wendkeep 0.79.0 → 0.80.0

package/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.80.0] — 2026-08-24
+
+### Added
+
+- **Task Contract v1.** `wendkeep task list/show/evaluate/claim/release` deriva contratos tipados
+  da change e do active context, com IDs estáveis, hashes de HEAD/tarefas/spec/manifesto,
+  diagnósticos estruturados e leases exclusivos recuperáveis sob o lock do `SESSION_REGISTRY`.
+- **Artifact gates bounded.** Manifestos v1 suportam `name`, `path`, `glob` e `file-count`, com
+  fallback de filesystem explícito, ignores seguros, limites de tempo/quantidade e bloqueio de
+  path escape, symlink ou junction externo.
+- **Handoff Contract v1.** SessionStop publica handoff causal com task, artifacts, Evidence
+  Envelope, decisões, próximas ações, blockers e hashes; ASSURE exige contrato verificado e
+  handoffs históricos permanecem `legacy-reported`.
+- **Schemas e guias bilíngues.** Schemas públicos de task/handoff/artifacts, README e guias PT-BR/EN
+  documentam comandos, erros, recovery, autoridade e compatibilidade.
+
+### Changed
+
+- **Execute → Verify machine-checkable.** `verify` preserva o Evidence Envelope recém-capturado,
+  grava `task-evaluation.json` e bloqueia sucesso/pacote deep quando checkbox, requisito, sensor,
+  artifact, dependência ou binding causal ainda estiver aberto; `[phase:verify]` separa a tarefa
+  final de revisão/arquivo sem enfraquecer o gate de archive.
+- **Memória e Observer sem autoridade duplicada.** `handoff.latest` passa a transportar o contrato
+  estruturado verificado pela mesma outbox sanitizada; resumos heurísticos continuam apenas como
+  projeção reportada.
+
 ## [0.79.0] — 2026-08-23
 
 ### Added

package/README.en.md

@@ -242,7 +242,7 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | **Managed worktrees** | `worktree create/list/status/open/finish/cleanup/remove/prune`, merge proof, preflight, crash-safe cleanup/common gate, and receipts | [Managed worktrees](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/worktrees.md) |
 | **Active context** | `active_contexts` by `repository_id`/`worktree_id`/`work_session_id`, causal transition, quarantine, and explicit recovery | [Active context](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/context.md) |
 | **Operating profiles** | `profile`, `flow`, always-on Keep Core, and Wend Runtime governance | [Operating profiles](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md) |
-| **Changes and verification** | `change`, specs, sensors, TDD, evidence, and archive | [Changes and verification](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/changes-and-verification.md) |
+| **Changes and verification** | `change`, specs, sensors, TDD, evidence, Task Contracts, and archive | [Changes and verification](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/changes-and-verification.md) |
 | **Shared memory** | CORE, SHARED, status, validation, repair, and curation | [Memory](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory.md) |
 | **Sessions and import** | causal hooks, observability reconciliation, and Claude/Codex backfill | [Sessions and import](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/sessions-and-import.md) |
 | **Notes and knowledge** | BUG/APR/ADR, repairs, renumbering, lessons, and dashboard | [Notes and knowledge](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/notes-and-knowledge.md) |

package/README.md

@@ -242,7 +242,7 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | **Managed worktrees** | `worktree create/list/status/open/finish/cleanup/remove/prune`, merge proof, preflight, crash-safe cleanup/common gate, and receipts | [Managed worktrees](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/worktrees.md) |
 | **Active context** | `active_contexts` by `repository_id`/`worktree_id`/`work_session_id`, causal transition, quarantine, and explicit recovery | [Active context](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/context.md) |
 | **Operating profiles** | `profile`, `flow`, always-on Keep Core, and Wend Runtime governance | [Operating profiles](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md) |
-| **Changes and verification** | `change`, specs, sensors, TDD, evidence, and archive | [Changes and verification](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/changes-and-verification.md) |
+| **Changes and verification** | `change`, specs, sensors, TDD, evidence, Task Contracts, and archive | [Changes and verification](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/changes-and-verification.md) |
 | **Shared memory** | CORE, SHARED, status, validation, repair, and curation | [Memory](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory.md) |
 | **Sessions and import** | causal hooks, observability reconciliation, and Claude/Codex backfill | [Sessions and import](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/sessions-and-import.md) |
 | **Notes and knowledge** | BUG/APR/ADR, repairs, renumbering, lessons, and dashboard | [Notes and knowledge](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/notes-and-knowledge.md) |

