owlrunkit 0.18.1 → 0.18.3

package/scripts/runkit-contract/quick-receipt.mjs

@@ -16,6 +16,8 @@ import path from "node:path";
 import { sha256Bytes } from "./quick-canonical.mjs";
 
 const QUICK_ROOT = ".owlcoda/runkit/quick";
+const OUTPUT_SUMMARY_BYTES = 16 * 1024;
+const OUTPUT_SUMMARY_LINES = 3;
 
 function withinRoot(root, candidate) {
   const remainder = path.relative(root, candidate);
@@ -87,12 +89,56 @@ export function closeQuickOutputFiles(store) {
   closeSync(store.stderrFd);
 }
 
+function cleanOutputLine(line) {
+  const withoutAnsi = line.replace(/\u001b\[[0-?]*[ -/]*[@-~]/gu, "");
+  return [...withoutAnsi]
+    .filter((character) => character === "\t" || character.codePointAt(0) >= 32)
+    .join("")
+    .trim();
+}
+
+function cleanOutputLines(text) {
+  return text
+    .split(/\r?\n/u)
+    .map(cleanOutputLine)
+    .filter(Boolean);
+}
+
+function summarizeOutputBytes(bytes) {
+  if (bytes.byteLength <= OUTPUT_SUMMARY_BYTES) {
+    const lines = cleanOutputLines(bytes.toString("utf8"));
+    return {
+      headLines: lines.slice(0, OUTPUT_SUMMARY_LINES),
+      tailLines: lines.slice(-OUTPUT_SUMMARY_LINES),
+      truncated: lines.length > OUTPUT_SUMMARY_LINES * 2,
+    };
+  }
+
+  const windowBytes = Math.floor(OUTPUT_SUMMARY_BYTES / 2);
+  let headText = bytes.subarray(0, windowBytes).toString("utf8");
+  const lastHeadBreak = headText.lastIndexOf("\n");
+  if (lastHeadBreak >= 0) headText = headText.slice(0, lastHeadBreak + 1);
+
+  let tailText = bytes.subarray(bytes.byteLength - windowBytes).toString("utf8");
+  const firstTailBreak = tailText.indexOf("\n");
+  if (firstTailBreak >= 0) tailText = tailText.slice(firstTailBreak + 1);
+
+  return {
+    headLines: cleanOutputLines(headText).slice(0, OUTPUT_SUMMARY_LINES),
+    tailLines: cleanOutputLines(tailText).slice(-OUTPUT_SUMMARY_LINES),
+    truncated: true,
+  };
+}
+
 function outputArtifact(workspaceRoot, filePath) {
   const bytes = readFileSync(filePath);
   return {
-    path: path.relative(realpathSync(workspaceRoot), filePath).split(path.sep).join("/"),
-    sha256: sha256Bytes(bytes),
-    sizeBytes: bytes.byteLength,
+    artifact: {
+      path: path.relative(realpathSync(workspaceRoot), filePath).split(path.sep).join("/"),
+      sha256: sha256Bytes(bytes),
+      sizeBytes: bytes.byteLength,
+    },
+    summary: summarizeOutputBytes(bytes),
   };
 }
 
@@ -115,15 +161,66 @@ function validateQuickReceiptStore(workspaceRoot, store) {
   assertStorePath(root, store.receiptRoot, store.receiptRootIdentity, "directory");
   assertStorePath(root, store.stdoutPath, store.stdoutIdentity, "file");
   assertStorePath(root, store.stderrPath, store.stderrIdentity, "file");
+  if (store.stdinPath !== undefined) {
+    assertStorePath(root, store.stdinPath, store.stdinIdentity, "file");
+    const bytes = readFileSync(store.stdinPath);
+    if (
+      bytes.byteLength !== store.stdinArtifact.sizeBytes
+      || sha256Bytes(bytes) !== store.stdinArtifact.sha256
+    ) {
+      throw new Error(`Quick receipt store stdin material changed: ${store.stdinPath}`);
+    }
+  }
+}
+
+export function persistQuickInputArtifact({ workspaceRoot, store, bytes }) {
+  if (!Buffer.isBuffer(bytes)) throw new Error("Quick stdin material must be bytes.");
+  validateQuickReceiptStore(workspaceRoot, store);
+  const stdinPath = path.join(store.receiptRoot, "stdin.bin");
+  writeFileSync(stdinPath, bytes, { flag: "wx", mode: 0o600 });
+  const stat = lstatSync(stdinPath);
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    throw new Error(`Quick receipt store stdin material is not trusted: ${stdinPath}`);
+  }
+  const root = realpathSync(workspaceRoot);
+  const resolved = realpathSync(stdinPath);
+  if (!withinRoot(root, resolved)) {
+    throw new Error(`Quick receipt store stdin material escapes the workspace: ${stdinPath}`);
+  }
+  store.stdinPath = stdinPath;
+  store.stdinIdentity = { dev: stat.dev, ino: stat.ino };
+  store.stdinArtifact = {
+    path: path.relative(root, resolved).split(path.sep).join("/"),
+    sha256: sha256Bytes(bytes),
+    sizeBytes: bytes.byteLength,
+  };
+  return {
+    artifact: store.stdinArtifact,
+    inputPath: stdinPath,
+  };
 }
 
