driftseal 1.3.0 → 1.4.0

package/README.md

@@ -210,17 +210,28 @@ driftseal verify
 `driftseal verify` passes the exact stored string to the operating-system shell.
 The command can therefore read or modify files, access the network, or run any
 other program available to the current user. Treat it as executable code, not as
-passive log data. A locally created open intent is parked in Git metadata and runs
-normally. If the open intent came from the repository's tracked intent log,
-DriftSeal prints the command to stderr and refuses to execute it until you inspect
-it and explicitly run `driftseal verify --allow-tracked-command`. The programmatic
-API and MCP tool expose the equivalent `allowTrackedCommand` opt-in.
+passive log data. DriftSeal records local provenance when an intent is opened:
+the default Git workflow parks the intent in Git metadata, while non-Git and
+custom `DRIFTSEAL_HOME` workflows keep a small local marker outside the intent
+log. Those locally created intents run normally. If an open intent arrives only
+through an intent log, without matching local provenance, DriftSeal cannot confirm
+who chose its command. It prints the command to stderr and refuses to execute it
+until you inspect it and explicitly run
+`driftseal verify --allow-tracked-command`. The programmatic API and MCP tool
+expose the equivalent `allowTrackedCommand` opt-in. Local provenance state is
+removed when the intent closes. Non-Git markers are bound to the local log
+file's identity, so copying a marker with the log does not transfer trust. If
+local provenance is lost or no longer matches, verification fails safe and
+requires the same explicit opt-in.
 
 The verification event records the command's exit status, duration, output
 digest and byte counts, Git HEAD, and a fingerprint of every tracked or
 untracked non-ignored workspace file except the intent event log. A successful
 result becomes stale if those workspace contents change. DriftSeal therefore
 rejects `completed` until the command passes again on the current workspace.
+Command output is spooled to temporary files instead of a fixed in-memory
+buffer, then replayed after the command exits and removed. Output size therefore
+has no DriftSeal-defined limit, though it remains bounded by available disk space.
 Ignored files are deliberately outside this fingerprint. Outside a Git
 worktree the fingerprint is unavailable, so the gate proves only the command's
 recorded exit status and cannot detect later content changes.
@@ -240,22 +251,39 @@ driftseal end \
 
 If the scope changes, close the current intent as `partial` or `abandoned`, then start a new one. After context loss, use `driftseal status` and `driftseal log --last 3` to re-anchor.
 
-Git operations are entirely outside the intent log because Git maintains their
-history. Inspection, branch and worktree management, staging, commits, merges,
-rebases, cherry-picks, tags, and pushes never need an intent of their own. They
-still require normal authorization and safety checks. A command whose result
-can be reconstructed from Git state, such as a patch file regenerated from a
-commit range or a scratch harness that re-runs, needs no intent either; content
-that will be committed and cannot be reconstructed, such as a `.gitignore`
-edit, does. Single-step builds and checks, such as compiling or running tests,
-also need no intent. Any other non-Git content change starts a new work round.
+Record an intent for changes intended to persist in the project: edits to code,
+configuration, documentation, dependencies, and equivalent project files. The
+boundary does not depend on Git: inside a worktree it includes content intended
+for commit, while outside Git it includes durable project files. Everything else
+is exempt. Git operations are entirely outside the intent log because Git
+maintains their history; inspection, branch and worktree management, staging,
+commits, merges, rebases, cherry-picks, tags, and pushes never need an intent of
+their own, though they still require normal authorization and safety checks.
+Single-step builds and checks, such as compiling or running tests, need no
+intent. Auxiliary file or shell operations whose results remain outside durable
+project content — an `rsync` scratch copy, temp scaffolding — need none either.
+State changes to a remote machine or the local environment are also exempt when
+they do not write durable project content into this workspace. When an external
+operation does bring durable content into the project, record the intent for
+that project-content change, not for the external operation itself.
+
+In multi-agent work the scope belongs to the worktree, not the writer. One
+worktree holds one open intent; every agent or subagent changing durable project
+content there re-anchors and continues that matching intent. Agents in separate
+worktrees hold separate intents. A configured project root outside Git follows
+the same single-intent rule. An agent that only receives another agent's changes
+through Git or into a shared worktree records no receiving intent and lets
+`verify` expose misalignment. Handoff files are exempt while ignored or
+otherwise kept outside durable project content and require an intent when
+promoted into it. Taking over work in the same root is a re-anchor, not a
+boundary: resume the open intent when its objective still matches the task.
 
