driftseal 1.2.1 → 1.3.2

package/README.md

@@ -137,7 +137,7 @@ The v1 server provides:
 | MCP capability | Purpose |
 | --- | --- |
 | `driftseal_status`, `driftseal_log` | Read the current intent and intent history. |
-| `driftseal_begin`, `driftseal_end` | Open and honestly close a work round. |
+| `driftseal_begin`, `driftseal_verify`, `driftseal_end` | Open a work round, capture machine verification evidence, and honestly close it. |
 | `driftseal_absorb` | Repair merge collisions or absorb another worktree's logs while remapping colliding IDs. |
 | `driftseal_reclaim`, `driftseal_unreclaim` | Hide meaningless closed records behind append-only markers, or restore them. |
 | `driftseal_decision_list`, `driftseal_decision_show` | Find and read MADR records. |
@@ -196,10 +196,51 @@ Declare the round before making non-Git changes:
 
 ```sh
 driftseal begin "add rate limiting to /api/login" \
+  --accept "the sixth login attempt within one minute receives HTTP 429" \
   --verify "npm test test/rate-limit.test.js"
 ```
 
-Do the work, run the declared check, then reconcile the result:
+Do the work, reconcile any linked decisions, inspect the declared command with
+`driftseal status`, and only then let DriftSeal run it:
+
+```sh
+driftseal verify
+```
+
+`driftseal verify` passes the exact stored string to the operating-system shell.
+The command can therefore read or modify files, access the network, or run any
+other program available to the current user. Treat it as executable code, not as
+passive log data. DriftSeal records local provenance when an intent is opened:
+the default Git workflow parks the intent in Git metadata, while non-Git and
+custom `DRIFTSEAL_HOME` workflows keep a small local marker outside the intent
+log. Those locally created intents run normally. If an open intent arrives only
+through an intent log, without matching local provenance, DriftSeal cannot confirm
+who chose its command. It prints the command to stderr and refuses to execute it
+until you inspect it and explicitly run
+`driftseal verify --allow-tracked-command`. The programmatic API and MCP tool
+expose the equivalent `allowTrackedCommand` opt-in. Local provenance state is
+removed when the intent closes. Non-Git markers are bound to the local log
+file's identity, so copying a marker with the log does not transfer trust. If
+local provenance is lost or no longer matches, verification fails safe and
+requires the same explicit opt-in.
+
+The verification event records the command's exit status, duration, output
+digest and byte counts, Git HEAD, and a fingerprint of every tracked or
+untracked non-ignored workspace file except the intent event log. A successful
+result becomes stale if those workspace contents change. DriftSeal therefore
+rejects `completed` until the command passes again on the current workspace.
+Command output is spooled to temporary files instead of a fixed in-memory
+buffer, then replayed after the command exits and removed. Output size therefore
+has no DriftSeal-defined limit, though it remains bounded by available disk space.
+Ignored files are deliberately outside this fingerprint. Outside a Git
+worktree the fingerprint is unavailable, so the gate proves only the command's
+recorded exit status and cannot detect later content changes.
+
+This proves that the declared command passed on recorded contents; it does not
+prove that the acceptance criterion or test is adequate. Existing intents
+without `--accept` retain the manual verification workflow for compatibility.
+Use protected CI, independent review, or human approval when the verifier was
+written by the same agent, the outcome is subjective, or the change is high risk.
 
 ```sh
 driftseal end \
@@ -224,7 +265,8 @@ also need no intent. Any other non-Git content change starts a new work round.
 
 | Command | Purpose |
 | --- | --- |
-| `driftseal begin "<intent>" [-v "<verify>"] [--decision id] [--force]` | Open a work-round intent and optionally link existing decisions. |
+| `driftseal begin "<intent>" [--accept "<outcome>"] [-v "<command>"] [--decision id] [--force]` | Open a work-round intent. Repeat `--accept` for observable completion criteria; acceptance requires a verification command. |
+| `driftseal verify [--allow-tracked-command]` | Execute the acceptance-bound intent's predeclared command and bind machine evidence to the current Git-visible workspace contents. Commands without matching local provenance require the explicit opt-in. |
 | `driftseal end [id] [-s status] [-n note] [-r verify-result]` | Close an intent honestly. |
 | `driftseal status` | Show the intent currently in progress. |
 | `driftseal log [-n N] [--all]` | Review intent history (`--all` includes reclaimed records). |
@@ -248,7 +290,9 @@ When `begin` declares one or more `--decision <id>` links, every linked
 decision must be reconciled with `driftseal decision update` before that intent can
 close as `completed` or `partial`. The update changes the current status when
 requested and appends a timestamped history entry tied to the intent. Intents
-without decision links keep the ordinary workflow.
+without decision links keep the ordinary workflow. For acceptance-bound linked
+intents, perform every decision update before `driftseal verify`, because a decision
+update changes the workspace fingerprint: reconcile, verify, then end.
 
 ## Reclaiming noise records
 

package/README.zh-CN.md

@@ -132,7 +132,7 @@ v1 server 提供：
 | MCP capability | 用途 |
 | --- | --- |
 | `driftseal_status`, `driftseal_log` | 读取当前 intent 和 intent 历史。 |
-| `driftseal_begin`, `driftseal_end` | 开启并诚实关闭一轮工作。 |
+| `driftseal_begin`, `driftseal_verify`, `driftseal_end` | 开启一轮工作、采集机器验证证据，并诚实关闭。 |
 | `driftseal_absorb` | 修复 merge 撞号，或吸收另一条 worktree 日志并重编号冲突 ID。 |
 | `driftseal_reclaim`, `driftseal_unreclaim` | 用 append-only 标记隐藏已无意义的已关闭记录，或将其恢复。 |
 | `driftseal_decision_list`, `driftseal_decision_show` | 查找并读取 MADR record。 |
@@ -186,10 +186,45 @@ Kimi Code 只在全局 `config.toml` 中记录 hook，因此该 target 必须指
 
