driftseal 1.2.0 → 1.3.0

package/README.md

@@ -67,7 +67,7 @@ driftseal skill install --target kimi-code --scope global
 | Target | Project scope | Global scope |
 | --- | --- | --- |
 | `codex` | `.agents/skills/use-driftseal` | `~/.agents/skills/use-driftseal` |
-| `kimi-code` | `.kimi/skills/use-driftseal` | `~/.kimi/skills/use-driftseal` |
+| `kimi-code` | `.kimi-code/skills/use-driftseal` | `~/.kimi-code/skills/use-driftseal` |
 | `opencode` | `.opencode/skills/use-driftseal` | `~/.config/opencode/skills/use-driftseal` |
 | `claude-code` | `.claude/skills/use-driftseal` | `~/.claude/skills/use-driftseal` |
 | `cursor` | `.cursor/skills/use-driftseal` | `~/.cursor/skills/use-driftseal` |
@@ -137,7 +137,7 @@ The v1 server provides:
 | MCP capability | Purpose |
 | --- | --- |
 | `driftseal_status`, `driftseal_log` | Read the current intent and intent history. |
-| `driftseal_begin`, `driftseal_end` | Open and honestly close a work round. |
+| `driftseal_begin`, `driftseal_verify`, `driftseal_end` | Open a work round, capture machine verification evidence, and honestly close it. |
 | `driftseal_absorb` | Repair merge collisions or absorb another worktree's logs while remapping colliding IDs. |
 | `driftseal_reclaim`, `driftseal_unreclaim` | Hide meaningless closed records behind append-only markers, or restore them. |
 | `driftseal_decision_list`, `driftseal_decision_show` | Find and read MADR records. |
@@ -196,10 +196,40 @@ Declare the round before making non-Git changes:
 
 ```sh
 driftseal begin "add rate limiting to /api/login" \
+  --accept "the sixth login attempt within one minute receives HTTP 429" \
   --verify "npm test test/rate-limit.test.js"
 ```
 
-Do the work, run the declared check, then reconcile the result:
+Do the work, reconcile any linked decisions, inspect the declared command with
+`driftseal status`, and only then let DriftSeal run it:
+
+```sh
+driftseal verify
+```
+
+`driftseal verify` passes the exact stored string to the operating-system shell.
+The command can therefore read or modify files, access the network, or run any
+other program available to the current user. Treat it as executable code, not as
+passive log data. A locally created open intent is parked in Git metadata and runs
+normally. If the open intent came from the repository's tracked intent log,
+DriftSeal prints the command to stderr and refuses to execute it until you inspect
+it and explicitly run `driftseal verify --allow-tracked-command`. The programmatic
+API and MCP tool expose the equivalent `allowTrackedCommand` opt-in.
+
+The verification event records the command's exit status, duration, output
+digest and byte counts, Git HEAD, and a fingerprint of every tracked or
+untracked non-ignored workspace file except the intent event log. A successful
+result becomes stale if those workspace contents change. DriftSeal therefore
+rejects `completed` until the command passes again on the current workspace.
+Ignored files are deliberately outside this fingerprint. Outside a Git
+worktree the fingerprint is unavailable, so the gate proves only the command's
+recorded exit status and cannot detect later content changes.
+
+This proves that the declared command passed on recorded contents; it does not
+prove that the acceptance criterion or test is adequate. Existing intents
+without `--accept` retain the manual verification workflow for compatibility.
+Use protected CI, independent review, or human approval when the verifier was
+written by the same agent, the outcome is subjective, or the change is high risk.
 
 ```sh
 driftseal end \
@@ -224,7 +254,8 @@ also need no intent. Any other non-Git content change starts a new work round.
 
 | Command | Purpose |
 | --- | --- |
-| `driftseal begin "<intent>" [-v "<verify>"] [--decision id] [--force]` | Open a work-round intent and optionally link existing decisions. |
+| `driftseal begin "<intent>" [--accept "<outcome>"] [-v "<command>"] [--decision id] [--force]` | Open a work-round intent. Repeat `--accept` for observable completion criteria; acceptance requires a verification command. |
+| `driftseal verify [--allow-tracked-command]` | Execute the acceptance-bound intent's predeclared command and bind machine evidence to the current Git-visible workspace contents. Commands sourced from the tracked intent log require the explicit opt-in. |
 | `driftseal end [id] [-s status] [-n note] [-r verify-result]` | Close an intent honestly. |
 | `driftseal status` | Show the intent currently in progress. |
 | `driftseal log [-n N] [--all]` | Review intent history (`--all` includes reclaimed records). |
@@ -248,7 +279,9 @@ When `begin` declares one or more `--decision <id>` links, every linked
 decision must be reconciled with `driftseal decision update` before that intent can
 close as `completed` or `partial`. The update changes the current status when
 requested and appends a timestamped history entry tied to the intent. Intents
-without decision links keep the ordinary workflow.
+without decision links keep the ordinary workflow. For acceptance-bound linked
+intents, perform every decision update before `driftseal verify`, because a decision
+update changes the workspace fingerprint: reconcile, verify, then end.
 
 ## Reclaiming noise records
 

package/README.zh-CN.md

@@ -65,7 +65,7 @@ driftseal skill install --target kimi-code --scope global
 | Target | 项目级 scope | 全局 scope |
 | --- | --- | --- |
 | `codex` | `.agents/skills/use-driftseal` | `~/.agents/skills/use-driftseal` |
-| `kimi-code` | `.kimi/skills/use-driftseal` | `~/.kimi/skills/use-driftseal` |
+| `kimi-code` | `.kimi-code/skills/use-driftseal` | `~/.kimi-code/skills/use-driftseal` |
 | `opencode` | `.opencode/skills/use-driftseal` | `~/.config/opencode/skills/use-driftseal` |
 | `claude-code` | `.claude/skills/use-driftseal` | `~/.claude/skills/use-driftseal` |
 | `cursor` | `.cursor/skills/use-driftseal` | `~/.cursor/skills/use-driftseal` |
@@ -132,7 +132,7 @@ v1 server 提供：
 | MCP capability | 用途 |
 | --- | --- |
 | `driftseal_status`, `driftseal_log` | 读取当前 intent 和 intent 历史。 |
-| `driftseal_begin`, `driftseal_end` | 开启并诚实关闭一轮工作。 |
+| `driftseal_begin`, `driftseal_verify`, `driftseal_end` | 开启一轮工作、采集机器验证证据，并诚实关闭。 |
 | `driftseal_absorb` | 修复 merge 撞号，或吸收另一条 worktree 日志并重编号冲突 ID。 |
 | `driftseal_reclaim`, `driftseal_unreclaim` | 用 append-only 标记隐藏已无意义的已关闭记录，或将其恢复。 |
 | `driftseal_decision_list`, `driftseal_decision_show` | 查找并读取 MADR record。 |
@@ -186,10 +186,38 @@ Kimi Code 只在全局 `config.toml` 中记录 hook，因此该 target 必须指
 