 ## Commands
 
 | Command | Purpose |
 | --- | --- |
 | `driftseal begin "<intent>" [--accept "<outcome>"] [-v "<command>"] [--decision id] [--force]` | Open a work-round intent. Repeat `--accept` for observable completion criteria; acceptance requires a verification command. |
-| `driftseal verify [--allow-tracked-command]` | Execute the acceptance-bound intent's predeclared command and bind machine evidence to the current Git-visible workspace contents. Commands sourced from the tracked intent log require the explicit opt-in. |
+| `driftseal verify [--allow-tracked-command]` | Execute the acceptance-bound intent's predeclared command and bind machine evidence to the current Git-visible workspace contents. Commands without matching local provenance require the explicit opt-in. |
 | `driftseal end [id] [-s status] [-n note] [-r verify-result]` | Close an intent honestly. |
 | `driftseal status` | Show the intent currently in progress. |
 | `driftseal log [-n N] [--all]` | Review intent history (`--all` includes reclaimed records). |

package/README.zh-CN.md

@@ -199,16 +199,23 @@ driftseal verify
 
 `driftseal verify` 会把日志中保存的完整字符串交给操作系统 shell。这个命令可以
 读写文件、访问网络，也可以运行当前用户有权执行的任何程序；因此它是可执行代码，
-不是被动的日志数据。当前 worktree 本地创建的 open intent 会 park 在 Git metadata
-中，可以直接运行。如果 open intent 来自 repository 中被跟踪的 intent log，
-DriftSeal 会先把命令输出到 stderr，并拒绝执行；只有检查并信任该命令后，才能显式
-运行 `driftseal verify --allow-tracked-command`。Programmatic API 和 MCP tool 中对应的
-显式开关是 `allowTrackedCommand`。
+不是被动的日志数据。创建 intent 时，DriftSeal 会记录本地 provenance：默认 Git
+流程把 open intent park 在 Git metadata 中；非 Git 环境和自定义
+`DRIFTSEAL_HOME` 则在 intent log 之外保存一个很小的本地标记。这些本地创建的
+intent 可以直接验证。如果 open intent 只有 log 记录、没有匹配的本地 provenance，
+DriftSeal 就无法确认是谁选择了其中的命令。此时它会先把命令输出到 stderr 并拒绝
+执行；只有检查并信任该命令后，才能显式运行
+`driftseal verify --allow-tracked-command`。Programmatic API 和 MCP tool 中对应的显式
+开关是 `allowTrackedCommand`。intent 关闭时，本地 provenance 会被清理；如果它提前
+丢失，DriftSeal 会按安全方向处理，仍要求显式 opt in。非 Git marker 还会绑定本地
+log 文件的 identity，因此把 marker 和 log 一起复制到别处也不会转移信任。
 
 验证事件会记录 exit status、耗时、输出摘要及字节数、Git HEAD，以及当前所有
 tracked 和未被 ignore 的 untracked 文件的内容指纹（intent event log 除外）。
 验证后只要这些内容发生变化，成功证据就会过期，必须重新运行；否则 DriftSeal
-会拒绝把 intent 关闭为 `completed`。被 ignore 的文件不在指纹范围内。
+会拒绝把 intent 关闭为 `completed`。命令输出会先写入临时 spool 文件，而不是
+受固定大小的内存 buffer 限制；命令退出后再回放并删除。因此 DriftSeal 不再限制
+输出大小，但实际容量仍受可用磁盘空间约束。被 ignore 的文件不在指纹范围内。
 如果当前目录不是 Git worktree，指纹不可用；此时 gate 只能证明记录到的 exit
 status，无法发现之后发生的内容变化。
 
@@ -228,19 +235,30 @@ driftseal end \
 
 如果范围发生变化，先把当前 intent 以 `partial` 或 `abandoned` 关闭，再开启新的 intent。发生 context loss 后，用 `driftseal status` 和 `driftseal log --last 3` 重新锚定当前目标。
 
-Git 操作完全不计入 intent log，因为 Git 会自行维护历史。查看状态、管理 branch
-或 worktree、stage、commit、merge、rebase、cherry-pick、tag 和 push 都不需要
-单独开启 intent，但仍须遵守正常的授权与安全要求。结果能从 Git 状态重建的命令
-——比如从 commit range 重新生成的 patch 文件、可以重跑的临时 harness——也不需要
-intent；会被提交且无法重建的内容改动（比如编辑 `.gitignore`）则需要。编译、跑测试
-等单步构建或检查同样不需要 intent；除此之外的非 Git 内容改动，都要开启新一轮。
+需要记录 intent 的是准备作为项目内容长期保留的改动，包括代码、配置、文档、依赖及同类
+项目文件。这个边界不取决于 Git：在 worktree 中，它包括准备提交的内容；在非 Git 项目中，
+它包括要长期保留的项目文件。其余操作一律免记。Git 会自行维护操作历史，因此查看状态、
+管理 branch 或 worktree、stage、commit、merge、rebase、cherry-pick、tag 和 push 都
+不需要单独开启 intent，但仍须遵守正常的授权与安全要求。编译、跑测试等单步构建或检查也
+不需要 intent。结果不会成为持久项目内容的辅助文件或 shell 操作——比如 `rsync` 临时拷贝、
+临时脚手架——同样免记。远程机器或本机环境的状态变更，只要不把持久项目内容写入当前
+workspace，也不属于 intent log；如果外部操作确实把持久内容带进项目，记录的是落入项目的
+内容改动，而不是外部操作本身。
+
+多 agent 协作时，intent 的作用域属于 worktree，而不是写入者。一个 worktree 只能有一个
+open intent；在那里改动持久项目内容的所有 agent 和 subagent 都要先重新锚定，再继续同一个
+匹配的 intent。不同 worktree 各自持有 intent；非 Git 项目的 configured root 同样只持有
+一个。只通过 Git 或共享 worktree 接收其他 agent 变更的一方不另记 receiving intent，交给
+`verify` 暴露不一致。handoff 文件在被 ignore 或以其他方式排除在持久项目内容之外时免记，
+一旦转为正式项目内容就需要 intent。在同一个 root 中途接手工作属于重新锚定而非边界：目标
+仍然匹配就继续沿用 open intent。
 
