intentdna 1.8.0 → 1.8.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "intentdna",
       "description": "Declarative policy layer for AI agent behavior with plugin-managed hook runtime for Claude Code.",
-      "version": "1.8.0",
+      "version": "1.8.2",
       "author": {
         "name": "Samuel"
       },
@@ -25,5 +25,5 @@
       ]
     }
   ],
-  "version": "1.8.0"
+  "version": "1.8.2"
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "intentdna",
-  "version": "1.8.0",
+  "version": "1.8.2",
   "description": "Declarative policy layer for AI agent behavior",
   "author": {
     "name": "Samuel"

package/dist/cli/commands/run.d.ts

@@ -6,6 +6,7 @@
  * via `claude -p --agent` child processes.
  */
 import type { WorkflowStep, ParallelGroup, TransitionRule } from "../../schema/types.js";
+import type { ConstraintIR } from "../../schema/types.js";
 export interface RunOptions {
     dnaFiles: string[];
     workflowName: string;
@@ -35,6 +36,7 @@ interface StepExecOptions {
     workflowName: string;
     workflowAsset?: string;
     inputs: Record<string, string>;
+    ir: Pick<ConstraintIR, "verifier_policy">;
 }
 /**
  * Replace {{var}} placeholders in a template string.

package/dist/cli/commands/run.js

@@ -6,7 +6,7 @@
  * via `claude -p --agent` child processes.
  */
 import { spawn } from "node:child_process";
-import { mkdir, writeFile, readFile } from "node:fs/promises";
+import { mkdir, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 import { loadDNA, compileFromFiles, expandDNAInputFiles } from "../../compiler/index.js";
@@ -17,6 +17,7 @@ import { createCompiledIR, writeCompiledIR } from "../../runtime/plugin-adapter.
 import { trustedEvidenceCaptureAttribution } from "../../governance/index.js";
 import { DNAStateManager } from "../../hooks/state-manager.js";
 import { appendEvidenceCaptureEvent, EVIDENCE_CAPTURE_SCHEMA_VERSION, } from "../../hooks/state.js";
+import { runCompletionVerifier, runCheckpointVerifier, } from "../../runtime/verifier.js";
 // ── Template & Condition Helpers ───────────────────────────
 /**
  * Replace {{var}} placeholders in a template string.
@@ -56,53 +57,44 @@ export function evaluateRunIf(condition, round) {
  * Run checkpoint assertions for a completed step.
  * Returns true if all checkpoints pass, false if any fail.
  */
-async function runCheckpoints(step, projectDir) {
+async function runCompletions(step, vars, opts) {
+    if (!step.completion)
+        return true;
+    for (const completion of step.completion) {
+        const result = await runCompletionVerifier(completion, opts.ir, {
+            projectDir: opts.projectDir,
+            variables: vars,
+        });
+        if (!result.passed) {
+            logVerifierFailure("Completion failed", step.id, result);
+            return false;
+        }
+    }
+    return true;
+}
+async function runCheckpoints(step, vars, opts) {
     if (!step.checkpoints)
         return true;
-    const assertCommands = {
-        clean_working_tree: 'git status --porcelain',
-        lint_passing: 'npm run lint --silent 2>/dev/null',
-        build_passing: 'npm run build --silent 2>/dev/null',
-    };
     for (const cp of step.checkpoints) {
         const action = cp.action ?? "block";
-        let passed = false;
-        try {
-            if (cp.command) {
-                // Custom command — must exit 0
-                await spawnAsync("bash", ["-c", cp.command], "", projectDir);
-                passed = true;
-            }
-            else if (cp.assert === "clean_working_tree") {
-                const output = await spawnAsync("git", ["status", "--porcelain"], "", projectDir);
-                passed = output.trim() === "";
-            }
-            else if (cp.assert === "no_test_regression") {
-                // Read baselines from .dna/
-                const baseline = parseInt(await readFile(join(projectDir, ".dna", "test-baseline"), "utf-8").catch(() => "0"), 10);
-                const current = parseInt(await readFile(join(projectDir, ".dna", "test-current"), "utf-8").catch(() => "0"), 10);
-                passed = current <= baseline;
-            }
-            else if (assertCommands[cp.assert]) {
-                await spawnAsync("bash", ["-c", assertCommands[cp.assert]], "", projectDir);
-                passed = true;
-            }
-            else {
