mjolnir-qa 0.5.37 → 0.5.38

package/CHANGELOG.md

@@ -9,6 +9,12 @@ Rule behavior changes (new rules, FP-rate changes against the corpus,
 severity changes) are first-class entries here — rule IDs are immutable
 once shipped, so this file is the record of what changed between versions.
 
+## [0.5.38] — 2026-09-09
+
+### Changes since 0
+
+- P7: agent loop — mjolnir verify + MCP verify tool + install surfaces (#68)
+
 ## [0.5.37] — 2026-09-08
 
 ### Changes since 0

package/dist/cli.d.mts

@@ -783,7 +783,7 @@ declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniver
  * `scripts/sync-sarif-version.cjs` on release and guarded by
  * `tests/version-consistency.spec.ts` locally.
  */
-declare const CLI_VERSION = "0.5.37";
+declare const CLI_VERSION = "0.5.38";
 /** A usage-error detail: the offending token, when one exists. */
 interface UsageErrorDetail {
   /** The unknown flag or rejected value (e.g. `--nope`, `loud`). */
@@ -898,6 +898,16 @@ declare function runBaselineCommand(argv: string[], io?: {
   err: Output;
 }): Promise<number>;
 /** Testable `diff` handler (Sprint 6 Task 24) — new/worsened debt only. */
+/** Testable `verify` handler — the agent-loop verb (master plan P7,
+ * plan 1788853205786). Scans the target and diffs against the committed
+ * baseline, rendering the before/after digest the agent loop consumes
+ * (resolved per §15 · new · unchanged by ruleId+location · score delta).
+ * Exit semantics are the frozen contract: 0 clean · 1 new error
+ * findings · 2 partial scan or no baseline · 20 internal. */
+declare function runVerifyCommand(argv: string[], io?: {
+  out: Output;
+  err: Output;
+}): Promise<number>;
 declare function runDiffCommand(argv: string[], io?: {
   out: Output;
   err: Output;
@@ -943,4 +953,4 @@ declare function runHelpCommand(argv: string[], io?: {
 }): number;
 declare function isEntryPoint(): boolean;
 //#endregion
-export { CLI_VERSION, type CliArgs, EVIDENCE_OVERRIDES, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, type Output, SUITE_INVALIDATING_RULE_IDS, type ScanHooks, UsageErrorDetail, buildUniversalRules, discoverRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, pathMatchesGlob, runBadgeCommand, runBaselineCommand, runCiInstall, runCreateRuleCommand, runDebtCommand, runDiffCommand, runDoctorCommand, runDoctorPlaywright, runExplainCommand, runFixCommand, runForensicsCommand, runHandoverCommand, runHelpCommand, runImpactCommand, runInitCommand, runMutationCommand, runPrCommentCommand, runPwReportCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSuppressions, runTriageCommand, usageErrorMessage };
+export { CLI_VERSION, type CliArgs, EVIDENCE_OVERRIDES, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, type Output, SUITE_INVALIDATING_RULE_IDS, type ScanHooks, UsageErrorDetail, buildUniversalRules, discoverRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, pathMatchesGlob, runBadgeCommand, runBaselineCommand, runCiInstall, runCreateRuleCommand, runDebtCommand, runDiffCommand, runDoctorCommand, runDoctorPlaywright, runExplainCommand, runFixCommand, runForensicsCommand, runHandoverCommand, runHelpCommand, runImpactCommand, runInitCommand, runMutationCommand, runPrCommentCommand, runPwReportCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSuppressions, runTriageCommand, runVerifyCommand, usageErrorMessage };

package/dist/cli.mjs

@@ -13464,7 +13464,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.37",
+			version: "0.5.38",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -14697,6 +14697,7 @@ function agentBrief(surface, cwdNote) {
 		"- Exit 0 = clean. Exit 1 = new findings on changed lines: fix them (smallest behavior-preserving change) or justify them to the user.",
 		`- npx mjolnir-qa@${CLI_VERSION} why <file>:<line> explains any finding (evidence level, measured FP rate, fix).`,
 		`- npx mjolnir-qa@${CLI_VERSION} handoff renders a full remediation plan from a saved --json report.`,
+		`- Agent loop: establish the before-state once with npx mjolnir-qa@${CLI_VERSION} baseline (commits .mjolnir/baseline.json); after fixing, npx mjolnir-qa@${CLI_VERSION} verify prints the before/after digest — resolved (per §15 lifecycle) / new / unchanged by ruleId+location, and the score delta. Exit 0 clean, 1 new errors, 2 partial or no baseline.`,
 		"- NEVER suppress a finding merely to obtain a green scan (suppressions live in mjolnir.config.json, require a reason, and expire after 90 days).",
 		"- After fixing: re-run the scan, report files changed, report checks not run, report unresolved findings honestly.",
 		"",
@@ -15525,6 +15526,113 @@ function renderBaselineDiff(diff) {
 	return lines.join("\n");
 }
 //#endregion
+//#region src/commands/verify.ts
+/**
+* `mjolnir verify` — the agent-loop digest (product-gap-remediation
+* master plan P7, plan 1788853205786 — flag agent, decision 6).