 export function persistQuickReceipt({ workspaceRoot, store, receipt }) {
   validateQuickReceiptStore(workspaceRoot, store);
+  const receiptStdin = receipt.inputArtifacts?.stdin;
+  if (
+    (store.stdinArtifact === undefined) !== (receiptStdin === undefined)
+    || store.stdinArtifact !== undefined
+      && (
+        receiptStdin.path !== store.stdinArtifact.path
+        || receiptStdin.sha256 !== store.stdinArtifact.sha256
+        || receiptStdin.sizeBytes !== store.stdinArtifact.sizeBytes
+      )
+  ) {
+    throw new Error("Quick receipt stdin binding does not match the persisted material.");
+  }
+  const stdout = outputArtifact(workspaceRoot, store.stdoutPath);
+  const stderr = outputArtifact(workspaceRoot, store.stderrPath);
   const complete = {
     ...receipt,
     outputArtifacts: {
-      stdout: outputArtifact(workspaceRoot, store.stdoutPath),
-      stderr: outputArtifact(workspaceRoot, store.stderrPath),
+      stdout: stdout.artifact,
+      stderr: stderr.artifact,
     },
   };
   atomicWriteJson(store.receiptPath, complete);
@@ -131,6 +228,14 @@ export function persistQuickReceipt({ workspaceRoot, store, receipt }) {
     receipt: complete,
     receiptPath: store.receiptPath,
     receiptSha256: sha256Bytes(readFileSync(store.receiptPath)),
+    outputSummary: {
+      stdoutHead: stdout.summary.headLines,
+      stdoutTail: stdout.summary.tailLines,
+      stderrHead: stderr.summary.headLines,
+      stderrTail: stderr.summary.tailLines,
+      stdoutTruncated: stdout.summary.truncated,
+      stderrTruncated: stderr.summary.truncated,
+    },
   };
 }
 

package/scripts/runkit-contract/quick-verify.mjs

@@ -1,10 +1,18 @@
 import { spawn } from "node:child_process";
-import { realpathSync } from "node:fs";
+import {
+  closeSync,
+  constants,
+  openSync,
+  realpathSync,
+} from "node:fs";
+import path from "node:path";
 
+import { readFileBytesBounded } from "../../packages/attest/src/formal.mjs";
 import { currentCoreIdentity } from "./core-contract.mjs";
 import {
   closeQuickOutputFiles,
   createQuickReceiptStore,
+  persistQuickInputArtifact,
   persistQuickReceipt,
 } from "./quick-receipt.mjs";
 import { captureWorkspaceSnapshot } from "./quick-workspace-snapshot.mjs";
@@ -17,15 +25,31 @@ function quickAttestCommand(workspaceRoot, receiptPath) {
   return `owlrunkit quick-attest --workspace ${shellQuote(workspaceRoot)} --receipt ${shellQuote(receiptPath)}`;
 }
 
