wendkeep 0.76.9 → 0.78.0

package/src/change.mjs

@@ -19,13 +19,24 @@ import {
   isGuideCompactChange,
   setActiveChange,
 } from '../hooks/change-core.mjs';
-import { evaluateGate, requiredSensors } from '../hooks/sensors-core.mjs';
+import { evaluateGate, loadSensorsDetailed, requiredSensors } from '../hooks/sensors-core.mjs';
 import { buildEffectiveRequirementPackage, evaluateVerdict, formatOrphanReqs, tasksHashOf, parseSpecsList, parseDelta, parseRequirements, applyDelta, validateSpecImpact } from '../hooks/spec-core.mjs';
 import { getNextAdrNumber, readControl, readSessionRegistry, upsertSessionRegistry } from '../hooks/obsidian-common.mjs';
 import { getLocale } from '../hooks/locale.mjs';
 import { enqueueObserverDocumentChange } from './observer-sql-publish.mjs';
 import { readProjectForValidation } from '../packages/vault/src/validate-memory.mjs';
 import { resolveCommandActiveContext } from './active-context-runtime.mjs';
+import {
+  captureGitSnapshot,
+  resolveEvidenceIdentity,
+  sensorConfigSha256,
+} from './evidence-envelope.mjs';
+import {
+  evaluateEvidenceBinding,
+  evidenceCheckoutBinding,
+  evidenceCheckoutBindingMatches,
+  evidenceSensors,
+} from '../packages/vault/src/evidence-envelope.mjs';
 
 function observerMarkdownUnder(vaultBase, relativeRoot) {
   const output = [];
@@ -74,15 +85,15 @@ export function runChange(argv) {
   const VALUE_FLAGS = new Set(['--vault', '--change', '--project', '--session']);
   const slugArg = () => rest.find((a, i) => !a.startsWith('-') && !VALUE_FLAGS.has(rest[i - 1]));
   const projectRoot = resolve(opt(rest, '--project') || process.cwd());
+  const sessionId = opt(rest, '--session')
+    || process.env.CODEX_THREAD_ID
+    || process.env.CLAUDE_SESSION_ID
+    || '';
   let contextResolved = false;
   let resolvedContext = null;
   const context = () => {
     if (contextResolved) return resolvedContext;
     contextResolved = true;
-    const sessionId = opt(rest, '--session')
-      || process.env.CODEX_THREAD_ID
-      || process.env.CLAUDE_SESSION_ID
-      || '';
     try {
       resolvedContext = resolveCommandActiveContext({ vaultBase, projectRoot, sessionId });
       return resolvedContext;
@@ -196,19 +207,48 @@ export function runChange(argv) {
     }
     let evidence = null;
     try { evidence = JSON.parse(readFileSync(join(dir, 'evidencia.json'), 'utf8')); } catch { /* sem evidência */ }
-    if (evidence) for (const e of evidence) process.stdout.write(`  ${e.status === 'green' ? '✓' : '✗'} ${e.id} (${e.severity || 'critical'})\n`);
+    if (evidence) for (const e of evidenceSensors(evidence)) process.stdout.write(`  ${e.status === 'green' ? '✓' : '✗'} ${e.id} (${e.severity || 'critical'})\n`);
     else process.stdout.write('evidencia: ausente\n');
     const reqIds = [...new Set(tasks.flatMap((t) => t.reqs ?? []))];
     const effective = buildEffectiveRequirementPackage(vaultBase, dir, reqIds);
     if (effective.errors.length || effective.missing.length) {
       process.stdout.write(`spec efetiva: inválida (${[...effective.errors, ...effective.missing.map((id) => `req órfão ${id}`)].join('; ')})\n`);
     }
+    if (evidence) {
+      let expected = {
+        change_slug: slug,
+        tasks_sha256: tasksHashOf(tarefasMd),
+        effective_spec_sha256: `sha256:${effective.hash}`,
+      };
+      let unavailable = '';
+      try {
+        const ids = requiredSensors(tasks);
+        const loaded = loadSensorsDetailed(projectRoot);
+        expected = {
+          ...expected,