+*
+* An agent fixes findings, then runs `mjolnir verify` against the
+* committed baseline (established once with `mjolnir baseline`). The
+* digest answers exactly the loop's questions, derived from the SAME
+* §15 comparison machinery as `mjolnir diff` (no second truth):
+*
+*   - RESOLVED — baseline findings no longer present, each with its
+*     lifecycle resolution (only VERIFIED-RESOLVED is a fix claim);
+*   - NEW — findings the fix introduced;
+*   - UNCHANGED — pre-existing debt, grouped by ruleId + location
+*     (the agent-loop key: an agent works by location, not message);
+*   - SCORE DELTA — before (baseline) → after (this scan).
+*
+* Exit semantics are the frozen contract: 0 clean · 1 new error
+* findings · 2 partial scan or no baseline (nothing to verify against
+* — the agent must first establish the before-state).
+*/
+function buildVerifyDigest(result, baseline) {
+	const diff = diffAgainstBaseline(result, baseline);
+	const digest = {
+		hasBaseline: diff.hasBaseline,
+		...diff.baselineCapturedAt !== void 0 ? { baselineCapturedAt: diff.baselineCapturedAt } : {},
+		...diff.baselineCommit !== void 0 ? { baselineCommit: diff.baselineCommit } : {},
+		resolved: diff.resolvedFindings.map((f) => ({
+			ruleId: f.ruleId,
+			file: f.file,
+			resolution: f.resolution.status
+		})),
+		new: diff.newFindings.map((f) => ({
+			ruleId: f.ruleId,
+			file: f.file,
+			line: f.line,
+			severity: f.severity
+		})),
+		unchanged: [],
+		unchangedCount: diff.unchangedCount,
+		scoreBefore: diff.baselineScore ?? null,
+		scoreAfter: result.score ?? null,
+		scoreDelta: diff.baselineScore !== void 0 && result.score !== null ? result.score - diff.baselineScore : null
+	};
+	if (diff.hasBaseline && baseline) {
+		const byRule = /* @__PURE__ */ new Map();
+		const headByFingerprint = /* @__PURE__ */ new Map();
+		for (const f of result.findings) headByFingerprint.set(`${f.ruleId}\u0000${f.file}\u0000${f.message}`, f);
+		for (const b of baseline.findings) {
+			const head = headByFingerprint.get(`${b.ruleId}\u0000${b.file}\u0000${b.message}`);
+			if (!head) continue;
+			let group = byRule.get(b.ruleId);
+			if (!group) {
+				group = {
+					ruleId: b.ruleId,
+					locations: []
+				};
+				byRule.set(b.ruleId, group);
+			}
+			group.locations.push(`${head.file}:${head.line}`);
+		}
+		digest.unchanged = [...byRule.values()].map((g) => ({
+			ruleId: g.ruleId,
+			locations: g.locations.sort()
+		}));
+	}
+	return digest;
+}
+function renderVerifyDigest(digest) {
+	if (!digest.hasBaseline) return [
+		"VERIFY — no baseline",
+		"",
+		"No committed baseline at .mjolnir/baseline.json — nothing to verify",
+		"against. Establish the before-state once with `mjolnir baseline`,",
+		"then re-run `mjolnir verify` after the fix."
