crewly 1.14.1 → 1.16.0

package/config/skills/orchestrator/wiki-migrate/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: Wiki Migrate
 description: One-shot conversion from legacy `.crewly/knowledge/*.json` + loose `.md` + agent `memory.json` into the v2.1 three-scope vault structure. Default dry-run; idempotent; never deletes legacy files.
-version: 1.0.0
+version: 1.1.0
 category: knowledge
 skillType: claude-skill
 assignableRoles:
@@ -65,14 +65,39 @@ Vault picker:
 | `--project-root <abs path>` | yes | — | The dir containing `.crewly/`. |
 | `--apply` | no | off | Execute writes. Without this, run a dry-run scan. |
 | `--no-memory` | no | off | Skip the per-agent `memory.json` import. |
+| `--full` (or `"full": true`) | no | off | Return the raw backend payload including the full `proposedPages` array. Default output is the compact report below. |
+
+## Output: compact by default
+
+The backend payload carries one row per proposed page — hundreds of entries on a real project — and re-reading it on every scan is a context-cost problem, not a decision aid. By default the skill therefore returns a **compact report**:
+
+```json
+{
+  "ok": true, "vaultPath": "...", "legacyDetected": true,
+  "bootstrapNeeded": { "project": true, "global": false, "teams": [] },
+  "summary": { "decisions": 10, "patterns": 8, "...": 0, "alreadyMigrated": 8 },
+  "totalProposed": 25, "alreadyMigrated": 8, "skippedOther": 1, "netNew": 16,
+  "routingUncertain": 2,
+  "byCategory": { "decision": { "proposed": 10, "netNew": 6 }, "pattern": { "...": 0 } },
+  "netNewSample": [ "llm-curated/decisions/2026-05-01-foo.md", "..." ],
+  "hint": "compact view — pass --full for the complete proposedPages array"
+}
+```
+
+- `byCategory` is keyed by `sourceType`; `netNew` = pages without a `skipReason`.
+- `netNewSample` lists the first 10 net-new target paths (`WIKI_MIGRATE_SAMPLE_SIZE` env overrides the count).
+- Apply-only keys (`applied`, `skipped`, `bootstrapped`, `manifestPath`) pass through unchanged.
+
+Only pass `--full` when you actually need per-row detail (a specific `sourceFile`, `sourceId`, or the `routingUncertain` rows). Even then the shared skill output cap applies: very large payloads are parked under `$CREWLY_HOME/tmp/skill-output/` and you get a `{"truncated":true,"file":...}` envelope — read the file with `jq` and select the fields you need.
 
 ## What you do with the report
 
 **On scan (dry-run):**
-- Read `proposedPages` — each row tells you target path, source file, sourceId.
+- `netNew == 0` → nothing to do; stop here.
+- Read `byCategory` / `netNewSample` to sanity-check what will land; use `--full` only if a specific row needs inspection.
 - Look at `bootstrapNeeded` — confirms which vaults will be created.
 - Look at `summary` — counts per source type.
-- Look for `routingUncertain: true` rows — these will land in the project vault but flagged for later human review.
+- `routingUncertain` counts rows that will land in the project vault but flagged for later human review (`--full` shows which).
 
 **On apply:**
 - Confirm `applied` count matches the proposal.
@@ -97,6 +122,11 @@ bash execute.sh --project-root /Users/me/code/myproject --apply
 bash execute.sh --project-root /Users/me/code/myproject --no-memory --apply
 ```
 
+**Inspect every proposed row (raw payload):**
+```bash
+bash execute.sh --project-root /Users/me/code/myproject --full
+```
+
 ## Failure modes
 
 - `400 invalid_input` — `projectRoot` is not absolute, or `confirm` was missing on apply (skill handles this automatically).

package/config/skills/orchestrator/wiki-migrate/compact.jq

@@ -0,0 +1,36 @@
+# wiki-migrate compact report filter.
+#
+# The backend's scan/apply payload carries the full `proposedPages` array —
+# hundreds of rows on a real project — and the orchestrator only needs the
+# shape of the migration to decide whether to apply it. This filter drops the
+# array and replaces it with counts (by sourceType), the already-migrated /
+# net-new split, and a short sample of net-new target paths.