+          identity: resolveEvidenceIdentity({
+            vaultBase, projectRoot, changeSlug: slug, sessionId, context: context(),
+          }),
+          snapshot: captureGitSnapshot(projectRoot),
+          sensor_config_sha256: sensorConfigSha256(loaded.sensors, ids),
+        };
+      } catch (error) {
+        unavailable = error.code || error.message;
+      }
+      const binding = evaluateEvidenceBinding(evidence, expected);
+      process.stdout.write(`evidence-binding: ${binding.state}${binding.reasons.length ? ` (${binding.reasons.join('; ')})` : ''}${unavailable ? ` [current snapshot unavailable: ${unavailable}]` : ''}\n`);
+    }
     let verdict = null;
     try { verdict = JSON.parse(readFileSync(join(dir, 'verdict.json'), 'utf8')); } catch { /* sem verdict */ }
     if (!verdict) process.stdout.write(`verdict: ausente — rode \`wendkeep verify --deep\`${reqIds.length ? ' + wk-verify' : ' (verdict trivial automático)'}\n`);
     else if (!reqIds.length) process.stdout.write(`verdict: ${verdict.ok === true ? 'ok (trivial)' : 'não-ok — re-verifique'}\n`);
     else {
-      const v = evaluateVerdict(verdict, reqIds, { tasksHash: tasksHashOf(tarefasMd), effectiveSpecHash: effective.hash });
+      const v = evaluateVerdict(verdict, reqIds, {
+        tasksHash: tasksHashOf(tarefasMd),
+        effectiveSpecHash: effective.hash,
+        evidenceEnvelopeId: evidence?.schema_version === 2 ? evidence.envelope_id : undefined,
+        evidenceBinding: evidence?.schema_version === 2 ? evidenceCheckoutBinding(evidence) : undefined,
+      });
       process.stdout.write(`verdict: ${v.ok ? 'ok' : v.stale ? 'stale — re-verifique' : `incompleto: falta ${v.missing.join(', ')}`}\n`);
     }
     try { process.stdout.write(`mutation-round: ${readFileSync(join(dir, '.mutation-round'), 'utf8').trim()}/3\n`); } catch { /* sem rodadas */ }
@@ -289,9 +329,34 @@ export function runChange(argv) {
       const effective = buildEffectiveRequirementPackage(vaultBase, dir, reqIds);
       if (effective.errors.length) return { ok: false, failing: [`spec efetiva inválida: ${effective.errors.join('; ')}`] };
       if (effective.missing.length) return { ok: false, failing: [formatOrphanReqs(effective.missing)] };
-      let evidence = [];
+      let evidence = null;
       try { evidence = JSON.parse(readFileSync(join(dir, 'evidencia.json'), 'utf8')); } catch { /* no evidence */ }
-      const s = evaluateGate(evidence, required);
+      const sensorEvidence = evidenceSensors(evidence);
+      if (required.length && (!evidence || evidence.schema_version !== 2)) {
+        return { ok: false, failing: ['evidência legacy-unbound não satisfaz autoridade v2 — rode `wendkeep verify` novamente'] };
+      }
+      if (evidence?.schema_version === 2) {
+        let currentBinding;
+        try {
+          const loaded = loadSensorsDetailed(projectRoot);
+          currentBinding = evaluateEvidenceBinding(evidence, {
+            change_slug: slug,
+            identity: resolveEvidenceIdentity({
+              vaultBase, projectRoot, changeSlug: slug, sessionId, context: selectedContext,
+            }),
+            snapshot: captureGitSnapshot(projectRoot),
+            tasks_sha256: tasksHashOf(tarefasMd),
+            effective_spec_sha256: `sha256:${effective.hash}`,
+            sensor_config_sha256: sensorConfigSha256(loaded.sensors, required),
+          });
+        } catch (error) {