-function runExactCommand({ executable, argv, cwd, stdoutFd, stderrFd }) {
+function runExactCommand({ executable, argv, cwd, stdinPath, stdoutFd, stderrFd }) {
   return new Promise((resolve) => {
     let settled = false;
-    const child = spawn(executable, argv, {
-      cwd,
-      shell: false,
-      stdio: ["ignore", stdoutFd, stderrFd],
-      env: process.env,
-    });
+    let stdinFd;
+    let child;
+    try {
+      stdinFd = stdinPath === undefined
+        ? undefined
+        : openSync(stdinPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+      child = spawn(executable, argv, {
+        cwd,
+        shell: false,
+        stdio: [stdinFd ?? "ignore", stdoutFd, stderrFd],
+        env: process.env,
+      });
+    } catch (error) {
+      if (stdinFd !== undefined) closeSync(stdinFd);
+      resolve({
+        exitCode: null,
+        signal: null,
+        launchError: error instanceof Error ? error.message : String(error),
+      });
+      return;
+    }
+    if (stdinFd !== undefined) closeSync(stdinFd);
     child.once("error", (error) => {
       if (settled) return;
       settled = true;
@@ -39,7 +63,13 @@ function runExactCommand({ executable, argv, cwd, stdoutFd, stderrFd }) {
   });
 }
 
-export async function runQuickVerification({ workspaceRoot, commandArgv }) {
+function inputArtifactResult(stdinArtifact) {
+  return stdinArtifact === null
+    ? {}
+    : { inputArtifacts: { stdin: stdinArtifact } };
+}
+
+export async function runQuickVerification({ workspaceRoot, commandArgv, stdinFile }) {
   if (!Array.isArray(commandArgv) || commandArgv.length === 0 || !commandArgv.every((value) => typeof value === "string")) {
     return {
       status: "quick_verification_input_invalid",
@@ -60,12 +90,49 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
     };
   }
 
+  let stdinBytes;
+  if (stdinFile !== undefined) {
+    if (typeof stdinFile !== "string" || stdinFile.length === 0) {
+      return {
+        status: "quick_verification_input_invalid",
+        exitCode: 3,
+        issues: ["--stdin-file requires a non-empty regular file path."],
+        authorizationGranted: false,
+      };
+    }
+    try {
+      const selected = path.isAbsolute(stdinFile)
+        ? stdinFile
+        : path.resolve(root, stdinFile);
+      stdinBytes = readFileBytesBounded(selected).bytes;
+    } catch (error) {
+      return {
+        status: "quick_verification_input_invalid",
+        exitCode: 3,
+        issues: [`Quick stdin file is invalid: ${error instanceof Error ? error.message : String(error)}`],
+        authorizationGranted: false,
+      };
+    }
+  }
+
   let workspaceBefore;
   let store;
+  let stdinArtifact = null;
+  let persistedStdinPath;
   try {
     workspaceBefore = captureWorkspaceSnapshot(root);
     store = createQuickReceiptStore(root);
+    if (stdinBytes !== undefined) {
+      const persistedInput = persistQuickInputArtifact({
+        workspaceRoot: root,
+        store,
+        bytes: stdinBytes,
+      });
+      stdinArtifact = persistedInput.artifact;
+      persistedStdinPath = persistedInput.inputPath;
+    }
   } catch (error) {
+    if (store !== undefined) closeQuickOutputFiles(store);
     return {
       status: "quick_verification_input_invalid",
       exitCode: 3,
@@ -80,6 +147,7 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
     executable,
     argv,
     cwd: root,
+    stdinPath: persistedStdinPath,
     stdoutFd: store.stdoutFd,
     stderrFd: store.stderrFd,
   });
@@ -101,7 +169,7 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
   }
 
   const sourceMutated = workspaceBefore.sourceFingerprint !== workspaceAfter.sourceFingerprint;
-  const issueCodes = ["quick_ignored_artifact_unbound"];
+  const issueCodes = [];
   if (sourceMutated) issueCodes.push("source_mutated_during_verification");
   let persisted;
   try {
@@ -109,7 +177,9 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
       workspaceRoot: root,
       store,
       receipt: {
-      schemaVersion: "OwlCodaQuickVerificationReceiptV1",
+      schemaVersion: stdinArtifact === null
+        ? "OwlCodaQuickVerificationReceiptV1"
+        : "OwlCodaQuickVerificationReceiptV2",
       receiptId: store.receiptId,
       assurance: "captured_verification",
       authorizationGranted: false,
@@ -124,6 +194,9 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
         argv,
         cwd: root,
       },
+      ...(stdinArtifact === null
+        ? {}
+        : { inputArtifacts: { stdin: stdinArtifact } }),
       verificationContext: {
         platform: process.platform,
         architecture: process.arch,
@@ -154,12 +227,15 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
         ? "invalidated_by_command_source_mutation"
         : "source_unchanged",
       issueCodes: [...issueCodes, "quick_receipt_store_invalid"],
+      ...inputArtifactResult(stdinArtifact),
       issues: [error instanceof Error ? error.message : String(error)],
       nextAllowedAction: "repair_quick_receipt_store_and_rerun",
       authorizationGranted: false,
     };
   }
 
