crewly 1.20.191 → 1.20.193

package/config/skills/marketplace-registry.ts

@@ -118,10 +118,10 @@ export const SKILL_FILE_EXCLUDES: ReadonlyArray<RegExp> = [/\.test\./, /^mock-/,
  * never installed.
  *
  * Deliberately FLAT: files in subdirectories (e.g. remotion-video/templates/)
- * are not listed. The shipped CLI writes each listed file without creating
- * parent directories, so a nested path would fail the whole install on every
- * CLI released so far. List them only after the CLI creates parent dirs AND
- * the older CLIs are no longer in use.
+ * are not listed. CLIs released before #800 write each listed file without
+ * creating parent directories, so a nested path fails the whole install on
+ * them. The installers create parent dirs since #800; list nested files only
+ * once the older CLIs are no longer in use.
  *
  * @param skillDir - Absolute skill directory
  * @returns File names relative to the skill directory

package/config/skills/orchestrator/complete-task/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: Complete Task
-description: Mark a task as complete in the task management system.
-version: 1.0.0
+description: Mark a WorkItem complete in the V3 task pool, with evidence.
+version: 1.1.0
 category: management
 skillType: claude-skill
 assignableRoles:
@@ -24,18 +24,25 @@ execution:
 
 # Complete Task
 
-Mark a task as complete in the task management system.
+Mark a WorkItem complete via `POST /api/task-pool/complete/:id`.
 
 ## Usage
 
 ```bash
-bash config/skills/orchestrator/complete-task/execute.sh '{"taskId":"task-123","result":"success"}'
+bash config/skills/orchestrator/complete-task/execute.sh '{"workItemId":"wi-123","summary":"Shipped the report","evidence":[{"type":"artifact","path":"/abs/path/report.md"},{"type":"command","command":"npm test","exitCode":0}]}'
 ```
 
 ## Parameters
 
-Pass the full JSON body as expected by `POST /api/task-management/complete`.
+| Parameter | Required | Description |
+|-----------|----------|-------------|
+| `workItemId` (alias `taskId`) | Yes | The WorkItem to complete |
+| `summary` (alias `result`) | Yes | What was produced |
+| `evidence` | Yes* | Evidence array (#873): `{"type":"artifact","path":…}` (must exist, or an https URL), `{"type":"command","command":…,"exitCode":0,"outputTail":…}`, or `{"type":"blocked","step":…,"reason":…}` (records the item as blocked, not done). *Accepted without it this release with a `warning`; required from the next |
+| `output` | No | Structured output stored on the WorkItem before completion |
+| `agentId` / `sessionName` | No | Who completed it (defaults to `crewly-orc`) |
 
 ## Output
 
-JSON confirmation of task completion.
+The server's JSON response. A `warning` from the server (completion without
+evidence) is repeated on stderr.

package/config/skills/orchestrator/complete-task/execute.sh

@@ -6,7 +6,15 @@
 # on the WorkItem (replaces `<taskId>.output.json`) before completion.
 #
 # Input shape:
-#   { "workItemId": "abc-123", "summary": "...", "output"?: { ... } }
+#   { "workItemId": "abc-123", "summary": "...", "output"?: { ... },
+#     "evidence"?: [ {"type":"artifact","path":"..."} |
+#                    {"type":"command","command":"...","exitCode":0,"outputTail":"..."} |
+#                    {"type":"blocked","step":"...","reason":"..."} ] }
+#
+# `evidence` (#873) is sent as result.evidence. The server checks it: missing
+# artifacts and non-zero exit codes are refused, a `blocked` entry records the
+# item as blocked instead of done, and no evidence at all is accepted this
+# release with a `warning` (refused from the next).
 #
 # Backwards-compat: a `taskId` field is accepted as alias for `workItemId`.
 