+          return { ok: false, failing: [`binding atual indisponível (${error.code || error.message}) — recupere o contexto e rode \`wendkeep verify\` novamente`] };
+        }
+        if (currentBinding.state !== 'bound') {
+          return { ok: false, failing: [`evidência ${currentBinding.state} (${currentBinding.reasons.join('; ')}) — rode \`wendkeep verify\` novamente`] };
+        }
+      }
+      const s = evaluateGate(sensorEvidence, required);
       if (!s.ok) return s;
       // Verdict SEMPRE exigido (0.31.0) — a exigência universal vive AQUI no gate; a semântica
       // reqless→ok de evaluateVerdict (spec-core) não muda porque `verify --deep` e `change
@@ -310,6 +375,19 @@ export function runChange(argv) {
       }
       let verification = null;
       try { verification = JSON.parse(readFileSync(join(dir, 'verificacao.json'), 'utf8')); } catch { /* none */ }
+      const checkoutBinding = evidence?.schema_version === 2 ? evidenceCheckoutBinding(evidence) : null;
+      if (evidence?.schema_version === 2 && verification?.evidenceEnvelopeId !== evidence.envelope_id) {
+        return { ok: false, failing: ['pacote de verificação não está ligado ao envelope atual — rode `wendkeep verify --deep` novamente'] };
+      }
+      if (checkoutBinding && !evidenceCheckoutBindingMatches(verification?.evidenceBinding, checkoutBinding)) {
+        return { ok: false, failing: ['binding do pacote de verificação diverge do checkout provado — rode `wendkeep verify --deep` novamente'] };
+      }
+      if (evidence?.schema_version === 2 && verdict.evidenceEnvelopeId !== evidence.envelope_id) {
+        return { ok: false, failing: [`verdict não está ligado ao envelope atual — rode \`wendkeep verify --deep\`${reqIds.length ? ' + wk-verify' : ''}`] };
+      }
+      if (checkoutBinding && !evidenceCheckoutBindingMatches(verdict.evidenceBinding, checkoutBinding)) {
+        return { ok: false, failing: [`binding do verdict diverge do checkout provado — rode \`wendkeep verify --deep\`${reqIds.length ? ' + wk-verify' : ''}`] };
+      }
       if (verification?.effectiveSpecHash && verification.effectiveSpecHash !== effective.hash) {
         return { ok: false, failing: ['pacote de verificação stale (spec efetiva mudou) — rode `wendkeep verify --deep` novamente'] };
       }
@@ -317,7 +395,12 @@ export function runChange(argv) {
         return { ok: false, failing: ['verdict sem effectiveSpecHash — rode a skill wk-verify novamente'] };
       }
       if (reqIds.length) {
-        const v = evaluateVerdict(verdict, reqIds, { tasksHash: hash, effectiveSpecHash: effective.hash });
+        const v = evaluateVerdict(verdict, reqIds, {
+          tasksHash: hash,
+          effectiveSpecHash: effective.hash,
+          evidenceEnvelopeId: evidence?.schema_version === 2 ? evidence.envelope_id : undefined,
+          evidenceBinding: checkoutBinding || undefined,
+        });
         if (!v.ok) {
           if (v.stale) return { ok: false, failing: ['verdict stale (tarefas.md mudou depois da verificação) — re-verifique: `wendkeep verify --deep` + wk-verify'] };
           return { ok: false, failing: [`verdict incompleto: falta ${v.missing.join(', ')}`] };

package/src/evidence-envelope.mjs

@@ -0,0 +1,288 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { isUtf8 } from 'node:buffer';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { readProjectForValidation } from '../packages/vault/src/validate-memory.mjs';
+import {
+  discoverWorktreeRepository,
+  readWorktreeRegistry,
+  worktreeIdentity,
+} from '../packages/vault/src/worktree-metadata.mjs';