+  const { outputSummary } = persisted;
+
   if (sourceMutated) {
     const attestCommand = quickAttestCommand(root, persisted.receiptPath);
     return {
@@ -171,6 +247,8 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
       commandExitCode: execution.exitCode,
       mutationDecision: "invalidated_by_command_source_mutation",
       issueCodes,
+      ...inputArtifactResult(stdinArtifact),
+      outputSummary,
       attestCommand,
       issues: [],
       nextAllowedAction: "restore_source_or_run_a_new_quick_verification",
@@ -188,6 +266,8 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
       commandExitCode: execution.exitCode,
       mutationDecision: "source_unchanged",
       issueCodes,
+      ...inputArtifactResult(stdinArtifact),
+      outputSummary,
       attestCommand,
       issues: execution.launchError ? [execution.launchError] : [],
       nextAllowedAction: "inspect_output_and_rerun",
@@ -204,6 +284,8 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
     commandExitCode: 0,
     mutationDecision: "source_unchanged",
     issueCodes,
+    ...inputArtifactResult(stdinArtifact),
+    outputSummary,
     attestCommand,
     issues: [],
     nextAllowedAction: attestCommand,

package/scripts/runkit-contract/runkit-cli.mjs

@@ -100,7 +100,10 @@ import {
   replaceFleetRegistry,
   rollbackFleetRegistry,
 } from "./fleet-discovery.mjs";
-import { routeRunKitAssuranceV1 } from "./assurance-router.mjs";
+import {
+  RUNKIT_RISK_CATEGORIES,
+  routeRunKitAssuranceV1,
+} from "./assurance-router.mjs";
 import {
   formatUsageModeHumanV1,
   recommendUsageModeV1,
@@ -155,6 +158,7 @@ import {
   integrateTeamProjectV1,
   openTeamProjectDecisionV1,
   readTeamProjectStatusV1,
+  rejectAndReturnTeamProjectV1,
   resolveTeamProjectDecisionV1,
 } from "./team-project.mjs";
 import {
@@ -197,7 +201,7 @@ Fleet and status
   owlrunkit fleet discover; owlrunkit status --workspace .
 
 Agent team projects
-  owlrunkit project <init|assign|checkpoint|handoff|decision|verification|capture|status|takeover|successor> [options]
+  owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|decision|verification|capture|status|takeover|successor> [options]
   Durable Agent work, dependencies, decisions, gates, progress, and handoffs.
 Core successor
   owlrunkit core-successor <plan|apply|resume> --workspace . [...]
@@ -244,7 +248,7 @@ read-only and grant no Git, release, deployment, production, or business authori
     [--irreversible] [--rollback-uncertain]
     [--permission-sensitive] [--security-sensitive] [--funds-at-risk]
     [--schema-or-data-migration] [--formal-acceptance]
-    [--risk-category <category>] [--json]
+    [--risk-category <${RUNKIT_RISK_CATEGORIES.join("|")}>] [--json]
 
 Returns one user mode plus the independent continuity and assurance selections.
 Persisted mode preferences are not part of this release.
@@ -259,6 +263,22 @@ Reads the current mode preference source without creating project state.
 