+#
+# Every other top-level key (ok, vaultPath, legacyDetected, bootstrapNeeded,
+# summary, applied, skipped, bootstrapped, manifestPath, ...) passes through.
+#
+# Args: $sample (number) — how many net-new relPaths to include.
+def is_new: (.skipReason // "") == "";
+
+. as $r
+| ($r.proposedPages // []) as $pages
+| ($pages | map(select(is_new))) as $new
+| ($r | del(.proposedPages))
++ {
+    totalProposed: ($pages | length),
+    alreadyMigrated: ($pages | map(select(.skipReason == "already migrated")) | length),
+    skippedOther: ($pages | map(select((.skipReason // "") != "" and .skipReason != "already migrated")) | length),
+    netNew: ($new | length),
+    routingUncertain: ($pages | map(select(.routingUncertain == true)) | length),
+    byCategory: (
+      $pages
+      | group_by(.sourceType)
+      | map({
+          key: (.[0].sourceType // "unknown"),
+          value: { proposed: length, netNew: (map(select(is_new)) | length) }
+        })
+      | from_entries
+    ),
+    netNewSample: ($new | .[:$sample] | map(.targetRelativePath)),
+    hint: "compact view — pass --full for the complete proposedPages array"
+  }

package/config/skills/orchestrator/wiki-migrate/execute.sh

@@ -12,18 +12,30 @@
 # Safe to re-run. The manifest at <project>/.crewly/wiki/.migration-state.json
 # tracks already-migrated entries by content hash + sourceId.
 #
+# Output is a COMPACT report by default (counts by sourceType, alreadyMigrated
+# vs netNew, first few net-new target paths). The raw backend payload carries
+# the full `proposedPages` array — hundreds of rows — and is only returned
+# with --full.
+#
 # Usage:
-#   bash execute.sh --project-root /abs/path                       # scan
+#   bash execute.sh --project-root /abs/path                       # scan (compact)
+#   bash execute.sh --project-root /abs/path --full                # scan (raw proposedPages)
 #   bash execute.sh --project-root /abs/path --apply               # write
 #   bash execute.sh --project-root /abs/path --no-memory --apply   # skip agent memory.json copies
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../../_common/lib.sh"
 
+# Number of net-new target paths listed in the compact report.
+WIKI_MIGRATE_SAMPLE_SIZE="${WIKI_MIGRATE_SAMPLE_SIZE:-10}"
+COMPACT_FILTER="${SCRIPT_DIR}/compact.jq"
+
 INPUT_JSON=""
 PROJECT_ROOT=""
 APPLY="false"
 INCLUDE_MEMORY="true"
+# lib.sh sets CREWLY_SKILL_FULL_OUTPUT=1 when --full is anywhere in argv.
+FULL="${CREWLY_SKILL_FULL_OUTPUT:-0}"
 
 if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
   INPUT_JSON="$1"; shift || true
@@ -34,6 +46,7 @@ while [[ $# -gt 0 ]]; do
     --project-root|-p) PROJECT_ROOT="$2"; shift 2 ;;
     --apply|-a)        APPLY="true";     shift   ;;
     --no-memory)       INCLUDE_MEMORY="false"; shift ;;
+    --full|-f)         FULL="1";         shift   ;;
     --json|-j)         INPUT_JSON="$2";  shift 2 ;;
     --help|-h)
       cat <<EOF
@@ -42,14 +55,20 @@ Usage:
   execute.sh --project-root <abs path> --apply    # execute migration
   execute.sh --project-root <abs path> --no-memory --apply
                                                   # apply but skip agent memory.json copies
+  execute.sh --project-root <abs path> --full     # raw payload incl. full proposedPages
 
-Outputs a JSON report:
+Outputs a compact JSON report (default):
   - legacyDetected   : true when any legacy source exists
-  - proposedPages    : per-entry target + skipReason (when "already migrated")
+  - totalProposed / alreadyMigrated / netNew / skippedOther / routingUncertain
+  - byCategory       : {sourceType: {proposed, netNew}}
+  - netNewSample     : first ${WIKI_MIGRATE_SAMPLE_SIZE} net-new target paths
   - bootstrapNeeded  : which vaults will be bootstrapped on --apply
   - summary          : counts per source type
   - applied/skipped  : only present on --apply
 
+With --full the raw backend payload is returned instead, including the
+per-entry proposedPages array (target + skipReason when "already migrated").