 ```sh
 driftseal begin "add rate limiting to /api/login" \
+  --accept "the sixth login attempt within one minute receives HTTP 429" \
   --verify "npm test test/rate-limit.test.js"
 ```
 
-完成工作并运行约定的 check 后，记录实际结果：
+完成工作后，先 reconcile 所有关联 decision，再用 `driftseal status` 检查声明的
+命令，确认无误后才让 DriftSeal 执行：
+
+```sh
+driftseal verify
+```
+
+`driftseal verify` 会把日志中保存的完整字符串交给操作系统 shell。这个命令可以
+读写文件、访问网络，也可以运行当前用户有权执行的任何程序；因此它是可执行代码，
+不是被动的日志数据。创建 intent 时，DriftSeal 会记录本地 provenance：默认 Git
+流程把 open intent park 在 Git metadata 中；非 Git 环境和自定义
+`DRIFTSEAL_HOME` 则在 intent log 之外保存一个很小的本地标记。这些本地创建的
+intent 可以直接验证。如果 open intent 只有 log 记录、没有匹配的本地 provenance，
+DriftSeal 就无法确认是谁选择了其中的命令。此时它会先把命令输出到 stderr 并拒绝
+执行；只有检查并信任该命令后，才能显式运行
+`driftseal verify --allow-tracked-command`。Programmatic API 和 MCP tool 中对应的显式
+开关是 `allowTrackedCommand`。intent 关闭时，本地 provenance 会被清理；如果它提前
+丢失，DriftSeal 会按安全方向处理，仍要求显式 opt in。非 Git marker 还会绑定本地
+log 文件的 identity，因此把 marker 和 log 一起复制到别处也不会转移信任。
+
+验证事件会记录 exit status、耗时、输出摘要及字节数、Git HEAD，以及当前所有
+tracked 和未被 ignore 的 untracked 文件的内容指纹（intent event log 除外）。
+验证后只要这些内容发生变化，成功证据就会过期，必须重新运行；否则 DriftSeal
+会拒绝把 intent 关闭为 `completed`。命令输出会先写入临时 spool 文件，而不是
+受固定大小的内存 buffer 限制；命令退出后再回放并删除。因此 DriftSeal 不再限制
+输出大小，但实际容量仍受可用磁盘空间约束。被 ignore 的文件不在指纹范围内。
+如果当前目录不是 Git worktree，指纹不可用；此时 gate 只能证明记录到的 exit
+status，无法发现之后发生的内容变化。
+
+这只能证明预先声明的命令在记录的内容上通过，不能证明 acceptance criterion
+或测试本身足够可靠。为兼容旧记录，没有 `--accept` 的 intent 仍沿用手动验证流程。
+如果验证器也由同一个 agent 编写、结果带有主观判断，或改动风险较高，应再使用
+受保护的 CI、独立 review 或人工确认。
+
+最后记录实际结果：
 
 ```sh
 driftseal end \
@@ -211,7 +246,8 @@ intent；会被提交且无法重建的内容改动（比如编辑 `.gitignore`
 
 | Command | 用途 |
 | --- | --- |
-| `driftseal begin "<intent>" [-v "<verify>"] [--decision id] [--force]` | 开启一轮工作，并可关联已有 decision。 |
+| `driftseal begin "<intent>" [--accept "<outcome>"] [-v "<command>"] [--decision id] [--force]` | 开启一轮工作。可重复使用 `--accept` 声明可观察的完成条件；一旦声明，就必须同时提供验证命令。 |
+| `driftseal verify [--allow-tracked-command]` | 执行 acceptance-bound intent 预先声明的命令，并把机器证据绑定到当前 Git 可见的工作区内容；没有匹配本地 provenance 的命令必须显式 opt in。 |
 | `driftseal end [id] [-s status] [-n note] [-r verify-result]` | 诚实地关闭 intent。 |
 | `driftseal status` | 查看当前进行中的 intent。 |
 | `driftseal log [-n N] [--all]` | 查看 intent 历史（`--all` 包含已回收的记录）。 |
@@ -234,7 +270,10 @@ intent；会被提交且无法重建的内容改动（比如编辑 `.gitignore`
 如果 `begin` 通过一个或多个 `--decision <id>` 声明了关联，那么 intent
 以 `completed` 或 `partial` 关闭前，必须用 `driftseal decision update` reconcile
 每一条关联 decision。update 可以改变当前 status，并会追加一条包含时间和
-intent ID 的 history。没有关联 decision 的 intent 仍沿用普通流程。
+intent ID 的 history。没有关联 decision 的 intent 仍沿用普通流程。对于
+acceptance-bound linked intent，所有 decision update 都必须发生在
+`driftseal verify` 之前，因为 update 会改变 workspace fingerprint；顺序应当是
+reconcile、verify、end。
 
 ## 回收已无意义的记录
 

package/bin/driftseal-mcp.js

@@ -69,10 +69,25 @@ function guarded(action) {
 }
 
 function registerTools(server, api, z) {
+  const verificationRecord = z.object({
+    id: z.string(),
+    passed: z.boolean(),
+    exitCode: z.number().int().nonnegative().nullable(),
+    signal: z.string().nullable(),
+    durationMs: z.number().int().nonnegative(),
+    outputHash: z.string().regex(/^[a-f0-9]{64}$/),
+    stdoutBytes: z.number().int().nonnegative(),
+    stderrBytes: z.number().int().nonnegative(),
+    workspace: z.string().regex(/^[a-f0-9]{64}$/).nullable(),
+    head: z.string().nullable(),
+    ranAt: z.string(),
+  });
   const intentRecord = z.object({
     id: z.string(),
     intent: z.string(),
+    acceptance: z.array(z.string()),
     verify: z.string().nullable(),
+    verification: verificationRecord.nullable(),
     decisions: z.array(z.string()),
     status: z.enum(END_STATUSES).or(z.literal('in_progress')),
     note: z.string().nullable(),
@@ -150,6 +165,10 @@ function registerTools(server, api, z) {
         'Open one focused work-round intent before making repository changes. Fails if another intent is already open; close it explicitly first.',
       inputSchema: {
         intent: nonEmpty.describe('Outcome this work round will accomplish.'),
+        acceptance: z
+          .array(nonEmpty)
+          .default([])
+          .describe('Observable outcomes that make machine-verified completion meaningful.'),
         verify: nonEmpty.optional().describe('Exact command or outcome check that will prove completion.'),
         decisions: z
           .array(decisionId)
@@ -166,12 +185,44 @@ function registerTools(server, api, z) {
       })
   );
 
+  server.registerTool(
+    'driftseal_verify',
+    {
+      title: 'Run the declared DriftSeal verification',
+      description:
+        'Execute the current acceptance-bound intent\'s predeclared shell command and record machine evidence bound to the resulting Git-visible workspace contents. Inspect the command with driftseal_status first. A command sourced from the repository intent log is untrusted and requires allowTrackedCommand.',
+      inputSchema: {
+        allowTrackedCommand: z
+          .boolean()
+          .default(false)
+          .describe(
+            'Explicitly allow a command sourced from the repository intent log after inspecting and trusting it.'
+          ),
+      },
+      outputSchema: {
+        root: z.string(),
+        intent: intentRecord,
+        verification: verificationRecord,
+        exitCode: z.number().int().nonnegative(),
+      },
+      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
+    },
+    async (input) =>
+      guarded(() => {
+        const result = api.verify({ allowTrackedCommand: input.allowTrackedCommand });
+        return success(
+          { root: api.root, ...result },
+          `Machine verification ${result.verification.passed ? 'passed' : 'failed'} for intent ${result.intent.id}.`
+        );
+      })
+  );
+
   server.registerTool(
     'driftseal_end',
     {
       title: 'Close a DriftSeal intent',
       description:
-        'Close the current work-round intent with an honest terminal status, note, and verification result. Linked decisions must be reconciled before completed or partial closure.',
+        'Close the current work-round intent with an honest terminal status, note, and verification result. Reconcile linked decisions before running final verification. Acceptance-bound intents require fresh successful machine verification before completed closure.',
       inputSchema: {
         id: z.string().optional().describe('Intent ID; omit to close the current open intent.'),
         status: closedStatus.default('completed'),
@@ -447,7 +498,7 @@ async function createServer({ root }) {
     { name: SERVER_NAME, version: SERVER_VERSION },
     {
       instructions:
-        'Use driftseal_status before repository changes or after context loss. Open one focused intent with driftseal_begin before changes, then run the declared verification and close it honestly with driftseal_end. Reconcile every linked decision before completed or partial closure.',
+        'Use driftseal_status before repository changes or after context loss. Open one focused intent with driftseal_begin before changes. Reconcile every linked decision before verification. When the intent declares acceptance criteria, inspect its command and use driftseal_verify to capture machine evidence before completed closure; a command sourced from the repository log requires explicit allowTrackedCommand after it is trusted. Otherwise run the declared check directly. Close honestly with driftseal_end.',
     }
   );
   registerTools(server, api, z);