-                log(`Unknown checkpoint assert: ${cp.assert} (step: ${step.id})`);
-                passed = false;
-            }
-        }
-        catch {
-            passed = false;
-        }
-        if (!passed) {
-            log(`Checkpoint failed: ${cp.assert} — ${cp.message} (step: ${step.id})`);
+        const result = await runCheckpointVerifier(cp, opts.ir, {
+            projectDir: opts.projectDir,
+            variables: vars,
+        });
+        if (!result.passed) {
+            logVerifierFailure(`Checkpoint failed: ${cp.assert}`, step.id, result);
             if (action === "block")
                 return false;
         }
     }
     return true;
 }
+function logVerifierFailure(prefix, stepId, result) {
+    const exitCode = result.exit_code === undefined ? "" : ` exit_code=${result.exit_code}`;
+    const target = result.target ? ` target=${result.target}` : "";
+    const message = result.message ? ` — ${result.message}` : "";
+    log(`${prefix}${target}${exitCode}${message} (step: ${stepId})`);
+}
 // ── Step Execution ─────────────────────────────────────────
 async function recordStepResultEvidence(step, opts, sessionId, status, durationMs) {
     const result = status === "pass" ? "success" : "failure";
@@ -180,9 +172,17 @@ export async function executeStep(step, vars, opts, iteration = 1) {
             // Non-JSON output → treat as success
         }
         const status = isError ? "fail" : "pass";
-        // Run checkpoints if step passed and has checkpoints defined
+        if (status === "pass" && step.completion && step.completion.length > 0) {
+            const completionsPassed = await runCompletions(step, vars, opts);
+            if (!completionsPassed) {
+                const durationMs = Date.now() - start;
+                await recordStepResultEvidence(step, opts, sessionId, "fail", durationMs);
+                log(`Step ${step.id} COMPLETION_FAIL (${durationMs}ms)`);
+                return { stepId: step.id, status: "fail", durationMs, resultFile };
+            }
+        }
         if (status === "pass" && step.checkpoints && step.checkpoints.length > 0) {
-            const checkpointsPassed = await runCheckpoints(step, opts.projectDir);
+            const checkpointsPassed = await runCheckpoints(step, vars, opts);
             if (!checkpointsPassed) {
                 const durationMs = Date.now() - start;
                 await recordStepResultEvidence(step, opts, sessionId, "fail", durationMs);
@@ -343,6 +343,7 @@ export async function runRun(opts) {
         const vars = {
             ...(opts.vars ?? {}),
             task_id: opts.taskId,
+            ARGUMENTS: opts.taskId,
             workflow: opts.workflowName,
         };
         // ── Dry-run mode ─────────────────────────────────────
@@ -375,8 +376,10 @@ export async function runRun(opts) {
             inputs: {
                 ...(opts.vars ?? {}),
                 task_id: opts.taskId,
+                ARGUMENTS: opts.taskId,
                 workflow: opts.workflowName,
             },
+            ir,
         };
         // ── Step 6: Execute workflow ──────────────────────────
         const maxRetries = plan.retry.max_retries;

package/dist/hooks/cli.d.ts

@@ -99,6 +99,8 @@ export declare function runVerifiersForTest(projectDir: string, ir: ConstraintIR
     workflow: string;
     current_step: string;
     current_role: string;
+    inputs?: Record<string, string>;
+    resolved_variables?: Record<string, string>;
 }, when: VerifierSpec["when"], sessionId?: string, options?: {
     commandTimeoutMs?: number;
 }): Promise<VerifierResultEntry[]>;
@@ -106,6 +108,8 @@ export declare function runStopVerifiersForTest(projectDir: string, ir: Constrai
     workflow: string;
     current_step: string;
     current_role: string;
+    inputs?: Record<string, string>;
+    resolved_variables?: Record<string, string>;
 }, sessionId?: string, options?: {
     commandTimeoutMs?: number;
 }): Promise<VerifierResultEntry[]>;

package/dist/hooks/cli.js

@@ -28,6 +28,7 @@ import { hookEventsForSurface } from "./event-registry.js";
 import { writeAuditEvent } from "../audit/index.js";
 import { RUNTIME_DECISION_EVENT_SCHEMA_VERSION, trustedEvidenceCaptureAttribution } from "../governance/index.js";
 import { runCodexHook } from "../runtime/codex-adapter.js";