+
 The skill makes NO LLM calls. Re-running is safe (idempotent via manifest).
 EOF
       exit 0 ;;
@@ -65,6 +84,7 @@ if [ -n "$INPUT_JSON" ]; then
   [ -z "$PROJECT_ROOT" ] && PROJECT_ROOT=$(printf '%s' "$INPUT" | jq -r '.projectRoot       // empty')
   if printf '%s' "$INPUT" | jq -e '.apply == true' >/dev/null 2>&1; then APPLY="true"; fi
   if printf '%s' "$INPUT" | jq -e '.includeAgentMemory == false' >/dev/null 2>&1; then INCLUDE_MEMORY="false"; fi
+  if printf '%s' "$INPUT" | jq -e '.full == true' >/dev/null 2>&1; then FULL="1"; fi
 fi
 
 require_param "projectRoot (--project-root)" "$PROJECT_ROOT"
@@ -74,9 +94,19 @@ export _WM_M="$INCLUDE_MEMORY"
 
 if [ "$APPLY" = "true" ]; then
   BODY=$(jq -n '{projectRoot: env._WM_R, includeAgentMemory: (env._WM_M == "true"), confirm: true}')
-  api_call POST "/wiki/migrate/apply" "$BODY"
+  ENDPOINT="/wiki/migrate/apply"
 else
   BODY=$(jq -n '{projectRoot: env._WM_R, includeAgentMemory: (env._WM_M == "true")}')
-  api_call POST "/wiki/migrate/scan" "$BODY"
+  ENDPOINT="/wiki/migrate/scan"
 fi
 unset _WM_R _WM_M
+
+# Fetch the raw payload uncapped so the compact filter sees the whole array;
+# the compact report is small, and --full re-enters the shared output cap.
+RAW=$(CREWLY_SKILL_FULL_OUTPUT=1 api_call POST "$ENDPOINT" "$BODY")
+
+if [ "$FULL" = "1" ]; then
+  _cap_skill_output "$RAW"
+else
+  printf '%s' "$RAW" | jq --argjson sample "$WIKI_MIGRATE_SAMPLE_SIZE" -f "$COMPACT_FILTER"
+fi

package/config/skills/orchestrator/wiki-migrate/execute.test.sh

@@ -0,0 +1,124 @@
+#!/bin/bash
+# Tests for ORC wiki-migrate execute.sh
+#
+# The backend's scan payload carries the full `proposedPages` array (hundreds
+# of rows on a real project). The skill must return a COMPACT report by
+# default and only hand back the raw payload with --full / {"full":true}.
+#
+# Like delegate-task/execute.test.sh, this harness runs a COPY of the real
+# execute.sh (plus compact.jq) under a stubbed api_call so production logic
+# is exercised verbatim.
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PASS=0
+FAIL=0
+
+CALL_LOG=$(mktemp)
+SKILL_PARENT=$(mktemp -d)
+trap 'rm -rf "$SKILL_PARENT" "$CALL_LOG"' EXIT
+
+# The skill resolves `${SCRIPT_DIR}/../../_common/lib.sh`, so mirror the
+# config/skills/<role>/<skill> depth.
+mkdir -p "$SKILL_PARENT/_common" "$SKILL_PARENT/orchestrator/wiki-migrate"
+
+# Fixture: 25 proposed pages across 4 sourceTypes; 8 already migrated, 1
+# skipped for another reason, 16 net-new, 2 routingUncertain.