package/bin/driftseal.js

@@ -7,12 +7,14 @@
  * Intent-level write-ahead log and MADR decision log for agentic coding sessions.
  *
  * Protocol per work round:
- *   1. driftseal begin "<intent>" [--verify "<how to verify>"]   (before changes that may need a rollback)
+ *   1. driftseal begin "<intent>" [--accept "<observable outcome>"] [--verify "<command>"]
  *   2. execute the intent
- *   3. driftseal end [--status ...] [--note ...] [--verify-result ...]  (reconcile against intent)
+ *   3. driftseal verify   (for acceptance-bound machine evidence)
+ *   4. driftseal end [--status ...] [--note ...] [--verify-result ...]  (reconcile against intent)
  *
  * Events are appended to an append-only JSONL log (WAL semantics):
- *   { "type": "begin", "id", "ts", "intent", "verify" }
+ *   { "type": "begin", "id", "ts", "intent", "acceptance", "verify" }
+ *   { "type": "verify", "id", "ts", "command", "passed", "workspace" }
  *   { "type": "end",   "id", "ts", "status", "note", "verifyResult" }
  *
  * Intent log: $DRIFTSEAL_HOME/events.jsonl, or .intent-log/events.jsonl in cwd.
@@ -25,7 +27,8 @@ const path = require('path');
 const crypto = require('crypto');
 const os = require('os');
 const { isDeepStrictEqual } = require('util');
-const { execFileSync } = require('child_process');
+const { StringDecoder } = require('string_decoder');
+const { execFileSync, spawnSync } = require('child_process');
 const { version: PACKAGE_VERSION } = require('../package.json');
 
 const END_STATUSES = ['completed', 'partial', 'failed', 'abandoned'];
@@ -37,8 +40,8 @@ const DECISION_STATUSES = [
   'deprecated',
   'superseded',
 ];
-const EVENT_SCHEMA_VERSION = 3;
-const PROTOCOL_VERSION = 12;
+const EVENT_SCHEMA_VERSION = 4;
+const PROTOCOL_VERSION = 13;
 const DEFAULT_LOG_LANGUAGE = 'en';
 const IN_PROGRESS_GIT_PATH = 'driftseal-in-progress.jsonl';
 const LOCK_STALE_MS = 30 * 60 * 1000;
@@ -46,6 +49,10 @@ const LOCK_INIT_STALE_MS = 5 * 1000;
 const READ_ONLY_NOTICE = '(read-only: another mutation holds the lock; tail repair skipped)';
 const READ_ONLY_LOCK_WAIT_MS = Number(process.env._DRIFTSEAL_TEST_READ_ONLY_LOCK_WAIT_MS) || 1500;
 const MAX_DECISION_SLUG_LENGTH = 180;
+const VERIFICATION_OUTPUT_CHUNK_BYTES = 64 * 1024;
+const CAPTURE_OUTPUT_EDGE_CHARACTERS = 32 * 1024;
+const CAPTURE_OUTPUT_OMISSION = '\n... [driftseal captured output truncated] ...\n';
+const LOCAL_INTENT_PROVENANCE_FILE = '.driftseal-local-intent.json';
 
 class DriftSealError extends Error {
   constructor(message) {
@@ -66,7 +73,9 @@ class HelpRequested extends DriftSealError {
 /** Single source of truth for per-command usage lines. */
 function usageFor(key) {
   const lines = {
-    begin: 'usage: driftseal begin "<intent>" [--verify "<how to verify>"] [--decision <id>] [--force]',
+    begin:
+      'usage: driftseal begin "<intent>" [--accept "<observable outcome>"] [--verify "<command>"] [--decision <id>] [--force]',
+    verify: 'usage: driftseal verify [--allow-tracked-command]',
     end: 'usage: driftseal end [id] [options]',
     status: 'usage: driftseal status',
     log: 'usage: driftseal log [--last N] [--all]',
@@ -94,33 +103,73 @@ function usageFor(key) {
 
 let activeOutput = null;
 
+function createBoundedOutputCapture() {
+  return { head: '', tail: '', length: 0, headComplete: false };
+}
+
+function splitsSurrogatePair(text, index) {
+  if (index <= 0 || index >= text.length) return false;
+  const before = text.charCodeAt(index - 1);
+  const after = text.charCodeAt(index);
+  return before >= 0xd800 && before <= 0xdbff && after >= 0xdc00 && after <= 0xdfff;
+}
+
+function appendBoundedOutput(capture, value) {
+  let text = String(value);
+  capture.length += text.length;
+
+  if (!capture.headComplete) {
+    let take = Math.min(CAPTURE_OUTPUT_EDGE_CHARACTERS - capture.head.length, text.length);
+    if (splitsSurrogatePair(text, take)) take -= 1;
+    capture.head += text.slice(0, take);
+    text = text.slice(take);
+    if (text.length > 0) capture.headComplete = true;
+  }
+
+  if (text.length === 0) return;
+  const combined = capture.tail + text;
+  let start = Math.max(0, combined.length - CAPTURE_OUTPUT_EDGE_CHARACTERS);
+  if (splitsSurrogatePair(combined, start)) start += 1;
+  capture.tail = combined.slice(start);
+}
+
+function renderBoundedOutput(capture) {
+  if (capture.length === capture.head.length + capture.tail.length) {
+    return capture.head + capture.tail;
+  }
+  return capture.head + CAPTURE_OUTPUT_OMISSION + capture.tail;
+}
+
+function captureOutput(stream, value) {
+  if (!activeOutput) return false;
+  appendBoundedOutput(activeOutput[stream], value);
+  return true;
+}
+
 function printLine(value = '') {
   const text = String(value);
-  if (activeOutput) {
-    activeOutput.stdout += text + '\n';
-    return;
-  }
+  if (captureOutput('stdout', text + '\n')) return;
   console.log(text);
 }
 
 function printError(value = '') {
   const text = String(value);
-  if (activeOutput) {
-    activeOutput.stderr += text + '\n';
-    return;
-  }
+  if (captureOutput('stderr', text + '\n')) return;
   console.error(text);
 }
 
 function writeOutput(value) {
   const text = String(value);
-  if (activeOutput) {
-    activeOutput.stdout += text;
-    return;
-  }
+  if (captureOutput('stdout', text)) return;
   process.stdout.write(text);
 }
 