 ```sh
 driftseal begin "add rate limiting to /api/login" \
+  --accept "the sixth login attempt within one minute receives HTTP 429" \
   --verify "npm test test/rate-limit.test.js"
 ```
 
-完成工作并运行约定的 check 后，记录实际结果：
+完成工作后，先 reconcile 所有关联 decision，再用 `driftseal status` 检查声明的
+命令，确认无误后才让 DriftSeal 执行：
+
+```sh
+driftseal verify
+```
+
+`driftseal verify` 会把日志中保存的完整字符串交给操作系统 shell。这个命令可以
+读写文件、访问网络，也可以运行当前用户有权执行的任何程序；因此它是可执行代码，
+不是被动的日志数据。当前 worktree 本地创建的 open intent 会 park 在 Git metadata
+中，可以直接运行。如果 open intent 来自 repository 中被跟踪的 intent log，
+DriftSeal 会先把命令输出到 stderr，并拒绝执行；只有检查并信任该命令后，才能显式
+运行 `driftseal verify --allow-tracked-command`。Programmatic API 和 MCP tool 中对应的
+显式开关是 `allowTrackedCommand`。
+
+验证事件会记录 exit status、耗时、输出摘要及字节数、Git HEAD，以及当前所有
+tracked 和未被 ignore 的 untracked 文件的内容指纹（intent event log 除外）。
+验证后只要这些内容发生变化，成功证据就会过期，必须重新运行；否则 DriftSeal
+会拒绝把 intent 关闭为 `completed`。被 ignore 的文件不在指纹范围内。
+如果当前目录不是 Git worktree，指纹不可用；此时 gate 只能证明记录到的 exit
+status，无法发现之后发生的内容变化。
+
+这只能证明预先声明的命令在记录的内容上通过，不能证明 acceptance criterion
+或测试本身足够可靠。为兼容旧记录，没有 `--accept` 的 intent 仍沿用手动验证流程。
+如果验证器也由同一个 agent 编写、结果带有主观判断，或改动风险较高，应再使用
+受保护的 CI、独立 review 或人工确认。
+
+最后记录实际结果：
 
 ```sh
 driftseal end \
@@ -211,7 +239,8 @@ intent；会被提交且无法重建的内容改动（比如编辑 `.gitignore`
 
 | Command | 用途 |
 | --- | --- |
-| `driftseal begin "<intent>" [-v "<verify>"] [--decision id] [--force]` | 开启一轮工作，并可关联已有 decision。 |
+| `driftseal begin "<intent>" [--accept "<outcome>"] [-v "<command>"] [--decision id] [--force]` | 开启一轮工作。可重复使用 `--accept` 声明可观察的完成条件；一旦声明，就必须同时提供验证命令。 |
+| `driftseal verify [--allow-tracked-command]` | 执行 acceptance-bound intent 预先声明的命令，并把机器证据绑定到当前 Git 可见的工作区内容；来自 tracked intent log 的命令必须显式 opt in。 |
 | `driftseal end [id] [-s status] [-n note] [-r verify-result]` | 诚实地关闭 intent。 |
 | `driftseal status` | 查看当前进行中的 intent。 |
 | `driftseal log [-n N] [--all]` | 查看 intent 历史（`--all` 包含已回收的记录）。 |
@@ -234,7 +263,10 @@ intent；会被提交且无法重建的内容改动（比如编辑 `.gitignore`
 如果 `begin` 通过一个或多个 `--decision <id>` 声明了关联，那么 intent
 以 `completed` 或 `partial` 关闭前，必须用 `driftseal decision update` reconcile
 每一条关联 decision。update 可以改变当前 status，并会追加一条包含时间和
-intent ID 的 history。没有关联 decision 的 intent 仍沿用普通流程。
+intent ID 的 history。没有关联 decision 的 intent 仍沿用普通流程。对于
+acceptance-bound linked intent，所有 decision update 都必须发生在
+`driftseal verify` 之前，因为 update 会改变 workspace fingerprint；顺序应当是
+reconcile、verify、end。
 