+import {
+  canonicalSha256,
+  evaluateEvidenceBinding,
+  evidenceSensors,
+} from '../packages/vault/src/evidence-envelope.mjs';
+
+export { canonicalSha256, evaluateEvidenceBinding, evidenceSensors };
+
+const PACKAGE_VERSION = JSON.parse(readFileSync(
+  join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'),
+  'utf8',
+)).version;
+
+export function sensorConfigSha256(sensors, ids) {
+  const selected = new Set(ids || []);
+  const canonical = (sensors || [])
+    .filter((sensor) => selected.has(sensor.id))
+    .map((sensor) => sensor)
+    .sort((left, right) => String(left.id || '').localeCompare(String(right.id || '')));
+  return canonicalSha256(canonical);
+}
+
+function normalizedPath(value) {
+  return String(value || '').replaceAll('\\', '/');
+}
+
+const BINARY_EXTENSIONS = new Set([
+  '.7z', '.a', '.avi', '.bin', '.bmp', '.class', '.dll', '.doc', '.docx', '.dylib', '.eot',
+  '.exe', '.gif', '.gz', '.ico', '.jar', '.jpeg', '.jpg', '.mov', '.mp3', '.mp4', '.o',
+  '.ogg', '.otf', '.pdf', '.png', '.so', '.tar', '.tif', '.tiff', '.ttf', '.wav', '.webm',
+  '.webp', '.woff', '.woff2', '.xls', '.xlsx', '.zip',
+]);
+
+function normalizedContent(content, binary = false) {
+  const bytes = Buffer.isBuffer(content) ? content : Buffer.from(content || '');
+  if (binary || bytes.includes(0) || !isUtf8(bytes)) return bytes;
+  return Buffer.from(bytes.toString('utf8').replace(/\r\n?/g, '\n'), 'utf8');
+}
+
+export function digestWorktreeEntries(entries) {
+  const canonical = (entries || []).map((entry) => ({
+    layer: String(entry.layer || ''),
+    status: String(entry.status || ''),
+    path: normalizedPath(entry.path),
+    ...(entry.oldPath ? { old_path: normalizedPath(entry.oldPath) } : {}),
+    content_mode: entry.binary ? 'binary' : 'text',
+    content_sha256: entry.content == null ? null : canonicalSha256(normalizedContent(entry.content, entry.binary)),
+  })).sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
+  return canonicalSha256(canonical);
+}
+
+function gitResult(projectRoot, args, { spawn = spawnSync, allowFailure = false } = {}) {
+  const result = spawn('git', args, {
+    cwd: projectRoot,
+    encoding: null,
+    stdio: ['ignore', 'pipe', 'pipe'],
+    windowsHide: true,
+  });
+  if (!allowFailure && (result.error || result.status !== 0)) {
+    const detail = Buffer.from(result.stderr || '').toString('utf8').trim();
+    const error = new Error(`git ${args.join(' ')} falhou${detail ? `: ${detail}` : ''}`);
+    error.code = 'WENDKEEP_EVIDENCE_GIT_FAILED';
+    throw error;
+  }
+  return result;
+}
+
+function gitText(projectRoot, args, options) {
+  const result = gitResult(projectRoot, args, options);
+  if (result.status !== 0) return '';
+  return Buffer.from(result.stdout || '').toString('utf8').trim();
+}
+
+function gitBuffer(projectRoot, args, options) {
+  const result = gitResult(projectRoot, args, options);
+  return result.status === 0 ? Buffer.from(result.stdout || '') : Buffer.alloc(0);
+}
+
+function parseNameStatus(buffer, layer) {
+  const tokens = buffer.toString('utf8').split('\0');
+  if (tokens.at(-1) === '') tokens.pop();
+  const entries = [];
+  for (let index = 0; index < tokens.length;) {
+    const status = tokens[index++];
+    const renamed = /^[RC]/.test(status);
+    const oldPath = renamed ? tokens[index++] : '';
+    const path = tokens[index++];
+    if (!path) continue;
+    entries.push({ layer, status, path, ...(oldPath ? { oldPath } : {}) });
+  }
+  return entries;
+}