+function writeErrorOutput(value) {
+  const text = String(value);
+  if (captureOutput('stderr', text)) return;
+  process.stderr.write(text);
+}
+
 if (process.env._DRIFTSEAL_TEST_UMASK) {
   process.umask(Number.parseInt(process.env._DRIFTSEAL_TEST_UMASK, 8));
 }
@@ -168,15 +217,65 @@ function normalizeEvent(event, line) {
     if (!Array.isArray(event.decisions) && event.decisions !== undefined) {
       fail(`invalid decisions list on log line ${line}`);
     }
+    if (!Array.isArray(event.acceptance) && event.acceptance !== undefined) {
+      fail(`invalid acceptance list on log line ${line}`);
+    }
+    const acceptance = event.acceptance || [];
+    if (acceptance.some((criterion) => typeof criterion !== 'string' || criterion.trim().length === 0)) {
+      fail(`invalid acceptance criterion on log line ${line}`);
+    }
+    if (acceptance.length > 0 && (typeof event.verify !== 'string' || event.verify.trim().length === 0)) {
+      fail(`acceptance-bound intent has no verification command on log line ${line}`);
+    }
     const decisions = (event.decisions || []).map(normalizeDecisionId);
     if (new Set(decisions).size !== decisions.length) {
       fail(`duplicate linked decision on log line ${line}`);
     }
-    return { ...event, decisions, head: normalizeHead(event.head) };
+    return { ...event, acceptance, decisions, head: normalizeHead(event.head) };
+  }
+
+  if (event.type === 'verify') {
+    if (
+      typeof event.verificationId !== 'string' ||
+      event.verificationId.length === 0 ||
+      typeof event.command !== 'string' ||
+      event.command.trim().length === 0 ||
+      typeof event.passed !== 'boolean' ||
+      (event.exitCode !== null && (!Number.isInteger(event.exitCode) || event.exitCode < 0)) ||
+      (event.signal !== null && typeof event.signal !== 'string') ||
+      !Number.isSafeInteger(event.durationMs) ||
+      event.durationMs < 0 ||
+      !Number.isSafeInteger(event.stdoutBytes) ||
+      event.stdoutBytes < 0 ||
+      !Number.isSafeInteger(event.stderrBytes) ||
+      event.stderrBytes < 0 ||
+      typeof event.outputHash !== 'string' ||
+      !/^[a-f0-9]{64}$/.test(event.outputHash) ||
+      (event.workspace !== null &&
+        (typeof event.workspace !== 'string' || !/^[a-f0-9]{64}$/.test(event.workspace))) ||
+      event.passed !== (event.exitCode === 0 && event.signal === null)
+    ) {
+      fail(`invalid verification event on log line ${line}`);
+    }
+    return { ...event, head: normalizeHead(event.head) };
   }
 
   if (event.type === 'end') {
     if (!END_STATUSES.includes(event.status)) fail(`invalid end event on log line ${line}`);
+    if (
+      event.verificationId !== undefined &&
+      event.verificationId !== null &&
+      (typeof event.verificationId !== 'string' || event.verificationId.length === 0)
+    ) {
+      fail(`invalid end verification id on log line ${line}`);
+    }
+    if (
+      event.workspace !== undefined &&
+      event.workspace !== null &&
+      (typeof event.workspace !== 'string' || !/^[a-f0-9]{64}$/.test(event.workspace))
+    ) {
+      fail(`invalid end workspace on log line ${line}`);
+    }
     return { ...event, head: normalizeHead(event.head) };
   }
 
@@ -506,7 +605,12 @@ function parkedOpenIntent(park) {
 
 function appendEvent(event) {
   const park = inProgressFile();
-  if (!park) return appendEventTo(logFile(), event);
+  if (!park) {
+    const stored = appendEventTo(logFile(), event);
+    if (event.type === 'begin') writeLocalIntentProvenance(stored);
+    if (event.type === 'end') clearLocalIntentProvenance(event.id);
+    return stored;
+  }
 
   const open = parkedOpenIntent(park);
   // A park with nothing open left in it belongs in the log; an interrupted end retries here.
@@ -528,9 +632,88 @@ function contentHash(content) {
   return crypto.createHash('sha256').update(content, 'utf8').digest('hex');
 }
 
-function atomicWriteFile(target, content) {
+function localIntentProvenanceFile() {
+  const root = gitWorktreeRoot();
+  const key = contentHash(path.resolve(logFile())).slice(0, 16);
+  if (!root) return path.join(logDir(), LOCAL_INTENT_PROVENANCE_FILE);
+  const gitPath = gitCapture(['rev-parse', '--git-path', `driftseal-local-intent-${key}.json`]);
+  return gitPath ? path.resolve(process.cwd(), gitPath) : null;
+}
+
+function localIntentLogIdentity() {
+  try {
+    const stat = fs.statSync(logFile(), { bigint: true });
+    return contentHash(JSON.stringify([String(stat.dev), String(stat.ino), String(stat.birthtimeNs)]));
+  } catch {
+    return null;
+  }
+}
+
+function localIntentProvenanceFingerprint({ id, ts, verify }) {
+  return contentHash(JSON.stringify([id, ts, verify || null]));
+}
+
+function writeLocalIntentProvenance(event) {
+  const file = localIntentProvenanceFile();
+  if (!file) return;
+  ensureDirectoryDurable(path.dirname(file));
+  atomicWriteFile(
+    file,
+    JSON.stringify({
+      version: 1,
+      id: event.id,
+      fingerprint: localIntentProvenanceFingerprint(event),
+      logIdentity: localIntentLogIdentity(),
+    }) + '\n',
+    0o600
+  );
+}
+
+function readLocalIntentProvenance() {
+  const file = localIntentProvenanceFile();
+  if (!file || !fs.existsSync(file)) return null;
+  try {
+    const provenance = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (
+      provenance.version !== 1 ||
+      typeof provenance.id !== 'string' ||
+      !/^[a-f0-9]{64}$/.test(provenance.fingerprint) ||
+      !/^[a-f0-9]{64}$/.test(provenance.logIdentity)
+    ) {
+      return null;
+    }
+    return provenance;
+  } catch {
+    return null;
+  }
+}
+
+function hasMatchingLocalIntentProvenance(intent) {
+  const provenance = readLocalIntentProvenance();
+  return (
+    provenance !== null &&
+    provenance.id === intent.id &&
+    provenance.logIdentity === localIntentLogIdentity() &&
+    provenance.fingerprint ===
+      localIntentProvenanceFingerprint({
+        id: intent.id,
+        ts: intent.tsBegin,
+        verify: intent.verify,
+      })
+  );
+}
+
+function clearLocalIntentProvenance(id) {
+  const file = localIntentProvenanceFile();
+  const provenance = readLocalIntentProvenance();
+  if (!file || !provenance || provenance.id !== id) return;
+  fs.unlinkSync(file);
+  fsyncDirectory(path.dirname(file));
+}
+
+function atomicWriteFile(target, content, createMode = 0o644) {
   const existed = fs.existsSync(target);
-  const mode = existed ? fs.statSync(target).mode & 0o777 : 0o644;
+  const mode = existed ? fs.statSync(target).mode & 0o777 : createMode;
   const temp = path.join(
     path.dirname(target),
     `.${path.basename(target)}.${process.pid}.${crypto.randomUUID()}.tmp`
@@ -817,6 +1000,7 @@ function fold(events) {
         id: ev.id,
         tsBegin: ev.ts,
         intent: ev.intent,
+        acceptance: Array.isArray(ev.acceptance) ? ev.acceptance : [],
         verify: ev.verify || null,
         beginHead: ev.head || null,
         decisions: Array.isArray(ev.decisions) ? ev.decisions : [],
@@ -824,6 +1008,8 @@ function fold(events) {
         decisionPrepares: [],
         decisionTerminals: [],
         decisionUpdates: [],
+        verificationAttempts: [],
+        verification: null,
         status: 'in_progress',
         tsEnd: null,
         note: null,
@@ -834,6 +1020,20 @@ function fold(events) {
         reclaimedAt: null,
       });
       order.push(ev.id);
+    } else if (ev.type === 'verify') {
+      const rec = records.get(ev.id);
+      if (!rec) fail(`verification event references unknown intent id: ${ev.id}`);
+      if (rec.status !== 'in_progress') {
+        fail(`verification occurred after intent ${ev.id} was closed`);
+      }
+      if (rec.acceptance.length === 0 || !rec.verify) {
+        fail(`verification event references intent ${ev.id} without acceptance criteria`);
+      }
+      if (ev.command !== rec.verify) {
+        fail(`verification command does not match intent ${ev.id}`);
+      }
+      rec.verificationAttempts.push(ev);
+      rec.verification = ev;
     } else if (ev.type === 'reclaim' || ev.type === 'unreclaim') {
       const rec = records.get(ev.id);
       if (!rec) fail(`${ev.type} event references unknown intent id: ${ev.id}`);
@@ -877,6 +1077,18 @@ function fold(events) {
       ) {
         fail(`linked intent ${ev.id} was closed without reconciling every declared decision`);
       }
+      if (ev.status === 'completed' && rec.acceptance.length > 0) {
+        if (!rec.verification || !rec.verification.passed) {
+          fail(`acceptance-bound intent ${ev.id} was completed without successful machine verification`);
+        }
+        if (
+          (ev.schemaVersion || 1) < 4 ||
+          ev.verificationId !== rec.verification.verificationId ||
+          (ev.workspace ?? null) !== rec.verification.workspace
+        ) {
+          fail(`acceptance-bound intent ${ev.id} was completed with stale machine verification`);
+        }
+      }
       rec.status = ev.status;
       rec.tsEnd = ev.ts;
       rec.note = ev.note || null;
@@ -1335,8 +1547,19 @@ function parseArgs(argv, spec, usageKey) {
 function render(rec) {
   const lines = [`[${rec.id}] ${rec.status}`];
   lines.push(`  intent: ${rec.intent}`);
+  for (const criterion of rec.acceptance) lines.push(`  accept: ${criterion}`);
   if (rec.decisions.length > 0) lines.push(`  decisions: ${rec.decisions.join(', ')}`);
   if (rec.verify) lines.push(`  verify: ${rec.verify}`);
+  if (rec.verification) {
+    const state = rec.verification.passed ? 'passed' : 'failed';
+    const workspace = rec.verification.workspace
+      ? `, workspace ${rec.verification.workspace.slice(0, 12)}`
+      : ', workspace unavailable';
+    lines.push(
+      `  machine-verification: ${state} (exit ${rec.verification.exitCode ?? '-'}, ` +
+        `${rec.verification.durationMs} ms${workspace})`
+    );
+  }
   if (rec.verifyResult) lines.push(`  verify-result: ${rec.verifyResult}`);
   if (rec.note) lines.push(`  note: ${rec.note}`);
   if (rec.beginHead || rec.endHead) {
@@ -1347,12 +1570,31 @@ function render(rec) {
   return lines.join('\n');
 }
 