 Attests one Quick Receipt against its bound materials and current workspace.
 It never grants repository or business authority.
+`,
+  "quick-verify": `Usage:
+  owlrunkit quick-verify --workspace <directory> [--stdin-file <file>] [--attest] [--json]
+    -- <executable> [args...]
+
+Runs one exact command, saves source-bound stdout/stderr and a Quick receipt,
+and returns a bounded head/tail output summary. --stdin-file copies and hash-binds
+up to 1 MiB of exact stdin bytes in the receipt store. --attest immediately
+attests the saved receipt without merging Quick and attestation semantics.
+Quick evidence is not Formal acceptance and grants no repository or business authority.
+`,
+  "quick-metrics": `Usage:
+  owlrunkit quick-metrics --workspace <directory> --local [--verbose] [--json]
+
+Returns aggregate local-only Quick counts with no telemetry or network access.
+--verbose additionally lists the receipt paths used for the aggregation.
 `,
   fleet: `Usage:
   owlrunkit fleet register-root --fleet-root <directory>
@@ -409,6 +429,9 @@ action without granting any authority.
   owlrunkit project handoff --workspace <directory> --handoff-id <id> --at <ISO-UTC>
     --assignment-id <current> --work-item <id> --from-agent <id> --to-agent <id>
     --summary <text> --next <text> --evidence <ref> [--evidence <ref> ...] [--json]
+  owlrunkit project reject-and-return --workspace <directory> --rework-id <id> --at <ISO-UTC>
+    --work-item <failed-id> --reviewer-agent <id> --to-agent <id>
+    --reason <text> --next <text> --evidence <ref> [--evidence <ref> ...] [--json]
   owlrunkit project decision --workspace <directory> --open --decision-id <id> --at <ISO-UTC>
     --title <text> --question <text> --owner-agent <id>
     [--blocking-work-item <id> ...] --option <text> [--option <text> ...] [--json]
@@ -437,6 +460,27 @@ action without granting any authority.
 Project status is derived from durable work items, Agent assignments,
 dependencies, decisions, checkpoints, integration gates, and evidence refs.
 No self-reported percentage is accepted.
+`,
+  "project checkpoint": `Usage:
+  owlrunkit project checkpoint --workspace <directory> --checkpoint-id <id> --at <ISO-UTC>
+    --assignment-id <current> --work-item <id>
+    --state <active|waiting_dependency|waiting_decision|verifying|ready_to_integrate|completed|failed>
+    --summary <text> [--completed-units <nonnegative-int>]
+    [--evidence <ref> ...] [--blocker <ref> ...] [--decision <id> ...]
+    [--next <text>] [--source-fingerprint <sha256>] [--json]
+
+Measured WorkItems require --completed-units on every checkpoint. A completed
+checkpoint must use the WorkItem's declared total. Example:
+  owlrunkit project checkpoint --workspace . --checkpoint-id checkpoint-x --at 2026-08-11T00:00:00.000Z --assignment-id assign-x --work-item x --state completed --summary 'Completed x.' --completed-units 5 --evidence receipt:quick
+`,
+  "project reject-and-return": `Usage:
+  owlrunkit project reject-and-return --workspace <directory> --rework-id <id> --at <ISO-UTC>
+    --work-item <failed-id> --reviewer-agent <id> --to-agent <id>
+    --reason <text> --next <text> --evidence <ref> [--evidence <ref> ...] [--json]
+
+Atomically records the rejection and opens a new assigned rework attempt. The
+failed attempt remains immutable and evidence-linked. This action does not
+grant Git, release, deployment, production, or business authority.
 `,
   "project status": `Usage:
   owlrunkit project status --workspace <directory> [--json]
@@ -465,6 +509,25 @@ function withHumanOutput(result, humanOutput) {
   return result;
 }
 
+function shellCommandToken(value) {
+  const text = String(value);
+  return /^[A-Za-z0-9_@%+=:,./-]+$/u.test(text)
+    ? text
+    : `'${text.replaceAll("'", `'"'"'`)}'`;
+}
+
+function correctedCheckpointCommand(argv, completedUnits) {
+  const corrected = [...argv];
+  const jsonIndex = corrected.indexOf("--json");
+  corrected.splice(
+    jsonIndex === -1 ? corrected.length : jsonIndex,
+    0,
+    "--completed-units",
+    String(completedUnits),
+  );
+  return `owlrunkit ${corrected.map(shellCommandToken).join(" ")}`;
+}
+
 function formatTeamProjectAssignmentHuman(result) {
   const disposition = result.resumed ? "Resumed" : "Assigned";
   const nextAction = result.nextAction === null
@@ -495,6 +558,20 @@ function formatTeamProjectHandoffHuman(result) {
   ].join("\n");
 }
 