+
+function binaryAttributes(projectRoot, paths, options) {
+  const unique = [...new Set(paths.filter(Boolean))];
+  if (!unique.length) return new Map();
+  const tokens = gitBuffer(projectRoot, ['check-attr', '-z', 'binary', 'text', '--', ...unique], {
+    ...options, allowFailure: true,
+  }).toString('utf8').split('\0');
+  if (tokens.at(-1) === '') tokens.pop();
+  const attributes = new Map();
+  for (let index = 0; index + 2 < tokens.length; index += 3) {
+    const [path, attribute, value] = tokens.slice(index, index + 3);
+    const entry = attributes.get(path) || {};
+    entry[attribute] = value;
+    attributes.set(path, entry);
+  }
+  return attributes;
+}
+
+function pathIsBinary(path, attributes) {
+  const values = attributes.get(path) || {};
+  if (values.binary === 'set' || values.text === 'unset') return true;
+  if (values.binary === 'unset' || values.text === 'set' || values.text === 'auto') return false;
+  const normalized = normalizedPath(path).toLowerCase();
+  const dot = normalized.lastIndexOf('.');
+  return dot >= 0 && BINARY_EXTENSIONS.has(normalized.slice(dot));
+}
+
+function readWorkingPath(projectRoot, path) {
+  const root = resolve(projectRoot);
+  const absolute = resolve(root, ...normalizedPath(path).split('/'));
+  const scoped = relative(root, absolute);
+  if (scoped === '..' || scoped.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`) || isAbsolute(scoped)) {
+    return null;
+  }
+  try {
+    if (!existsSync(absolute) || !statSync(absolute).isFile()) return null;
+    return readFileSync(absolute);
+  } catch {
+    return null;
+  }
+}
+
+function changedEntries(projectRoot, options) {
+  const staged = parseNameStatus(gitBuffer(projectRoot, [
+    'diff', '--cached', '--name-status', '-z', '--find-renames', '--no-ext-diff',
+  ], options), 'index');
+  const unstaged = parseNameStatus(gitBuffer(projectRoot, [
+    'diff', '--name-status', '-z', '--find-renames', '--no-ext-diff',
+  ], options), 'worktree');
+  const untracked = gitBuffer(projectRoot, [
+    'ls-files', '--others', '--exclude-standard', '-z',
+  ], options).toString('utf8').split('\0').filter(Boolean).map((path) => ({
+    layer: 'untracked', status: '?', path,
+  }));
+  const attributes = binaryAttributes(projectRoot, [
+    ...staged.map((entry) => entry.path),
+    ...unstaged.map((entry) => entry.path),
+    ...untracked.map((entry) => entry.path),
+  ], options);
+
+  for (const entry of staged) {
+    entry.binary = pathIsBinary(entry.path, attributes);
+    entry.content = /^D/.test(entry.status)
+      ? null
+      : gitBuffer(projectRoot, ['show', `:${entry.path}`], { ...options, allowFailure: true });
+  }
+  for (const entry of [...unstaged, ...untracked]) {
+    entry.binary = pathIsBinary(entry.path, attributes);
+    entry.content = /^D/.test(entry.status) ? null : readWorkingPath(projectRoot, entry.path);
+  }
+  return [...staged, ...unstaged, ...untracked];
+}
+
+function resolveBaseSha(projectRoot, headSha, options) {
+  const upstream = gitText(projectRoot, ['rev-parse', '--verify', '@{upstream}'], {
+    ...options, allowFailure: true,
+  });
+  let candidate = upstream;
+  if (!candidate) {
+    candidate = gitText(projectRoot, ['rev-parse', '--verify', 'refs/heads/main'], {
+      ...options, allowFailure: true,
+    });
+  }
+  if (!candidate) return headSha;
+  return gitText(projectRoot, ['merge-base', headSha, candidate], {
+    ...options, allowFailure: true,
+  }) || headSha;
+}
+