+	].join("\n");
+	const lines = [];
+	lines.push("VERIFY — before/after digest");
+	lines.push("");
+	if (digest.scoreDelta !== null) {
+		const dir = digest.scoreDelta > 0 ? "improved" : digest.scoreDelta < 0 ? "worse" : "unchanged";
+		lines.push(`score: ${digest.scoreBefore} → ${digest.scoreAfter} (${dir}, Δ${digest.scoreDelta >= 0 ? "+" : ""}${digest.scoreDelta})`);
+	}
+	lines.push(`${digest.resolved.length} resolved · ${digest.new.length} new · ${digest.unchangedCount} unchanged`);
+	lines.push("");
+	if (digest.resolved.length > 0) {
+		lines.push("RESOLVED (per §15 lifecycle — only VERIFIED-RESOLVED is a fix claim):");
+		for (const r of digest.resolved) lines.push(`  ${r.ruleId} ${r.file} — ${r.resolution}`);
+		lines.push("");
+	}
+	if (digest.new.length > 0) {
+		lines.push("NEW (introduced by the change under verification):");
+		for (const n of digest.new) lines.push(`  ${n.ruleId} ${n.file}:${n.line} (${n.severity})`);
+		lines.push("");
+	}
+	if (digest.unchanged.length > 0) {
+		lines.push("UNCHANGED (pre-existing debt — out of this fix's scope):");
+		for (const g of digest.unchanged) {
+			lines.push(`  ${g.ruleId} × ${g.locations.length}`);
+			for (const loc of g.locations.slice(0, 5)) lines.push(`    ${loc}`);
+			if (g.locations.length > 5) lines.push(`    … and ${g.locations.length - 5} more`);
+		}
+		lines.push("");
+	}
+	return lines.join("\n").trimEnd();
+}
+//#endregion
 //#region src/mcp/server.ts
 /** Hard caps (§21 threat model: parameter size + resource bounds). */
 const MAX_PARAM_BYTES = 65536;
@@ -15586,6 +15694,18 @@ const MCP_TOOLS = [
 			},
 			required: ["path", "scanResult"]
 		}
+	},
+	{
+		name: "verify",
+		description: "Agent-loop digest (1:1 with `mjolnir verify`): scan the target and diff against the committed baseline. Returns resolved (per §15 lifecycle), new, unchanged (grouped by ruleId + location), and the score delta. Read-only; the same transport guardrails as every other tool.",
+		inputSchema: {
+			type: "object",
+			properties: { path: {
+				type: "string",
+				description: "Directory to scan and verify."
+			} },
+			required: ["path"]
+		}
 	}
 ];
 /** Strict param validation — unknown/missing/mistyped ⇒ INVALID_PARAMS. */
@@ -15602,6 +15722,9 @@ function validateParams(name, args) {
 		if (typeof args["path"] !== "string" || args["path"].length === 0) return "diff requires a non-empty string `path`";
 		if (typeof args["scanResult"] !== "object" || args["scanResult"] === null) return "diff requires the `scanResult` object from a previous scan tool call";
 	}
+	if (name === "verify") {
+		if (typeof args["path"] !== "string" || args["path"].length === 0) return "verify requires a non-empty string `path`";
+	}
 	return null;
 }
 /**
@@ -15718,6 +15841,52 @@ async function handleToolCall(call) {
 				}
 			};
 		}
+		if (call.name === "verify") {
+			const target = resolve(call.args["path"]);
+			if (!existsSync(target)) return {
+				jsonrpc: "2.0",