+import { runCheckpointVerifier as runSharedCheckpointVerifier, runCompletionVerifier, toProjectRelativePath, } from "../runtime/verifier.js";
 // ── Constants ──────────────────────────────────────────────
 const DEFAULT_IR_PATH = ".dna/compiled/ir.json";
 const VALID_EVENTS = new Set(hookEventsForSurface("cli"));
@@ -423,6 +424,8 @@ export async function runHookEvent(options) {
             current_step: wfState.current_step,
             current_role: wfState.current_role,
             started_at: wfState.started_at,
+            inputs: wfState.inputs,
+            resolved_variables: wfState.resolved_variables,
             completed_artifacts: wfState.completed_artifacts,
             artifact_facts: stopArtifactFacts,
         } : null;
@@ -507,6 +510,8 @@ export async function runHookEvent(options) {
                     workflow: wfStateRaw.workflow,
                     current_step: wfStateRaw.current_step,
                     current_role: wfStateRaw.current_role,
+                    inputs: wfStateRaw.inputs,
+                    resolved_variables: wfStateRaw.resolved_variables,
                 }, "post_tool_use", sessionId);
                 const failingResults = verifierResults.filter((result) => result.status === "fail");
                 if (failingResults.length > 0) {
@@ -951,8 +956,6 @@ function clearBlockingVerifierCheckpoints(ir, workflowState) {
             }),
     };
 }
-const DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS = 30_000;
-const MAX_VERIFIER_EVIDENCE_BYTES = 4096;
 function appendOutputText(output, text, hookEventName) {
     if (!text)
         return output;
@@ -999,316 +1002,6 @@ export function appendStopVerifierWarnings(output, verifierResults, currentStep)
         "\nFix the warning above before relying on this step, or rerun the verifier after repair.";
     return appendOutputText(output, warningText, "Stop");
 }
-function trimEvidence(raw) {
-    if (!raw)
-        return undefined;
-    const trimmed = raw.trim();
-    if (!trimmed)
-        return undefined;
-    return trimmed.length > MAX_VERIFIER_EVIDENCE_BYTES
-        ? trimmed.slice(0, MAX_VERIFIER_EVIDENCE_BYTES)
-        : trimmed;
-}
-function hasUnsafeShellControl(command) {
-    let inSingle = false;
-    let inDouble = false;
-    let escaped = false;
-    for (let i = 0; i < command.length; i++) {
-        const ch = command[i];
-        const next = command[i + 1] ?? "";
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (ch === "\\" && !inSingle) {
-            escaped = true;
-            continue;
-        }
-        if (ch === "'" && !inDouble) {
-            inSingle = !inSingle;
-            continue;
-        }
-        if (ch === '"' && !inSingle) {
-            inDouble = !inDouble;
-            continue;
-        }
-        if (!inSingle && !inDouble) {
-            if (ch === ";" || ch === "`" || ch === "\n" || ch === "\r")
-                return true;
-            if ((ch === "&" || ch === "|" || ch === "<" || ch === ">") && next === ch)
-                return true;
-            if (ch === "$" && next === "(")
-                return true;
-            if ((ch === "<" || ch === ">") && next === "(")
-                return true;
-            if (ch === "|" || ch === "&" || ch === "<" || ch === ">")
-                return true;
-        }
-        if (inDouble) {
-            if (ch === "`")
-                return true;
-            if (ch === "$" && next === "(")
-                return true;
-        }
-    }
-    return false;
-}
-function isVerifierCommandAllowed(ir, command) {
-    const normalized = command.trim();
-    const policy = ir.verifier_policy;
-    if (!policy)
-        return false;
-    if (policy.allow_commands?.includes(normalized))
-        return true;
-    if (hasUnsafeShellControl(normalized))
-        return false;
-    return policy.allow_command_prefixes?.some((prefix) => normalized.startsWith(prefix)) ?? false;
-}
-function verifierCommandPolicyMessage(command) {
-    return `Verifier command not allowed by verifier_policy: ${command}`;
-}
-function isBuiltinAssertAllowed(ir, assertName) {
-    const policy = ir.verifier_policy;
-    return policy?.allow_builtin_asserts?.includes(assertName) ?? false;
-}
-function verifierAssertPolicyMessage(assertName) {
-    return `Verifier assert not allowed by verifier_policy: ${assertName}`;
-}