+FIXTURE=$(jq -nc '
+  def page($i; $type; $skip; $unc):
+    {sourceType: $type, sourceFile: "src/\($i).json", sourceId: "id-\($i)",
+     contentHash: "h\($i)", targetVaultPath: "/vault",
+     targetRelativePath: "llm-curated/\($type)/\($i).md", title: "t\($i)",
+     routingUncertain: $unc}
+    + (if $skip == "" then {} else {skipReason: $skip} end);
+  {
+    ok: true, vaultPath: "/vault", legacyDetected: true,
+    bootstrapNeeded: {project: true, global: false, teams: []},
+    summary: {decisions: 10, patterns: 8, gotchas: 4, relationships: 3,
+              learnings: 0, looseMd: 0, memoryEntries: 0, alreadyMigrated: 8},
+    proposedPages: (
+      [range(0;10) | page(.; "decision"; (if . < 4 then "already migrated" else "" end); false)]
+      + [range(10;18) | page(.; "pattern"; (if . < 14 then "already migrated" else "" end); (. == 15))]
+      + [range(18;22) | page(.; "gotcha"; (if . == 18 then "malformed" else "" end); (. == 19))]
+      + [range(22;25) | page(.; "relationship"; ""; false)]
+    )
+  }')
+export FIXTURE
+
+REAL_LIB="$(cd "$SCRIPT_DIR/../.." && pwd)/_common/lib.sh"
+cat > "$SKILL_PARENT/_common/lib.sh" <<EOF
+source "$REAL_LIB"
+api_call() {
+  local method="\$1" path="\$2" body="\${3:-}"
+  echo "\${method} \${path} \${body}" >> "${CALL_LOG}"
+  printf '%s' "\$FIXTURE"
+}
+EOF
+cp "$SCRIPT_DIR/execute.sh" "$SCRIPT_DIR/compact.jq" "$SKILL_PARENT/orchestrator/wiki-migrate/"
+chmod +x "$SKILL_PARENT/orchestrator/wiki-migrate/execute.sh"
+SKILL="$SKILL_PARENT/orchestrator/wiki-migrate/execute.sh"
+
+assert_eq() {
+  local desc="$1" expected="$2" actual="$3"
+  if [ "$expected" = "$actual" ]; then
+    echo "  PASS: $desc"; PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"; echo "    expected: $expected"; echo "    actual:   $actual"; FAIL=$((FAIL + 1))
+  fi
+}
+
+echo "=== wiki-migrate compact output ==="
+
+# ---- Test 1: default scan is compact and drops proposedPages ----
+OUT=$(bash "$SKILL" --project-root /tmp/proj)
+assert_eq "scan hits the scan endpoint" "1" "$(grep -c 'POST /wiki/migrate/scan' "$CALL_LOG")"
+assert_eq "compact: proposedPages dropped" "false" "$(printf '%s' "$OUT" | jq 'has("proposedPages")')"
+assert_eq "compact: totalProposed" "25" "$(printf '%s' "$OUT" | jq '.totalProposed')"
+assert_eq "compact: alreadyMigrated" "8" "$(printf '%s' "$OUT" | jq '.alreadyMigrated')"
+assert_eq "compact: skippedOther" "1" "$(printf '%s' "$OUT" | jq '.skippedOther')"
+assert_eq "compact: netNew" "16" "$(printf '%s' "$OUT" | jq '.netNew')"
+assert_eq "compact: routingUncertain" "2" "$(printf '%s' "$OUT" | jq '.routingUncertain')"
+assert_eq "compact: byCategory decision" '{"proposed":10,"netNew":6}' "$(printf '%s' "$OUT" | jq -c '.byCategory.decision')"
+assert_eq "compact: byCategory gotcha" '{"proposed":4,"netNew":3}' "$(printf '%s' "$OUT" | jq -c '.byCategory.gotcha')"
+assert_eq "compact: sample holds first 10 net-new relPaths" "10" "$(printf '%s' "$OUT" | jq '.netNewSample | length')"
+assert_eq "compact: sample starts at first net-new page" "llm-curated/decision/4.md" "$(printf '%s' "$OUT" | jq -r '.netNewSample[0]')"
+assert_eq "compact: sample excludes skipped pages" "0" "$(printf '%s' "$OUT" | jq '[.netNewSample[] | select(. == "llm-curated/gotcha/18.md")] | length')"
+assert_eq "compact: passthrough keys kept" "true|/vault|true" "$(printf '%s' "$OUT" | jq -r '"\(.ok)|\(.vaultPath)|\(.bootstrapNeeded.project)"')"
+assert_eq "compact: original summary kept" "8" "$(printf '%s' "$OUT" | jq '.summary.alreadyMigrated')"