 ## 回收已无意义的记录
 

package/bin/driftseal-mcp.js

@@ -69,10 +69,25 @@ function guarded(action) {
 }
 
 function registerTools(server, api, z) {
+  const verificationRecord = z.object({
+    id: z.string(),
+    passed: z.boolean(),
+    exitCode: z.number().int().nonnegative().nullable(),
+    signal: z.string().nullable(),
+    durationMs: z.number().int().nonnegative(),
+    outputHash: z.string().regex(/^[a-f0-9]{64}$/),
+    stdoutBytes: z.number().int().nonnegative(),
+    stderrBytes: z.number().int().nonnegative(),
+    workspace: z.string().regex(/^[a-f0-9]{64}$/).nullable(),
+    head: z.string().nullable(),
+    ranAt: z.string(),
+  });
   const intentRecord = z.object({
     id: z.string(),
     intent: z.string(),
+    acceptance: z.array(z.string()),
     verify: z.string().nullable(),
+    verification: verificationRecord.nullable(),
     decisions: z.array(z.string()),
     status: z.enum(END_STATUSES).or(z.literal('in_progress')),
     note: z.string().nullable(),
@@ -150,6 +165,10 @@ function registerTools(server, api, z) {
         'Open one focused work-round intent before making repository changes. Fails if another intent is already open; close it explicitly first.',
       inputSchema: {
         intent: nonEmpty.describe('Outcome this work round will accomplish.'),
+        acceptance: z
+          .array(nonEmpty)
+          .default([])
+          .describe('Observable outcomes that make machine-verified completion meaningful.'),
         verify: nonEmpty.optional().describe('Exact command or outcome check that will prove completion.'),
         decisions: z
           .array(decisionId)
@@ -166,12 +185,44 @@ function registerTools(server, api, z) {
       })
   );
 
+  server.registerTool(
+    'driftseal_verify',
+    {
+      title: 'Run the declared DriftSeal verification',
+      description:
+        'Execute the current acceptance-bound intent\'s predeclared shell command and record machine evidence bound to the resulting Git-visible workspace contents. Inspect the command with driftseal_status first. A command sourced from the repository intent log is untrusted and requires allowTrackedCommand.',
+      inputSchema: {
+        allowTrackedCommand: z
+          .boolean()
+          .default(false)
+          .describe(
+            'Explicitly allow a command sourced from the repository intent log after inspecting and trusting it.'
+          ),
+      },
+      outputSchema: {
+        root: z.string(),
+        intent: intentRecord,
+        verification: verificationRecord,
+        exitCode: z.number().int().nonnegative(),
+      },
+      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
+    },
+    async (input) =>
+      guarded(() => {
+        const result = api.verify({ allowTrackedCommand: input.allowTrackedCommand });
+        return success(
+          { root: api.root, ...result },
+          `Machine verification ${result.verification.passed ? 'passed' : 'failed'} for intent ${result.intent.id}.`
+        );
+      })
+  );
+
   server.registerTool(
     'driftseal_end',
     {
       title: 'Close a DriftSeal intent',
       description:
-        'Close the current work-round intent with an honest terminal status, note, and verification result. Linked decisions must be reconciled before completed or partial closure.',
+        'Close the current work-round intent with an honest terminal status, note, and verification result. Reconcile linked decisions before running final verification. Acceptance-bound intents require fresh successful machine verification before completed closure.',
       inputSchema: {
         id: z.string().optional().describe('Intent ID; omit to close the current open intent.'),
         status: closedStatus.default('completed'),
@@ -447,7 +498,7 @@ async function createServer({ root }) {
     { name: SERVER_NAME, version: SERVER_VERSION },
     {
       instructions:
-        'Use driftseal_status before repository changes or after context loss. Open one focused intent with driftseal_begin before changes, then run the declared verification and close it honestly with driftseal_end. Reconcile every linked decision before completed or partial closure.',
+        'Use driftseal_status before repository changes or after context loss. Open one focused intent with driftseal_begin before changes. Reconcile every linked decision before verification. When the intent declares acceptance criteria, inspect its command and use driftseal_verify to capture machine evidence before completed closure; a command sourced from the repository log requires explicit allowTrackedCommand after it is trusted. Otherwise run the declared check directly. Close honestly with driftseal_end.',
     }
   );
   registerTools(server, api, z);

package/bin/driftseal.js

@@ -7,12 +7,14 @@
  * Intent-level write-ahead log and MADR decision log for agentic coding sessions.
  *
  * Protocol per work round:
- *   1. driftseal begin "<intent>" [--verify "<how to verify>"]   (before changes that may need a rollback)
+ *   1. driftseal begin "<intent>" [--accept "<observable outcome>"] [--verify "<command>"]
  *   2. execute the intent
- *   3. driftseal end [--status ...] [--note ...] [--verify-result ...]  (reconcile against intent)
+ *   3. driftseal verify   (for acceptance-bound machine evidence)
+ *   4. driftseal end [--status ...] [--note ...] [--verify-result ...]  (reconcile against intent)
  *
  * Events are appended to an append-only JSONL log (WAL semantics):
- *   { "type": "begin", "id", "ts", "intent", "verify" }
+ *   { "type": "begin", "id", "ts", "intent", "acceptance", "verify" }
+ *   { "type": "verify", "id", "ts", "command", "passed", "workspace" }
  *   { "type": "end",   "id", "ts", "status", "note", "verifyResult" }
  *
  * Intent log: $DRIFTSEAL_HOME/events.jsonl, or .intent-log/events.jsonl in cwd.
@@ -25,7 +27,7 @@ const path = require('path');
 const crypto = require('crypto');
 const os = require('os');
 const { isDeepStrictEqual } = require('util');
-const { execFileSync } = require('child_process');
+const { execFileSync, spawnSync } = require('child_process');
 const { version: PACKAGE_VERSION } = require('../package.json');
 
 const END_STATUSES = ['completed', 'partial', 'failed', 'abandoned'];
@@ -37,8 +39,8 @@ const DECISION_STATUSES = [
   'deprecated',
   'superseded',
 ];
-const EVENT_SCHEMA_VERSION = 3;
-const PROTOCOL_VERSION = 12;
+const EVENT_SCHEMA_VERSION = 4;
+const PROTOCOL_VERSION = 13;
 const DEFAULT_LOG_LANGUAGE = 'en';
 const IN_PROGRESS_GIT_PATH = 'driftseal-in-progress.jsonl';
 const LOCK_STALE_MS = 30 * 60 * 1000;
@@ -66,7 +68,9 @@ class HelpRequested extends DriftSealError {
 /** Single source of truth for per-command usage lines. */
 function usageFor(key) {
   const lines = {
-    begin: 'usage: driftseal begin "<intent>" [--verify "<how to verify>"] [--decision <id>] [--force]',
+    begin:
+      'usage: driftseal begin "<intent>" [--accept "<observable outcome>"] [--verify "<command>"] [--decision <id>] [--force]',
+    verify: 'usage: driftseal verify [--allow-tracked-command]',
     end: 'usage: driftseal end [id] [options]',
     status: 'usage: driftseal status',
     log: 'usage: driftseal log [--last N] [--all]',
@@ -121,6 +125,15 @@ function writeOutput(value) {
   process.stdout.write(text);
 }
 