+				id: call.id,
+				error: {
+					code: MCP_ERRORS.INVALID_PARAMS,
+					message: `verify target does not exist: ${target}`
+				}
+			};
+			const baselinePath = join(target, DEFAULT_BASELINE_PATH);
+			if (!existsSync(baselinePath)) return {
+				jsonrpc: "2.0",
+				id: call.id,
+				result: {
+					hasBaseline: false,
+					note: "no committed baseline at .mjolnir/baseline.json — establish the before-state with `mjolnir baseline` first"
+				}
+			};
+			const result = await serializeScan(() => runScan({
+				target,
+				json: true,
+				verbose: false,
+				maxDurationMs: Number.POSITIVE_INFINITY,
+				scopeChanged: false,
+				format: "json"
+			}));
+			const digest = buildVerifyDigest(result, loadBaseline(baselinePath));
+			return {
+				jsonrpc: "2.0",
+				id: call.id,
+				result: {
+					hasBaseline: digest.hasBaseline,
+					baselineCapturedAt: digest.baselineCapturedAt,
+					baselineCommit: digest.baselineCommit,
+					resolved: digest.resolved,
+					new: digest.new,
+					unchanged: digest.unchanged,
+					unchangedCount: digest.unchangedCount,
+					scoreBefore: digest.scoreBefore,
+					scoreAfter: digest.scoreAfter,
+					scoreDelta: digest.scoreDelta,
+					partial: result.partial
+				}
+			};
+		}
 		return {
 			jsonrpc: "2.0",
 			id: call.id,
@@ -16669,10 +16838,16 @@ const HELP_ENTRIES = [
 	},
 	{
 		verb: "diff",
-		summary: "compare a fresh scan against the baseline — new/worsened only",
-		usage: "mjolnir diff [path]",
+		summary: "lifecycle diff vs the committed baseline",
+		usage: "mjolnir diff [path] [--json] [scan flags]",
 		examples: ["mjolnir diff"]
 	},
+	{
+		verb: "verify",
+		summary: "agent-loop digest: resolved/new/unchanged vs baseline + score delta",
+		usage: "mjolnir verify [path] [--json] [scan flags]",
+		examples: ["mjolnir verify"]
+	},
 	{
 		verb: "impact",
 		summary: "what a commit introduced vs resolved, since a prior commit",
@@ -16759,7 +16934,7 @@ const HELP_ENTRIES = [
 	},
 	{
 		verb: "mcp",
-		summary: "run as an MCP server over stdio (scan / explain / diff tools)",
+		summary: "run as an MCP server over stdio (scan / explain / diff / verify tools)",
 		usage: "mjolnir mcp",
 		examples: ["mjolnir mcp"]
 	}
@@ -16912,7 +17087,8 @@ const GROUPS = [
 			"badge",
 			"impact",
 			"baseline",
-			"diff"
+			"diff",
+			"verify"
 		]
 	},
 	{
@@ -19246,7 +19422,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.37";
+const CLI_VERSION = "0.5.38";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",
@@ -20004,6 +20180,36 @@ async function runBaselineCommand(argv, io = {
 	}
 }
 /** Testable `diff` handler (Sprint 6 Task 24) — new/worsened debt only. */
+/** Testable `verify` handler — the agent-loop verb (master plan P7,
+* plan 1788853205786). Scans the target and diffs against the committed
+* baseline, rendering the before/after digest the agent loop consumes
+* (resolved per §15 · new · unchanged by ruleId+location · score delta).
