mustflow 1.31.0 → 2.16.0

package/dist/cli/commands/verify.js

@@ -1,15 +1,24 @@
+import { createHash } from 'node:crypto';
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { createClassifyOutput } from './classify.js';
 import { runRun } from './run.js';
 import { createChangeVerificationReport, } from '../../core/change-verification.js';
+import { createVerifyCompletionVerdict, } from '../../core/completion-verdict.js';
+import { createExternalEvidenceRisks, } from '../../core/external-evidence.js';
+import { createRepeatedFailureRisks, createVerificationFailureFingerprint, updateRepeatedFailureState, } from '../../core/repeated-failure.js';
+import { countReproEvidenceVerdictEffects, createReproEvidenceRisks, } from '../../core/repro-evidence.js';
+import { createVerifyEvidenceModel } from '../../core/verification-evidence.js';
+import { createScopeDiffRisks } from '../../core/scope-risk.js';
+import { countValidationRatchetVerdictEffects, createValidationRatchetRisks, } from '../../core/validation-ratchet.js';
 import { readCommandContract } from '../../core/config-loading.js';
 import { printUsageError, renderHelp } from '../lib/cli-output.js';
 import { t } from '../lib/i18n.js';
-import { readLocalCommandEffectGraph, readLocalPathSurfaces, } from '../lib/local-index.js';
+import { readLocalCommandEffectGraph, readLocalPathSurfaces, readLocalSourceAnchorVerdictRisks, } from '../lib/local-index.js';
 import { resolveMustflowRoot } from '../lib/project-root.js';
 const VERIFY_SCHEMA_VERSION = '1';
 const VERIFY_RUN_DIR = path.join('.mustflow', 'state', 'runs', 'verify-latest');
+const VERIFY_MANIFEST_PATH = path.join(VERIFY_RUN_DIR, 'manifest.json');
 const LATEST_RUN_RECEIPT_PATH = path.join('.mustflow', 'state', 'runs', 'latest.json');
 function createBufferedOutput() {
     const stdout = [];
@@ -33,13 +42,16 @@ function createBufferedOutput() {
 }
 export function getVerifyHelp(lang = 'en') {
     return renderHelp({
-        usage: 'mf verify --reason <event> [options] | mf verify --from-plan <path> [options] | mf verify --changed [options]',
+        usage: 'mf verify --reason <event> [options] | mf verify --from-classification <path> [options] | mf verify --changed [options]',
         summary: t(lang, 'verify.help.summary'),
         options: [
             { label: '--reason <event>', description: t(lang, 'verify.help.option.reason') },
+            { label: '--from-classification <path>', description: t(lang, 'verify.help.option.fromClassification') },
             { label: '--from-plan <path>', description: t(lang, 'verify.help.option.fromPlan') },
             { label: '--changed', description: t(lang, 'verify.help.option.changed') },
             { label: '--write-plan <path>', description: t(lang, 'verify.help.option.writePlan') },
+            { label: '--repro-evidence <path>', description: t(lang, 'verify.help.option.reproEvidence') },
+            { label: '--external-evidence <path>', description: t(lang, 'verify.help.option.externalEvidence') },
             { label: '--plan-only', description: t(lang, 'verify.help.option.planOnly') },
             { label: '--json', description: t(lang, 'cli.option.json') },
             { label: '-h, --help', description: t(lang, 'cli.option.help') },
@@ -48,9 +60,9 @@ export function getVerifyHelp(lang = 'en') {
             'mf verify --reason code_change',
             'mf verify --reason docs_change --json',
             'mf verify --reason docs_change --plan-only --json',
-            'mf verify --from-plan verify-plan.json --json',
+            'mf verify --from-classification .mustflow/state/change-classification.json --json',
+            'mf verify --reason bug_fix --repro-evidence repro-evidence.json --json',
             'mf verify --changed --plan-only --json',
-            'mf verify --changed --write-plan .mustflow/state/change-plan.json --json',
             'mf verify --reason mustflow_docs_change',
         ],
         exitCodes: [
@@ -61,8 +73,11 @@ export function getVerifyHelp(lang = 'en') {
 }
 function parseVerifyArgs(args) {
     let reason;
+    let fromClassification;
     let fromPlan;
     let writePlan;
+    let reproEvidence;
+    let externalEvidence;
     let json = false;
     let planOnly = false;
     let changed = false;
@@ -92,21 +107,86 @@ function parseVerifyArgs(args) {
         if (arg === '--from-plan') {
             const value = args[index + 1];
             if (!value || value.startsWith('-')) {
-                return { json, planOnly, changed, reason, fromPlan, error: 'missing_from_plan_value' };
+                return { json, planOnly, changed, reason, fromClassification, fromPlan, error: 'missing_from_plan_value' };
             }
             fromPlan = value;
             index += 1;
             continue;
         }
+        if (arg === '--from-classification') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('-')) {
+                return {
+                    json,
+                    planOnly,
+                    changed,
+                    reason,
+                    fromClassification,
+                    fromPlan,
+                    error: 'missing_from_classification_value',
+                };
+            }
+            fromClassification = value;
+            index += 1;
+            continue;
+        }
         if (arg === '--write-plan') {
             const value = args[index + 1];
             if (!value || value.startsWith('-')) {
-                return { json, planOnly, changed, reason, fromPlan, writePlan, error: 'missing_write_plan_value' };
+                return {
+                    json,
+                    planOnly,
+                    changed,
+                    reason,
+                    fromClassification,
+                    fromPlan,
+                    writePlan,
+                    error: 'missing_write_plan_value',
+                };
             }
             writePlan = value;
             index += 1;
             continue;
         }
+        if (arg === '--external-evidence') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('-')) {
+                return {
+                    json,
+                    planOnly,
+                    changed,
+                    reason,
+                    fromClassification,
+                    fromPlan,
+                    writePlan,
+                    externalEvidence,
+                    error: 'missing_external_evidence_value',
+                };
+            }
+            externalEvidence = value;
+            index += 1;
+            continue;
+        }
+        if (arg === '--repro-evidence') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('-')) {
+                return {
+                    json,
+                    planOnly,
+                    changed,
+                    reason,
+                    fromClassification,
+                    fromPlan,
+                    writePlan,
+                    reproEvidence,
+                    externalEvidence,
+                    error: 'missing_repro_evidence_value',