+function writeErrorOutput(value) {
+  const text = String(value);
+  if (activeOutput) {
+    activeOutput.stderr += text;
+    return;
+  }
+  process.stderr.write(text);
+}
+
 if (process.env._DRIFTSEAL_TEST_UMASK) {
   process.umask(Number.parseInt(process.env._DRIFTSEAL_TEST_UMASK, 8));
 }
@@ -168,15 +181,65 @@ function normalizeEvent(event, line) {
     if (!Array.isArray(event.decisions) && event.decisions !== undefined) {
       fail(`invalid decisions list on log line ${line}`);
     }
+    if (!Array.isArray(event.acceptance) && event.acceptance !== undefined) {
+      fail(`invalid acceptance list on log line ${line}`);
+    }
+    const acceptance = event.acceptance || [];
+    if (acceptance.some((criterion) => typeof criterion !== 'string' || criterion.trim().length === 0)) {
+      fail(`invalid acceptance criterion on log line ${line}`);
+    }
+    if (acceptance.length > 0 && (typeof event.verify !== 'string' || event.verify.trim().length === 0)) {
+      fail(`acceptance-bound intent has no verification command on log line ${line}`);
+    }
     const decisions = (event.decisions || []).map(normalizeDecisionId);
     if (new Set(decisions).size !== decisions.length) {
       fail(`duplicate linked decision on log line ${line}`);
     }
-    return { ...event, decisions, head: normalizeHead(event.head) };
+    return { ...event, acceptance, decisions, head: normalizeHead(event.head) };
+  }
+
+  if (event.type === 'verify') {
+    if (
+      typeof event.verificationId !== 'string' ||
+      event.verificationId.length === 0 ||
+      typeof event.command !== 'string' ||
+      event.command.trim().length === 0 ||
+      typeof event.passed !== 'boolean' ||
+      (event.exitCode !== null && (!Number.isInteger(event.exitCode) || event.exitCode < 0)) ||
+      (event.signal !== null && typeof event.signal !== 'string') ||
+      !Number.isSafeInteger(event.durationMs) ||
+      event.durationMs < 0 ||
+      !Number.isSafeInteger(event.stdoutBytes) ||
+      event.stdoutBytes < 0 ||
+      !Number.isSafeInteger(event.stderrBytes) ||
+      event.stderrBytes < 0 ||
+      typeof event.outputHash !== 'string' ||
+      !/^[a-f0-9]{64}$/.test(event.outputHash) ||
+      (event.workspace !== null &&
+        (typeof event.workspace !== 'string' || !/^[a-f0-9]{64}$/.test(event.workspace))) ||
+      event.passed !== (event.exitCode === 0 && event.signal === null)
+    ) {
+      fail(`invalid verification event on log line ${line}`);
+    }
+    return { ...event, head: normalizeHead(event.head) };
   }
 
   if (event.type === 'end') {
     if (!END_STATUSES.includes(event.status)) fail(`invalid end event on log line ${line}`);
+    if (
+      event.verificationId !== undefined &&
+      event.verificationId !== null &&
+      (typeof event.verificationId !== 'string' || event.verificationId.length === 0)
+    ) {
+      fail(`invalid end verification id on log line ${line}`);
+    }
+    if (
+      event.workspace !== undefined &&
+      event.workspace !== null &&
+      (typeof event.workspace !== 'string' || !/^[a-f0-9]{64}$/.test(event.workspace))
+    ) {
+      fail(`invalid end workspace on log line ${line}`);
+    }
     return { ...event, head: normalizeHead(event.head) };
   }
 
@@ -817,6 +880,7 @@ function fold(events) {
         id: ev.id,
         tsBegin: ev.ts,
         intent: ev.intent,
+        acceptance: Array.isArray(ev.acceptance) ? ev.acceptance : [],
         verify: ev.verify || null,
         beginHead: ev.head || null,
         decisions: Array.isArray(ev.decisions) ? ev.decisions : [],
@@ -824,6 +888,8 @@ function fold(events) {
         decisionPrepares: [],
         decisionTerminals: [],
         decisionUpdates: [],
+        verificationAttempts: [],
+        verification: null,
         status: 'in_progress',
         tsEnd: null,
         note: null,
@@ -834,6 +900,20 @@ function fold(events) {
         reclaimedAt: null,
       });
       order.push(ev.id);
+    } else if (ev.type === 'verify') {
+      const rec = records.get(ev.id);
+      if (!rec) fail(`verification event references unknown intent id: ${ev.id}`);
+      if (rec.status !== 'in_progress') {
+        fail(`verification occurred after intent ${ev.id} was closed`);
+      }
+      if (rec.acceptance.length === 0 || !rec.verify) {
+        fail(`verification event references intent ${ev.id} without acceptance criteria`);
+      }
+      if (ev.command !== rec.verify) {
+        fail(`verification command does not match intent ${ev.id}`);
+      }
+      rec.verificationAttempts.push(ev);
+      rec.verification = ev;
     } else if (ev.type === 'reclaim' || ev.type === 'unreclaim') {
       const rec = records.get(ev.id);
       if (!rec) fail(`${ev.type} event references unknown intent id: ${ev.id}`);
@@ -877,6 +957,18 @@ function fold(events) {
       ) {
         fail(`linked intent ${ev.id} was closed without reconciling every declared decision`);
       }
+      if (ev.status === 'completed' && rec.acceptance.length > 0) {
+        if (!rec.verification || !rec.verification.passed) {
+          fail(`acceptance-bound intent ${ev.id} was completed without successful machine verification`);
+        }
+        if (
+          (ev.schemaVersion || 1) < 4 ||
+          ev.verificationId !== rec.verification.verificationId ||
+          (ev.workspace ?? null) !== rec.verification.workspace
+        ) {
+          fail(`acceptance-bound intent ${ev.id} was completed with stale machine verification`);
+        }
+      }
       rec.status = ev.status;
       rec.tsEnd = ev.ts;
       rec.note = ev.note || null;
@@ -1335,8 +1427,19 @@ function parseArgs(argv, spec, usageKey) {
 function render(rec) {
   const lines = [`[${rec.id}] ${rec.status}`];
   lines.push(`  intent: ${rec.intent}`);
+  for (const criterion of rec.acceptance) lines.push(`  accept: ${criterion}`);
   if (rec.decisions.length > 0) lines.push(`  decisions: ${rec.decisions.join(', ')}`);
   if (rec.verify) lines.push(`  verify: ${rec.verify}`);
+  if (rec.verification) {
+    const state = rec.verification.passed ? 'passed' : 'failed';
+    const workspace = rec.verification.workspace
+      ? `, workspace ${rec.verification.workspace.slice(0, 12)}`
+      : ', workspace unavailable';
+    lines.push(
+      `  machine-verification: ${state} (exit ${rec.verification.exitCode ?? '-'}, ` +
+        `${rec.verification.durationMs} ms${workspace})`
+    );
+  }
   if (rec.verifyResult) lines.push(`  verify-result: ${rec.verifyResult}`);
   if (rec.note) lines.push(`  note: ${rec.note}`);
   if (rec.beginHead || rec.endHead) {
@@ -1347,12 +1450,31 @@ function render(rec) {
   return lines.join('\n');
 }
 