+* Exit semantics are the frozen contract: 0 clean · 1 new error
+* findings · 2 partial scan or no baseline · 20 internal. */
+async function runVerifyCommand(argv, io = {
+	out,
+	err
+}) {
+	const args = parseArgsOrUsage(argv, io);
+	if (!args) return 10;
+	try {
+		const target = resolve(args.target);
+		const invalid = validateScanTarget(target, io.err);
+		if (invalid !== null) return invalid;
+		const result = await runScan({
+			...args,
+			target
+		});
+		const digest = buildVerifyDigest(result, loadBaseline(join(target, DEFAULT_BASELINE_PATH), (w) => io.err(w)));
+		io.out(renderVerifyDigest(digest));
+		if (result.partial) return 2;
+		if (!digest.hasBaseline) return 2;
+		return digest.new.some((f) => f.severity === "error") ? 1 : 0;
+	} catch (err) {
+		internalErrorMessage(err, io.err, args?.debug === true);
+		return 20;
+	}
+}
 async function runDiffCommand(argv, io = {
 	out,
 	err
@@ -20207,6 +20413,7 @@ async function main(argv = process$1.argv.slice(2), io = {
 	if (argv[0] === "impact") return runImpactCommand(argv.slice(1));
 	if (argv[0] === "baseline") return runBaselineCommand(argv.slice(1));
 	if (argv[0] === "diff") return runDiffCommand(argv.slice(1));
+	if (argv[0] === "verify") return runVerifyCommand(argv.slice(1), io);
 	if (argv[0] === "pr-comment") return runPrCommentCommand(argv.slice(1));
 	if (argv[0] === "summary") return runSummaryCommand(argv.slice(1), io);
 	if (argv[0] === "stats") return runStatsCommand(argv.slice(1));
@@ -20278,4 +20485,4 @@ function isEntryPoint() {
 }
 if (isEntryPoint()) process$1.exitCode = await main();
 //#endregion
-export { CLI_VERSION, EVIDENCE_OVERRIDES, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, SUITE_INVALIDATING_RULE_IDS, buildUniversalRules, discoverRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, pathMatchesGlob, runBadgeCommand, runBaselineCommand, runCiInstall, runCreateRuleCommand, runDebtCommand, runDiffCommand, runDoctorCommand, runDoctorPlaywright, runExplainCommand, runFixCommand, runForensicsCommand, runHandoverCommand, runHelpCommand, runImpactCommand, runInitCommand, runMutationCommand, runPrCommentCommand, runPwReportCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSuppressions, runTriageCommand, usageErrorMessage };
+export { CLI_VERSION, EVIDENCE_OVERRIDES, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, SUITE_INVALIDATING_RULE_IDS, buildUniversalRules, discoverRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, pathMatchesGlob, runBadgeCommand, runBaselineCommand, runCiInstall, runCreateRuleCommand, runDebtCommand, runDiffCommand, runDoctorCommand, runDoctorPlaywright, runExplainCommand, runFixCommand, runForensicsCommand, runHandoverCommand, runHelpCommand, runImpactCommand, runInitCommand, runMutationCommand, runPrCommentCommand, runPwReportCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSuppressions, runTriageCommand, runVerifyCommand, usageErrorMessage };

package/dist/mcp/stdio.mjs

@@ -13463,7 +13463,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.37",
+			version: "0.5.38",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -14696,6 +14696,7 @@ function agentBrief(surface, cwdNote) {
 		"- Exit 0 = clean. Exit 1 = new findings on changed lines: fix them (smallest behavior-preserving change) or justify them to the user.",
 		`- npx mjolnir-qa@${CLI_VERSION} why <file>:<line> explains any finding (evidence level, measured FP rate, fix).`,
 		`- npx mjolnir-qa@${CLI_VERSION} handoff renders a full remediation plan from a saved --json report.`,
+		`- Agent loop: establish the before-state once with npx mjolnir-qa@${CLI_VERSION} baseline (commits .mjolnir/baseline.json); after fixing, npx mjolnir-qa@${CLI_VERSION} verify prints the before/after digest — resolved (per §15 lifecycle) / new / unchanged by ruleId+location, and the score delta. Exit 0 clean, 1 new errors, 2 partial or no baseline.`,
 		"- NEVER suppress a finding merely to obtain a green scan (suppressions live in mjolnir.config.json, require a reason, and expire after 90 days).",
 		"- After fixing: re-run the scan, report files changed, report checks not run, report unresolved findings honestly.",