-function summarizeCommandEvidence(stdout, stderr) {
-    const stdoutBytes = Buffer.byteLength(stdout, "utf8");
-    const stderrBytes = Buffer.byteLength(stderr, "utf8");
-    if (stdoutBytes === 0 && stderrBytes === 0)
-        return undefined;
-    return trimEvidence(`stdout_bytes=${stdoutBytes} stderr_bytes=${stderrBytes}`);
-}
-async function execVerifierCommand(projectDir, command, timeoutMs = DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS) {
-    return new Promise((resolvePromise) => {
-        const child = spawn("bash", ["-lc", command], { cwd: projectDir, stdio: ["ignore", "pipe", "pipe"] });
-        let stdout = "";
-        let stderr = "";
-        let settled = false;
-        const settle = (result) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timeoutId);
-            resolvePromise(result);
-        };
-        const timeoutId = setTimeout(() => {
-            child.kill("SIGTERM");
-            setTimeout(() => child.kill("SIGKILL"), 1000).unref();
-            settle({ passed: false, timedOut: true, exitCode: 124, evidence: summarizeCommandEvidence(stdout, stderr) });
-        }, timeoutMs);
-        child.stdout.on("data", (chunk) => {
-            stdout += String(chunk);
-            if (stdout.length > MAX_VERIFIER_EVIDENCE_BYTES) {
-                stdout = stdout.slice(0, MAX_VERIFIER_EVIDENCE_BYTES);
-            }
-        });
-        child.stderr.on("data", (chunk) => {
-            stderr += String(chunk);
-            if (stderr.length > MAX_VERIFIER_EVIDENCE_BYTES) {
-                stderr = stderr.slice(0, MAX_VERIFIER_EVIDENCE_BYTES);
-            }
-        });
-        child.on("error", (_error) => settle({
-            passed: false,
-            timedOut: false,
-            exitCode: 1,
-            evidence: summarizeCommandEvidence(stdout, stderr),
-        }));
-        child.on("close", (code) => settle({
-            passed: code === 0,
-            timedOut: false,
-            exitCode: code ?? 1,
-            evidence: summarizeCommandEvidence(stdout, stderr),
-        }));
-    });
-}
-async function runCheckpointVerifier(projectDir, ir, checkpoint, commandTimeoutMs = DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS) {
-    const assertCommands = {
-        clean_working_tree: "git status --porcelain",
-        lint_passing: "npm run lint --silent 2>/dev/null",
-        build_passing: "npm run build --silent 2>/dev/null",
-    };
-    if (checkpoint.command) {
-        if (!isVerifierCommandAllowed(ir, checkpoint.command)) {
-            return {
-                passed: false,
-                target: checkpoint.command,
-                evidence: "policy_denied",
-                exit_code: 126,
-                message: verifierCommandPolicyMessage(checkpoint.command),
-            };
-        }
-        const commandResult = await execVerifierCommand(projectDir, checkpoint.command, commandTimeoutMs);
-        return {
-            passed: commandResult.passed,
-            target: checkpoint.command,
-            evidence: commandResult.evidence,
-            exit_code: commandResult.exitCode,
-            message: commandResult.passed
-                ? checkpoint.message
-                : commandResult.timedOut
-                    ? `Verifier command timed out after ${commandTimeoutMs}ms: ${checkpoint.command}`
-                    : `Verifier command failed: ${checkpoint.command}`,
-        };
-    }
-    if (checkpoint.assert === "clean_working_tree") {
-        if (!isBuiltinAssertAllowed(ir, checkpoint.assert)) {
-            return {
-                passed: false,
-                target: checkpoint.assert,
-                evidence: "policy_denied",
-                exit_code: 126,
-                message: verifierAssertPolicyMessage(checkpoint.assert),
-            };
-        }
-        try {
-            const raw = await new Promise((resolvePromise, rejectPromise) => {
-                const child = spawn("git", ["status", "--porcelain"], { cwd: projectDir, stdio: ["ignore", "pipe", "ignore"] });
-                let stdout = "";
-                child.stdout.on("data", (chunk) => { stdout += String(chunk); });
-                child.on("error", rejectPromise);
-                child.on("close", (code) => code === 0 ? resolvePromise(stdout) : rejectPromise(new Error("git status failed")));
-            });