+function publicVerification(verification) {
+  if (!verification) return null;
+  return {
+    id: verification.verificationId,
+    passed: verification.passed,
+    exitCode: verification.exitCode,
+    signal: verification.signal,
+    durationMs: verification.durationMs,
+    outputHash: verification.outputHash,
+    stdoutBytes: verification.stdoutBytes,
+    stderrBytes: verification.stderrBytes,
+    workspace: verification.workspace,
+    head: verification.head,
+    ranAt: verification.ts,
+  };
+}
+
 function publicIntent(rec) {
   if (!rec) return null;
   return {
     id: rec.id,
     intent: rec.intent,
+    acceptance: [...rec.acceptance],
     verify: rec.verify,
+    verification: publicVerification(rec.verification),
     decisions: [...rec.decisions],
     status: rec.status,
     note: rec.note,
@@ -1634,7 +1756,8 @@ ${intentLogLanguageParagraph(language)}
 
 1. **Write intent first**, before modifying, creating, or deleting files, or
    making any other non-Git change that may need a rollback:
-   \`driftseal begin "<what this round will accomplish>" --verify "<command or check that proves it>"\`.
+   \`driftseal begin "<what this round will accomplish>" --accept "<observable outcome>" --verify "<exact command that proves it>"\`.
+   Repeat \`--accept\` when completion has multiple independently observable criteria.
    Add one \`--decision <id>\` for each existing decision this round may change.
    Git operations never need an intent and are not included in the intent log;
    Git maintains their history. This includes inspection, branch and worktree
@@ -1649,8 +1772,17 @@ ${intentLogLanguageParagraph(language)}
    and can be verified on its own.
 2. **Execute only the intent.** Scope change? Close the current intent
    (\`driftseal end -s partial|abandoned -n "<why>"\`) and \`driftseal begin\` a new one.
-3. **Verify, then close**: run the declared verification, then
-   \`driftseal end -s completed|partial|failed|abandoned -n "<what happened>" -r "<what the verification showed, written for the next agent>"\`.
+3. **Reconcile, verify, then close**: for a linked intent, first reconcile every
+   declared decision as described below. For an acceptance-bound intent, inspect the
+   exact command shown by \`driftseal status\`, then run \`driftseal verify\` to execute it
+   and bind its exit status to the current Git-visible workspace contents. A command
+   sourced from the repository intent log is untrusted and requires
+   \`--allow-tracked-command\` after inspection; locally parked commands do not.
+   An intent without \`--accept\` uses its declared check directly. Then run
+   \`driftseal end -s completed|partial|failed|abandoned -n "<what happened>" -r "<optional context for the next agent>"\`.
+   DriftSeal rejects \`completed\` when machine verification failed, never ran, or
+   the workspace changed after it. Ignored files are outside the workspace fingerprint.
+   Outside a Git worktree, only the recorded exit status is available.
    Never report success without closing the intent.
    Before closing a linked intent as \`completed\` or \`partial\`, reconcile every
    declared decision with \`driftseal decision update <id> --status <status> --note "<why>"\`.
@@ -1682,8 +1814,30 @@ Log: \`.intent-log/events.jsonl\` (override with \`$DRIFTSEAL_HOME\`); ${localLo
 ${INTENT_PROTOCOL_END}`;
 }
 