 		"",
@@ -15860,10 +15861,16 @@ const HELP_ENTRIES = [
 	},
 	{
 		verb: "diff",
-		summary: "compare a fresh scan against the baseline — new/worsened only",
-		usage: "mjolnir diff [path]",
+		summary: "lifecycle diff vs the committed baseline",
+		usage: "mjolnir diff [path] [--json] [scan flags]",
 		examples: ["mjolnir diff"]
 	},
+	{
+		verb: "verify",
+		summary: "agent-loop digest: resolved/new/unchanged vs baseline + score delta",
+		usage: "mjolnir verify [path] [--json] [scan flags]",
+		examples: ["mjolnir verify"]
+	},
 	{
 		verb: "impact",
 		summary: "what a commit introduced vs resolved, since a prior commit",
@@ -15950,7 +15957,7 @@ const HELP_ENTRIES = [
 	},
 	{
 		verb: "mcp",
-		summary: "run as an MCP server over stdio (scan / explain / diff tools)",
+		summary: "run as an MCP server over stdio (scan / explain / diff / verify tools)",
 		usage: "mjolnir mcp",
 		examples: ["mjolnir mcp"]
 	}
@@ -16103,7 +16110,8 @@ const GROUPS = [
 			"badge",
 			"impact",
 			"baseline",
-			"diff"
+			"diff",
+			"verify"
 		]
 	},
 	{
@@ -17089,6 +17097,113 @@ function renderBaselineDiff(diff) {
 	return lines.join("\n");
 }
 //#endregion
+//#region src/commands/verify.ts
+/**
+* `mjolnir verify` — the agent-loop digest (product-gap-remediation
+* master plan P7, plan 1788853205786 — flag agent, decision 6).
+*
+* An agent fixes findings, then runs `mjolnir verify` against the
+* committed baseline (established once with `mjolnir baseline`). The
+* digest answers exactly the loop's questions, derived from the SAME
+* §15 comparison machinery as `mjolnir diff` (no second truth):
+*
+*   - RESOLVED — baseline findings no longer present, each with its
+*     lifecycle resolution (only VERIFIED-RESOLVED is a fix claim);
+*   - NEW — findings the fix introduced;
+*   - UNCHANGED — pre-existing debt, grouped by ruleId + location
+*     (the agent-loop key: an agent works by location, not message);
+*   - SCORE DELTA — before (baseline) → after (this scan).
+*
+* Exit semantics are the frozen contract: 0 clean · 1 new error
+* findings · 2 partial scan or no baseline (nothing to verify against
+* — the agent must first establish the before-state).
+*/
+function buildVerifyDigest(result, baseline) {
+	const diff = diffAgainstBaseline(result, baseline);
+	const digest = {
+		hasBaseline: diff.hasBaseline,
+		...diff.baselineCapturedAt !== void 0 ? { baselineCapturedAt: diff.baselineCapturedAt } : {},
+		...diff.baselineCommit !== void 0 ? { baselineCommit: diff.baselineCommit } : {},
+		resolved: diff.resolvedFindings.map((f) => ({
+			ruleId: f.ruleId,
+			file: f.file,
+			resolution: f.resolution.status
+		})),
+		new: diff.newFindings.map((f) => ({
+			ruleId: f.ruleId,
+			file: f.file,
+			line: f.line,
+			severity: f.severity
+		})),
+		unchanged: [],
+		unchangedCount: diff.unchangedCount,
+		scoreBefore: diff.baselineScore ?? null,
+		scoreAfter: result.score ?? null,
+		scoreDelta: diff.baselineScore !== void 0 && result.score !== null ? result.score - diff.baselineScore : null
+	};
+	if (diff.hasBaseline && baseline) {
+		const byRule = /* @__PURE__ */ new Map();
+		const headByFingerprint = /* @__PURE__ */ new Map();
+		for (const f of result.findings) headByFingerprint.set(`${f.ruleId}\u0000${f.file}\u0000${f.message}`, f);
+		for (const b of baseline.findings) {
+			const head = headByFingerprint.get(`${b.ruleId}\u0000${b.file}\u0000${b.message}`);
+			if (!head) continue;
+			let group = byRule.get(b.ruleId);
+			if (!group) {
+				group = {
+					ruleId: b.ruleId,
+					locations: []
+				};
+				byRule.set(b.ruleId, group);
+			}
+			group.locations.push(`${head.file}:${head.line}`);
+		}
+		digest.unchanged = [...byRule.values()].map((g) => ({
+			ruleId: g.ruleId,
+			locations: g.locations.sort()
+		}));
+	}
+	return digest;
+}
+function renderVerifyDigest(digest) {
+	if (!digest.hasBaseline) return [
+		"VERIFY — no baseline",
+		"",
+		"No committed baseline at .mjolnir/baseline.json — nothing to verify",
+		"against. Establish the before-state once with `mjolnir baseline`,",
+		"then re-run `mjolnir verify` after the fix."