+                };
+            }
+            reproEvidence = value;
+            index += 1;
+            continue;
+        }
         if (arg.startsWith('--reason=')) {
             const value = arg.slice('--reason='.length);
             if (value.length === 0) {
@@ -118,25 +198,98 @@ function parseVerifyArgs(args) {
         if (arg.startsWith('--from-plan=')) {
             const value = arg.slice('--from-plan='.length);
             if (value.length === 0) {
-                return { json, planOnly, changed, reason, fromPlan, error: 'missing_from_plan_value' };
+                return { json, planOnly, changed, reason, fromClassification, fromPlan, error: 'missing_from_plan_value' };
             }
             fromPlan = value;
             continue;
         }
+        if (arg.startsWith('--from-classification=')) {
+            const value = arg.slice('--from-classification='.length);
+            if (value.length === 0) {
+                return {
+                    json,
+                    planOnly,
+                    changed,
+                    reason,
+                    fromClassification,
+                    fromPlan,
+                    error: 'missing_from_classification_value',
+                };
+            }
+            fromClassification = value;
+            continue;
+        }
         if (arg.startsWith('--write-plan=')) {
             const value = arg.slice('--write-plan='.length);
             if (value.length === 0) {
-                return { json, planOnly, changed, reason, fromPlan, writePlan, error: 'missing_write_plan_value' };
+                return {
+                    json,
+                    planOnly,
+                    changed,
+                    reason,
+                    fromClassification,
+                    fromPlan,
+                    writePlan,
+                    error: 'missing_write_plan_value',
+                };
             }
             writePlan = value;
             continue;
         }
+        if (arg.startsWith('--external-evidence=')) {
+            const value = arg.slice('--external-evidence='.length);
+            if (value.length === 0) {
+                return {
+                    json,
+                    planOnly,
+                    changed,
+                    reason,
+                    fromClassification,
+                    fromPlan,
+                    writePlan,
+                    externalEvidence,
+                    error: 'missing_external_evidence_value',
+                };
+            }
+            externalEvidence = value;
+            continue;
+        }
+        if (arg.startsWith('--repro-evidence=')) {
+            const value = arg.slice('--repro-evidence='.length);
+            if (value.length === 0) {
+                return {
+                    json,
+                    planOnly,
+                    changed,
+                    reason,
+                    fromClassification,
+                    fromPlan,
+                    writePlan,
+                    reproEvidence,
+                    externalEvidence,
+                    error: 'missing_repro_evidence_value',
+                };
+            }
+            reproEvidence = value;
+            continue;
+        }
         if (arg.startsWith('-')) {
-            return { json, planOnly, changed, reason, fromPlan, writePlan, error: arg };
+            return { json, planOnly, changed, reason, fromClassification, fromPlan, writePlan, reproEvidence, externalEvidence, error: arg };
         }
-        return { json, planOnly, changed, reason, fromPlan, writePlan, error: `unexpected:${arg}` };
+        return {
+            json,
+            planOnly,
+            changed,
+            reason,
+            fromClassification,
+            fromPlan,
+            writePlan,
+            reproEvidence,
+            externalEvidence,
+            error: `unexpected:${arg}`,
+        };
     }
-    return { json, planOnly, changed, reason, fromPlan, writePlan };
+    return { json, planOnly, changed, reason, fromClassification, fromPlan, writePlan, reproEvidence, externalEvidence };
 }
 function uniqueStrings(values) {
     return [...new Set(values.map((value) => value.trim()).filter((value) => value.length > 0))];
@@ -307,6 +460,285 @@ export function readInputFromPlan(projectRoot, inputPath) {
         classificationReport,
     };
 }
+function isExternalEvidenceStatus(value) {
+    return value === 'passed' || value === 'failed' || value === 'cancelled' || value === 'unknown';
+}
+function isLegacyReproEvidenceStatus(value) {
+    return value === 'present' || value === 'unavailable' || value === 'missing';
+}
+function isReproBeforeFixStatus(value) {
+    return value === 'reproduced' || value === 'unavailable' || value === 'missing';
+}
+function isReproBeforeFixOutcome(value) {
+    return value === 'failed_as_expected' || value === 'failed_differently' || value === 'passed_unexpectedly' || value === null;
+}
+function isReproAfterFixStatus(value) {
+    return value === 'passed' || value === 'failed' || value === 'unavailable' || value === 'missing';
+}
+function isReproAfterFixOutcome(value) {
+    return value === 'passed_expected_behavior' || value === 'failed_same_route' || value === 'failed_differently' || value === null;
+}
+function isReproRegressionGuardStatus(value) {
+    return value === 'passed' || value === 'failed' || value === 'unavailable' || value === 'missing';
+}
+function isReproRouteKind(value) {
+    return (value === 'test' ||
+        value === 'cli' ||
+        value === 'browser' ||
+        value === 'api' ||
+        value === 'manual' ||
+        value === 'unknown' ||
+        value === null);
+}
+function readOptionalString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : null;
+}
+function readRouteStep(value, index) {
+    if (!isPlainRecord(value)) {
+        return {
+            ordinal: index + 1,
+            action: null,
+            target: null,
+            input_digest: null,
+            observation_digest: null,
+            summary: null,
+        };
+    }
+    const ordinal = typeof value.ordinal === 'number' && Number.isInteger(value.ordinal) && value.ordinal > 0 ? value.ordinal : index + 1;
+    return {
+        ordinal,
+        action: readOptionalString(value.action),
+        target: readOptionalString(value.target),
+        input_digest: readOptionalString(value.input_digest),
+        observation_digest: readOptionalString(value.observation_digest),
+        summary: readOptionalString(value.summary),
+    };
+}
+function readReproductionRoute(value) {
+    if (!isPlainRecord(value)) {
+        return {
+            route_id: null,
+            route_kind: null,
+            route_digest: null,
+            failure_oracle_hash: null,
+            steps: [],
+        };
+    }
+    const routeKind = value.route_kind ?? null;
+    if (!isReproRouteKind(routeKind)) {
+        throw new Error('invalid_repro_evidence_file');
+    }
+    const rawSteps = Array.isArray(value.steps) ? value.steps : [];
+    return {