 ## 命令速览
 
 | Command | 用途 |
 | --- | --- |
 | `driftseal begin "<intent>" [--accept "<outcome>"] [-v "<command>"] [--decision id] [--force]` | 开启一轮工作。可重复使用 `--accept` 声明可观察的完成条件；一旦声明，就必须同时提供验证命令。 |
-| `driftseal verify [--allow-tracked-command]` | 执行 acceptance-bound intent 预先声明的命令，并把机器证据绑定到当前 Git 可见的工作区内容；来自 tracked intent log 的命令必须显式 opt in。 |
+| `driftseal verify [--allow-tracked-command]` | 执行 acceptance-bound intent 预先声明的命令，并把机器证据绑定到当前 Git 可见的工作区内容；没有匹配本地 provenance 的命令必须显式 opt in。 |
 | `driftseal end [id] [-s status] [-n note] [-r verify-result]` | 诚实地关闭 intent。 |
 | `driftseal status` | 查看当前进行中的 intent。 |
 | `driftseal log [-n N] [--all]` | 查看 intent 历史（`--all` 包含已回收的记录）。 |

package/bin/driftseal.js

@@ -27,6 +27,7 @@ const path = require('path');
 const crypto = require('crypto');
 const os = require('os');
 const { isDeepStrictEqual } = require('util');
+const { StringDecoder } = require('string_decoder');
 const { execFileSync, spawnSync } = require('child_process');
 const { version: PACKAGE_VERSION } = require('../package.json');
 
@@ -40,7 +41,7 @@ const DECISION_STATUSES = [
   'superseded',
 ];
 const EVENT_SCHEMA_VERSION = 4;
-const PROTOCOL_VERSION = 13;
+const PROTOCOL_VERSION = 14;
 const DEFAULT_LOG_LANGUAGE = 'en';
 const IN_PROGRESS_GIT_PATH = 'driftseal-in-progress.jsonl';
 const LOCK_STALE_MS = 30 * 60 * 1000;
@@ -48,6 +49,10 @@ const LOCK_INIT_STALE_MS = 5 * 1000;
 const READ_ONLY_NOTICE = '(read-only: another mutation holds the lock; tail repair skipped)';
 const READ_ONLY_LOCK_WAIT_MS = Number(process.env._DRIFTSEAL_TEST_READ_ONLY_LOCK_WAIT_MS) || 1500;
 const MAX_DECISION_SLUG_LENGTH = 180;
+const VERIFICATION_OUTPUT_CHUNK_BYTES = 64 * 1024;
+const CAPTURE_OUTPUT_EDGE_CHARACTERS = 32 * 1024;
+const CAPTURE_OUTPUT_OMISSION = '\n... [driftseal captured output truncated] ...\n';
+const LOCAL_INTENT_PROVENANCE_FILE = '.driftseal-local-intent.json';
 
 class DriftSealError extends Error {
   constructor(message) {
@@ -98,39 +103,70 @@ function usageFor(key) {
 
 let activeOutput = null;
 
+function createBoundedOutputCapture() {
+  return { head: '', tail: '', length: 0, headComplete: false };
+}
+
+function splitsSurrogatePair(text, index) {
+  if (index <= 0 || index >= text.length) return false;
+  const before = text.charCodeAt(index - 1);
+  const after = text.charCodeAt(index);
+  return before >= 0xd800 && before <= 0xdbff && after >= 0xdc00 && after <= 0xdfff;
+}
+
+function appendBoundedOutput(capture, value) {
+  let text = String(value);
+  capture.length += text.length;
+
+  if (!capture.headComplete) {
+    let take = Math.min(CAPTURE_OUTPUT_EDGE_CHARACTERS - capture.head.length, text.length);
+    if (splitsSurrogatePair(text, take)) take -= 1;
+    capture.head += text.slice(0, take);
+    text = text.slice(take);
+    if (text.length > 0) capture.headComplete = true;
+  }
+
+  if (text.length === 0) return;
+  const combined = capture.tail + text;
+  let start = Math.max(0, combined.length - CAPTURE_OUTPUT_EDGE_CHARACTERS);
+  if (splitsSurrogatePair(combined, start)) start += 1;
+  capture.tail = combined.slice(start);
+}
+
+function renderBoundedOutput(capture) {
+  if (capture.length === capture.head.length + capture.tail.length) {
+    return capture.head + capture.tail;
+  }
+  return capture.head + CAPTURE_OUTPUT_OMISSION + capture.tail;
+}
+
+function captureOutput(stream, value) {
+  if (!activeOutput) return false;
+  appendBoundedOutput(activeOutput[stream], value);
+  return true;
+}
+
 function printLine(value = '') {
   const text = String(value);
-  if (activeOutput) {
-    activeOutput.stdout += text + '\n';
-    return;
-  }
+  if (captureOutput('stdout', text + '\n')) return;
   console.log(text);
 }
 