package/docs/en/commands/changes-and-verification.md

@@ -29,6 +29,8 @@ npx wendkeep change new <slug> [--simple|--guide] [--session <id>]
 npx wendkeep change status [slug] [--session <id>]
 npx wendkeep spec effective [--change <slug>] [--session <id>]
 npx wendkeep sensors list
+npx wendkeep task list [--change <slug>] [--session <id>] [--json]
+npx wendkeep task evaluate <task-id> [--change <slug>] [--session <id>] [--json]
 npx wendkeep verify [--deep] [--change <slug>] [--session <id>]
 npx wendkeep change archive <slug> [--json] [--session <id>]
 npx wendkeep change archive recover <operation-id> --change <slug> [--spec-action rollback|resume] [--json]
@@ -48,6 +50,8 @@ npx wendkeep change archive recover <operation-id> --change <slug> [--spec-actio
   only one unambiguous active context for the worktree is accepted; ambiguity returns exit `2`.
 - `change relink [--apply]` and `change backlink [--apply]` repair graph links; preview is default.
 - `change abandon <slug>` drops work without an ADR; `archive --force` needs explicit human choice.
+- `task list/show/evaluate` derives read-only contracts from change authorship. `task claim/release`
+  controls owner/lease in the causal active context.
 - `change archive recover <operation-id> --change <slug> [--spec-action rollback|resume]` inspects a
   pending transaction by default; with `rollback` or `resume`, it converges only the spec
   promotion prepared in the journal, under the operation lock and validation. It never promotes the
@@ -148,6 +152,52 @@ cleanup is automatic. Sanitized `operation_id` and
 Text and --json use the same sanitized diagnostic with code, operation, state, blocker, expected,
 observed, recovery, reason_codes, diagnostics, and repair.
 
+## Task Contracts, artifacts, and handoffs
+
+Task Contract v1 is a rebuildable projection whose authorship remains in `tarefas.md`, the
+effective spec, and the change's `artifacts.json`. The contract neither copies spec text nor infers
+a requirement from chat. Project, active context, HEAD, and tasks/spec/manifest hashes bind the
+projection; any mismatch yields `stale`.
+
+```markdown
+- [ ] 2.3 produce report [req:REP-1] [sensor:tests] [depends:2.2] [artifact:report]
+- [ ] 9.1 review the deep package and archive [req:REP-1] [phase:verify]
+```
+
+```powershell
+npx wendkeep task list --session <id> [--change <slug>] [--json]
+npx wendkeep task show 2.3 --session <id> [--json]
+npx wendkeep task evaluate 2.3 --session <id> [--json]
+npx wendkeep task claim 2.3 --session <id> [--lease-seconds 900] [--json]
+npx wendkeep task release 2.3 --session <id> [--json]
+```
+
+`list`, `show`, and `evaluate` do not write. `claim` and `release` use the atomic
+`SESSION_REGISTRY` lock, are scoped by repository/worktree/work session/change/task, and reject a
+concurrent owner. An expired lease can be recovered; release by a non-owner fails with
+`TASK_LEASE_NOT_OWNER`.
+
+An artifact manifest uses `schema_version: 1` and an `artifacts` list; each named entry may use
+type `name`, `path`, `glob`, or `file-count`. The `fromFilesystem` fallback is explicit, never reads
+content, ignores `.git`, `.worktrees`, `node_modules`, and `dist`, has time/entry limits, and fails
+closed on path escape or an external symlink/junction.
+
+A checkbox is an authored signal, not proof. `task evaluate` returns `can_complete`, missing
+requirements, sensors, artifacts, dependencies, and `blocking_findings`. In a causal active
+context, `verify` may write `evidencia.json`, but it cannot report success or create the deep
+package while any default `execute` task is blocked; diagnostics live in `task-evaluation.json`.
+Use `[phase:verify]` only for the review/archive task that necessarily runs after the deep package:
+it does not participate in the Execute → Verify gate, remains blocked in individual evaluation,
+and must still be completed before `change archive`.
+
+SessionStop binds source/target, task, artifacts, Evidence Envelope, decisions, next actions,
+blockers, and HEAD/tasks/spec hashes. ASSURE requires a verified Handoff Contract v1; it is optional
+in other profiles. Historical summaries remain `legacy-reported`. Shared memory, brain injection,
+and Observer consume the same sanitized projection.
+
+Public schemas: `schema/task-contract-v1.schema.json`,
+`schema/artifact-manifest-v1.schema.json`, and `schema/handoff-contract-v1.schema.json`.
+
 ## Tool-scope fence
 