+	].join("\n");
+	const lines = [];
+	lines.push("VERIFY — before/after digest");
+	lines.push("");
+	if (digest.scoreDelta !== null) {
+		const dir = digest.scoreDelta > 0 ? "improved" : digest.scoreDelta < 0 ? "worse" : "unchanged";
+		lines.push(`score: ${digest.scoreBefore} → ${digest.scoreAfter} (${dir}, Δ${digest.scoreDelta >= 0 ? "+" : ""}${digest.scoreDelta})`);
+	}
+	lines.push(`${digest.resolved.length} resolved · ${digest.new.length} new · ${digest.unchangedCount} unchanged`);
+	lines.push("");
+	if (digest.resolved.length > 0) {
+		lines.push("RESOLVED (per §15 lifecycle — only VERIFIED-RESOLVED is a fix claim):");
+		for (const r of digest.resolved) lines.push(`  ${r.ruleId} ${r.file} — ${r.resolution}`);
+		lines.push("");
+	}
+	if (digest.new.length > 0) {
+		lines.push("NEW (introduced by the change under verification):");
+		for (const n of digest.new) lines.push(`  ${n.ruleId} ${n.file}:${n.line} (${n.severity})`);
+		lines.push("");
+	}
+	if (digest.unchanged.length > 0) {
+		lines.push("UNCHANGED (pre-existing debt — out of this fix's scope):");
+		for (const g of digest.unchanged) {
+			lines.push(`  ${g.ruleId} × ${g.locations.length}`);
+			for (const loc of g.locations.slice(0, 5)) lines.push(`    ${loc}`);
+			if (g.locations.length > 5) lines.push(`    … and ${g.locations.length - 5} more`);
+		}
+		lines.push("");
+	}
+	return lines.join("\n").trimEnd();
+}
+//#endregion
 //#region src/commands/stats.ts
 /**
 * `mjolnir stats` — Sprint 6 Task 26 (Master-Stabilization-Plan.md).
@@ -18882,7 +18997,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.37";
+const CLI_VERSION = "0.5.38";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",
@@ -19640,6 +19755,36 @@ async function runBaselineCommand(argv, io = {
 	}
 }
 /** Testable `diff` handler (Sprint 6 Task 24) — new/worsened debt only. */
+/** Testable `verify` handler — the agent-loop verb (master plan P7,
+* plan 1788853205786). Scans the target and diffs against the committed
+* baseline, rendering the before/after digest the agent loop consumes
+* (resolved per §15 · new · unchanged by ruleId+location · score delta).