 function printError(value = '') {
   const text = String(value);
-  if (activeOutput) {
-    activeOutput.stderr += text + '\n';
-    return;
-  }
+  if (captureOutput('stderr', text + '\n')) return;
   console.error(text);
 }
 
 function writeOutput(value) {
   const text = String(value);
-  if (activeOutput) {
-    activeOutput.stdout += text;
-    return;
-  }
+  if (captureOutput('stdout', text)) return;
   process.stdout.write(text);
 }
 
 function writeErrorOutput(value) {
   const text = String(value);
-  if (activeOutput) {
-    activeOutput.stderr += text;
-    return;
-  }
+  if (captureOutput('stderr', text)) return;
   process.stderr.write(text);
 }
 
@@ -569,7 +605,12 @@ function parkedOpenIntent(park) {
 
 function appendEvent(event) {
   const park = inProgressFile();
-  if (!park) return appendEventTo(logFile(), event);
+  if (!park) {
+    const stored = appendEventTo(logFile(), event);
+    if (event.type === 'begin') writeLocalIntentProvenance(stored);
+    if (event.type === 'end') clearLocalIntentProvenance(event.id);
+    return stored;
+  }
 
   const open = parkedOpenIntent(park);
   // A park with nothing open left in it belongs in the log; an interrupted end retries here.
@@ -591,9 +632,88 @@ function contentHash(content) {
   return crypto.createHash('sha256').update(content, 'utf8').digest('hex');
 }
 
-function atomicWriteFile(target, content) {
+function localIntentProvenanceFile() {
+  const root = gitWorktreeRoot();
+  const key = contentHash(path.resolve(logFile())).slice(0, 16);
+  if (!root) return path.join(logDir(), LOCAL_INTENT_PROVENANCE_FILE);
+  const gitPath = gitCapture(['rev-parse', '--git-path', `driftseal-local-intent-${key}.json`]);
+  return gitPath ? path.resolve(process.cwd(), gitPath) : null;
+}
+
+function localIntentLogIdentity() {
+  try {
+    const stat = fs.statSync(logFile(), { bigint: true });
+    return contentHash(JSON.stringify([String(stat.dev), String(stat.ino), String(stat.birthtimeNs)]));
+  } catch {
+    return null;
+  }
+}
+
+function localIntentProvenanceFingerprint({ id, ts, verify }) {
+  return contentHash(JSON.stringify([id, ts, verify || null]));
+}
+
+function writeLocalIntentProvenance(event) {
+  const file = localIntentProvenanceFile();
+  if (!file) return;
+  ensureDirectoryDurable(path.dirname(file));
+  atomicWriteFile(
+    file,
+    JSON.stringify({
+      version: 1,
+      id: event.id,
+      fingerprint: localIntentProvenanceFingerprint(event),
+      logIdentity: localIntentLogIdentity(),
+    }) + '\n',
+    0o600
+  );
+}
+
+function readLocalIntentProvenance() {
+  const file = localIntentProvenanceFile();
+  if (!file || !fs.existsSync(file)) return null;
+  try {
+    const provenance = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (
+      provenance.version !== 1 ||
+      typeof provenance.id !== 'string' ||
+      !/^[a-f0-9]{64}$/.test(provenance.fingerprint) ||
+      !/^[a-f0-9]{64}$/.test(provenance.logIdentity)
+    ) {
+      return null;
+    }
+    return provenance;
+  } catch {
+    return null;
+  }
+}
+
+function hasMatchingLocalIntentProvenance(intent) {
+  const provenance = readLocalIntentProvenance();
+  return (
+    provenance !== null &&
+    provenance.id === intent.id &&
+    provenance.logIdentity === localIntentLogIdentity() &&
+    provenance.fingerprint ===
+      localIntentProvenanceFingerprint({
+        id: intent.id,
+        ts: intent.tsBegin,
+        verify: intent.verify,
+      })
+  );
+}
+
+function clearLocalIntentProvenance(id) {
+  const file = localIntentProvenanceFile();
+  const provenance = readLocalIntentProvenance();
+  if (!file || !provenance || provenance.id !== id) return;
+  fs.unlinkSync(file);
+  fsyncDirectory(path.dirname(file));
+}
+
+function atomicWriteFile(target, content, createMode = 0o644) {
   const existed = fs.existsSync(target);
-  const mode = existed ? fs.statSync(target).mode & 0o777 : 0o644;
+  const mode = existed ? fs.statSync(target).mode & 0o777 : createMode;
   const temp = path.join(
     path.dirname(target),
     `.${path.basename(target)}.${process.pid}.${crypto.randomUUID()}.tmp`
@@ -1754,20 +1874,31 @@ MCP and lifecycle hooks are optional adapters.
 