+        route_id: readOptionalString(value.route_id),
+        route_kind: routeKind,
+        route_digest: readOptionalString(value.route_digest),
+        failure_oracle_hash: readOptionalString(value.failure_oracle_hash),
+        steps: rawSteps.map((step, index) => readRouteStep(step, index)),
+    };
+}
+function readLegacyReproEvidenceItem(value) {
+    if (!isPlainRecord(value)) {
+        return {
+            status: 'missing',
+            summary: null,
+            reason: null,
+        };
+    }
+    if (!isLegacyReproEvidenceStatus(value.status)) {
+        throw new Error('invalid_repro_evidence_file');
+    }
+    return {
+        status: value.status,
+        summary: readOptionalString(value.summary),
+        reason: readOptionalString(value.reason),
+    };
+}
+function legacyBeforeFixEvidence(value) {
+    const item = readLegacyReproEvidenceItem(value);
+    return {
+        status: item.status === 'present' ? 'reproduced' : item.status,
+        outcome: item.status === 'present' ? 'failed_as_expected' : null,
+        receipt_path: null,
+        receipt_sha256: null,
+        verification_plan_id: null,
+        summary: item.summary,
+        reason: item.reason,
+    };
+}
+function legacyAfterFixEvidence(value) {
+    const item = readLegacyReproEvidenceItem(value);
+    return {
+        status: item.status === 'present' ? 'passed' : item.status,
+        outcome: item.status === 'present' ? 'passed_expected_behavior' : null,
+        same_route_as: null,
+        receipt_path: null,
+        receipt_sha256: null,
+        verification_plan_id: null,
+        summary: item.summary,
+        reason: item.reason,
+    };
+}
+function legacyRegressionGuardEvidence(value) {
+    const item = readLegacyReproEvidenceItem(value);
+    return {
+        status: item.status === 'present' ? 'passed' : item.status,
+        intent: null,
+        test_path: null,
+        receipt_path: null,
+        receipt_sha256: null,
+        verification_plan_id: null,
+        summary: item.summary,
+        reason: item.reason,
+    };
+}
+function readBeforeFixEvidence(value) {
+    if (!isPlainRecord(value)) {
+        return {
+            status: 'missing',
+            outcome: null,
+            receipt_path: null,
+            receipt_sha256: null,
+            verification_plan_id: null,
+            summary: null,
+            reason: null,
+        };
+    }
+    const outcome = value.outcome ?? null;
+    if (!isReproBeforeFixStatus(value.status) || !isReproBeforeFixOutcome(outcome)) {
+        throw new Error('invalid_repro_evidence_file');
+    }
+    return {
+        status: value.status,
+        outcome,
+        receipt_path: readOptionalString(value.receipt_path),
+        receipt_sha256: readOptionalString(value.receipt_sha256),
+        verification_plan_id: readOptionalString(value.verification_plan_id),
+        summary: readOptionalString(value.summary),
+        reason: readOptionalString(value.reason),
+    };
+}
+function readAfterFixEvidence(value) {
+    if (!isPlainRecord(value)) {
+        return {
+            status: 'missing',
+            outcome: null,
+            same_route_as: null,
+            receipt_path: null,
+            receipt_sha256: null,
+            verification_plan_id: null,
+            summary: null,
+            reason: null,
+        };
+    }
+    const outcome = value.outcome ?? null;
+    if (!isReproAfterFixStatus(value.status) || !isReproAfterFixOutcome(outcome)) {
+        throw new Error('invalid_repro_evidence_file');
+    }
+    return {
+        status: value.status,
+        outcome,
+        same_route_as: readOptionalString(value.same_route_as),
+        receipt_path: readOptionalString(value.receipt_path),
+        receipt_sha256: readOptionalString(value.receipt_sha256),
+        verification_plan_id: readOptionalString(value.verification_plan_id),
+        summary: readOptionalString(value.summary),
+        reason: readOptionalString(value.reason),
+    };
+}
+function readRegressionGuardEvidence(value) {
+    if (!isPlainRecord(value)) {
+        return {
+            status: 'missing',
+            intent: null,
+            test_path: null,
+            receipt_path: null,
+            receipt_sha256: null,
+            verification_plan_id: null,
+            summary: null,
+            reason: null,
+        };
+    }
+    if (!isReproRegressionGuardStatus(value.status)) {
+        throw new Error('invalid_repro_evidence_file');
+    }
+    return {
+        status: value.status,
+        intent: readOptionalString(value.intent),
+        test_path: readOptionalString(value.test_path),
+        receipt_path: readOptionalString(value.receipt_path),
+        receipt_sha256: readOptionalString(value.receipt_sha256),
+        verification_plan_id: readOptionalString(value.verification_plan_id),
+        summary: readOptionalString(value.summary),
+        reason: readOptionalString(value.reason),
+    };
+}
+function readReproEvidenceFile(projectRoot, inputPath) {
+    let parsed;
+    const evidencePath = resolvePlanPath(projectRoot, inputPath);
+    try {
+        parsed = JSON.parse(readFileSync(evidencePath, 'utf8'));
+    }
+    catch {
+        throw new Error('invalid_repro_evidence_file');
+    }
+    if (!isPlainRecord(parsed) || parsed.schema_version !== '1' || parsed.command !== 'repro-evidence') {
+        throw new Error('unsupported_repro_evidence_source');
+    }
+    const regressionGuard = isPlainRecord(parsed.regression_guard) && isReproRegressionGuardStatus(parsed.regression_guard.status)
+        ? readRegressionGuardEvidence(parsed.regression_guard)
+        : legacyRegressionGuardEvidence(parsed.regression_guard);
+    return {
+        source: 'repro_first_debug',
+        authority: 'claim_evidence',
+        reported_symptom: readOptionalString(parsed.reported_symptom),
+        expected_behavior: readOptionalString(parsed.expected_behavior),
+        observed_behavior: readOptionalString(parsed.observed_behavior),
+        reproduction_route: readReproductionRoute(parsed.reproduction_route),
+        before_fix: isPlainRecord(parsed.before_fix)
+            ? readBeforeFixEvidence(parsed.before_fix)
+            : legacyBeforeFixEvidence(parsed.evidence_before_fix),
+        after_fix: isPlainRecord(parsed.after_fix)
+            ? readAfterFixEvidence(parsed.after_fix)
+            : legacyAfterFixEvidence(parsed.evidence_after_fix),
+        regression_guard: regressionGuard,
+    };
+}
+function readExternalEvidenceFile(projectRoot, inputPath) {
+    let parsed;
+    const evidencePath = resolvePlanPath(projectRoot, inputPath);
+    try {
+        parsed = JSON.parse(readFileSync(evidencePath, 'utf8'));
+    }
+    catch {
+        throw new Error('invalid_external_evidence_file');
+    }
+    if (!isPlainRecord(parsed) || parsed.schema_version !== '1' || parsed.command !== 'external-evidence') {
+        throw new Error('unsupported_external_evidence_source');
+    }
+    if (!Array.isArray(parsed.checks)) {
+        throw new Error('invalid_external_evidence_file');