+assert_eq "compact: hint mentions --full" "true" "$(printf '%s' "$OUT" | jq '.hint | test("--full")')"
+COMPACT_BYTES=$(printf '%s' "$OUT" | wc -c | tr -d ' ')
+RAW_BYTES=$(printf '%s' "$FIXTURE" | wc -c | tr -d ' ')
+assert_eq "compact: smaller than raw" "yes" "$([ "$COMPACT_BYTES" -lt "$RAW_BYTES" ] && echo yes || echo no)"
+
+# ---- Test 2: WIKI_MIGRATE_SAMPLE_SIZE tunes the sample ----
+OUT=$(WIKI_MIGRATE_SAMPLE_SIZE=3 bash "$SKILL" --project-root /tmp/proj)
+assert_eq "sample size env respected" "3" "$(printf '%s' "$OUT" | jq '.netNewSample | length')"
+
+# ---- Test 3: --full returns the raw payload ----
+OUT=$(bash "$SKILL" --project-root /tmp/proj --full)
+assert_eq "--full: proposedPages present" "25" "$(printf '%s' "$OUT" | jq '.proposedPages | length')"
+assert_eq "--full: no compact keys" "false" "$(printf '%s' "$OUT" | jq 'has("netNew")')"
+
+# ---- Test 4: {"full":true} JSON input also returns the raw payload ----
+OUT=$(bash "$SKILL" '{"projectRoot":"/tmp/proj","full":true}')
+assert_eq "json full:true: proposedPages present" "25" "$(printf '%s' "$OUT" | jq '.proposedPages | length')"
+
+# ---- Test 5: apply path is compacted too and keeps apply-only keys ----
+FIXTURE=$(printf '%s' "$FIXTURE" | jq -c '. + {applied: 16, skipped: 9, bootstrapped: ["/vault"], manifestPath: "/vault/.migration-state.json"}')
+export FIXTURE
+: > "$CALL_LOG"
+OUT=$(bash "$SKILL" --project-root /tmp/proj --apply)
+assert_eq "apply hits the apply endpoint" "1" "$(grep -c 'POST /wiki/migrate/apply' "$CALL_LOG")"
+assert_eq "apply body carries confirm:true" "1" "$(grep -c '"confirm": *true' "$CALL_LOG")"
+assert_eq "apply: applied/skipped kept" "16|9|/vault/.migration-state.json" "$(printf '%s' "$OUT" | jq -r '"\(.applied)|\(.skipped)|\(.manifestPath)"')"
+assert_eq "apply: proposedPages dropped" "false" "$(printf '%s' "$OUT" | jq 'has("proposedPages")')"
+
+# ---- Test 6: payload without proposedPages does not break the filter ----
+FIXTURE='{"ok":true,"legacyDetected":false,"bootstrapNeeded":{"project":false,"global":false,"teams":[]}}'
+export FIXTURE
+OUT=$(bash "$SKILL" --project-root /tmp/proj)
+assert_eq "empty scan: netNew 0" "0" "$(printf '%s' "$OUT" | jq '.netNew')"
+assert_eq "empty scan: byCategory {}" "{}" "$(printf '%s' "$OUT" | jq -c '.byCategory')"
+
+echo ""
+echo "=== Results: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ]

package/config/skills/team-leader/verify-output/execute.sh

@@ -44,6 +44,12 @@ elif [ -n "$WI_BRIEF" ]; then
   TASK_OUTPUT="$WI_BRIEF"
 fi
 
+# Defaults. A pre-approved checklist or a template pipeline (below) may
+# override these — they must NOT be reset after checklist loading, or the
+# checklist's passPolicy is silently discarded.
+PASS_POLICY="all"
+MAX_RETRIES=2
+
 # =============================================================================
 # Pre-approved checklist loading (from design-checklist skill)
 # =============================================================================
@@ -55,13 +61,17 @@ if [ -n "$CHECKLIST_PATH" ] && [ -f "$CHECKLIST_PATH" ]; then
   CHECKLIST_STATUS=$(echo "$CHECKLIST_DATA" | jq -r '.status // "unknown"' 2>/dev/null || true)
 
   if [ "$CHECKLIST_STATUS" = "approved" ]; then
-    # Convert checklist items to verification checks
+    # Convert checklist items to verification checks.
+    # NOTE: `(.command // empty)` inside an object constructor makes jq drop
+    # the WHOLE item when the key is absent, so every checklist item without
+    # both `command` and `pattern` used to vanish. Use `// null` instead —
+    # the consumers below read fields with `// empty`, so null is harmless.