 ${intentLogLanguageParagraph(language)}
 
-1. **Write intent first**, before modifying, creating, or deleting files, or
-   making any other non-Git change that may need a rollback:
+1. **Write intent first**, before changing durable project content:
    \`driftseal begin "<what this round will accomplish>" --accept "<observable outcome>" --verify "<exact command that proves it>"\`.
    Repeat \`--accept\` when completion has multiple independently observable criteria.
    Add one \`--decision <id>\` for each existing decision this round may change.
-   Git operations never need an intent and are not included in the intent log;
-   Git maintains their history. This includes inspection, branch and worktree
-   management, staging, commits, merges, rebases, cherry-picks, tags, and pushes.
-   A command whose result can be reconstructed from Git state (for example a
-   patch file regenerated from a commit range, or a scratch harness that
-   re-runs) needs no intent; content that will be committed and cannot be
-   reconstructed (for example a .gitignore edit) does.
-   Single-step commands that only build or check work already done, such as
-   compiling or running tests, also need no intent.
+   Record intents for changes intended to persist in the project: edits to code,
+   configuration, documentation, dependencies, and equivalent project files,
+   whether or not the project is inside a Git worktree. Everything else is
+   exempt: Git operations (Git maintains their history — inspection, branch
+   and worktree management, staging, commits, merges, rebases, cherry-picks,
+   tags, and pushes); single-step commands that only build or check work
+   already done, such as compiling or running tests; auxiliary file or shell
+   operations whose results remain outside durable project content (for example
+   an rsync scratch copy or temp scaffolding); and state changes to a remote
+   machine or the local environment that do not write durable project content
+   into this workspace. When an external operation does bring durable content
+   into the project, record an intent for that project-content change, not for
+   the external operation itself.
+   In multi-agent work, one open intent belongs to one worktree, or to one
+   configured project root outside Git. Every agent or subagent that changes
+   durable project content in the same root first re-anchors and continues its
+   matching open intent; agents working in separate worktrees hold separate
+   intents. An agent that only receives another agent's changes through Git or
+   into a shared worktree records no receiving intent and lets \`verify\` expose
+   misalignment; handoff files are exempt while ignored or otherwise kept
+   outside durable project content and require an intent when promoted into it.
    Size an intent to the smallest unit that leaves the tree self-consistent
    and can be verified on its own.
 2. **Execute only the intent.** Scope change? Close the current intent
@@ -1794,12 +1925,15 @@ ${intentLogLanguageParagraph(language)}
    by the next linked \`decision update\` or successful \`end\`. Closing as
    \`failed\` or \`abandoned\` cancels pending recovery for that intent.
    Git operations remain subject to normal authorization and safety requirements
-   even though they do not require an intent. Any non-Git content change made while
-   preparing a Git operation does require a new intent, per the step 1 test.
+   even though they do not require an intent. Any content change made while
+   preparing a Git operation still requires an intent when it meets the
+   durable-project-content rule in step 1.
 4. **Re-anchor after context loss**: run \`driftseal status\` and \`driftseal log --last 3\` before
    doing anything else. The open intent is the source of truth: resume it when its
    objective still matches the current task; otherwise close it (\`partial\` or
-   \`abandoned\`, with a note) and \`begin\` a new one.
+   \`abandoned\`, with a note) and \`begin\` a new one. Taking over work in the
+   same root from another agent is the same re-anchor: resume the open intent
+   when its objective still matches.
 
 **Log access goes only through DriftSeal.** Never read, edit, move, or delete
 \`.intent-log/events.jsonl\` (or anything under \`$DRIFTSEAL_HOME\`) directly; use
@@ -1815,7 +1949,75 @@ ${INTENT_PROTOCOL_END}`;
 }
 