+    }
+    return parsed.checks.map((check) => {
+        if (!isPlainRecord(check) ||
+            typeof check.provider !== 'string' ||
+            check.provider.length === 0 ||
+            typeof check.name !== 'string' ||
+            check.name.length === 0 ||
+            !isExternalEvidenceStatus(check.status)) {
+            throw new Error('invalid_external_evidence_file');
+        }
+        return {
+            source: 'external_ci',
+            authority: 'supporting_only',
+            provider: check.provider,
+            name: check.name,
+            status: check.status,
+            url: readOptionalString(check.url),
+            summary: readOptionalString(check.summary),
+        };
+    });
+}
 function createInputFromChanged(projectRoot) {
     const plan = createClassifyOutput(projectRoot, 'changed', []);
     return {
@@ -344,6 +776,9 @@ function skippedResult(candidate) {
         reason: candidate.reason,
         detail: candidate.detail,
         exit_code: null,
+        verification_plan_id: null,
+        receipt_path: null,
+        receipt_sha256: null,
         receipt: null,
     };
 }
@@ -383,7 +818,7 @@ function testTargetsByScheduledIntent(report) {
         candidate.appliedTestTargets.length > 0)
         .map((candidate) => [candidate.intent, candidate.appliedTestTargets]));
 }
-async function runVerificationIntent(intent, lang, testTargets = []) {
+async function runVerificationIntent(intent, lang, verificationPlanId, testTargets = []) {
     const output = createBufferedOutput();
     const exitCode = await runRun([intent, '--json'], output.reporter, lang, {
         writeLatestReceipt: false,
@@ -413,6 +848,9 @@ async function runVerificationIntent(intent, lang, testTargets = []) {
         reason: exitCode === 0 ? null : 'run_failed',
         detail: output.stderr().trim() || null,
         exit_code: exitCode,
+        verification_plan_id: verificationPlanId,
+        receipt_path: null,
+        receipt_sha256: null,
         receipt,
     };
 }
@@ -430,6 +868,210 @@ function summarizeResults(results) {
         skipped,
     };
 }
+function countUndeclaredWriteDrift(results) {
+    return results.filter((result) => {
+        const writeDrift = result.receipt?.write_drift;
+        if (typeof writeDrift !== 'object' || writeDrift === null) {
+            return false;
+        }
+        return writeDrift.has_undeclared_changes === true;
+    }).length;
+}
+function stringField(value) {
+    return typeof value === 'string' && value.length > 0 ? value : null;
+}
+function objectField(value) {
+    return typeof value === 'object' && value !== null ? value : null;
+}
+function performanceForResult(result) {
+    return objectField(result.receipt?.performance);
+}
+function resultSummaryForResult(result) {
+    return objectField(performanceForResult(result)?.result_summary);
+}
+function commandFingerprintForResult(result) {
+    return stringField(performanceForResult(result)?.command_fingerprint);
+}
+function exitCodeClassForResult(result) {
+    const resultSummary = resultSummaryForResult(result);
+    const explicitClass = stringField(resultSummary?.exit_code_class);
+    if (explicitClass) {
+        return explicitClass;
+    }
+    if (result.exit_code === null) {
+        return 'no_exit_code';
+    }
+    return result.exit_code === 0 ? 'success' : 'failure';
+}
+function timedOutForResult(result) {
+    const resultSummary = resultSummaryForResult(result);
+    return result.status === 'timed_out' || resultSummary?.timed_out === true;
+}
+function errorKindForResult(result) {
+    return stringField(resultSummaryForResult(result)?.error_kind) ?? (result.status === 'start_failed' ? 'start_failed' : null);
+}
+function failedResults(results) {
+    return results.filter((result) => !result.skipped &&
+        (result.status === 'failed' || result.status === 'timed_out' || result.status === 'start_failed'));
+}
+function createFailureFingerprintForVerify(input) {
+    const failures = failedResults(input.results);
+    return createVerificationFailureFingerprint({
+        verificationPlanId: input.verificationPlanId,
+        failedIntents: failures.map((result) => result.intent).filter((intent) => intent !== null),
+        exitCodeClasses: failures.map(exitCodeClassForResult).filter((value) => value !== null),
+        timeoutFlags: failures.map(timedOutForResult),
+        errorKinds: failures.map(errorKindForResult).filter((value) => value !== null),
+        riskCodes: input.riskCodes,
+        affectedSurfaces: input.report.requirements.flatMap((requirement) => requirement.surfaces),
+        commandFingerprints: failures.map(commandFingerprintForResult).filter((value) => value !== null),
+    });
+}
+function riskCodesForFailureFingerprint(input) {
+    const writeDriftRiskCodes = countUndeclaredWriteDrift(input.results) > 0 ? ['undeclared_write_drift'] : [];
+    return [
+        ...input.sourceAnchorRisks.map(() => 'source_anchor_invariant_review_required'),
+        ...input.scopeDiffRisks.map((risk) => risk.code),
+        ...input.validationRatchetRisks.map((risk) => risk.code),
+        ...input.reproEvidenceRisks.map((risk) => risk.code),
+        ...input.externalEvidenceRisks.map((risk) => risk.code),
+        ...writeDriftRiskCodes,
+    ];
+}
+function createReceiptBindingEvidence(results, verificationPlanId) {
+    let planBoundCount = 0;
+    let planUnboundCount = 0;
+    let fingerprintBoundCount = 0;
+    let fingerprintUnboundCount = 0;
+    let currentStateBoundCount = 0;
+    let currentStateUnavailableCount = 0;
+    let staleCount = 0;
+    let planMismatchCount = 0;
+    for (const result of results) {
+        if (!result.receipt) {
+            continue;
+        }
+        const receiptPlanId = stringField(result.receipt.verification_plan_id);
+        const resultPlanId = result.verification_plan_id;
+        const resultPlanMatches = resultPlanId === verificationPlanId;
+        const receiptPlanMatches = receiptPlanId === verificationPlanId;
+        if (resultPlanMatches && receiptPlanMatches) {
+            planBoundCount += 1;
+        }
+        else if ((typeof resultPlanId === 'string' && resultPlanId !== verificationPlanId) ||
+            (receiptPlanId !== null && receiptPlanId !== verificationPlanId)) {
+            planMismatchCount += 1;
+        }
+        else {
+            planUnboundCount += 1;
+        }
+        const performance = objectField(result.receipt.performance);
+        const hasFingerprints = performance !== null &&
+            stringField(performance.command_fingerprint) !== null &&
+            stringField(performance.intent_fingerprint) !== null &&
+            stringField(performance.contract_fingerprint) !== null;
+        if (hasFingerprints) {
+            fingerprintBoundCount += 1;
+        }
+        else {
+            fingerprintUnboundCount += 1;
+        }
+        const currentStateBinding = stringField(result.receipt.head_tree_hash) ??
+            stringField(result.receipt.changed_files_hash) ??