-            const changedEntries = raw.split("\n").filter(Boolean).length;
-            return {
-                passed: raw.trim() === "",
-                target: checkpoint.assert,
-                evidence: `changed_entries=${changedEntries}`,
-                exit_code: 0,
-                message: checkpoint.message,
-            };
-        }
-        catch {
-            return { passed: false, target: checkpoint.assert, exit_code: 1, message: checkpoint.message };
-        }
-    }
-    if (checkpoint.assert === "no_test_regression") {
-        if (!isBuiltinAssertAllowed(ir, checkpoint.assert)) {
-            return {
-                passed: false,
-                target: checkpoint.assert,
-                evidence: "policy_denied",
-                exit_code: 126,
-                message: verifierAssertPolicyMessage(checkpoint.assert),
-            };
-        }
-        try {
-            const baseline = parseInt(await readFile(resolve(projectDir, ".dna/test-baseline"), "utf-8").catch(() => "0"), 10);
-            const current = parseInt(await readFile(resolve(projectDir, ".dna/test-current"), "utf-8").catch(() => "0"), 10);
-            return {
-                passed: current <= baseline,
-                target: checkpoint.assert,
-                evidence: `baseline=${baseline} current=${current}`,
-                exit_code: 0,
-                message: checkpoint.message,
-            };
-        }
-        catch {
-            return { passed: false, target: checkpoint.assert, exit_code: 1, message: checkpoint.message };
-        }
-    }
-    if (assertCommands[checkpoint.assert]) {
-        if (!isBuiltinAssertAllowed(ir, checkpoint.assert)) {
-            return {
-                passed: false,
-                target: checkpoint.assert,
-                evidence: "policy_denied",
-                exit_code: 126,
-                message: verifierAssertPolicyMessage(checkpoint.assert),
-            };
-        }
-        const commandResult = await execVerifierCommand(projectDir, assertCommands[checkpoint.assert], commandTimeoutMs);
-        return {
-            passed: commandResult.passed,
-            target: checkpoint.assert,
-            evidence: commandResult.evidence,
-            exit_code: commandResult.exitCode,
-            message: commandResult.passed
-                ? checkpoint.message
-                : commandResult.timedOut
-                    ? `Verifier command timed out after ${commandTimeoutMs}ms: ${assertCommands[checkpoint.assert]}`
-                    : checkpoint.message,
-        };
-    }
-    return { passed: false, target: checkpoint.assert, exit_code: 1, message: checkpoint.message };
-}
-function isWithinProjectRoot(projectRoot, targetPath) {
-    const relPath = relative(projectRoot, targetPath);
-    return relPath === "" || (!relPath.startsWith("..") && !isAbsolute(relPath));
-}
-async function resolveVerifierTarget(projectDir, targetPath) {
-    const projectRoot = await realpath(projectDir).catch(() => resolve(projectDir));
-    const resolvedPath = resolve(projectDir, targetPath);
-    if (!isWithinProjectRoot(projectRoot, resolvedPath)) {
-        return null;
-    }
-    const canonicalParent = await realpath(dirname(resolvedPath)).catch(() => null);
-    if (canonicalParent && !isWithinProjectRoot(projectRoot, canonicalParent)) {
-        return null;
-    }
-    const canonicalTarget = await realpath(resolvedPath).catch(() => null);
-    if (canonicalTarget && !isWithinProjectRoot(projectRoot, canonicalTarget)) {
-        return null;
-    }
-    return canonicalTarget ?? resolvedPath;
-}
-async function toProjectRelativePath(projectDir, filePath) {
-    const projectRoot = await realpath(projectDir).catch(() => resolve(projectDir));
-    const resolvedPath = resolve(projectDir, filePath);
-    const canonicalPath = await realpath(resolvedPath).catch(() => resolvedPath);
-    const targetPath = isWithinProjectRoot(projectRoot, canonicalPath) ? canonicalPath : resolvedPath;
-    const relPath = relative(projectRoot, targetPath);
-    return relPath === "" ? "." : relPath;
-}
-function getCompletionCheckFields(completion) {
-    if (typeof completion !== "object" || completion === null || Array.isArray(completion))
-        return [];
-    const fields = [];
-    if (completion.file_exists !== undefined)
-        fields.push("file_exists");
