
   registerVerifyEnvCommand(program);
   registerRetryCommand(program);
   registerTimeoutReportCommand(program);
+  registerValidateStateCommand(program);
   return program;
 }
 if (!process.env["VITEST"]) {