+            stringField(result.receipt.current_state_hash);
+        if (currentStateBinding !== null) {
+            currentStateBoundCount += 1;
+        }
+        else {
+            currentStateUnavailableCount += 1;
+        }
+        if (!result.receipt_path || !result.receipt_sha256) {
+            staleCount += 1;
+        }
+    }
+    return {
+        plan_bound_count: planBoundCount,
+        plan_unbound_count: planUnboundCount,
+        fingerprint_bound_count: fingerprintBoundCount,
+        fingerprint_unbound_count: fingerprintUnboundCount,
+        current_state_bound_count: currentStateBoundCount,
+        current_state_unavailable_count: currentStateUnavailableCount,
+        stale_count: staleCount,
+        plan_mismatch_count: planMismatchCount,
+    };
+}
+function resultForSelectedIntent(results, intent) {
+    return results.find((result) => result.intent === intent && result.status !== 'skipped') ?? null;
+}
+function createCriteriaEvidence(report, results) {
+    const evidence = {
+        total: report.requirements.length,
+        covered: 0,
+        partially_covered: 0,
+        uncovered: 0,
+        blocked: 0,
+        contradicted: 0,
+    };
+    return report.requirements.reduce((current, requirement) => {
+        const candidates = report.candidates.filter((candidate) => candidate.reason === requirement.reason);
+        const selectedIntents = candidates
+            .filter((candidate) => candidate.selectionState === 'selected')
+            .map((candidate) => candidate.intent)
+            .filter((intent) => intent !== null);
+        const skippedIntents = candidates
+            .filter((candidate) => candidate.status !== 'runnable')
+            .map((candidate) => candidate.intent)
+            .filter((intent) => intent !== null);
+        const gapCount = report.gaps.filter((gap) => gap.reason === requirement.reason).length;
+        const selectedResults = selectedIntents.map((intent) => resultForSelectedIntent(results, intent));
+        if (selectedResults.some((result) => result?.status === 'failed' || result?.status === 'timed_out' || result?.status === 'start_failed')) {
+            return { ...current, contradicted: current.contradicted + 1 };
+        }
+        if (gapCount > 0 || (selectedIntents.length === 0 && skippedIntents.length > 0)) {
+            return { ...current, blocked: current.blocked + 1 };
+        }
+        if (selectedIntents.length === 0) {
+            return { ...current, uncovered: current.uncovered + 1 };
+        }
+        if (skippedIntents.length > 0) {
+            return { ...current, partially_covered: current.partially_covered + 1 };
+        }
+        if (selectedResults.every((result) => result?.status === 'passed')) {
+            return { ...current, covered: current.covered + 1 };
+        }
+        return { ...current, uncovered: current.uncovered + 1 };
+    }, evidence);
+}
+function createCompletionVerdictForResults(input) {
+    const receiptBinding = createReceiptBindingEvidence(input.results, input.verificationPlanId);
+    const receiptBindingRiskCount = receiptBinding.plan_unbound_count + receiptBinding.fingerprint_unbound_count;
+    const repeatedFailureBlockerCount = input.repeatedFailureRisks.filter((risk) => risk.verdict_effect === 'blocker').length;
+    return createVerifyCompletionVerdict({
+        verificationPlanId: input.verificationPlanId,
+        matchedIntents: input.summary.matched,
+        ranIntents: input.summary.ran,
+        passedIntents: input.summary.passed,
+        failedIntents: input.summary.failed,
+        skippedIntents: input.summary.skipped,
+        receiptCount: input.results.filter((result) => result.receipt !== null).length,
+        sourceAnchorRiskCount: input.sourceAnchorRiskCount,
+        scopeDiffRiskCount: input.scopeDiffRiskCount,
+        repeatedFailureCount: input.repeatedFailureRisks.length,
+        repeatedFailureBlockerCount,
+        validationRatchetRiskCount: input.validationRatchetRiskCount,
+        validationRatchetContradictionCount: input.validationRatchetContradictionCount,
+        reproEvidenceRiskCount: input.reproEvidenceRiskCount,
+        reproEvidenceContradictionCount: input.reproEvidenceContradictionCount,
+        reproEvidenceUnverifiedCount: input.reproEvidenceUnverifiedCount,
+        externalEvidenceRiskCount: input.externalEvidenceRiskCount,
+        writeDriftRiskCount: countUndeclaredWriteDrift(input.results),
+        receiptBindingRiskCount,
+        staleReceiptCount: receiptBinding.stale_count,
+        planMismatchCount: receiptBinding.plan_mismatch_count,
+        criteria: createCriteriaEvidence(input.report, input.results),
+        receiptBinding,
+    });
+}
 function getVerificationStatus(summary) {
     if (summary.failed > 0) {
         return 'failed';
@@ -442,35 +1084,223 @@ function getVerificationStatus(summary) {
     }
     return 'passed';
 }
-function writeVerifyRunReceipts(projectRoot, output) {
+function isVerificationStatus(value) {
+    return value === 'passed' || value === 'partial' || value === 'failed' || value === 'blocked';
+}
+function readVerificationFailureFingerprint(value) {
+    const record = objectField(value);
+    if (record?.schema_version !== '1' ||
+        typeof record.fingerprint !== 'string' ||
+        typeof record.verification_plan_id !== 'string' ||
+        typeof record.failed_intents_hash !== 'string' ||
+        typeof record.exit_code_classes_hash !== 'string' ||
+        typeof record.timeout_flags_hash !== 'string' ||
+        typeof record.error_kinds_hash !== 'string' ||
+        typeof record.diagnostic_hash !== 'string' ||
+        typeof record.risk_codes_hash !== 'string' ||
+        typeof record.affected_surfaces_hash !== 'string' ||
+        typeof record.command_fingerprints_hash !== 'string') {
+        return null;
+    }
+    return {
+        schema_version: '1',
+        fingerprint: record.fingerprint,
+        verification_plan_id: record.verification_plan_id,
+        failed_intents_hash: record.failed_intents_hash,
+        exit_code_classes_hash: record.exit_code_classes_hash,
+        timeout_flags_hash: record.timeout_flags_hash,
+        error_kinds_hash: record.error_kinds_hash,
+        diagnostic_hash: record.diagnostic_hash,
+        risk_codes_hash: record.risk_codes_hash,
+        affected_surfaces_hash: record.affected_surfaces_hash,
+        command_fingerprints_hash: record.command_fingerprints_hash,
+    };
+}
+function readPreviousVerifyLatestSummary(projectRoot) {
+    try {
+        const parsed = JSON.parse(readFileSync(path.join(projectRoot, LATEST_RUN_RECEIPT_PATH), 'utf8'));
+        if (parsed.command !== 'verify' ||
+            parsed.kind !== 'verify_run_summary' ||
+            typeof parsed.verification_plan_id !== 'string' ||
+            !isVerificationStatus(parsed.status)) {
+            return null;
+        }
+        return {
+            verification_plan_id: parsed.verification_plan_id,
+            status: parsed.status,
+            failure_fingerprint: readVerificationFailureFingerprint(parsed.failure_fingerprint),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function hashTextSha256(content) {
+    return `sha256:${createHash('sha256').update(content).digest('hex')}`;
+}