 `change-guard` is also projected to Codex `PreToolUse`. Before a Git mutation or supported writing

package/docs/en/commands/sessions-and-import.md

@@ -142,3 +142,9 @@ from a busy lock or skipped path without reopening the original session.
 
 Read [Operating profiles](operating-profiles.md), [retroactive import](retroactive-import.md),
 [costs and observability](costs-and-observability.md), and [notes](notes-and-knowledge.md).
+# Handoff Contract v1
+
+In a causal active context, SessionStop projects a typed handoff with task, artifacts, Evidence
+Envelope, decisions, next actions, blockers, and HEAD/tasks/spec hashes. ASSURE blocks publication
+when that verified contract cannot be produced; other profiles preserve the optional fallback.
+Historical handoffs remain `legacy-reported`. See [Changes and verification](changes-and-verification.md).

package/docs/en/commands/verify.md

@@ -154,3 +154,12 @@ destructive cleanup is automatic. A failure retains `published-recovery-required
 Return to the [change lifecycle](changes-and-verification.md) for archive, review
 [Operating profiles](operating-profiles.md), or use [maintenance](maintenance-and-diagnostics.md)
 when no change exists.
+# Task Contract gate
+
+After running sensors and writing the current Evidence Envelope, `verify` evaluates Task Contracts
+for the causal active context. An open checkbox, missing requirement/sensor/artifact, open
+dependency, or stale binding returns exit `1`, preserves `evidencia.json`, writes
+`task-evaluation.json`, and does not create the deep package. Tasks explicitly authored with
+`[phase:verify]` are excluded only from this transition because they depend on the deep package;
+they remain open for the archive gate. See
+[Changes and verification](changes-and-verification.md).