+function publicVerification(verification) {
+  if (!verification) return null;
+  return {
+    id: verification.verificationId,
+    passed: verification.passed,
+    exitCode: verification.exitCode,
+    signal: verification.signal,
+    durationMs: verification.durationMs,
+    outputHash: verification.outputHash,
+    stdoutBytes: verification.stdoutBytes,
+    stderrBytes: verification.stderrBytes,
+    workspace: verification.workspace,
+    head: verification.head,
+    ranAt: verification.ts,
+  };
+}
+
 function publicIntent(rec) {
   if (!rec) return null;
   return {
     id: rec.id,
     intent: rec.intent,
+    acceptance: [...rec.acceptance],
     verify: rec.verify,
+    verification: publicVerification(rec.verification),
     decisions: [...rec.decisions],
     status: rec.status,
     note: rec.note,
@@ -1634,7 +1876,8 @@ ${intentLogLanguageParagraph(language)}
 
 1. **Write intent first**, before modifying, creating, or deleting files, or
    making any other non-Git change that may need a rollback:
-   \`driftseal begin "<what this round will accomplish>" --verify "<command or check that proves it>"\`.
+   \`driftseal begin "<what this round will accomplish>" --accept "<observable outcome>" --verify "<exact command that proves it>"\`.
+   Repeat \`--accept\` when completion has multiple independently observable criteria.
    Add one \`--decision <id>\` for each existing decision this round may change.
    Git operations never need an intent and are not included in the intent log;
    Git maintains their history. This includes inspection, branch and worktree
@@ -1649,8 +1892,17 @@ ${intentLogLanguageParagraph(language)}
    and can be verified on its own.
 2. **Execute only the intent.** Scope change? Close the current intent
    (\`driftseal end -s partial|abandoned -n "<why>"\`) and \`driftseal begin\` a new one.
-3. **Verify, then close**: run the declared verification, then
-   \`driftseal end -s completed|partial|failed|abandoned -n "<what happened>" -r "<what the verification showed, written for the next agent>"\`.
+3. **Reconcile, verify, then close**: for a linked intent, first reconcile every
+   declared decision as described below. For an acceptance-bound intent, inspect the
+   exact command shown by \`driftseal status\`, then run \`driftseal verify\` to execute it
+   and bind its exit status to the current Git-visible workspace contents. A command
+   sourced from the repository intent log is untrusted and requires
+   \`--allow-tracked-command\` after inspection; locally parked commands do not.
+   An intent without \`--accept\` uses its declared check directly. Then run
+   \`driftseal end -s completed|partial|failed|abandoned -n "<what happened>" -r "<optional context for the next agent>"\`.
+   DriftSeal rejects \`completed\` when machine verification failed, never ran, or
+   the workspace changed after it. Ignored files are outside the workspace fingerprint.
+   Outside a Git worktree, only the recorded exit status is available.
    Never report success without closing the intent.
    Before closing a linked intent as \`completed\` or \`partial\`, reconcile every
    declared decision with \`driftseal decision update <id> --status <status> --note "<why>"\`.
@@ -1682,8 +1934,30 @@ Log: \`.intent-log/events.jsonl\` (override with \`$DRIFTSEAL_HOME\`); ${localLo
 ${INTENT_PROTOCOL_END}`;
 }
 