@@ -26,6 +34,11 @@ OUTPUT=$(printf '%s' "$INPUT" | jq -c '.output // empty')
 # work — pass that session name instead).
 AGENT_ID=$(printf '%s' "$INPUT" | jq -r '.agentId // .sessionName // "crewly-orc"')
 
+EVIDENCE=$(printf '%s' "$INPUT" | jq -c '.evidence // empty')
+if [ -n "$EVIDENCE" ] && [ "$(printf '%s' "$EVIDENCE" | jq -r 'type')" != "array" ]; then
+  error_exit "evidence must be a JSON array, e.g. [{\"type\":\"artifact\",\"path\":\"/abs/file\"}]"
+fi
+
 require_param "workItemId" "$WORK_ITEM_ID"
 
 # Persist structured output on the WorkItem before completing, so that
@@ -47,6 +60,12 @@ fi
 COMPLETE_BODY=$(jq -n \
   --arg agentId "$AGENT_ID" \
   --arg summary "$SUMMARY" \
-  '{agentId: $agentId, result: {summary: $summary}}')
+  --argjson evidence "${EVIDENCE:-null}" \
+  '{agentId: $agentId, result: ({summary: $summary} + (if $evidence != null then {evidence: $evidence} else {} end))}')
 
-api_call POST "/task-pool/complete/${WORK_ITEM_ID}" "$COMPLETE_BODY"
+COMPLETE_RESPONSE=$(api_call POST "/task-pool/complete/${WORK_ITEM_ID}" "$COMPLETE_BODY")
+printf '%s\n' "$COMPLETE_RESPONSE"
+EVIDENCE_WARNING=$(printf '%s' "$COMPLETE_RESPONSE" | jq -r '.warning // empty' 2>/dev/null || true)
+if [ -n "$EVIDENCE_WARNING" ]; then
+  jq -n --arg w "$EVIDENCE_WARNING" '{warning: $w}' >&2
+fi

package/config/skills/orchestrator/delegate-task/execute.sh

@@ -255,13 +255,13 @@ if [ "$USE_STRUCTURED" = "true" ] && [ -n "$TITLE" ]; then
 
   [ -n "$CONTEXT" ] && TASK_MESSAGE="${TASK_MESSAGE}\n\nAdditional context: ${CONTEXT}"
   [ -n "$DEADLINE_HINT" ] && TASK_MESSAGE="${TASK_MESSAGE}\n\n**Deadline hint**: ${DEADLINE_HINT}"
-  TASK_MESSAGE="${TASK_MESSAGE}\n\n---\nWhen done, report back with report-status, passing the workItemId from your [CREWLY-DISPATCH] notice (or from get-my-tasks) so the right WorkItem is closed: bash ${CREWLY_ROOT}/config/skills/agent/core/report-status/execute.sh '{\"sessionName\":\"${TO}\",\"workItemId\":\"<your WorkItem id>\",\"status\":\"done\",\"summary\":\"<brief summary>\",\"projectPath\":\"${PROJECT_PATH}\"}'"
+  TASK_MESSAGE="${TASK_MESSAGE}\n\n---\nWhen done, report back with report-status, passing the workItemId from your [CREWLY-DISPATCH] notice (or from get-my-tasks) so the right WorkItem is closed: bash ${CREWLY_ROOT}/config/skills/agent/core/report-status/execute.sh '{\"sessionName\":\"${TO}\",\"workItemId\":\"<your WorkItem id>\",\"status\":\"done\",\"summary\":\"<brief summary>\",\"evidence\":[{\"type\":\"artifact\",\"path\":\"<file you produced>\"},{\"type\":\"command\",\"command\":\"<check you ran>\",\"exitCode\":0}],\"projectPath\":\"${PROJECT_PATH}\"}' — done needs evidence (files that exist, checks with exit code 0); if a step failed, send [{\"type\":\"blocked\",\"step\":\"<step>\",\"reason\":\"<why>\"}] instead, never done."
   TASK_MESSAGE="${TASK_MESSAGE}\n\nBefore reporting done, persist key findings using: bash ${CREWLY_ROOT}/config/skills/agent/core/remember/execute.sh '{\"agentId\":\"${TO}\",\"content\":\"<key findings>\",\"category\":\"pattern\",\"scope\":\"project\",\"projectPath\":\"${PROJECT_PATH}\"}'"
 else
   # Legacy free-text format (backwards compatible)
   TASK_MESSAGE="New task from orchestrator (priority: ${PRIORITY}):\n\n${TASK}"
   [ -n "$CONTEXT" ] && TASK_MESSAGE="${TASK_MESSAGE}\n\nContext: ${CONTEXT}"
-  TASK_MESSAGE="${TASK_MESSAGE}\n\nWhen done, report back with report-status, passing the workItemId from your [CREWLY-DISPATCH] notice (or from get-my-tasks) so the right WorkItem is closed: bash ${CREWLY_ROOT}/config/skills/agent/core/report-status/execute.sh '{\"sessionName\":\"${TO}\",\"workItemId\":\"<your WorkItem id>\",\"status\":\"done\",\"summary\":\"<brief summary>\",\"projectPath\":\"${PROJECT_PATH}\"}'"
+  TASK_MESSAGE="${TASK_MESSAGE}\n\nWhen done, report back with report-status, passing the workItemId from your [CREWLY-DISPATCH] notice (or from get-my-tasks) so the right WorkItem is closed: bash ${CREWLY_ROOT}/config/skills/agent/core/report-status/execute.sh '{\"sessionName\":\"${TO}\",\"workItemId\":\"<your WorkItem id>\",\"status\":\"done\",\"summary\":\"<brief summary>\",\"evidence\":[{\"type\":\"artifact\",\"path\":\"<file you produced>\"},{\"type\":\"command\",\"command\":\"<check you ran>\",\"exitCode\":0}],\"projectPath\":\"${PROJECT_PATH}\"}' — done needs evidence (files that exist, checks with exit code 0); if a step failed, send [{\"type\":\"blocked\",\"step\":\"<step>\",\"reason\":\"<why>\"}] instead, never done."
   TASK_MESSAGE="${TASK_MESSAGE}\n\nBefore reporting done, persist key findings using: bash ${CREWLY_ROOT}/config/skills/agent/core/remember/execute.sh '{\"agentId\":\"${TO}\",\"content\":\"<key findings>\",\"category\":\"pattern\",\"scope\":\"project\",\"projectPath\":\"${PROJECT_PATH}\"}'"
 fi
 