+function formatTeamProjectReworkHuman(result) {
+  const disposition = result.resumed ? "Resumed" : "Returned";
+  const nextAction = result.nextAction === null
+    ? "none"
+    : String(result.nextAction).replace(/\s+/gu, " ").trim();
+  return [
+    `${disposition} failed WorkItem ${result.workItemId} to Agent ${result.toAgentId} for rework attempt ${result.reworkAttempt}.`,
+    `Failed checkpoint preserved: ${result.failedCheckpointEventId}`,
+    `Next: ${nextAction}`,
+    `Rework assignment: ${result.assignmentId}`,
+    "",
+  ].join("\n");
+}
+
 function formatTeamProjectDecisionHuman(result) {
   const disposition = result.resumed
     ? "Resumed"
@@ -1882,6 +1959,8 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? ["owned-path"]
         : command === "project" && action === "handoff"
           ? ["evidence"]
+        : command === "project" && action === "reject-and-return"
+          ? ["evidence"]
         : command === "project" && action === "integrate"
           ? ["evidence"]
         : command === "project" && action === "verification"
@@ -1919,7 +1998,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? ["json", "open", "resolve"]
         : command === "project" && action === "verification"
           ? ["json", "defer", "close"]
-        : command === "project" && new Set(["assign", "handoff", "checkpoint", "integrate", "status", "takeover", "successor"]).has(action)
+        : command === "project" && new Set(["assign", "handoff", "reject-and-return", "checkpoint", "integrate", "status", "takeover", "successor"]).has(action)
           ? ["json"]
           : command === "doctor" || command === "adopt" || command === "status"
             ? ["json"]
@@ -1933,8 +2012,12 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? ["adopt-orphan-success-receipts"]
         : command === "deployment" && action === "execute"
           ? ["resume"]
-        : new Set(["quick-verify", "quick-attest", "quick-metrics"]).has(command)
-          ? ["json", "local"]
+        : command === "quick-verify"
+          ? ["json", "attest"]
+        : command === "quick-attest"
+          ? ["json"]
+        : command === "quick-metrics"
+          ? ["json", "local", "verbose"]
           : [],
     });
     if (command === "init") return await initialize(options);
@@ -2770,6 +2853,10 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           "workspace", "request", "handoff-id", "at", "assignment-id", "work-item",
           "from-agent", "to-agent", "summary", "next", "evidence", "json",
         ],
+        "reject-and-return": [
+          "workspace", "rework-id", "at", "work-item", "reviewer-agent",
+          "to-agent", "reason", "next", "evidence", "json",
+        ],
         decision: [
           "workspace", "request", "open", "resolve", "decision-id", "at", "title",
           "question", "owner-agent", "blocking-work-item", "option", "resolution",
@@ -2877,6 +2964,22 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? handedOff
           : withHumanOutput(handedOff, formatTeamProjectHandoffHuman(handedOff));
       }
+      if (action === "reject-and-return") {
+        const returned = rejectAndReturnTeamProjectV1({
+          workspaceRoot: root,
+          reworkId: requireOption(options, "rework-id"),
+          occurredAt: requireOption(options, "at"),
+          workItemId: requireOption(options, "work-item"),
+          reviewerAgentId: requireOption(options, "reviewer-agent"),
+          toAgentId: requireOption(options, "to-agent"),
+          reason: requireOption(options, "reason"),
+          nextAction: requireOption(options, "next"),
+          evidenceRefs: options.evidence ?? [],
+        });
+        return options.json === true
+          ? returned
+          : withHumanOutput(returned, formatTeamProjectReworkHuman(returned));
+      }
       if (action === "decision") {
         const directDecisionFields = [
           "open",
@@ -3073,24 +3176,49 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
             event: requestedEvent,
           });
         }
+        const checkpointId = requireOption(options, "checkpoint-id");
+        const occurredAt = requireOption(options, "at");
+        const assignmentId = requireOption(options, "assignment-id");
+        const workItemId = requireOption(options, "work-item");
+        const state = requireOption(options, "state");
+        const summary = requireOption(options, "summary");
         const completedUnits = options["completed-units"] === undefined
           ? undefined
           : parseCanonicalNonnegativeSafeInteger(options["completed-units"], "completed-units");