+function stableJson(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map((entry) => stableJson(entry)).join(',')}]`;
+    }
+    if (value && typeof value === 'object') {
+        const record = value;
+        return `{${Object.keys(record)
+            .sort((left, right) => left.localeCompare(right))
+            .map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(value) ?? 'null';
+}
+function getCandidateIntentNames(report) {
+    return [...new Set(report.candidates.map((candidate) => candidate.intent).filter((intent) => Boolean(intent)))]
+        .sort((left, right) => left.localeCompare(right));
+}
+function createVerificationPlanId(report, contract) {
+    const relatedIntents = Object.fromEntries(getCandidateIntentNames(report).map((intent) => [intent, contract.intents[intent] ?? null]));
+    const fingerprintSource = {
+        schema_version: '1',
+        algorithm: 'mustflow.verify_plan_id.v1',
+        report: {
+            source: report.source,
+            files: report.files,
+            classification_summary: report.classification_summary,
+            requirements: report.requirements,
+            candidates: report.candidates,
+            gaps: report.gaps,
+            schedule: report.schedule,
+            test_selection: report.test_selection,
+        },
+        command_contract: {
+            defaults: contract.defaults,
+            resources: contract.resources,
+            intents: relatedIntents,
+        },
+    };
+    return hashTextSha256(stableJson(fingerprintSource));
+}
+function writeVerifyRunReceipts(projectRoot, output, report, sourceAnchorRisks, scopeDiffRisks, validationRatchetRisks, reproEvidence, externalChecks) {
     const runDir = path.join(projectRoot, VERIFY_RUN_DIR);
     const intentDir = path.join(runDir, 'intents');
     const receipts = [];
+    const results = [];
     rmSync(runDir, { recursive: true, force: true });
     mkdirSync(intentDir, { recursive: true });
     for (const [index, result] of output.results.entries()) {
         let receiptPath = null;
+        let receiptSha256 = null;
+        let receipt = result.receipt;
         if (result.intent && result.receipt) {
             const fileName = `${String(index + 1).padStart(3, '0')}-${sanitizeIntentFilePart(result.intent)}.json`;
             const absoluteReceiptPath = path.join(intentDir, fileName);
             receiptPath = toPosixPath(path.join(VERIFY_RUN_DIR, 'intents', fileName));
-            writeFileSync(absoluteReceiptPath, `${JSON.stringify({ ...result.receipt, receipt_path: receiptPath }, null, 2)}\n`, 'utf8');
+            receipt = {
+                ...result.receipt,
+                verification_plan_id: output.verification_plan_id,
+                receipt_path: receiptPath,
+            };
+            const receiptContent = `${JSON.stringify(receipt, null, 2)}\n`;
+            receiptSha256 = hashTextSha256(receiptContent);
+            writeFileSync(absoluteReceiptPath, receiptContent, 'utf8');
         }
         receipts.push({
             intent: result.intent,
             status: result.status,
             skipped: result.skipped,
+            verification_plan_id: result.skipped ? null : output.verification_plan_id,
             receipt_path: receiptPath,
+            receipt_sha256: receiptSha256,
+        });
+        results.push({
+            ...result,
+            verification_plan_id: result.skipped ? null : output.verification_plan_id,
+            receipt_path: receiptPath,
+            receipt_sha256: receiptSha256,
+            receipt,
         });
     }
+    const reproEvidenceRisks = createReproEvidenceRisks(reproEvidence, {
+        verificationPlanId: output.verification_plan_id,
+    });
+    const reproEvidenceVerdictEffects = countReproEvidenceVerdictEffects(reproEvidenceRisks);
+    const validationRatchetVerdictEffects = countValidationRatchetVerdictEffects(validationRatchetRisks);
+    const externalEvidenceRisks = createExternalEvidenceRisks(externalChecks);
+    const failureFingerprint = createFailureFingerprintForVerify({
+        verificationPlanId: output.verification_plan_id,
+        report,
+        results,
+        riskCodes: riskCodesForFailureFingerprint({
+            sourceAnchorRisks,
+            scopeDiffRisks,
+            validationRatchetRisks,
+            reproEvidenceRisks,
+            externalEvidenceRisks,
+            results,
+        }),
+    });
+    const repeatedFailureSummary = updateRepeatedFailureState({
+        projectRoot,
+        failureFingerprint,
+        status: output.status,
+    });
+    const previousVerifyLatest = readPreviousVerifyLatestSummary(projectRoot);
+    const finalRepeatedFailureRisks = createRepeatedFailureRisks({
+        previousFailureFingerprint: previousVerifyLatest?.failure_fingerprint ?? null,
+        previousStatus: previousVerifyLatest?.status ?? null,
+        currentFailureFingerprint: failureFingerprint,
+        currentStatus: output.status,
+        currentSummary: repeatedFailureSummary,
+    });
+    const completionVerdict = createCompletionVerdictForResults({
+        report,
+        verificationPlanId: output.verification_plan_id,
+        summary: output.summary,
+        results,
+        sourceAnchorRiskCount: sourceAnchorRisks.length,
+        scopeDiffRiskCount: scopeDiffRisks.length,
+        repeatedFailureRisks: finalRepeatedFailureRisks,
+        validationRatchetRiskCount: validationRatchetRisks.length,
+        validationRatchetContradictionCount: validationRatchetVerdictEffects.contradicted,
+        reproEvidenceRiskCount: reproEvidenceRisks.length,
+        reproEvidenceContradictionCount: reproEvidenceVerdictEffects.contradicted,
+        reproEvidenceUnverifiedCount: reproEvidenceVerdictEffects.unverified,
+        externalEvidenceRiskCount: externalEvidenceRisks.length,
+    });
+    const outputWithReceiptPaths = {
+        ...output,
+        completion_verdict: completionVerdict,
+        failure_fingerprint: failureFingerprint,
+        repeated_failure_summary: repeatedFailureSummary,
+        results,
+        evidence_model: createVerifyEvidenceModel({
+            report,
+            results,
+            verificationPlanId: output.verification_plan_id,
+            verdict: completionVerdict,
+            sourceAnchorRisks,
+            scopeDiffRisks,
+            repeatedFailureRisks: finalRepeatedFailureRisks,
+            validationRatchetRisks,
+            reproEvidence,
+            reproEvidenceRisks,
+            externalChecks,
+            externalEvidenceRisks,
+        }),
+    };
     const manifest = {
         schema_version: '1',
         command: 'verify',
-        reason: output.reason,
-        reasons: output.reasons,
-        plan_source: output.plan_source,
-        status: output.status,
-        summary: output.summary,
+        reason: outputWithReceiptPaths.reason,
+        reasons: outputWithReceiptPaths.reasons,
+        plan_source: outputWithReceiptPaths.plan_source,
+        verification_plan_id: outputWithReceiptPaths.verification_plan_id,
+        status: outputWithReceiptPaths.status,
+        completion_verdict: outputWithReceiptPaths.completion_verdict,
+        evidence_model: outputWithReceiptPaths.evidence_model,
+        failure_fingerprint: outputWithReceiptPaths.failure_fingerprint,