-    if (completion.file_not_empty !== undefined)
-        fields.push("file_not_empty");
-    if (completion.file_contains !== undefined)
-        fields.push("file_contains");
-    if (completion.command_success !== undefined)
-        fields.push("command_success");
-    return fields;
-}
-function validateCompletionVerifier(completion) {
-    const fields = getCompletionCheckFields(completion);
-    if (fields.length !== 1) {
-        return {
-            message: "Completion verifier must define exactly one check",
-            evidence: `fields:${fields.join(",") || "none"}`,
-        };
-    }
-    const field = fields[0];
-    if (field === "file_exists" && (typeof completion.file_exists !== "string" || !completion.file_exists)) {
-        return { message: "Completion verifier file_exists must be a non-empty string", evidence: "invalid:file_exists" };
-    }
-    if (field === "file_not_empty" && (typeof completion.file_not_empty !== "string" || !completion.file_not_empty)) {
-        return { message: "Completion verifier file_not_empty must be a non-empty string", evidence: "invalid:file_not_empty" };
-    }
-    if (field === "command_success" && (typeof completion.command_success !== "string" || !completion.command_success)) {
-        return { message: "Completion verifier command_success must be a non-empty string", evidence: "invalid:command_success" };
-    }
-    if (field === "file_contains") {
-        const fileContains = completion.file_contains;
-        if (typeof fileContains !== "object" || fileContains === null) {
-            return { message: "Completion verifier file_contains must define path and pattern", evidence: "invalid:file_contains" };
-        }
-        if (typeof fileContains.path !== "string" || !fileContains.path) {
-            return { message: "Completion verifier file_contains.path must be a non-empty string", evidence: "invalid:file_contains.path" };
-        }
-        if (typeof fileContains.pattern !== "string" || !fileContains.pattern) {
-            return { message: "Completion verifier file_contains.pattern must be a non-empty string", evidence: "invalid:file_contains.pattern" };
-        }
-    }
-    return null;
-}
 function getAuditCheckType(spec) {
     if (spec.completion?.file_exists !== undefined)
         return "file_exists";
@@ -1353,7 +1046,11 @@ async function runVerifierSpec(projectDir, ir, spec, workflowState, sessionId, o
     let artifact;
     let message = spec.checkpoint?.message;
     if (spec.kind === "checkpoint" && spec.checkpoint) {
-        const checkpointResult = await runCheckpointVerifier(projectDir, ir, spec.checkpoint, options?.commandTimeoutMs);
+        const checkpointResult = await runSharedCheckpointVerifier(spec.checkpoint, ir, {
+            projectDir,
+            variables: { ...(workflowState.resolved_variables ?? {}), ...(workflowState.inputs ?? {}) },
+            commandTimeoutMs: options?.commandTimeoutMs,
+        });
         passed = checkpointResult.passed;
         target = checkpointResult.target;
         evidence = checkpointResult.evidence;
@@ -1369,99 +1066,17 @@ async function runVerifierSpec(projectDir, ir, spec, workflowState, sessionId, o
             message = "Completion verifier must define exactly one check";
         }
         else {
-            const invalidCompletion = validateCompletionVerifier(completion);
-            if (invalidCompletion) {
-                passed = false;
-                evidence = invalidCompletion.evidence;
-                message = invalidCompletion.message;
-            }
-            else if (completion.file_exists) {
-                target = completion.file_exists;
-                const resolvedTarget = await resolveVerifierTarget(projectDir, completion.file_exists);
-                artifact = resolvedTarget ?? undefined;
-                evidence = resolvedTarget ? `exists:${resolvedTarget}` : "path_escape";
-                if (!resolvedTarget) {
-                    passed = false;
-                    message = `Verifier target escapes project root: ${completion.file_exists}`;
-                }
-                else {
-                    try {
-                        await stat(resolvedTarget);
-                    }
-                    catch {
-                        passed = false;