+export function captureGitSnapshot(projectRoot, { spawn = spawnSync } = {}) {
+  const options = { spawn };
+  const headSha = gitText(projectRoot, ['rev-parse', 'HEAD'], options);
+  const branch = gitText(projectRoot, ['symbolic-ref', '--short', '-q', 'HEAD'], {
+    ...options, allowFailure: true,
+  }) || 'HEAD';
+  const indexTreeSha = gitText(projectRoot, ['write-tree'], options);
+  const entries = changedEntries(projectRoot, options);
+  return {
+    branch,
+    base_sha: resolveBaseSha(projectRoot, headSha, options),
+    head_sha: headSha,
+    index_tree_sha: indexTreeSha,
+    worktree_digest: digestWorktreeEntries(entries),
+    dirty: entries.length > 0,
+  };
+}
+
+export function resolveEvidenceIdentity({
+  vaultBase,
+  projectRoot,
+  changeSlug,
+  sessionId = '',
+  context = null,
+  spawn = spawnSync,
+} = {}) {
+  const project = readProjectForValidation(vaultBase);
+  const repository = discoverWorktreeRepository({ startDir: projectRoot, spawn });
+  const { registry } = readWorktreeRegistry(repository);
+  if (registry && project.ok && registry.projectId !== project.projectId) {
+    const error = new Error('PROJECT.json e registry de worktrees pertencem a projetos diferentes');
+    error.code = 'WENDKEEP_EVIDENCE_IDENTITY_MISMATCH';
+    throw error;
+  }
+  const repositoryId = context?.repositoryId
+    || registry?.repositoryId
+    || canonicalSha256({ git_common_dir: normalizedPath(repository.commonDir).toLowerCase() });
+  const projectId = context?.projectId
+    || (project.ok ? project.projectId : canonicalSha256({ repository_id: repositoryId }));
+  const worktreeId = context?.worktreeId || worktreeIdentity(repositoryId, repository.gitDir);
+  const requestedSession = String(sessionId || '').trim();
+  const workSessionId = context?.workSessionId
+    || requestedSession
+    || canonicalSha256({ project_id: projectId, worktree_id: worktreeId, change_slug: changeSlug });
+  return {
+    project_id: projectId,
+    repository_id: repositoryId,
+    worktree_id: worktreeId,
+    work_session_id: workSessionId,
+  };
+}
+
+export function assertStableHead(startSnapshot, finishSnapshot) {
+  if (startSnapshot?.head_sha !== finishSnapshot?.head_sha) {
+    const error = new Error(
+      `HEAD mudou durante verify (${startSnapshot?.head_sha || 'ausente'} -> ${finishSnapshot?.head_sha || 'ausente'}); rode novamente no commit estável`,
+    );
+    error.code = 'WENDKEEP_EVIDENCE_HEAD_CHANGED';
+    throw error;
+  }
+}
+
+export function buildEvidenceEnvelope({
+  identity,
+  changeSlug,
+  snapshot,
+  tasksSha256,
+  effectiveSpecSha256,
+  sensorConfigSha256: configSha256,
+  sensors,
+  startedAt,
+  finishedAt,
+  version = PACKAGE_VERSION,
+  runtimePlatform = `${process.platform}-${process.arch}`,
+} = {}) {
+  const envelope = {
+    schema_version: 2,
+    ...identity,
+    change_slug: changeSlug,
+    branch: snapshot.branch,
+    base_sha: snapshot.base_sha,
+    head_sha: snapshot.head_sha,
+    index_tree_sha: snapshot.index_tree_sha,
+    worktree_digest: snapshot.worktree_digest,
+    dirty: snapshot.dirty,
+    tasks_sha256: tasksSha256,
+    effective_spec_sha256: effectiveSpecSha256,
+    sensor_config_sha256: configSha256,
+    wendkeep_version: version,
+    platform: runtimePlatform,
+    started_at: startedAt,
+    finished_at: finishedAt,
+    sensors,
+  };
+  return { ...envelope, envelope_id: canonicalSha256(envelope) };
+}

package/src/skills-seed.mjs

@@ -281,7 +281,8 @@ nunca tivesse visto a implementação. Contexto fresco, read-only.