-        const checkpointed = checkpointTeamProjectV1({
-          workspaceRoot: root,
-          checkpointId: requireOption(options, "checkpoint-id"),
-          occurredAt: requireOption(options, "at"),
-          assignmentId: requireOption(options, "assignment-id"),
-          workItemId: requireOption(options, "work-item"),
-          state: requireOption(options, "state"),
-          summary: requireOption(options, "summary"),
-          completedUnits,
-          evidenceRefs: options.evidence ?? [],
-          blockerRefs: options.blocker ?? [],
-          decisionRefs: options.decision ?? [],
-          nextAction: options.next ?? null,
-          sourceFingerprint: options["source-fingerprint"],
-        });
+        let checkpointed;
+        try {
+          checkpointed = checkpointTeamProjectV1({
+            workspaceRoot: root,
+            checkpointId,
+            occurredAt,
+            assignmentId,
+            workItemId,
+            state,
+            summary,
+            completedUnits,
+            evidenceRefs: options.evidence ?? [],
+            blockerRefs: options.blocker ?? [],
+            decisionRefs: options.decision ?? [],
+            nextAction: options.next ?? null,
+            sourceFingerprint: options["source-fingerprint"],
+          });
+        } catch (error) {
+          if (error instanceof Error
+            && error.message === "Measured work item checkpoint requires completedUnits.") {
+            const projectStatus = readTeamProjectStatusV1({ workspaceRoot: root });
+            const workItem = projectStatus.workItems.find((row) => row.workItemId === workItemId);
+            const suggestedUnits = state === "completed"
+              ? workItem?.progress.total
+              : workItem?.progress.completed;
+            if (Number.isSafeInteger(suggestedUnits)) {
+              throw new Error(
+                "Measured work item checkpoint requires --completed-units. "
+                + `Corrected command: ${correctedCheckpointCommand(argv, suggestedUnits)}`,
+              );
+            }
+          }
+          throw error;
+        }
         return options.json === true
           ? checkpointed
           : withHumanOutput(checkpointed, formatTeamProjectCheckpointHuman(checkpointed));
@@ -3162,7 +3290,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? successor
           : withHumanOutput(successor, formatTeamProjectSuccessorHumanV1(successor));
       }
-      throw new Error("Usage: owlrunkit project <init|assign|checkpoint|handoff|decision|verification|integrate|capture|status|takeover|successor> [options]");
+      throw new Error("Usage: owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|decision|verification|integrate|capture|status|takeover|successor> [options]");
     }
     if (command === "profiles") {
       const root = requireOption(options, "workspace");
@@ -3248,10 +3376,28 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       if (commandArgv.length === 0) {
         throw new Error("Usage: runkit-cli.mjs quick-verify --workspace <path> -- <executable> [args...]");
       }
-      return runQuickVerification({
+      const verification = await runQuickVerification({
         workspaceRoot: workspace(options),
         commandArgv,
+        stdinFile: options["stdin-file"],
+      });
+      if (options.attest !== true || typeof verification.receiptPath !== "string") {
+        return verification;
+      }
+      const details = attestQuickReceiptDetails({
+        receiptPath: verification.receiptPath,
+        workspaceRoot: workspace(options),
       });
+      return {
+        ...verification,
+        exitCode: details.exitCode === 0 ? verification.exitCode : details.exitCode,
+        attestationDecision: details.attestation.decision,
+        attestation: details.attestation,
+        nextAllowedAction: details.attestation.decision === "GO"
+          ? "consume_attestation"
+          : "inspect_attestation_issues",
+        authorizationGranted: false,
+      };
     }
     if (command === "quick-attest") {
       const details = attestQuickReceiptDetails({
@@ -3276,7 +3422,9 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       if (options.local !== true) {
         throw new Error("Quick metrics requires --local; network telemetry is not available.");
       }
-      const local = readLocalQuickMetrics(workspace(options));
+      const local = readLocalQuickMetrics(workspace(options), {
+        verbose: options.verbose === true,
+      });
       return {
         ...local,
         metrics: local.quick,