 function previousIntentProtocolBlock(version, language = DEFAULT_LOG_LANGUAGE, localLog = false) {
-  const v12 = intentProtocolBlock(version, language, localLog)
+  const v13 = intentProtocolBlock(version, language, localLog)
+    .replace(
+      '1. **Write intent first**, before changing durable project content:\n' +
+        '   `driftseal begin "<what this round will accomplish>" --accept "<observable outcome>" --verify "<exact command that proves it>"`.\n' +
+        '   Repeat `--accept` when completion has multiple independently observable criteria.\n' +
+        '   Add one `--decision <id>` for each existing decision this round may change.\n' +
+        '   Record intents for changes intended to persist in the project: edits to code,\n' +
+        '   configuration, documentation, dependencies, and equivalent project files,\n' +
+        '   whether or not the project is inside a Git worktree. Everything else is\n' +
+        '   exempt: Git operations (Git maintains their history — inspection, branch\n' +
+        '   and worktree management, staging, commits, merges, rebases, cherry-picks,\n' +
+        '   tags, and pushes); single-step commands that only build or check work\n' +
+        '   already done, such as compiling or running tests; auxiliary file or shell\n' +
+        '   operations whose results remain outside durable project content (for example\n' +
+        '   an rsync scratch copy or temp scaffolding); and state changes to a remote\n' +
+        '   machine or the local environment that do not write durable project content\n' +
+        '   into this workspace. When an external operation does bring durable content\n' +
+        '   into the project, record an intent for that project-content change, not for\n' +
+        '   the external operation itself.\n' +
+        '   In multi-agent work, one open intent belongs to one worktree, or to one\n' +
+        '   configured project root outside Git. Every agent or subagent that changes\n' +
+        '   durable project content in the same root first re-anchors and continues its\n' +
+        '   matching open intent; agents working in separate worktrees hold separate\n' +
+        "   intents. An agent that only receives another agent's changes through Git or\n" +
+        '   into a shared worktree records no receiving intent and lets `verify` expose\n' +
+        '   misalignment; handoff files are exempt while ignored or otherwise kept\n' +
+        '   outside durable project content and require an intent when promoted into it.\n' +
+        '   Size an intent to the smallest unit that leaves the tree self-consistent\n' +
+        '   and can be verified on its own.',
+      '1. **Write intent first**, before modifying, creating, or deleting files, or\n' +
+        '   making any other non-Git change that may need a rollback:\n' +
+        '   `driftseal begin "<what this round will accomplish>" --accept "<observable outcome>" --verify "<exact command that proves it>"`.\n' +
+        '   Repeat `--accept` when completion has multiple independently observable criteria.\n' +
+        '   Add one `--decision <id>` for each existing decision this round may change.\n' +
+        '   Git operations never need an intent and are not included in the intent log;\n' +
+        '   Git maintains their history. This includes inspection, branch and worktree\n' +
+        '   management, staging, commits, merges, rebases, cherry-picks, tags, and pushes.\n' +
+        '   A command whose result can be reconstructed from Git state (for example a\n' +
+        '   patch file regenerated from a commit range, or a scratch harness that\n' +
+        '   re-runs) needs no intent; content that will be committed and cannot be\n' +
+        '   reconstructed (for example a .gitignore edit) does.\n' +
+        '   Single-step commands that only build or check work already done, such as\n' +
+        '   compiling or running tests, also need no intent.\n' +
+        '   Size an intent to the smallest unit that leaves the tree self-consistent\n' +
+        '   and can be verified on its own.'
+    )
+    .replace(
+      '   Git operations remain subject to normal authorization and safety requirements\n' +
+        '   even though they do not require an intent. Any content change made while\n' +
+        '   preparing a Git operation still requires an intent when it meets the\n' +
+        '   durable-project-content rule in step 1.',
+      '   Git operations remain subject to normal authorization and safety requirements\n' +
+        '   even though they do not require an intent. Any non-Git content change made while\n' +
+        '   preparing a Git operation does require a new intent, per the step 1 test.'
+    )
+    .replace(
+      '4. **Re-anchor after context loss**: run `driftseal status` and `driftseal log --last 3` before\n' +
+        '   doing anything else. The open intent is the source of truth: resume it when its\n' +
+        '   objective still matches the current task; otherwise close it (`partial` or\n' +
+        '   `abandoned`, with a note) and `begin` a new one. Taking over work in the\n' +
+        '   same root from another agent is the same re-anchor: resume the open intent\n' +
+        '   when its objective still matches.',
+      '4. **Re-anchor after context loss**: run `driftseal status` and `driftseal log --last 3` before\n' +
+        '   doing anything else. The open intent is the source of truth: resume it when its\n' +
+        '   objective still matches the current task; otherwise close it (`partial` or\n' +
+        '   `abandoned`, with a note) and `begin` a new one.'
+    );
+  if (version >= 13) return v13;
+  const v12 = v13
     .replace(
       '   `driftseal begin "<what this round will accomplish>" --accept "<observable outcome>" --verify "<exact command that proves it>"`.\n' +
         '   Repeat `--accept` when completion has multiple independently observable criteria.',
@@ -2780,11 +2982,13 @@ function hookReminder(event, { readOnly = false } = {}) {
   if (!file) return null;
   if (event === 'prompt') {
     return (
-      'DriftSeal reminder: if this round will modify files or anything else that may need a ' +
-      'rollback, begin an intent first: driftseal begin "<intent>" --accept "<observable outcome>" ' +
+      'DriftSeal reminder: if this round will change durable project content in this workspace ' +
+      '(code, configuration, documentation, dependencies), ' +
+      'begin an intent first: driftseal begin "<intent>" --accept "<observable outcome>" ' +
       '--verify "<command>". ' +
-      'Questions, read-only exploration, and single-step checks need no intent — skip this ' +
-      'reminder when it does not apply.'
+      'Questions, read-only exploration, single-step checks, temporary work outside durable ' +
+      'project content, and external state changes that do not write project content here need ' +
+      'no intent — skip this reminder when it does not apply.'
     );
   }
   const open = openIntent(fold(readEvents({ file, readOnly })));
@@ -3802,6 +4006,101 @@ function absorbGit(baseFile, oursFile, theirsFile, { abandon, dryRun }) {
   });
 }
 