-function previousIntentProtocolBlock(version, language = DEFAULT_LOG_LANGUAGE) {
-  const v11 = intentProtocolBlock(version, language)
+function previousIntentProtocolBlock(version, language = DEFAULT_LOG_LANGUAGE, localLog = false) {
+  const v12 = intentProtocolBlock(version, language, localLog)
+    .replace(
+      '   `driftseal begin "<what this round will accomplish>" --accept "<observable outcome>" --verify "<exact command that proves it>"`.\n' +
+        '   Repeat `--accept` when completion has multiple independently observable criteria.',
+      '   `driftseal begin "<what this round will accomplish>" --verify "<command or check that proves it>"`.'
+    )
+    .replace(
+      '3. **Reconcile, verify, then close**: for a linked intent, first reconcile every\n' +
+        '   declared decision as described below. For an acceptance-bound intent, inspect the\n' +
+        '   exact command shown by `driftseal status`, then run `driftseal verify` to execute it\n' +
+        '   and bind its exit status to the current Git-visible workspace contents. A command\n' +
+        '   sourced from the repository intent log is untrusted and requires\n' +
+        '   `--allow-tracked-command` after inspection; locally parked commands do not.\n' +
+        '   An intent without `--accept` uses its declared check directly. Then run\n' +
+        '   `driftseal end -s completed|partial|failed|abandoned -n "<what happened>" -r "<optional context for the next agent>"`.\n' +
+        '   DriftSeal rejects `completed` when machine verification failed, never ran, or\n' +
+        '   the workspace changed after it. Ignored files are outside the workspace fingerprint.\n' +
+        '   Outside a Git worktree, only the recorded exit status is available.',
+      '3. **Verify, then close**: run the declared verification, then\n' +
+        '   `driftseal end -s completed|partial|failed|abandoned -n "<what happened>" -r "<what the verification showed, written for the next agent>"`.'
+    );
+  if (version >= 12) return v12;
+  const v11 = v12
     .replace(
       '-r "<what the verification showed, written for the next agent>"',
       '-r "<verify output>"'
@@ -1876,9 +2150,9 @@ When an intent declares an existing decision with \`--decision <id>\`, use
 Commit \`.decision-log/\` with the code.`;
 }
 
-function previousDecisionProtocolBlock(version, language = DEFAULT_LOG_LANGUAGE) {
-  if (version >= 11) return decisionProtocolBlock(version, language);
-  const v10 = stripDecisionLogLanguage(decisionProtocolBlock(version, language), language);
+function previousDecisionProtocolBlock(version, language = DEFAULT_LOG_LANGUAGE, localLog = false) {
+  if (version >= 11) return decisionProtocolBlock(version, language, localLog);
+  const v10 = stripDecisionLogLanguage(decisionProtocolBlock(version, language, localLog), language);
   if (version >= 9) return v10;
   const v8 = v10.replace(
     '\nAfter a merge, colliding decision ids are remapped with `driftseal absorb`;\n' +
@@ -2627,16 +2901,21 @@ function hookReminder(event, { readOnly = false } = {}) {
   if (event === 'prompt') {
     return (
       'DriftSeal reminder: if this round will modify files or anything else that may need a ' +
-      'rollback, begin an intent first: driftseal begin "<intent>" --verify "<check>". ' +
+      'rollback, begin an intent first: driftseal begin "<intent>" --accept "<observable outcome>" ' +
+      '--verify "<command>". ' +
       'Questions, read-only exploration, and single-step checks need no intent — skip this ' +
       'reminder when it does not apply.'
     );
   }
   const open = openIntent(fold(readEvents({ file, readOnly })));
   if (open) {
+    const reconciliation = open.decisions.length > 0 ? 'reconcile every linked decision, then ' : '';
+    const verification = open.acceptance.length > 0
+      ? `${reconciliation}inspect and run driftseal verify, then close it with driftseal end`
+      : `${reconciliation}run the declared verification, then close it with driftseal end`;
     return (
       `DriftSeal reminder: intent ${open.id} is still in_progress: "${open.intent}". ` +
-      'If its work is done, run the declared verification and close it with driftseal end; ' +
+      `If its work is done, ${verification}; ` +
       'if this turn was unrelated, ignore this reminder.'
     );
   }
@@ -2711,6 +2990,72 @@ function isGitWorkTree(cwd = process.cwd()) {
   return gitCapture(['rev-parse', '--is-inside-work-tree'], cwd) === 'true';
 }
 
+/**
+ * Hash the material Git-visible workspace contents rather than trusting the
+ * current commit alone. Any tracked or untracked (non-ignored) content change
+ * makes the verification stale.
+ * The intent event log is excluded because recording verification and closure
+ * necessarily appends to it.
+ */
+function workspaceFingerprint(cwd = process.cwd()) {
+  if (!isGitWorkTree(cwd)) return null;
+  const root = gitCaptureLine(['rev-parse', '--show-toplevel'], cwd);
+  if (!root) return null;
+  const listing = gitCaptureRaw(
+    ['ls-files', '-z', '--cached', '--others', '--exclude-standard'],
+    root
+  );
+  if (listing === null) return null;
+
+  const excludedFile = path.resolve(logFile());
+  const excludedLockPrefixes = [logDir(), decisionDir()].map((directory) =>
+    path.resolve(directory, '.driftseal.lock')
+  );
+  const files = [...new Set(listing.split('\0').filter(Boolean))].sort();
+  const hash = crypto.createHash('sha256');
+  for (const relative of files) {
+    const target = path.resolve(root, relative);
+    if (
+      target === excludedFile ||
+      excludedLockPrefixes.some(
+        (prefix) => target === prefix || target.startsWith(`${prefix}${path.sep}`) || target.startsWith(`${prefix}.stale.`)
+      )
+    ) {
+      continue;
+    }
+    hash.update(relative, 'utf8');
+    hash.update('\0');
+    let stat;
+    try {
+      stat = fs.lstatSync(target);
+    } catch (err) {
+      if (err.code === 'ENOENT') {
+        hash.update('missing\0');
+        continue;
+      }
+      throw err;
+    }
+    hash.update(String(stat.mode & 0o111));
+    hash.update('\0');
+    if (stat.isSymbolicLink()) {
+      hash.update('symlink\0');
+      hash.update(fs.readlinkSync(target));
+    } else if (stat.isFile()) {
+      hash.update('file\0');
+      hash.update(fs.readFileSync(target));
+    } else if (stat.isDirectory()) {
+      hash.update('directory\0');
+      hash.update(gitCapture(['rev-parse', 'HEAD'], target) || 'no-head');
+      hash.update('\0');
+      hash.update(gitCaptureRaw(['status', '--porcelain=v1', '-z'], target) || '');
+    } else {
+      hash.update('other\0');
+    }
+    hash.update('\0');
+  }
+  return hash.digest('hex');
+}
+
 /**
  * Warn (without mutating the index or .gitignore) when local log mode is on
  * but the default log paths are still tracked by git. The log directories are
@@ -3577,9 +3922,173 @@ function absorbGit(baseFile, oursFile, theirsFile, { abandon, dryRun }) {
   });
 }
 