package/config/skills/orchestrator/harness-login/SKILL.md

@@ -38,8 +38,15 @@ account ("帮我重新登陆 claude code", "换个账号", "send me the login li
 ```bash
 bash config/skills/orchestrator/harness-login/execute.sh --harness claude
 bash config/skills/orchestrator/harness-login/execute.sh --harness codex --switch-account
+bash config/skills/orchestrator/harness-login/execute.sh --harness claude --account work
 ```
 
+`--account <name>` signs in another of the owner's **own** Claude Code accounts
+("login claude work"): it gets its own config dir and login, and agents move to
+it when an earlier runtime in their fallback order runs out (chain entry
+`claude-code@work`). Nothing is restarted. Add only Claude Code accounts that
+the owner owns; never use it for another person's account.
+
 ## What happens
 
 1. Crewly starts the harness's own login command in a terminal it keeps alive
@@ -75,7 +82,7 @@ in one line to finish it in Setup).
 - `antigravity` answers `no_link_login` (it uses a Gemini API key, entered in
   Setup); Gemini CLI is enterprise-only. Pass the message on in one line.
 - The owner can also just write 「重新登录 claude」 / 「换个账号登录 codex」 /
-  `relogin claude` in your DM — Crewly handles that without you.
+  `relogin claude` / `login claude@work` in your DM — Crewly handles that without you.
 