+        repeated_failure_summary: outputWithReceiptPaths.repeated_failure_summary,
+        summary: outputWithReceiptPaths.summary,
+        ...(outputWithReceiptPaths.repro_evidence ? { repro_evidence: outputWithReceiptPaths.repro_evidence } : {}),
+        ...(outputWithReceiptPaths.external_checks ? { external_checks: outputWithReceiptPaths.external_checks } : {}),
         receipts,
     };
     writeFileSync(path.join(runDir, 'manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
@@ -478,27 +1308,93 @@ function writeVerifyRunReceipts(projectRoot, output) {
         schema_version: '1',
         command: 'verify',
         kind: 'verify_run_summary',
-        reason: output.reason,
-        reasons: output.reasons,
-        plan_source: output.plan_source,
-        status: output.status,
-        summary: output.summary,
+        reason: outputWithReceiptPaths.reason,
+        reasons: outputWithReceiptPaths.reasons,
+        plan_source: outputWithReceiptPaths.plan_source,
+        verification_plan_id: outputWithReceiptPaths.verification_plan_id,
+        status: outputWithReceiptPaths.status,
+        completion_verdict: outputWithReceiptPaths.completion_verdict,
+        evidence_model: outputWithReceiptPaths.evidence_model,
+        failure_fingerprint: outputWithReceiptPaths.failure_fingerprint,
+        repeated_failure_summary: outputWithReceiptPaths.repeated_failure_summary,
+        summary: outputWithReceiptPaths.summary,
+        ...(outputWithReceiptPaths.repro_evidence ? { repro_evidence: outputWithReceiptPaths.repro_evidence } : {}),
+        ...(outputWithReceiptPaths.external_checks ? { external_checks: outputWithReceiptPaths.external_checks } : {}),
         run_dir: toPosixPath(VERIFY_RUN_DIR),
-        manifest_path: toPosixPath(path.join(VERIFY_RUN_DIR, 'manifest.json')),
+        manifest_path: toPosixPath(VERIFY_MANIFEST_PATH),
     };
     writeFileSync(path.join(projectRoot, LATEST_RUN_RECEIPT_PATH), `${JSON.stringify(latest, null, 2)}\n`, 'utf8');
+    return outputWithReceiptPaths;
 }
-async function createVerifyOutput(input, planSource, projectRoot, lang) {
+async function createVerifyOutput(input, planSource, projectRoot, lang, reproEvidence = null, externalChecks = []) {
     const contract = readCommandContract(projectRoot);
     const report = createChangeVerificationReport(input.classificationReport, contract, projectRoot);
+    const verificationPlanId = createVerificationPlanId(report, contract);
     const scheduledIntents = new Set(report.schedule.entries.map((entry) => entry.intent));
     const scheduledTestTargets = testTargetsByScheduledIntent(report);
+    const sourceAnchorRisks = await readLocalSourceAnchorVerdictRisks(projectRoot, report.files);
+    const scopeDiffRisks = createScopeDiffRisks(input.classificationReport);
+    const validationRatchetRisks = createValidationRatchetRisks(input.classificationReport, projectRoot);
+    const validationRatchetVerdictEffects = countValidationRatchetVerdictEffects(validationRatchetRisks);
+    const reproEvidenceRisks = createReproEvidenceRisks(reproEvidence, { verificationPlanId });
+    const reproEvidenceVerdictEffects = countReproEvidenceVerdictEffects(reproEvidenceRisks);
+    const externalEvidenceRisks = createExternalEvidenceRisks(externalChecks);
     const results = [];
     for (const entry of report.schedule.entries) {
-        results.push(await runVerificationIntent(entry.intent, lang, scheduledTestTargets.get(entry.intent) ?? []));
+        results.push(await runVerificationIntent(entry.intent, lang, verificationPlanId, scheduledTestTargets.get(entry.intent) ?? []));
     }
     results.push(...createSkippedResults(report.candidates, scheduledIntents, report.gaps));
     const summary = summarizeResults(results);
+    const status = getVerificationStatus(summary);
+    const previousVerifyLatest = readPreviousVerifyLatestSummary(projectRoot);
+    const failureFingerprint = createFailureFingerprintForVerify({
+        verificationPlanId,
+        report,
+        results,
+        riskCodes: riskCodesForFailureFingerprint({
+            sourceAnchorRisks,
+            scopeDiffRisks,
+            validationRatchetRisks,
+            reproEvidenceRisks,
+            externalEvidenceRisks,
+            results,
+        }),
+    });
+    const repeatedFailureRisks = createRepeatedFailureRisks({
+        previousFailureFingerprint: previousVerifyLatest?.failure_fingerprint ?? null,
+        previousStatus: previousVerifyLatest?.status ?? null,
+        currentFailureFingerprint: failureFingerprint,
+        currentStatus: status,
+    });
+    const completionVerdict = createCompletionVerdictForResults({
+        report,
+        verificationPlanId,
+        summary,
+        results,
+        sourceAnchorRiskCount: sourceAnchorRisks.length,
+        scopeDiffRiskCount: scopeDiffRisks.length,
+        repeatedFailureRisks,
+        validationRatchetRiskCount: validationRatchetRisks.length,
+        validationRatchetContradictionCount: validationRatchetVerdictEffects.contradicted,
+        reproEvidenceRiskCount: reproEvidenceRisks.length,
+        reproEvidenceContradictionCount: reproEvidenceVerdictEffects.contradicted,
+        reproEvidenceUnverifiedCount: reproEvidenceVerdictEffects.unverified,
+        externalEvidenceRiskCount: externalEvidenceRisks.length,
+    });
+    const evidenceModel = createVerifyEvidenceModel({
+        report,
+        results,
+        verificationPlanId,
+        verdict: completionVerdict,
+        sourceAnchorRisks,
+        scopeDiffRisks,
+        repeatedFailureRisks,
+        validationRatchetRisks,
+        reproEvidence,
+        reproEvidenceRisks,
+        externalChecks,
+        externalEvidenceRisks,
+    });
     const output = {
         schema_version: VERIFY_SCHEMA_VERSION,
         command: 'verify',
@@ -506,16 +1402,25 @@ async function createVerifyOutput(input, planSource, projectRoot, lang) {
         reason: input.reasons.join(', '),
         reasons: input.reasons,
         plan_source: planSource,
-        status: getVerificationStatus(summary),
+        verification_plan_id: verificationPlanId,
+        status,
+        completion_verdict: completionVerdict,
+        evidence_model: evidenceModel,
+        failure_fingerprint: failureFingerprint,
+        repeated_failure_summary: null,
         summary,
+        ...(reproEvidence ? { repro_evidence: reproEvidence } : {}),
+        ...(externalChecks.length > 0 ? { external_checks: externalChecks } : {}),
+        run_dir: toPosixPath(VERIFY_RUN_DIR),
+        manifest_path: toPosixPath(VERIFY_MANIFEST_PATH),
         results,
     };
-    writeVerifyRunReceipts(projectRoot, output);
-    return output;
+    return writeVerifyRunReceipts(projectRoot, output, report, sourceAnchorRisks, scopeDiffRisks, validationRatchetRisks, reproEvidence, externalChecks);
 }
 async function createPlanOnlyOutput(input, projectRoot) {
     const contract = readCommandContract(projectRoot);
     const report = createChangeVerificationReport(input.classificationReport, contract, projectRoot);
+    const verificationPlanId = createVerificationPlanId(report, contract);
     const localSurfaceReadModels = await readLocalPathSurfaces(projectRoot, report.files);
     const [firstEntry] = report.schedule.entries;