-function previousIntentProtocolBlock(version, language = DEFAULT_LOG_LANGUAGE) {
-  const v11 = intentProtocolBlock(version, language)
+function previousIntentProtocolBlock(version, language = DEFAULT_LOG_LANGUAGE, localLog = false) {
+  const v12 = intentProtocolBlock(version, language, localLog)
+    .replace(
+      '   `driftseal begin "<what this round will accomplish>" --accept "<observable outcome>" --verify "<exact command that proves it>"`.\n' +
+        '   Repeat `--accept` when completion has multiple independently observable criteria.',
+      '   `driftseal begin "<what this round will accomplish>" --verify "<command or check that proves it>"`.'
+    )
+    .replace(
+      '3. **Reconcile, verify, then close**: for a linked intent, first reconcile every\n' +
+        '   declared decision as described below. For an acceptance-bound intent, inspect the\n' +
+        '   exact command shown by `driftseal status`, then run `driftseal verify` to execute it\n' +
+        '   and bind its exit status to the current Git-visible workspace contents. A command\n' +
+        '   sourced from the repository intent log is untrusted and requires\n' +
+        '   `--allow-tracked-command` after inspection; locally parked commands do not.\n' +
+        '   An intent without `--accept` uses its declared check directly. Then run\n' +
+        '   `driftseal end -s completed|partial|failed|abandoned -n "<what happened>" -r "<optional context for the next agent>"`.\n' +
+        '   DriftSeal rejects `completed` when machine verification failed, never ran, or\n' +
+        '   the workspace changed after it. Ignored files are outside the workspace fingerprint.\n' +
+        '   Outside a Git worktree, only the recorded exit status is available.',
+      '3. **Verify, then close**: run the declared verification, then\n' +
+        '   `driftseal end -s completed|partial|failed|abandoned -n "<what happened>" -r "<what the verification showed, written for the next agent>"`.'
+    );
+  if (version >= 12) return v12;
+  const v11 = v12
     .replace(
       '-r "<what the verification showed, written for the next agent>"',
       '-r "<verify output>"'
@@ -1876,9 +2030,9 @@ When an intent declares an existing decision with \`--decision <id>\`, use
 Commit \`.decision-log/\` with the code.`;
 }
 
-function previousDecisionProtocolBlock(version, language = DEFAULT_LOG_LANGUAGE) {
-  if (version >= 11) return decisionProtocolBlock(version, language);
-  const v10 = stripDecisionLogLanguage(decisionProtocolBlock(version, language), language);
+function previousDecisionProtocolBlock(version, language = DEFAULT_LOG_LANGUAGE, localLog = false) {
+  if (version >= 11) return decisionProtocolBlock(version, language, localLog);
+  const v10 = stripDecisionLogLanguage(decisionProtocolBlock(version, language, localLog), language);
   if (version >= 9) return v10;
   const v8 = v10.replace(
     '\nAfter a merge, colliding decision ids are remapped with `driftseal absorb`;\n' +
@@ -2202,8 +2356,8 @@ function skillInstallLocation(target, scope, root) {
       global: path.join(home, '.agents', 'skills'),
     },
     'kimi-code': {
-      project: path.join(root, '.kimi', 'skills'),
-      global: path.join(home, '.kimi', 'skills'),
+      project: path.join(root, '.kimi-code', 'skills'),
+      global: path.join(home, '.kimi-code', 'skills'),
     },
     opencode: {
       project: path.join(root, '.opencode', 'skills'),
@@ -2627,16 +2781,21 @@ function hookReminder(event, { readOnly = false } = {}) {
   if (event === 'prompt') {
     return (
       'DriftSeal reminder: if this round will modify files or anything else that may need a ' +
-      'rollback, begin an intent first: driftseal begin "<intent>" --verify "<check>". ' +
+      'rollback, begin an intent first: driftseal begin "<intent>" --accept "<observable outcome>" ' +
+      '--verify "<command>". ' +
       'Questions, read-only exploration, and single-step checks need no intent — skip this ' +
       'reminder when it does not apply.'
     );
   }
   const open = openIntent(fold(readEvents({ file, readOnly })));
   if (open) {
+    const reconciliation = open.decisions.length > 0 ? 'reconcile every linked decision, then ' : '';
+    const verification = open.acceptance.length > 0
+      ? `${reconciliation}inspect and run driftseal verify, then close it with driftseal end`
+      : `${reconciliation}run the declared verification, then close it with driftseal end`;
     return (
       `DriftSeal reminder: intent ${open.id} is still in_progress: "${open.intent}". ` +
-      'If its work is done, run the declared verification and close it with driftseal end; ' +
+      `If its work is done, ${verification}; ` +
       'if this turn was unrelated, ignore this reminder.'
     );
   }
@@ -2711,6 +2870,72 @@ function isGitWorkTree(cwd = process.cwd()) {
   return gitCapture(['rev-parse', '--is-inside-work-tree'], cwd) === 'true';
 }
 
+/**
+ * Hash the material Git-visible workspace contents rather than trusting the
+ * current commit alone. Any tracked or untracked (non-ignored) content change
+ * makes the verification stale.
+ * The intent event log is excluded because recording verification and closure
+ * necessarily appends to it.
+ */
+function workspaceFingerprint(cwd = process.cwd()) {
+  if (!isGitWorkTree(cwd)) return null;
+  const root = gitCaptureLine(['rev-parse', '--show-toplevel'], cwd);
+  if (!root) return null;
+  const listing = gitCaptureRaw(
+    ['ls-files', '-z', '--cached', '--others', '--exclude-standard'],
+    root
+  );
+  if (listing === null) return null;
+
+  const excludedFile = path.resolve(logFile());
+  const excludedLockPrefixes = [logDir(), decisionDir()].map((directory) =>
+    path.resolve(directory, '.driftseal.lock')
+  );
+  const files = [...new Set(listing.split('\0').filter(Boolean))].sort();
+  const hash = crypto.createHash('sha256');
+  for (const relative of files) {
+    const target = path.resolve(root, relative);
+    if (
+      target === excludedFile ||
+      excludedLockPrefixes.some(
+        (prefix) => target === prefix || target.startsWith(`${prefix}${path.sep}`) || target.startsWith(`${prefix}.stale.`)
+      )
+    ) {
+      continue;
+    }
+    hash.update(relative, 'utf8');
+    hash.update('\0');
+    let stat;
+    try {
+      stat = fs.lstatSync(target);
+    } catch (err) {
+      if (err.code === 'ENOENT') {
+        hash.update('missing\0');
+        continue;
+      }
+      throw err;
+    }
+    hash.update(String(stat.mode & 0o111));
+    hash.update('\0');
+    if (stat.isSymbolicLink()) {
+      hash.update('symlink\0');
+      hash.update(fs.readlinkSync(target));
+    } else if (stat.isFile()) {
+      hash.update('file\0');
+      hash.update(fs.readFileSync(target));
+    } else if (stat.isDirectory()) {
+      hash.update('directory\0');
+      hash.update(gitCapture(['rev-parse', 'HEAD'], target) || 'no-head');
+      hash.update('\0');
+      hash.update(gitCaptureRaw(['status', '--porcelain=v1', '-z'], target) || '');
+    } else {
+      hash.update('other\0');
+    }
+    hash.update('\0');
+  }
+  return hash.digest('hex');
+}
+
 /**
  * Warn (without mutating the index or .gitignore) when local log mode is on
  * but the default log paths are still tracked by git. The log directories are
@@ -3577,9 +3802,103 @@ function absorbGit(baseFile, oursFile, theirsFile, { abandon, dryRun }) {
   });
 }
 