 ## Errors
 
@@ -86,3 +93,4 @@ in one line to finish it in Setup).
 | `owner_request_unverifiable` | The owner's chat history could not be read |
 | `unknown_harness` | Use claude, codex or antigravity |
 | `no_link_login` | The harness has no link login (Antigravity, Gemini) |
+| `invalid_account` | Account names are 1–32 lower-case letters, digits, `-` or `_` |

package/config/skills/orchestrator/harness-login/execute.sh

@@ -19,6 +19,7 @@
 # Usage:
 #   bash execute.sh --harness claude
 #   bash execute.sh --harness codex --switch-account
+#   bash execute.sh --harness claude --account work   # another of the owner's Claude accounts
 #   bash execute.sh '{"harness":"claude","switchAccount":true}'
 # =============================================================================
 set -euo pipefail
@@ -28,22 +29,25 @@ source "${SCRIPT_DIR}/../_common/lib.sh"
 print_usage() {
   cat <<'EOF_USAGE'
 Usage:
-  bash execute.sh --harness <claude|codex|antigravity> [--switch-account]
-  bash execute.sh '{"harness":"claude","switchAccount":false}'
+  bash execute.sh --harness <claude|codex|antigravity> [--switch-account] [--account <name>]
+  bash execute.sh '{"harness":"claude","switchAccount":false,"account":"work"}'
 
 Options:
   --harness         claude (Claude Code), codex (Codex CLI) or antigravity (agy) — required
   --switch-account  The owner wants a different account (changes the wording of the DM)
+  --account         Sign in another of the owner's own Claude Code accounts (used as a
+                    runtime fallback, chain entry claude-code@<name>) instead of the default login
   --help | -h       Show this help
 EOF_USAGE
 }
 
-INPUT_JSON=""; HARNESS=""; SWITCH=false
+INPUT_JSON=""; HARNESS=""; SWITCH=false; ACCOUNT=""
 if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then INPUT_JSON="$1"; shift || true; fi
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --harness)        [ $# -ge 2 ] || error_exit "--harness requires a value"; HARNESS="$2"; shift 2 ;;
     --switch-account) SWITCH=true; shift ;;
+    --account)        [ $# -ge 2 ] || error_exit "--account requires a value"; ACCOUNT="$2"; shift 2 ;;
     --help|-h)        print_usage; exit 0 ;;
     *) error_exit "Unknown option: $1" ;;
   esac
@@ -52,6 +56,7 @@ if [ -n "$INPUT_JSON" ]; then
   INPUT=$(read_json_input "$INPUT_JSON")
   [ -z "$HARNESS" ] && HARNESS=$(printf '%s' "$INPUT" | jq -r '.harness // .harnessId // empty')
   [ "$(printf '%s' "$INPUT" | jq -r '.switchAccount // false')" = "true" ] && SWITCH=true
+  [ -z "$ACCOUNT" ] && ACCOUNT=$(printf '%s' "$INPUT" | jq -r '.account // empty')
 fi
 require_param "harness (--harness)" "$HARNESS"
 
@@ -59,7 +64,10 @@ require_param "harness (--harness)" "$HARNESS"
 HARNESS_ID=$(printf '%s' "$HARNESS" | tr '[:upper:]' '[:lower:]' | sed -E 's/[[:space:]_]+/-/g')
 [[ "$HARNESS_ID" =~ ^[a-z0-9-]+$ ]] || error_exit "Invalid harness: $HARNESS (use claude, codex or antigravity)"
 
-BODY=$(jq -cn --argjson sw "$SWITCH" '{switchAccount: $sw}')
+ACCOUNT=$(printf '%s' "$ACCOUNT" | tr '[:upper:]' '[:lower:]')
+[ -z "$ACCOUNT" ] || [[ "$ACCOUNT" =~ ^[a-z0-9][a-z0-9_-]{0,31}$ ]] || error_exit "Invalid account: $ACCOUNT (lower-case letters, digits, - or _)"
+
+BODY=$(jq -cn --argjson sw "$SWITCH" --arg acct "$ACCOUNT" '{switchAccount: $sw} + (if $acct != "" then {account: $acct} else {} end)')
 
 ERR_FILE=$(mktemp); trap 'rm -f "$ERR_FILE"' EXIT
 RESPONSE=$(api_call POST "/harness/${HARNESS_ID}/owner-login" "$BODY" 2>"$ERR_FILE") || {

package/config/skills/orchestrator/harness-login/execute.test.sh

@@ -54,6 +54,12 @@ check "display name → id, switch flag" "$(jq -c '{path, body}' "$STUB_LOG")" '
 OUT=$(run '{"harness":"claude","switchAccount":true}')
 check "json input" "$(jq -c .body "$STUB_LOG")" '{"switchAccount":true}'
 