     const requirements = report.requirements.map((requirement) => {
@@ -525,7 +1430,7 @@ async function createPlanOnlyOutput(input, projectRoot) {
         return surfaceReadModels.length > 0 ? { ...requirement, surfaceReadModels } : requirement;
     });
     if (!firstEntry) {
-        return { ...report, requirements };
+        return { ...report, verification_plan_id: verificationPlanId, requirements };
     }
     const firstGraph = await readLocalCommandEffectGraph(projectRoot, firstEntry.intent);
     const graphsByIntent = new Map([[firstEntry.intent, firstGraph]]);
@@ -538,6 +1443,7 @@ async function createPlanOnlyOutput(input, projectRoot) {
     }
     return {
         ...report,
+        verification_plan_id: verificationPlanId,
         requirements,
         schedule: {
             ...report.schedule,
@@ -555,6 +1461,7 @@ function renderVerifyOutput(output, lang) {
         `${t(lang, 'verify.label.reason')}: ${output.reason}`,
         `${t(lang, 'verify.label.planSource')}: ${output.plan_source ?? t(lang, 'value.none')}`,
         `${t(lang, 'verify.label.status')}: ${output.status}`,
+        `completion verdict: ${output.completion_verdict.status} (${output.completion_verdict.primary_reason})`,
         `matched: ${output.summary.matched}`,
         `ran: ${output.summary.ran}`,
         `passed: ${output.summary.passed}`,
@@ -579,17 +1486,28 @@ export async function runVerify(args, reporter, lang = 'en') {
     if (parsed.error) {
         const message = parsed.error === 'missing_reason_value'
             ? t(lang, 'cli.error.missingValue', { option: '--reason' })
-            : parsed.error === 'missing_from_plan_value'
-                ? t(lang, 'cli.error.missingValue', { option: '--from-plan' })
-                : parsed.error === 'missing_write_plan_value'
-                    ? t(lang, 'cli.error.missingValue', { option: '--write-plan' })
-                    : parsed.error.startsWith('unexpected:')
-                        ? t(lang, 'cli.error.unexpectedArgument', { argument: parsed.error.slice('unexpected:'.length) })
-                        : t(lang, 'cli.error.unknownOption', { option: parsed.error });
+            : parsed.error === 'missing_from_classification_value'
+                ? t(lang, 'cli.error.missingValue', { option: '--from-classification' })
+                : parsed.error === 'missing_from_plan_value'
+                    ? t(lang, 'cli.error.missingValue', { option: '--from-plan' })
+                    : parsed.error === 'missing_write_plan_value'
+                        ? t(lang, 'cli.error.missingValue', { option: '--write-plan' })
+                        : parsed.error === 'missing_repro_evidence_value'
+                            ? t(lang, 'cli.error.missingValue', { option: '--repro-evidence' })
+                            : parsed.error === 'missing_external_evidence_value'
+                                ? t(lang, 'cli.error.missingValue', { option: '--external-evidence' })
+                                : parsed.error.startsWith('unexpected:')
+                                    ? t(lang, 'cli.error.unexpectedArgument', { argument: parsed.error.slice('unexpected:'.length) })
+                                    : t(lang, 'cli.error.unknownOption', { option: parsed.error });
         printUsageError(reporter, message, 'mf verify --help', getVerifyHelp(lang), lang);
         return 1;
     }
-    const selectedInputCount = [parsed.reason, parsed.fromPlan, parsed.changed ? 'changed' : undefined].filter(Boolean).length;
+    const selectedInputCount = [
+        parsed.reason,
+        parsed.fromClassification,
+        parsed.fromPlan,
+        parsed.changed ? 'changed' : undefined,
+    ].filter(Boolean).length;
     if (selectedInputCount > 1) {
         printUsageError(reporter, t(lang, 'verify.error.conflictingInputs'), 'mf verify --help', getVerifyHelp(lang), lang);
         return 1;
@@ -606,17 +1524,27 @@ export async function runVerify(args, reporter, lang = 'en') {
         printUsageError(reporter, t(lang, 'verify.error.planOnlyJson'), 'mf verify --help', getVerifyHelp(lang), lang);
         return 1;
     }
+    if (parsed.planOnly && parsed.reproEvidence) {
+        printUsageError(reporter, t(lang, 'verify.error.reproEvidenceRequiresRun'), 'mf verify --help', getVerifyHelp(lang), lang);
+        return 1;
+    }
+    if (parsed.planOnly && parsed.externalEvidence) {
+        printUsageError(reporter, t(lang, 'verify.error.externalEvidenceRequiresRun'), 'mf verify --help', getVerifyHelp(lang), lang);
+        return 1;
+    }
     const projectRoot = resolveMustflowRoot();
     let input;
     let changedPlan = null;
+    let reproEvidence = null;
+    let externalChecks = [];
     try {
         if (parsed.changed) {
             const changedInput = createInputFromChanged(projectRoot);
             input = changedInput.input;
             changedPlan = changedInput.plan;
         }
-        else if (parsed.fromPlan) {
-            input = readInputFromPlan(projectRoot, parsed.fromPlan);
+        else if (parsed.fromClassification || parsed.fromPlan) {
+            input = readInputFromPlan(projectRoot, (parsed.fromClassification ?? parsed.fromPlan));
         }
         else {
             input = {
@@ -627,17 +1555,32 @@ export async function runVerify(args, reporter, lang = 'en') {
         if (parsed.writePlan && changedPlan) {
             writeChangedPlan(projectRoot, parsed.writePlan, changedPlan);
         }
+        if (parsed.reproEvidence) {
+            reproEvidence = readReproEvidenceFile(projectRoot, parsed.reproEvidence);
+        }
+        if (parsed.externalEvidence) {
+            externalChecks = readExternalEvidenceFile(projectRoot, parsed.externalEvidence);
+        }
     }
     catch (error) {
         const code = error instanceof Error ? error.message : 'invalid_plan_file';
-        printUsageError(reporter, t(lang, planErrorMessageKey(code)), 'mf verify --help', getVerifyHelp(lang), lang);
+        const message = code === 'invalid_repro_evidence_file'
+            ? t(lang, 'verify.error.invalid_repro_evidence_file')
+            : code === 'unsupported_repro_evidence_source'
+                ? t(lang, 'verify.error.unsupported_repro_evidence_source')
+                : code === 'invalid_external_evidence_file'
+                    ? t(lang, 'verify.error.invalid_external_evidence_file')
+                    : code === 'unsupported_external_evidence_source'
+                        ? t(lang, 'verify.error.unsupported_external_evidence_source')
+                        : t(lang, planErrorMessageKey(code));
+        printUsageError(reporter, message, 'mf verify --help', getVerifyHelp(lang), lang);
         return 1;
     }
     if (parsed.planOnly) {
         reporter.stdout(JSON.stringify(await createPlanOnlyOutput(input, projectRoot), null, 2));
         return 0;
     }
-    const output = await createVerifyOutput(input, parsed.fromPlan ?? (parsed.changed ? 'changed' : null), projectRoot, lang);
+    const output = await createVerifyOutput(input, parsed.fromClassification ?? parsed.fromPlan ?? (parsed.changed ? 'changed' : null), projectRoot, lang, reproEvidence, externalChecks);
     if (parsed.json) {
         reporter.stdout(JSON.stringify(output, null, 2));
     }