+* Exit semantics are the frozen contract: 0 clean · 1 new error
+* findings · 2 partial scan or no baseline · 20 internal. */
+async function runVerifyCommand(argv, io = {
+	out,
+	err
+}) {
+	const args = parseArgsOrUsage(argv, io);
+	if (!args) return 10;
+	try {
+		const target = resolve(args.target);
+		const invalid = validateScanTarget(target, io.err);
+		if (invalid !== null) return invalid;
+		const result = await runScan({
+			...args,
+			target
+		});
+		const digest = buildVerifyDigest(result, loadBaseline(join(target, DEFAULT_BASELINE_PATH), (w) => io.err(w)));
+		io.out(renderVerifyDigest(digest));
+		if (result.partial) return 2;
+		if (!digest.hasBaseline) return 2;
+		return digest.new.some((f) => f.severity === "error") ? 1 : 0;
+	} catch (err) {
+		internalErrorMessage(err, io.err, args?.debug === true);
+		return 20;
+	}
+}
 async function runDiffCommand(argv, io = {
 	out,
 	err
@@ -19843,6 +19988,7 @@ async function main(argv = process$1.argv.slice(2), io = {
 	if (argv[0] === "impact") return runImpactCommand(argv.slice(1));
 	if (argv[0] === "baseline") return runBaselineCommand(argv.slice(1));
 	if (argv[0] === "diff") return runDiffCommand(argv.slice(1));
+	if (argv[0] === "verify") return runVerifyCommand(argv.slice(1), io);
 	if (argv[0] === "pr-comment") return runPrCommentCommand(argv.slice(1));
 	if (argv[0] === "summary") return runSummaryCommand(argv.slice(1), io);
 	if (argv[0] === "stats") return runStatsCommand(argv.slice(1));
@@ -19975,6 +20121,18 @@ const MCP_TOOLS = [
 			},
 			required: ["path", "scanResult"]
 		}
+	},
+	{
+		name: "verify",
+		description: "Agent-loop digest (1:1 with `mjolnir verify`): scan the target and diff against the committed baseline. Returns resolved (per §15 lifecycle), new, unchanged (grouped by ruleId + location), and the score delta. Read-only; the same transport guardrails as every other tool.",
+		inputSchema: {
+			type: "object",
+			properties: { path: {
+				type: "string",
+				description: "Directory to scan and verify."
+			} },
+			required: ["path"]
+		}
 	}
 ];
 /** Strict param validation — unknown/missing/mistyped ⇒ INVALID_PARAMS. */
@@ -19991,6 +20149,9 @@ function validateParams(name, args) {
 		if (typeof args["path"] !== "string" || args["path"].length === 0) return "diff requires a non-empty string `path`";
 		if (typeof args["scanResult"] !== "object" || args["scanResult"] === null) return "diff requires the `scanResult` object from a previous scan tool call";
 	}
+	if (name === "verify") {
+		if (typeof args["path"] !== "string" || args["path"].length === 0) return "verify requires a non-empty string `path`";
+	}
 	return null;
 }
 /**
@@ -20107,6 +20268,52 @@ async function handleToolCall(call) {
 				}
 			};
 		}
+		if (call.name === "verify") {
+			const target = resolve(call.args["path"]);
+			if (!existsSync(target)) return {
+				jsonrpc: "2.0",
+				id: call.id,
+				error: {
+					code: MCP_ERRORS.INVALID_PARAMS,
+					message: `verify target does not exist: ${target}`
+				}
+			};
+			const baselinePath = join(target, DEFAULT_BASELINE_PATH);
+			if (!existsSync(baselinePath)) return {
+				jsonrpc: "2.0",
+				id: call.id,
+				result: {
+					hasBaseline: false,
+					note: "no committed baseline at .mjolnir/baseline.json — establish the before-state with `mjolnir baseline` first"
+				}
+			};
+			const result = await serializeScan(() => runScan({
+				target,
+				json: true,
+				verbose: false,
+				maxDurationMs: Number.POSITIVE_INFINITY,
+				scopeChanged: false,
+				format: "json"
+			}));
+			const digest = buildVerifyDigest(result, loadBaseline(baselinePath));
+			return {
+				jsonrpc: "2.0",
+				id: call.id,
+				result: {
+					hasBaseline: digest.hasBaseline,
+					baselineCapturedAt: digest.baselineCapturedAt,
+					baselineCommit: digest.baselineCommit,
+					resolved: digest.resolved,
+					new: digest.new,
+					unchanged: digest.unchanged,
+					unchangedCount: digest.unchangedCount,
+					scoreBefore: digest.scoreBefore,
+					scoreAfter: digest.scoreAfter,
+					scoreDelta: digest.scoreDelta,
+					partial: result.partial
+				}
+			};
+		}
 		return {
 			jsonrpc: "2.0",
 			id: call.id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mjolnir-qa",
-  "version": "0.5.37",
+  "version": "0.5.38",
   "description": "Mjölnir — the Verification Trust Engine for QA. Audits test suites and CI pipelines, reports a worthiness score and prioritized findings.",
   "type": "module",
   "engines": {