+OUT=$(run --harness claude --account Work)
+check "account (lower-cased)" "$(jq -c .body "$STUB_LOG")" '{"switchAccount":false,"account":"work"}'
+
+OUT=$(run '{"harness":"claude","account":"b"}')
+check "json account" "$(jq -c .body "$STUB_LOG")" '{"switchAccount":false,"account":"b"}'
+
 OUT=$(run --harness codex); RC=$?
 check "no owner request: exit 1" "$RC" "1"
 check "no owner request: reason" "$(printf '%s' "$OUT" | jq -r .reason)" "owner_request_not_found"
@@ -67,6 +73,7 @@ check "other agents refused" "$(printf '%s' "$OUT" | jq -r .reason)" "orchestrat
 check "missing harness" "$(run_err)" "Missing required parameter: harness (--harness)"
 check "path injection refused" "$(run_err --harness '../orc')" "Invalid harness: ../orc (use claude, codex or antigravity)"
 check "unknown option" "$(run_err --yes)" "Unknown option: --yes"
+check "invalid account" "$(run_err --harness claude --account '../x')" "Invalid account: ../x (lower-case letters, digits, - or _)"
 
 echo "=== Results: $PASS passed, $FAIL failed ==="
 [ "$FAIL" -eq 0 ]

package/config/skills/team-leader/delegate-task/execute.sh

@@ -170,7 +170,7 @@ if [ -n "$CONTEXT" ]; then
 fi
 
 # Build a structured task message from Team Leader
-TASK_MESSAGE="New task from Team Leader (priority: ${PRIORITY}):\n\n**[REQUIRED] When done, you MUST:** (1) Output a text summary of your work, findings, and any issues. (2) Call report-status, passing the workItemId from your [CREWLY-DISPATCH] notice (or from get-my-tasks) so the right WorkItem is closed:\nbash ${CREWLY_ROOT}/config/skills/agent/core/report-status/execute.sh '{\"sessionName\":\"${TO}\",\"workItemId\":\"<your WorkItem id>\",\"status\":\"done\",\"summary\":\"<brief summary>\",\"projectPath\":\"${PROJECT_PATH}\"}'\n\n---\n\n${TASK}"
+TASK_MESSAGE="New task from Team Leader (priority: ${PRIORITY}):\n\n**[REQUIRED] When done, you MUST:** (1) Output a text summary of your work, findings, and any issues. (2) Call report-status, passing the workItemId from your [CREWLY-DISPATCH] notice (or from get-my-tasks) so the right WorkItem is closed:\nbash ${CREWLY_ROOT}/config/skills/agent/core/report-status/execute.sh '{\"sessionName\":\"${TO}\",\"workItemId\":\"<your WorkItem id>\",\"status\":\"done\",\"summary\":\"<brief summary>\",\"evidence\":[{\"type\":\"artifact\",\"path\":\"<file you produced>\"},{\"type\":\"command\",\"command\":\"<check you ran>\",\"exitCode\":0}],\"projectPath\":\"${PROJECT_PATH}\"}' — done needs evidence (files that exist, checks with exit code 0); if a step failed, send [{\"type\":\"blocked\",\"step\":\"<step>\",\"reason\":\"<why>\"}] instead, never done.\n\n---\n\n${TASK}"
 [ -n "$CONTEXT" ] && TASK_MESSAGE="${TASK_MESSAGE}\n\nContext: ${CONTEXT}"
 
 # V3-only producer (spec 2026-05-06-task-management-v1-deprecation.md):

package/config/skills/team-leader/verify-output/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: Verify Output
 description: "Execute the team's verification pipeline against a completed task. Reads verificationPipeline configuration from the team template and runs each verification step sequentially."
-version: 1.0.0
+version: 1.1.0
 category: quality
 skillType: claude-skill
 assignableRoles:
@@ -33,6 +33,18 @@ Supports two modes:
 1. **Explicit checks**: Pass `checks[]` array directly with specific verification steps
 2. **Template pipeline**: Pass `templateId` to automatically load verification steps from the team template's `verificationPipeline`
 