+function appendVerificationSpawnError(file, error) {
+  const stat = fs.statSync(file);
+  let prefix = '';
+  if (stat.size > 0) {
+    const fd = fs.openSync(file, 'r');
+    const lastByte = Buffer.alloc(1);
+    try {
+      fs.readSync(fd, lastByte, 0, 1, stat.size - 1);
+    } finally {
+      fs.closeSync(fd);
+    }
+    if (lastByte[0] !== 0x0a) prefix = '\n';
+  }
+  fs.appendFileSync(file, `${prefix}${error.message}\n`, 'utf8');
+}
+
+function digestAndReplayVerificationOutput(file, writer, hash) {
+  const fd = fs.openSync(file, 'r');
+  const decoder = new StringDecoder('utf8');
+  const buffer = Buffer.allocUnsafe(VERIFICATION_OUTPUT_CHUNK_BYTES);
+  let bytes = 0;
+  let lastCharacter = null;
+
+  const display = (text) => {
+    if (!text) return;
+    writer(text);
+    lastCharacter = text.at(-1);
+  };
+
+  try {
+    while (true) {
+      const count = fs.readSync(fd, buffer, 0, buffer.length, null);
+      if (count === 0) break;
+      const chunk = buffer.subarray(0, count);
+      hash.update(chunk);
+      bytes += count;
+      display(decoder.write(chunk));
+    }
+    display(decoder.end());
+  } finally {
+    fs.closeSync(fd);
+  }
+
+  return { bytes, endsWithNewline: lastCharacter === '\n' };
+}
+
+function executeVerificationCommand(command) {
+  const spool = fs.mkdtempSync(path.join(os.tmpdir(), 'driftseal-verify-'));
+  const stdoutFile = path.join(spool, 'stdout');
+  const stderrFile = path.join(spool, 'stderr');
+  let stdoutFd;
+  let stderrFd;
+
+  try {
+    stdoutFd = fs.openSync(stdoutFile, 'wx', 0o600);
+    stderrFd = fs.openSync(stderrFile, 'wx', 0o600);
+    const started = process.hrtime.bigint();
+    let result;
+    try {
+      result = spawnSync(command, {
+        cwd: process.cwd(),
+        env: process.env,
+        shell: true,
+        stdio: ['ignore', stdoutFd, stderrFd],
+      });
+    } finally {
+      fs.closeSync(stdoutFd);
+      stdoutFd = undefined;
+      fs.closeSync(stderrFd);
+      stderrFd = undefined;
+    }
+    const durationMs = Number((process.hrtime.bigint() - started) / 1000000n);
+    if (result.error) appendVerificationSpawnError(stderrFile, result.error);
+
+    const hash = crypto.createHash('sha256');
+    const stdout = digestAndReplayVerificationOutput(stdoutFile, writeOutput, hash);
+    if (stdout.bytes > 0 && !stdout.endsWithNewline) printLine();
+    hash.update('\0');
+    const stderr = digestAndReplayVerificationOutput(stderrFile, writeErrorOutput, hash);
+    if (stderr.bytes > 0 && !stderr.endsWithNewline) printError();
+
+    return {
+      result,
+      durationMs,
+      outputHash: hash.digest('hex'),
+      stdoutBytes: stdout.bytes,
+      stderrBytes: stderr.bytes,
+    };
+  } finally {
+    if (stdoutFd !== undefined) fs.closeSync(stdoutFd);
+    if (stderrFd !== undefined) fs.closeSync(stderrFd);
+    fs.rmSync(spool, { recursive: true, force: true });
+  }
+}
+
 function runMachineVerification({ allowTrackedCommand = false } = {}) {
   const snapshot = withMutationLocks([logDir()], () => {
     const intent = openIntent(fold(readEvents({ repairTail: true })));
@@ -3811,56 +4110,31 @@ function runMachineVerification({ allowTrackedCommand = false } = {}) {
     }
     if (!intent.verify) fail(`intent ${intent.id} has no verification command`);
     const park = inProgressFile();
-    const parked = park && fs.existsSync(park) ? parkedOpenIntent(park) : null;
+    const parked = park ? parkedOpenIntent(park) : null;
+    const locallyProvenanced = hasMatchingLocalIntentProvenance(intent);
     return {
       id: intent.id,
       command: intent.verify,
-      fromTrackedLog: isParkableIntentLog() && (!parked || parked.id !== intent.id),
+      requiresExplicitTrust:
+        (!parked || parked.id !== intent.id) && !locallyProvenanced,
     };
   });
 
   const displayedCommand = JSON.stringify(snapshot.command);
   printError(`verification command: ${displayedCommand}`);
-  if (snapshot.fromTrackedLog && !allowTrackedCommand) {
+  if (snapshot.requiresExplicitTrust && !allowTrackedCommand) {
     fail(
-      `refusing to execute a verification command sourced from the repository intent log: ${displayedCommand}\n` +
+      `refusing to execute a verification command that DriftSeal cannot confirm was created locally: ${displayedCommand}\n` +
+        'no matching local intent provenance was found; ' +
         'inspect the command, then re-run with --allow-tracked-command only if you trust it'
     );
   }
 