-                        message = `Required file missing: ${completion.file_exists}`;
-                    }
-                }
-            }
-            else if (completion.file_not_empty) {
-                target = completion.file_not_empty;
-                const resolvedTarget = await resolveVerifierTarget(projectDir, completion.file_not_empty);
-                artifact = resolvedTarget ?? undefined;
-                evidence = resolvedTarget ? `not_empty:${resolvedTarget}` : "path_escape";
-                if (!resolvedTarget) {
-                    passed = false;
-                    message = `Verifier target escapes project root: ${completion.file_not_empty}`;
-                }
-                else {
-                    try {
-                        const raw = await readFile(resolvedTarget, "utf-8");
-                        evidence = `bytes=${Buffer.byteLength(raw, "utf8")}`;
-                        if (raw.trim().length === 0) {
-                            passed = false;
-                            message = `Required file is empty: ${completion.file_not_empty}`;
-                        }
-                    }
-                    catch {
-                        passed = false;
-                        message = `Required file missing: ${completion.file_not_empty}`;
-                    }
-                }
-            }
-            else if (completion.file_contains) {
-                target = completion.file_contains.path;
-                const resolvedTarget = await resolveVerifierTarget(projectDir, completion.file_contains.path);
-                artifact = resolvedTarget ?? undefined;
-                evidence = `pattern:${completion.file_contains.pattern}`;
-                if (!resolvedTarget) {
-                    passed = false;
-                    message = `Verifier target escapes project root: ${completion.file_contains.path}`;
-                }
-                else {
-                    try {
-                        const raw = await readFile(resolvedTarget, "utf-8");
-                        const re = new RegExp(completion.file_contains.pattern);
-                        if (!re.test(raw)) {
-                            passed = false;
-                            message = `Required pattern missing in ${completion.file_contains.path}`;
-                        }
-                    }
-                    catch {
-                        passed = false;
-                        message = `Required file missing: ${completion.file_contains.path}`;
-                    }
-                }
-            }
-            else if (completion.command_success) {
-                target = completion.command_success;
-                if (!isVerifierCommandAllowed(ir, completion.command_success)) {
-                    passed = false;
-                    evidence = "policy_denied";
-                    exit_code = 126;
-                    message = verifierCommandPolicyMessage(completion.command_success);
-                }
-                else {
-                    const commandResult = await execVerifierCommand(projectDir, completion.command_success, options?.commandTimeoutMs);
-                    passed = commandResult.passed;
-                    evidence = commandResult.evidence;
-                    exit_code = commandResult.exitCode;
-                    if (!passed) {
-                        message = commandResult.timedOut
-                            ? `Verifier command timed out after ${options?.commandTimeoutMs ?? DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS}ms: ${completion.command_success}`
-                            : `Verifier command failed: ${completion.command_success}`;
-                    }
-                }
-            }
+            const completionResult = await runCompletionVerifier(completion, ir, {
+                projectDir,
+                variables: { ...(workflowState.resolved_variables ?? {}), ...(workflowState.inputs ?? {}) },
+                commandTimeoutMs: options?.commandTimeoutMs,
+            });
+            passed = completionResult.passed;
+            target = completionResult.target;
+            evidence = completionResult.evidence;
+            exit_code = completionResult.exit_code;
+            artifact = completionResult.artifact;
+            message = completionResult.message;
         }
     }
     const entry = {