+## Evidence first (#873)
+
+The skill reads the worker's **evidence block** (`output.evidence` on the
+WorkItem: artifacts that exist, commands with exit codes, blocked steps) before
+running any check, and returns it as the first field of the verdict.
+
+- `evidenceWarning` is set when the item was marked done **without evidence**
+  (accepted only while the server is in evidence warn mode) — do not verify it
+  on its summary alone: check the work directly or send it back asking for
+  evidence. It is also set when the worker reported `blocked` steps.
+- The warning, when present, leads `feedback`.
+
 ## When to Use
 
 - When a worker reports a task as `done`
@@ -118,6 +130,11 @@ The template's `passPolicy` controls the overall pass/fail determination:
 
 ```json
 {
+  "evidence": [
+    { "type": "artifact", "path": "src/auth.ts" },
+    { "type": "command", "command": "npm test", "exitCode": 0, "outputTail": "42 passed" }
+  ],
+  "evidenceWarning": null,
   "passed": false,
   "score": 67,
   "feedback": "Verification failed: 1/3 checks failed (policy: critical_only).",

package/config/skills/team-leader/verify-output/execute.sh

@@ -36,6 +36,25 @@ WI_DATA=$(api_call GET "/task-pool/items/${WORK_ITEM_ID}" 2>/dev/null || echo '{
 WI_BRIEF=$(echo "$WI_DATA" | jq -r '.data.briefMarkdown // empty' 2>/dev/null || true)
 WI_OUTPUT_RAW=$(echo "$WI_DATA" | jq -c '.data.output // empty' 2>/dev/null || true)
 
+# Evidence first (#873). The worker's completion carries an evidence block
+# (artifacts that exist, commands with exit codes, or blocked steps), stored
+# at output.evidence. Read it before anything else, and flag an item that was
+# marked done WITHOUT evidence — accepted only because the server is in warn
+# mode this release — so it is not verified on its summary alone.
+WI_FOUND=$(echo "$WI_DATA" | jq -r 'if (.data // null) != null then "yes" else "no" end' 2>/dev/null || echo "no")
+WI_EVIDENCE=$(echo "$WI_DATA" | jq -c 'if (.data.output.evidence | type) == "array" then .data.output.evidence else [] end' 2>/dev/null || echo '[]')
+EVIDENCE_WARNING=""
+if [ "$WI_FOUND" = "yes" ]; then
+  if [ "$(printf '%s' "$WI_EVIDENCE" | jq 'length')" = "0" ]; then
+    EVIDENCE_WARNING="No completion evidence: this WorkItem was marked done without artifacts or commands (accepted only in evidence warn mode). Do not verify on the summary alone — check the work directly, or send it back asking for evidence."
+  else
+    BLOCKED_STEPS=$(printf '%s' "$WI_EVIDENCE" | jq -r '[.[] | select(.type == "blocked") | "\(.step): \(.reason)"] | join("; ")')
+    if [ -n "$BLOCKED_STEPS" ]; then
+      EVIDENCE_WARNING="The worker reported blocked steps (the item is blocked, not done): ${BLOCKED_STEPS}"
+    fi
+  fi
+fi
+
 # Compose `TASK_OUTPUT` for content-scan checks. Prefer worker-supplied
 # structured output, falling back to the brief if no output was set.
 if [ -n "$WI_OUTPUT_RAW" ] && [ "$WI_OUTPUT_RAW" != "null" ] && [ "$WI_OUTPUT_RAW" != "" ]; then
@@ -316,6 +335,11 @@ else
   FEEDBACK="Verification failed: ${TOTAL_FAILED}/${TOTAL_CHECKS} checks failed (policy: ${PASS_POLICY})."
 fi
 
+# The evidence finding leads the feedback.
+if [ -n "$EVIDENCE_WARNING" ]; then