+function appendVerificationSpawnError(file, error) {
+  const stat = fs.statSync(file);
+  let prefix = '';
+  if (stat.size > 0) {
+    const fd = fs.openSync(file, 'r');
+    const lastByte = Buffer.alloc(1);
+    try {
+      fs.readSync(fd, lastByte, 0, 1, stat.size - 1);
+    } finally {
+      fs.closeSync(fd);
+    }
+    if (lastByte[0] !== 0x0a) prefix = '\n';
+  }
+  fs.appendFileSync(file, `${prefix}${error.message}\n`, 'utf8');
+}
+
+function digestAndReplayVerificationOutput(file, writer, hash) {
+  const fd = fs.openSync(file, 'r');
+  const decoder = new StringDecoder('utf8');
+  const buffer = Buffer.allocUnsafe(VERIFICATION_OUTPUT_CHUNK_BYTES);
+  let bytes = 0;
+  let lastCharacter = null;
+
+  const display = (text) => {
+    if (!text) return;
+    writer(text);
+    lastCharacter = text.at(-1);
+  };
+
+  try {
+    while (true) {
+      const count = fs.readSync(fd, buffer, 0, buffer.length, null);
+      if (count === 0) break;
+      const chunk = buffer.subarray(0, count);
+      hash.update(chunk);
+      bytes += count;
+      display(decoder.write(chunk));
+    }
+    display(decoder.end());
+  } finally {
+    fs.closeSync(fd);
+  }
+
+  return { bytes, endsWithNewline: lastCharacter === '\n' };
+}
+
+function executeVerificationCommand(command) {
+  const spool = fs.mkdtempSync(path.join(os.tmpdir(), 'driftseal-verify-'));
+  const stdoutFile = path.join(spool, 'stdout');
+  const stderrFile = path.join(spool, 'stderr');
+  let stdoutFd;
+  let stderrFd;
+
+  try {
+    stdoutFd = fs.openSync(stdoutFile, 'wx', 0o600);
+    stderrFd = fs.openSync(stderrFile, 'wx', 0o600);
+    const started = process.hrtime.bigint();
+    let result;
+    try {
+      result = spawnSync(command, {
+        cwd: process.cwd(),
+        env: process.env,
+        shell: true,
+        stdio: ['ignore', stdoutFd, stderrFd],
+      });
+    } finally {
+      fs.closeSync(stdoutFd);
+      stdoutFd = undefined;
+      fs.closeSync(stderrFd);
+      stderrFd = undefined;
+    }
+    const durationMs = Number((process.hrtime.bigint() - started) / 1000000n);
+    if (result.error) appendVerificationSpawnError(stderrFile, result.error);
+
+    const hash = crypto.createHash('sha256');
+    const stdout = digestAndReplayVerificationOutput(stdoutFile, writeOutput, hash);
+    if (stdout.bytes > 0 && !stdout.endsWithNewline) printLine();
+    hash.update('\0');
+    const stderr = digestAndReplayVerificationOutput(stderrFile, writeErrorOutput, hash);
+    if (stderr.bytes > 0 && !stderr.endsWithNewline) printError();
+
+    return {
+      result,
+      durationMs,
+      outputHash: hash.digest('hex'),
+      stdoutBytes: stdout.bytes,
+      stderrBytes: stderr.bytes,
+    };
+  } finally {
+    if (stdoutFd !== undefined) fs.closeSync(stdoutFd);
+    if (stderrFd !== undefined) fs.closeSync(stderrFd);
+    fs.rmSync(spool, { recursive: true, force: true });
+  }
+}
+
+function runMachineVerification({ allowTrackedCommand = false } = {}) {
+  const snapshot = withMutationLocks([logDir()], () => {
+    const intent = openIntent(fold(readEvents({ repairTail: true })));
+    if (!intent) fail('no intent in progress; nothing to verify');
+    if (intent.acceptance.length === 0) {
+      fail(`intent ${intent.id} has no acceptance criteria; declare them with driftseal begin --accept`);
+    }
+    if (!intent.verify) fail(`intent ${intent.id} has no verification command`);
+    const park = inProgressFile();
+    const parked = park ? parkedOpenIntent(park) : null;
+    const locallyProvenanced = hasMatchingLocalIntentProvenance(intent);
+    return {
+      id: intent.id,
+      command: intent.verify,
+      requiresExplicitTrust:
+        (!parked || parked.id !== intent.id) && !locallyProvenanced,
+    };
+  });
+
+  const displayedCommand = JSON.stringify(snapshot.command);
+  printError(`verification command: ${displayedCommand}`);
+  if (snapshot.requiresExplicitTrust && !allowTrackedCommand) {
+    fail(
+      `refusing to execute a verification command that DriftSeal cannot confirm was created locally: ${displayedCommand}\n` +
+        'no matching local intent provenance was found; ' +
+        'inspect the command, then re-run with --allow-tracked-command only if you trust it'
+    );
+  }
+
+  const execution = executeVerificationCommand(snapshot.command);
+  const { result, durationMs, outputHash, stdoutBytes, stderrBytes } = execution;
+  const exitCode = Number.isInteger(result.status) ? result.status : 1;
+  const signal = typeof result.signal === 'string' ? result.signal : null;
+  const passed = exitCode === 0 && signal === null;
+  const verificationEvent = {
+    type: 'verify',
+    id: snapshot.id,
+    verificationId: crypto.randomUUID(),
+    ts: new Date().toISOString(),
+    command: snapshot.command,
+    passed,
+    exitCode,
+    signal,
+    durationMs,
+    outputHash,
+    stdoutBytes,
+    stderrBytes,
+    workspace: workspaceFingerprint(),
+    head: gitCapture(['rev-parse', 'HEAD']),
+  };
+
+  const intent = withMutationLocks([logDir()], () => {
+    const events = readEvents({ repairTail: true });
+    const current = openIntent(fold(events));
+    if (!current || current.id !== snapshot.id || current.verify !== snapshot.command) {
+      fail(`intent ${snapshot.id} changed while its verification command was running`);
+    }
+    events.push(appendEvent(verificationEvent));
+    return fold(events).find((candidate) => candidate.id === snapshot.id);
+  });
+  printLine(`${snapshot.id} verification ${passed ? 'passed' : 'failed'} (exit ${exitCode})`);
+  return {
+    intent: publicIntent(intent),
+    verification: publicVerification(intent.verification),
+    exitCode,
+  };
+}
+
 const commands = {
   begin(argv) {
     const { positionals, flags } = parseArgs(argv, {
+      accept: 'multiple',
       verify: '-v',
       decision: 'multiple',
       force: 'boolean',
@@ -3588,6 +4097,13 @@ const commands = {
     if (!intent) {
       fail(usageFor('begin'));
     }
+    const acceptance = [...new Set((flags.accept || []).map((criterion) => criterion.trim()))];
+    if (acceptance.some((criterion) => criterion.length === 0)) {
+      fail('--accept requires a non-empty observable outcome');
+    }
+    if (acceptance.length > 0 && (!flags.verify || flags.verify.trim().length === 0)) {
+      fail('--accept requires --verify with the exact machine verification command');
+    }
     const requestedDecisions = flags.decision || [];
     const index = requestedDecisions.length > 0 ? decisionIndex() : [];
     const decisions = [
@@ -3628,6 +4144,7 @@ const commands = {
       id,
       ts: new Date().toISOString(),
       intent,
+      acceptance,
       verify: flags.verify || null,
       decisions,
       head: gitCapture(['rev-parse', 'HEAD']),
@@ -3637,6 +4154,16 @@ const commands = {
     return publicIntent(record);
   },
 
+  verify(argv) {
+    const { positionals, flags } = parseArgs(
+      argv,
+      { 'allow-tracked-command': 'boolean' },
+      'verify'
+    );
+    if (positionals.length > 0) fail(usageFor('verify'));
+    return runMachineVerification({ allowTrackedCommand: flags['allow-tracked-command'] === true });
+  },
+
   end(argv) {
     const { positionals, flags } = parseArgs(argv, {
       status: '-s',
@@ -3661,6 +4188,25 @@ const commands = {
       if (!target) fail('no intent in progress; nothing to end');
     }
 