   (isolamento real). Nos outros, entre num contexto limpo e re-derive do spec, não da memória.
 - \`ok: false\` se algum requisito não tem cobertura que discrimina. Gap não é "quase lá" — é vermelho.
 - Não conserte aqui. Gap vira tarefa de correção na change; re-verifica depois.
-- O gate do \`archive\` **exige** \`verdict.json\` com \`ok\` cobrindo todo \`[req:]\`. Sem isso, não arquiva.
+- O gate do \`archive\` **exige** \`verdict.json\` com \`ok\` cobrindo todo \`[req:]\` e copiando
+  \`evidenceEnvelopeId\` + \`evidenceBinding\` de \`verificacao.json\`. Sem isso, não arquiva.
 
 ## Templates (nesta pasta)
 - \`spec-reviewer-prompt.md\` — cole ao spawnar o subagente verificador (read-only, autor≠verificador).
@@ -489,7 +490,8 @@ the author — even if you wrote the code, enter as if you'd never seen it. Fres
 - **Author ≠ verifier.** On Claude, spawn a read-only sub-agent for real isolation.
 - \`ok: false\` if any requirement lacks discriminating coverage. A gap is red, not "almost".
 - Don't fix here — a gap becomes a fix task; re-verify after.
-- The archive gate **requires** a fresh \`verdict.json\` (matching \`tasksHash\` and \`effectiveSpecHash\`) covering every \`[req:]\`.
+- The archive gate **requires** a fresh \`verdict.json\` matching \`tasksHash\`,
+  \`effectiveSpecHash\`, \`evidenceEnvelopeId\`, and \`evidenceBinding\`, covering every \`[req:]\`.
 
 ## Templates (in this folder)
 - \`spec-reviewer-prompt.md\` — hand it to the verifier sub-agent you spawn (read-only, author≠verifier).
@@ -507,6 +509,8 @@ const VERDICT_TEMPLATE = `{
   ],
   "tasksHash": "<copie de verificacao.json — selo de frescor / copy from verificacao.json — freshness seal>",
   "effectiveSpecHash": "<copie de verificacao.json / copy from verificacao.json>",
+  "evidenceEnvelopeId": "<copie de verificacao.json / copy from verificacao.json>",
+  "evidenceBinding": "<copie o objeto de verificacao.json / copy the object from verificacao.json>",
   "notes": []
 }
 `;
@@ -532,7 +536,8 @@ Para cada \`[req:ID]\` da mudança:
 
 Grave \`08-Mudanças/<slug>/verdict.json\` no formato de \`verdict-template.json\`. \`ok: false\` se
 qualquer \`[req:]\` não tem cobertura que discrimina. Não conserte aqui — gap vira tarefa de
-correção. \`tasksHash\` e \`effectiveSpecHash\` vêm do pacote; alterações posteriores deixam o verdict stale.
+correção. \`tasksHash\`, \`effectiveSpecHash\`, \`evidenceEnvelopeId\` e \`evidenceBinding\` vêm do
+pacote; alterações posteriores deixam o verdict stale e o binding nunca deve ser reconstruído à mão.
 ---
 `;
 
@@ -556,8 +561,9 @@ For each \`[req:ID]\`:
 4. Check the observable result against the criterion — not the code.
 
 Write \`08-Changes/<slug>/verdict.json\` in the shape of \`verdict-template.json\`. \`ok: false\` if any
-\`[req:]\` lacks discriminating coverage. Don't fix here — a gap becomes a fix task. \`tasksHash\`
-and \`effectiveSpecHash\` come from the package (freshness seals; later task/spec edits make verdict stale).
+\`[req:]\` lacks discriminating coverage. Don't fix here — a gap becomes a fix task. \`tasksHash\`,
+\`effectiveSpecHash\`, \`evidenceEnvelopeId\`, and \`evidenceBinding\` are copied from the package;
+never reconstruct the binding by hand (later checkout/task/spec edits make the verdict stale).
 ---
 `;