+  FEEDBACK="${EVIDENCE_WARNING} ${FEEDBACK}"
+fi
+
 # Check if any results require manual TL review
 REQUIRES_REVIEW=$(echo "$RESULTS" | jq '[.[] | select(.requiresReview == true)] | length')
 if [ "$REQUIRES_REVIEW" -gt 0 ]; then
@@ -323,6 +347,8 @@ if [ "$REQUIRES_REVIEW" -gt 0 ]; then
 fi
 
 jq -n \
+  --argjson evidence "$WI_EVIDENCE" \
+  --arg evidenceWarning "$EVIDENCE_WARNING" \
   --arg passed "$PASSED" \
   --arg score "$SCORE" \
   --arg feedback "$FEEDBACK" \
@@ -333,6 +359,8 @@ jq -n \
   --arg workerId "$WORKER_ID" \
   --arg templateId "$TEMPLATE_ID" \
   '{
+    evidence: $evidence,
+    evidenceWarning: (if $evidenceWarning != "" then $evidenceWarning else null end),
     passed: ($passed == "true"),
     score: ($score | tonumber),
     feedback: $feedback,

package/config/skills/team-leader/verify-output/execute.test.sh

@@ -25,6 +25,15 @@ cat > "$FAKE_BIN/curl" <<'CURL_EOF'
 #!/bin/bash
 url="${@: -1}"
 case "$url" in
+  */api/task-pool/items/wi-ev)
+    printf '%s\n200' '{"success":true,"data":{"id":"wi-ev","status":"done_by_worker","output":{"summary":"Report written","evidence":[{"type":"artifact","path":"/proj/report.md"},{"type":"command","command":"npm test","exitCode":0}]}}}'
+    ;;
+  */api/task-pool/items/wi-noev)
+    printf '%s\n200' '{"success":true,"data":{"id":"wi-noev","status":"done_by_worker","output":{"summary":"Trust me"}}}'
+    ;;
+  */api/task-pool/items/wi-blocked)
+    printf '%s\n200' '{"success":true,"data":{"id":"wi-blocked","status":"blocked","output":{"summary":"Stuck","evidence":[{"type":"blocked","step":"deploy","reason":"no creds"}]}}}'
+    ;;
   */api/templates/tmpl-majority)
     printf '%s\n200' '{"success":true,"data":{"verificationPipeline":{"passPolicy":"majority","maxRetries":3,"steps":[{"id":"s1","name":"Review","method":"code_review","critical":false}]}}}'
     ;;
@@ -112,6 +121,24 @@ INPUT_INLINE=$(jq -n --arg pp "$PROJECT_DIR" \
 assert_json_field "inline checks with default policy: all must pass" \
   "$INPUT_INLINE" '.passed' 'false'
 
+echo ""
+echo "verify-output: evidence first (#873)"
+
+assert_json_field "evidence is the first key of the verdict" \
+  '{"workItemId":"wi-ev"}' 'keys_unsorted[0]' 'evidence'
+assert_json_field "evidence block is surfaced from output.evidence" \
+  '{"workItemId":"wi-ev"}' '[.evidence[].type] | join(",")' 'artifact,command'
+assert_json_field "no evidence warning when evidence is present" \
+  '{"workItemId":"wi-ev"}' '.evidenceWarning' 'null'
+assert_json_field "done without evidence is flagged" \
+  '{"workItemId":"wi-noev"}' '.evidenceWarning | startswith("No completion evidence")' 'true'
+assert_json_field "the evidence flag leads the feedback" \
+  '{"workItemId":"wi-noev"}' '.feedback | startswith("No completion evidence")' 'true'
+assert_json_field "blocked evidence is surfaced with its step" \
+  '{"workItemId":"wi-blocked"}' '.evidenceWarning | contains("deploy: no creds")' 'true'
+assert_json_field "an unreadable WorkItem gets empty evidence and no flag" \
+  '{"workItemId":"wi-missing"}' '(.evidence | length | tostring) + "/" + (.evidenceWarning | tostring)' '0/null'
+
 echo ""
 echo "Results: $PASS passed, $FAIL failed"
 [ "$FAIL" -eq 0 ]