+function runMachineVerification({ allowTrackedCommand = false } = {}) {
+  const snapshot = withMutationLocks([logDir()], () => {
+    const intent = openIntent(fold(readEvents({ repairTail: true })));
+    if (!intent) fail('no intent in progress; nothing to verify');
+    if (intent.acceptance.length === 0) {
+      fail(`intent ${intent.id} has no acceptance criteria; declare them with driftseal begin --accept`);
+    }
+    if (!intent.verify) fail(`intent ${intent.id} has no verification command`);
+    const park = inProgressFile();
+    const parked = park && fs.existsSync(park) ? parkedOpenIntent(park) : null;
+    return {
+      id: intent.id,
+      command: intent.verify,
+      fromTrackedLog: isParkableIntentLog() && (!parked || parked.id !== intent.id),
+    };
+  });
+
+  const displayedCommand = JSON.stringify(snapshot.command);
+  printError(`verification command: ${displayedCommand}`);
+  if (snapshot.fromTrackedLog && !allowTrackedCommand) {
+    fail(
+      `refusing to execute a verification command sourced from the repository intent log: ${displayedCommand}\n` +
+        'inspect the command, then re-run with --allow-tracked-command only if you trust it'
+    );
+  }
+
+  const started = process.hrtime.bigint();
+  const result = spawnSync(snapshot.command, {
+    cwd: process.cwd(),
+    env: process.env,
+    shell: true,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    maxBuffer: 16 * 1024 * 1024,
+  });
+  const durationMs = Number((process.hrtime.bigint() - started) / 1000000n);
+  const stdout = result.stdout || '';
+  let stderr = result.stderr || '';
+  if (result.error) {
+    stderr += `${stderr && !stderr.endsWith('\n') ? '\n' : ''}${result.error.message}\n`;
+  }
+  if (stdout) {
+    writeOutput(stdout);
+    if (!stdout.endsWith('\n')) printLine();
+  }
+  if (stderr) {
+    writeErrorOutput(stderr);
+    if (!stderr.endsWith('\n')) printError();
+  }
+
+  const exitCode = Number.isInteger(result.status) ? result.status : 1;
+  const signal = typeof result.signal === 'string' ? result.signal : null;
+  const passed = exitCode === 0 && signal === null;
+  const outputHash = crypto
+    .createHash('sha256')
+    .update(stdout, 'utf8')
+    .update('\0')
+    .update(stderr, 'utf8')
+    .digest('hex');
+  const verificationEvent = {
+    type: 'verify',
+    id: snapshot.id,
+    verificationId: crypto.randomUUID(),
+    ts: new Date().toISOString(),
+    command: snapshot.command,
+    passed,
+    exitCode,
+    signal,
+    durationMs,
+    outputHash,
+    stdoutBytes: Buffer.byteLength(stdout),
+    stderrBytes: Buffer.byteLength(stderr),
+    workspace: workspaceFingerprint(),
+    head: gitCapture(['rev-parse', 'HEAD']),
+  };
+
+  const intent = withMutationLocks([logDir()], () => {
+    const events = readEvents({ repairTail: true });
+    const current = openIntent(fold(events));
+    if (!current || current.id !== snapshot.id || current.verify !== snapshot.command) {
+      fail(`intent ${snapshot.id} changed while its verification command was running`);
+    }
+    events.push(appendEvent(verificationEvent));
+    return fold(events).find((candidate) => candidate.id === snapshot.id);
+  });
+  printLine(`${snapshot.id} verification ${passed ? 'passed' : 'failed'} (exit ${exitCode})`);
+  return {
+    intent: publicIntent(intent),
+    verification: publicVerification(intent.verification),
+    exitCode,
+  };
+}
+
 const commands = {
   begin(argv) {
     const { positionals, flags } = parseArgs(argv, {
+      accept: 'multiple',
       verify: '-v',
       decision: 'multiple',
       force: 'boolean',
@@ -3588,6 +3907,13 @@ const commands = {
     if (!intent) {
       fail(usageFor('begin'));
     }
+    const acceptance = [...new Set((flags.accept || []).map((criterion) => criterion.trim()))];
+    if (acceptance.some((criterion) => criterion.length === 0)) {
+      fail('--accept requires a non-empty observable outcome');
+    }
+    if (acceptance.length > 0 && (!flags.verify || flags.verify.trim().length === 0)) {
+      fail('--accept requires --verify with the exact machine verification command');
+    }
     const requestedDecisions = flags.decision || [];
     const index = requestedDecisions.length > 0 ? decisionIndex() : [];
     const decisions = [
@@ -3628,6 +3954,7 @@ const commands = {
       id,
       ts: new Date().toISOString(),
       intent,
+      acceptance,
       verify: flags.verify || null,
       decisions,
       head: gitCapture(['rev-parse', 'HEAD']),
@@ -3637,6 +3964,16 @@ const commands = {
     return publicIntent(record);
   },
 