+    let completionWorkspace = null;
+    let completionVerificationId = null;
+    if (status === 'completed' && target.acceptance.length > 0) {
+      if (!target.verification || !target.verification.passed) {
+        fail(
+          `cannot complete acceptance-bound intent ${target.id} without successful machine verification; ` +
+            'run: driftseal verify'
+        );
+      }
+      completionWorkspace = workspaceFingerprint();
+      if (completionWorkspace !== target.verification.workspace) {
+        fail(
+          `cannot complete acceptance-bound intent ${target.id}: workspace changed after machine verification; ` +
+            'run: driftseal verify'
+        );
+      }
+      completionVerificationId = target.verification.verificationId;
+    }
+
     if (['failed', 'abandoned'].includes(status)) {
       const terminalStatus = closeIntentAsEscape(
         events,
@@ -3715,6 +4261,8 @@ const commands = {
       status,
       note: flags.note || null,
       verifyResult: flags['verify-result'] || null,
+      verificationId: completionVerificationId,
+      workspace: completionWorkspace,
       head: gitCapture(['rev-parse', 'HEAD']),
     }));
     const record = fold(events).find((candidate) => candidate.id === target.id);
@@ -4059,7 +4607,10 @@ const commands = {
       knownManagedBlocks: [
         ...sourceLanguages.flatMap((source) => [
           protocolEol(intentProtocolBlock(PROTOCOL_VERSION, source), eol),
+          protocolEol(previousIntentProtocolBlock(12, source), eol),
+          protocolEol(previousIntentProtocolBlock(12, source, true), eol),
           protocolEol(previousIntentProtocolBlock(11, source), eol),
+          protocolEol(previousIntentProtocolBlock(11, source, true), eol),
         ]),
         protocolEol(previousIntentProtocolBlock(2), eol),
         protocolEol(previousIntentProtocolBlock(3), eol),
@@ -4083,7 +4634,10 @@ const commands = {
       knownManagedBlocks: [
         ...sourceLanguages.flatMap((source) => [
           protocolEol(decisionProtocolBlock(PROTOCOL_VERSION, source), eol),
+          protocolEol(previousDecisionProtocolBlock(12, source), eol),
+          protocolEol(previousDecisionProtocolBlock(12, source, true), eol),
           protocolEol(previousDecisionProtocolBlock(11, source), eol),
+          protocolEol(previousDecisionProtocolBlock(11, source, true), eol),
         ]),
         protocolEol(previousDecisionProtocolBlock(2), eol),
         protocolEol(previousDecisionProtocolBlock(3), eol),
@@ -4146,7 +4700,11 @@ const commands = {
 Intent-level write-ahead log for agent sessions.
 
 usage:
-  driftseal begin "<intent>" [--verify "<how to verify>"] [--decision <id>] [--force]
+  driftseal begin "<intent>" [--accept "<observable outcome>"] [--verify "<command>"]
+                 [--decision <id>] [--force]
+  driftseal verify [--allow-tracked-command]
+                                       run the declared command and bind its result
+                                       to the current Git-visible workspace contents
   driftseal end [id] [--status completed|partial|failed|abandoned] [--note "..."] [--verify-result "..."]
   driftseal status                     show the intent currently in progress (re-anchor after drift)
   driftseal log [--last N] [--all]     show intent history (--all includes reclaimed records)
@@ -4214,7 +4772,7 @@ function requestedEndStatus(argv) {
  * subcommand, mirroring the value-taking entries of each parseArgs spec.
  */
 const VALUE_TAKING_FLAGS = {
-  begin: ['--verify', '-v', '--decision'],
+  begin: ['--accept', '--verify', '-v', '--decision'],
   end: ['--status', '-s', '--note', '-n', '--verify-result', '-r'],
   log: ['--last', '-n'],
   reclaim: ['--reason', '-r', '--older-than'],
@@ -4319,7 +4877,11 @@ function dispatch(argv) {
       const data = withMutationLocks(resources, () => fn(rest));
       return { data, exitCode: data && Number.isInteger(data.exitCode) ? data.exitCode : 0 };
     }
-    return { data: fn(rest), exitCode: 0 };
+    const data = fn(rest);
+    return {
+      data,
+      exitCode: data && Number.isInteger(data.exitCode) ? data.exitCode : 0,
+    };
   } catch (err) {
     if (err instanceof HelpRequested) {
       printLine(usageFor(err.usageKey) || usageFor(cmd) || 'run: driftseal help');
@@ -4355,7 +4917,15 @@ function runCommand(argv, { root = process.cwd(), isolateStorage = false, captur
   const previousIntentHome = process.env.DRIFTSEAL_HOME;
   const previousDecisionHome = process.env.DRIFTSEAL_DECISION_HOME;
   const output = { stdout: '', stderr: '', data: null, exitCode: 0, readOnly: false };
+  const captures = capture
+    ? { stdout: createBoundedOutputCapture(), stderr: createBoundedOutputCapture() }
+    : null;
   const previousOutput = activeOutput;
+  const finalizeCapturedOutput = () => {
+    if (!captures) return;
+    output.stdout = renderBoundedOutput(captures.stdout);
+    output.stderr = renderBoundedOutput(captures.stderr);
+  };
 
   try {
     process.chdir(fixedRoot);
@@ -4363,14 +4933,16 @@ function runCommand(argv, { root = process.cwd(), isolateStorage = false, captur
       delete process.env.DRIFTSEAL_HOME;
       delete process.env.DRIFTSEAL_DECISION_HOME;
     }
-    if (capture) activeOutput = output;
+    if (capture) activeOutput = captures;
     const result = dispatch(argv);
     output.data = result.data;
     output.exitCode = result.exitCode;
     output.readOnly = result.readOnly === true;
+    finalizeCapturedOutput();
     return output;
   } catch (err) {
     if (capture) {
+      finalizeCapturedOutput();
       err.stdout = output.stdout;
       err.stderr = output.stderr;
     }
@@ -4406,13 +4978,17 @@ function createApi({ root = process.cwd(), isolateStorage = false } = {}) {
     status() {
       return call(['status']);
     },
-    begin({ intent, verify, decisions = [], force = false }) {
+    begin({ intent, acceptance = [], verify, decisions = [], force = false }) {
       const argv = ['begin', intent];
+      for (const criterion of acceptance) appendFlag(argv, '--accept', criterion);
       appendFlag(argv, '--verify', verify);
       for (const decision of decisions) appendFlag(argv, '--decision', decision);
       if (force) argv.push('--force');
       return call(argv);
     },
+    verify({ allowTrackedCommand = false } = {}) {
+      return call(['verify', ...(allowTrackedCommand ? ['--allow-tracked-command'] : [])]);
+    },
     end({ id, status, note, verifyResult } = {}) {
       const argv = ['end'];
       if (id) argv.push(String(id));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "driftseal",
-  "version": "1.2.1",
+  "version": "1.3.2",
   "description": "Seal intent, verification, and decisions into an auditable workflow for agentic coding",
   "keywords": [
     "driftseal",