     CHECKS=$(echo "$CHECKLIST_DATA" | jq -c '
       [.items[] | {
         name: .id,
         type: .type,
-        command: (.command // empty),
-        pattern: (.pattern // empty),
+        command: (.command // null),
+        pattern: (.pattern // null),
         description: .description,
         critical: (.critical // false)
       }]
@@ -79,7 +89,7 @@ elif [ -n "$TASK_ID" ] && [ -n "$PROJECT_PATH" ]; then
   if [ -f "$AUTO_CHECKLIST" ]; then
     CHECKLIST_STATUS=$(jq -r '.status // "unknown"' "$AUTO_CHECKLIST" 2>/dev/null || true)
     if [ "$CHECKLIST_STATUS" = "approved" ]; then
-      CHECKS=$(jq -c '[.items[] | {name: .id, type: .type, command: (.command // empty), pattern: (.pattern // empty), description: .description, critical: (.critical // false)}]' "$AUTO_CHECKLIST" 2>/dev/null || echo '[]')
+      CHECKS=$(jq -c '[.items[] | {name: .id, type: .type, command: (.command // null), pattern: (.pattern // null), description: .description, critical: (.critical // false)}]' "$AUTO_CHECKLIST" 2>/dev/null || echo '[]')
       PASS_POLICY=$(jq -r '.passPolicy // "critical_only"' "$AUTO_CHECKLIST" 2>/dev/null || echo "critical_only")
     fi
   fi
@@ -89,8 +99,6 @@ fi
 # Pipeline loading: convert template pipeline steps to checks
 # =============================================================================
 
-PASS_POLICY="all"
-MAX_RETRIES=2
 CHECK_COUNT=$(echo "$CHECKS" | jq 'length')
 
 if [ "$CHECK_COUNT" = "0" ] && [ -n "$TEMPLATE_ID" ]; then

package/config/skills/team-leader/verify-output/execute.test.sh

@@ -0,0 +1,117 @@
+#!/bin/bash
+# Tests for TL verify-output execute.sh
+# Covers: passPolicy resolution — an approved checklist's passPolicy must
+#         survive into the verdict (it used to be clobbered by the
+#         pipeline-loading defaults), a template pipeline still overrides
+#         it when no checklist checks were loaded, and the default is "all".
+#
+# The real execute.sh is run end-to-end; HTTP is intercepted by a fake `curl`
+# placed first on PATH so api_call() sees controlled responses.
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PASS=0
+FAIL=0
+
+WORK_DIR=$(mktemp -d)
+trap 'rm -rf "$WORK_DIR"' EXIT
+
+# ---------------------------------------------------------------------------
+# Fake curl: dispatches on the URL (last argument) and emits body + http code
+# in the `-w '\n%{http_code}'` shape api_call() parses.
+# ---------------------------------------------------------------------------
+FAKE_BIN="$WORK_DIR/bin"
+mkdir -p "$FAKE_BIN"
+cat > "$FAKE_BIN/curl" <<'CURL_EOF'
+#!/bin/bash
+url="${@: -1}"
+case "$url" in
+  */api/templates/tmpl-majority)
+    printf '%s\n200' '{"success":true,"data":{"verificationPipeline":{"passPolicy":"majority","maxRetries":3,"steps":[{"id":"s1","name":"Review","method":"code_review","critical":false}]}}}'
+    ;;
+  *)
+    printf '%s\n404' '{"success":false}'
+    ;;
+esac
+CURL_EOF
+chmod +x "$FAKE_BIN/curl"
+
+PROJECT_DIR="$WORK_DIR/project"
+mkdir -p "$PROJECT_DIR/.crewly/tasks"
+
+run_verify() {
+  PATH="$FAKE_BIN:$PATH" CREWLY_API_URL="http://127.0.0.1:1" bash "$SCRIPT_DIR/execute.sh" "$1" 2>/dev/null
+}
+
+assert_json_field() {
+  local desc="$1" input="$2" filter="$3" expected="$4"
+  local OUTPUT actual
+  OUTPUT=$(run_verify "$input") || true
+  actual=$(printf '%s' "$OUTPUT" | jq -r "$filter" 2>/dev/null || echo "<no-json>")
+  if [ "$actual" = "$expected" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc (expected '$filter' = '$expected', got '$actual'; output: $OUTPUT)"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+# One critical check that passes, one non-critical check that fails.