+  verify(argv) {
+    const { positionals, flags } = parseArgs(
+      argv,
+      { 'allow-tracked-command': 'boolean' },
+      'verify'
+    );
+    if (positionals.length > 0) fail(usageFor('verify'));
+    return runMachineVerification({ allowTrackedCommand: flags['allow-tracked-command'] === true });
+  },
+
   end(argv) {
     const { positionals, flags } = parseArgs(argv, {
       status: '-s',
@@ -3661,6 +3998,25 @@ const commands = {
       if (!target) fail('no intent in progress; nothing to end');
     }
 
+    let completionWorkspace = null;
+    let completionVerificationId = null;
+    if (status === 'completed' && target.acceptance.length > 0) {
+      if (!target.verification || !target.verification.passed) {
+        fail(
+          `cannot complete acceptance-bound intent ${target.id} without successful machine verification; ` +
+            'run: driftseal verify'
+        );
+      }
+      completionWorkspace = workspaceFingerprint();
+      if (completionWorkspace !== target.verification.workspace) {
+        fail(
+          `cannot complete acceptance-bound intent ${target.id}: workspace changed after machine verification; ` +
+            'run: driftseal verify'
+        );
+      }
+      completionVerificationId = target.verification.verificationId;
+    }
+
     if (['failed', 'abandoned'].includes(status)) {
       const terminalStatus = closeIntentAsEscape(
         events,
@@ -3715,6 +4071,8 @@ const commands = {
       status,
       note: flags.note || null,
       verifyResult: flags['verify-result'] || null,
+      verificationId: completionVerificationId,
+      workspace: completionWorkspace,
       head: gitCapture(['rev-parse', 'HEAD']),
     }));
     const record = fold(events).find((candidate) => candidate.id === target.id);
@@ -4059,7 +4417,10 @@ const commands = {
       knownManagedBlocks: [
         ...sourceLanguages.flatMap((source) => [
           protocolEol(intentProtocolBlock(PROTOCOL_VERSION, source), eol),
+          protocolEol(previousIntentProtocolBlock(12, source), eol),
+          protocolEol(previousIntentProtocolBlock(12, source, true), eol),
           protocolEol(previousIntentProtocolBlock(11, source), eol),
+          protocolEol(previousIntentProtocolBlock(11, source, true), eol),
         ]),
         protocolEol(previousIntentProtocolBlock(2), eol),
         protocolEol(previousIntentProtocolBlock(3), eol),
@@ -4083,7 +4444,10 @@ const commands = {
       knownManagedBlocks: [
         ...sourceLanguages.flatMap((source) => [
           protocolEol(decisionProtocolBlock(PROTOCOL_VERSION, source), eol),
+          protocolEol(previousDecisionProtocolBlock(12, source), eol),
+          protocolEol(previousDecisionProtocolBlock(12, source, true), eol),
           protocolEol(previousDecisionProtocolBlock(11, source), eol),
+          protocolEol(previousDecisionProtocolBlock(11, source, true), eol),
         ]),
         protocolEol(previousDecisionProtocolBlock(2), eol),
         protocolEol(previousDecisionProtocolBlock(3), eol),
@@ -4146,7 +4510,11 @@ const commands = {
 Intent-level write-ahead log for agent sessions.
 
 usage:
-  driftseal begin "<intent>" [--verify "<how to verify>"] [--decision <id>] [--force]
+  driftseal begin "<intent>" [--accept "<observable outcome>"] [--verify "<command>"]
+                 [--decision <id>] [--force]
+  driftseal verify [--allow-tracked-command]
+                                       run the declared command and bind its result
+                                       to the current Git-visible workspace contents
   driftseal end [id] [--status completed|partial|failed|abandoned] [--note "..."] [--verify-result "..."]
   driftseal status                     show the intent currently in progress (re-anchor after drift)
   driftseal log [--last N] [--all]     show intent history (--all includes reclaimed records)
@@ -4214,7 +4582,7 @@ function requestedEndStatus(argv) {
  * subcommand, mirroring the value-taking entries of each parseArgs spec.
  */
 const VALUE_TAKING_FLAGS = {
-  begin: ['--verify', '-v', '--decision'],
+  begin: ['--accept', '--verify', '-v', '--decision'],
   end: ['--status', '-s', '--note', '-n', '--verify-result', '-r'],
   log: ['--last', '-n'],
   reclaim: ['--reason', '-r', '--older-than'],
@@ -4319,7 +4687,11 @@ function dispatch(argv) {
       const data = withMutationLocks(resources, () => fn(rest));
       return { data, exitCode: data && Number.isInteger(data.exitCode) ? data.exitCode : 0 };
     }
-    return { data: fn(rest), exitCode: 0 };
+    const data = fn(rest);
+    return {
+      data,
+      exitCode: data && Number.isInteger(data.exitCode) ? data.exitCode : 0,
+    };
   } catch (err) {
     if (err instanceof HelpRequested) {
       printLine(usageFor(err.usageKey) || usageFor(cmd) || 'run: driftseal help');
@@ -4406,13 +4778,17 @@ function createApi({ root = process.cwd(), isolateStorage = false } = {}) {
     status() {
       return call(['status']);
     },
-    begin({ intent, verify, decisions = [], force = false }) {
+    begin({ intent, acceptance = [], verify, decisions = [], force = false }) {
       const argv = ['begin', intent];
+      for (const criterion of acceptance) appendFlag(argv, '--accept', criterion);
       appendFlag(argv, '--verify', verify);
       for (const decision of decisions) appendFlag(argv, '--decision', decision);
       if (force) argv.push('--force');
       return call(argv);
     },
+    verify({ allowTrackedCommand = false } = {}) {
+      return call(['verify', ...(allowTrackedCommand ? ['--allow-tracked-command'] : [])]);
+    },
     end({ id, status, note, verifyResult } = {}) {
       const argv = ['end'];
       if (id) argv.push(String(id));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "driftseal",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Seal intent, verification, and decisions into an auditable workflow for agentic coding",
   "keywords": [
     "driftseal",