-  const started = process.hrtime.bigint();
-  const result = spawnSync(snapshot.command, {
-    cwd: process.cwd(),
-    env: process.env,
-    shell: true,
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'pipe'],
-    maxBuffer: 16 * 1024 * 1024,
-  });
-  const durationMs = Number((process.hrtime.bigint() - started) / 1000000n);
-  const stdout = result.stdout || '';
-  let stderr = result.stderr || '';
-  if (result.error) {
-    stderr += `${stderr && !stderr.endsWith('\n') ? '\n' : ''}${result.error.message}\n`;
-  }
-  if (stdout) {
-    writeOutput(stdout);
-    if (!stdout.endsWith('\n')) printLine();
-  }
-  if (stderr) {
-    writeErrorOutput(stderr);
-    if (!stderr.endsWith('\n')) printError();
-  }
-
+  const execution = executeVerificationCommand(snapshot.command);
+  const { result, durationMs, outputHash, stdoutBytes, stderrBytes } = execution;
   const exitCode = Number.isInteger(result.status) ? result.status : 1;
   const signal = typeof result.signal === 'string' ? result.signal : null;
   const passed = exitCode === 0 && signal === null;
-  const outputHash = crypto
-    .createHash('sha256')
-    .update(stdout, 'utf8')
-    .update('\0')
-    .update(stderr, 'utf8')
-    .digest('hex');
   const verificationEvent = {
     type: 'verify',
     id: snapshot.id,
@@ -3872,8 +4146,8 @@ function runMachineVerification({ allowTrackedCommand = false } = {}) {
     signal,
     durationMs,
     outputHash,
-    stdoutBytes: Buffer.byteLength(stdout),
-    stderrBytes: Buffer.byteLength(stderr),
+    stdoutBytes,
+    stderrBytes,
     workspace: workspaceFingerprint(),
     head: gitCapture(['rev-parse', 'HEAD']),
   };
@@ -4417,6 +4691,8 @@ const commands = {
       knownManagedBlocks: [
         ...sourceLanguages.flatMap((source) => [
           protocolEol(intentProtocolBlock(PROTOCOL_VERSION, source), eol),
+          protocolEol(previousIntentProtocolBlock(13, source), eol),
+          protocolEol(previousIntentProtocolBlock(13, source, true), eol),
           protocolEol(previousIntentProtocolBlock(12, source), eol),
           protocolEol(previousIntentProtocolBlock(12, source, true), eol),
           protocolEol(previousIntentProtocolBlock(11, source), eol),
@@ -4444,6 +4720,8 @@ const commands = {
       knownManagedBlocks: [
         ...sourceLanguages.flatMap((source) => [
           protocolEol(decisionProtocolBlock(PROTOCOL_VERSION, source), eol),
+          protocolEol(previousDecisionProtocolBlock(13, source), eol),
+          protocolEol(previousDecisionProtocolBlock(13, source, true), eol),
           protocolEol(previousDecisionProtocolBlock(12, source), eol),
           protocolEol(previousDecisionProtocolBlock(12, source, true), eol),
           protocolEol(previousDecisionProtocolBlock(11, source), eol),
@@ -4727,7 +5005,15 @@ function runCommand(argv, { root = process.cwd(), isolateStorage = false, captur
   const previousIntentHome = process.env.DRIFTSEAL_HOME;
   const previousDecisionHome = process.env.DRIFTSEAL_DECISION_HOME;
   const output = { stdout: '', stderr: '', data: null, exitCode: 0, readOnly: false };
+  const captures = capture
+    ? { stdout: createBoundedOutputCapture(), stderr: createBoundedOutputCapture() }
+    : null;
   const previousOutput = activeOutput;
+  const finalizeCapturedOutput = () => {
+    if (!captures) return;
+    output.stdout = renderBoundedOutput(captures.stdout);
+    output.stderr = renderBoundedOutput(captures.stderr);
+  };
 
   try {
     process.chdir(fixedRoot);
@@ -4735,14 +5021,16 @@ function runCommand(argv, { root = process.cwd(), isolateStorage = false, captur
       delete process.env.DRIFTSEAL_HOME;
       delete process.env.DRIFTSEAL_DECISION_HOME;
     }
-    if (capture) activeOutput = output;
+    if (capture) activeOutput = captures;
     const result = dispatch(argv);
     output.data = result.data;
     output.exitCode = result.exitCode;
     output.readOnly = result.readOnly === true;
+    finalizeCapturedOutput();
     return output;
   } catch (err) {
     if (capture) {
+      finalizeCapturedOutput();
       err.stdout = output.stdout;
       err.stderr = output.stderr;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "driftseal",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Seal intent, verification, and decisions into an auditable workflow for agentic coding",
   "keywords": [
     "driftseal",