+# Under critical_only the verdict is PASS; under "all" it would be FAIL.
+CHECKLIST='{
+  "status":"approved",
+  "passPolicy":"critical_only",
+  "items":[
+    {"id":"crit-ok","type":"command","command":"true","description":"critical passes","critical":true},
+    {"id":"minor-fail","type":"command","command":"false","description":"non-critical fails","critical":false}
+  ]
+}'
+printf '%s' "$CHECKLIST" > "$WORK_DIR/checklist.json"
+printf '%s' "$CHECKLIST" > "$PROJECT_DIR/.crewly/tasks/checklist-task-auto.json"
+
+echo "verify-output: passPolicy resolution"
+
+INPUT_EXPLICIT=$(jq -n --arg p "$WORK_DIR/checklist.json" --arg pp "$PROJECT_DIR" \
+  '{taskId:"task-1",workerId:"w1",teamId:"t1",projectPath:$pp,checklistPath:$p}')
+assert_json_field "explicit checklistPath: passPolicy from checklist survives" \
+  "$INPUT_EXPLICIT" '.passPolicy' 'critical_only'
+assert_json_field "explicit checklistPath: both checklist items are loaded as checks" \
+  "$INPUT_EXPLICIT" '[.results[] | select(.name != "manual-review")] | length' '2'
+assert_json_field "explicit checklistPath: non-critical failure is recorded" \
+  "$INPUT_EXPLICIT" '.failedSteps | join(",")' 'minor-fail'
+assert_json_field "explicit checklistPath: verdict honours critical_only" \
+  "$INPUT_EXPLICIT" '.passed' 'true'
+
+INPUT_AUTO=$(jq -n --arg pp "$PROJECT_DIR" \
+  '{taskId:"task-auto",workerId:"w1",teamId:"t1",projectPath:$pp}')
+assert_json_field "auto-discovered checklist: passPolicy from checklist survives" \
+  "$INPUT_AUTO" '.passPolicy' 'critical_only'
+assert_json_field "auto-discovered checklist: both checklist items are loaded as checks" \
+  "$INPUT_AUTO" '[.results[] | select(.name != "manual-review")] | length' '2'
+assert_json_field "auto-discovered checklist: verdict honours critical_only" \
+  "$INPUT_AUTO" '.passed' 'true'
+
+INPUT_ALL_POLICY=$(jq -n --arg p "$WORK_DIR/checklist-all.json" --arg pp "$PROJECT_DIR" \
+  '{taskId:"task-1b",workerId:"w1",teamId:"t1",projectPath:$pp,checklistPath:$p}')
+printf '%s' "$CHECKLIST" | jq '.passPolicy = "all"' > "$WORK_DIR/checklist-all.json"
+assert_json_field "checklist with passPolicy=all: non-critical failure fails the verdict" \
+  "$INPUT_ALL_POLICY" '.passed' 'false'
+
+INPUT_TEMPLATE=$(jq -n --arg pp "$PROJECT_DIR" \
+  '{taskId:"task-2",workerId:"w1",teamId:"t1",projectPath:$pp,templateId:"tmpl-majority"}')
+assert_json_field "template pipeline: passPolicy comes from the pipeline when no checklist" \
+  "$INPUT_TEMPLATE" '.passPolicy' 'majority'
+
+INPUT_NONE=$(jq -n --arg pp "$PROJECT_DIR" \
+  '{taskId:"task-3",workerId:"w1",teamId:"t1",projectPath:$pp}')
+assert_json_field "no checklist, no template: passPolicy defaults to all" \
+  "$INPUT_NONE" '.passPolicy' 'all'
+
+INPUT_INLINE=$(jq -n --arg pp "$PROJECT_DIR" \
+  '{taskId:"task-4",workerId:"w1",teamId:"t1",projectPath:$pp,checks:[{name:"ok",type:"command",command:"true",critical:true},{name:"bad",type:"command",command:"false",critical:false}]}')
+assert_json_field "inline checks with default policy: all must pass" \
+  "$INPUT_INLINE" '.passed' 'false'
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]