package/docs/pt-BR/commands/changes-and-verification.md

@@ -29,6 +29,8 @@ npx wendkeep change new <slug> [--simple|--guide] [--session <id>]
 npx wendkeep change status [slug] [--session <id>]
 npx wendkeep spec effective [--change <slug>] [--session <id>]
 npx wendkeep sensors list
+npx wendkeep task list [--change <slug>] [--session <id>] [--json]
+npx wendkeep task evaluate <task-id> [--change <slug>] [--session <id>] [--json]
 npx wendkeep verify [--deep] [--change <slug>] [--session <id>]
 npx wendkeep change archive <slug> [--json] [--session <id>]
 npx wendkeep change archive recover <operation-id> --change <slug> [--spec-action rollback|resume] [--json]
@@ -48,6 +50,8 @@ npx wendkeep change archive recover <operation-id> --change <slug> [--spec-actio
   somente um contexto ativo inequívoco da worktree é aceito; ambiguidade retorna exit `2`.
 - `change relink [--apply]` e `change backlink [--apply]` reparam o grafo; dry-run é o padrão.
 - `change abandon <slug>` descarta sem ADR; `archive --force` exige decisão humana explícita.
+- `task list/show/evaluate` projeta contratos read-only da autoria da change. `task claim/release`
+  controla owner/lease no active context causal.
 - `change archive recover <operation-id> --change <slug> [--spec-action rollback|resume]` inspeciona
   uma transação pendente por padrão; com `rollback` ou `resume`, converge somente a promoção de
   specs preparada no journal, sob lock e validação. Não promove a change, não apaga o journal e não
@@ -147,6 +151,52 @@ destrutivo automático. Os campos sanitizados
 Texto e --json usam o mesmo diagnóstico sanitizado com code, operation, state, blocker, expected,
 observed, recovery, reason_codes, diagnostics e repair.
 
+## Task Contracts, artifacts e handoffs
+
+Task Contract v1 é uma projeção reconstruível cuja autoria permanece em `tarefas.md`, na spec
+efetiva e no `artifacts.json` da change. O contrato não copia a spec nem infere requisito do chat.
+Projeto, active context, HEAD e hashes de tarefas/spec/manifesto vinculam a projeção; divergência
+resulta em `stale`.
+
+```markdown
+- [ ] 2.3 gerar relatório [req:REP-1] [sensor:tests] [depends:2.2] [artifact:report]
+- [ ] 9.1 revisar pacote deep e arquivar [req:REP-1] [phase:verify]
+```
+
+```powershell
+npx wendkeep task list --session <id> [--change <slug>] [--json]
+npx wendkeep task show 2.3 --session <id> [--json]
+npx wendkeep task evaluate 2.3 --session <id> [--json]
+npx wendkeep task claim 2.3 --session <id> [--lease-seconds 900] [--json]
+npx wendkeep task release 2.3 --session <id> [--json]
+```
+
+`list`, `show` e `evaluate` não escrevem. `claim` e `release` usam o lock atômico do
+`SESSION_REGISTRY`, são escopados por repository/worktree/work session/change/task e recusam owner
+concorrente. Lease expirada pode ser retomada; release por não-owner falha com
+`TASK_LEASE_NOT_OWNER`.
+
+Um manifesto de artifacts usa `schema_version: 1` e uma lista `artifacts`; cada entrada nomeada
+pode ter tipo `name`, `path`, `glob` ou `file-count`. O fallback `fromFilesystem` é explícito, não
+lê conteúdo, ignora `.git`, `.worktrees`, `node_modules` e `dist`, tem limites de tempo/quantidade
+e falha fechado em path escape, symlink ou junction externo.
+
+Checkbox é sinal autoral, não prova. `task evaluate` retorna `can_complete`, requisitos, sensores,
+artifacts e dependências ausentes, além de `blocking_findings`. No active context causal, `verify`
+pode gravar `evidencia.json`, mas não anuncia sucesso nem cria o pacote deep enquanto houver task
+bloqueada na fase padrão `execute`; o diagnóstico fica em `task-evaluation.json`. Use
+`[phase:verify]` somente para a tarefa de revisão/arquivo que necessariamente ocorre depois do
+pacote deep: ela não integra o gate Execute → Verify, permanece bloqueada na avaliação individual
+e ainda precisa ser concluída antes de `change archive`.
+
+SessionStop vincula origem/destino, task, artifacts, Evidence Envelope, decisões, próximas ações,
+blockers e hashes de HEAD/tarefas/spec. ASSURE exige Handoff Contract v1 verificado; nos demais
+perfis ele é opcional. Handoffs históricos permanecem `legacy-reported`. Memória compartilhada,
+brain injection e Observer consomem a mesma projeção sanitizada.
+
+Schemas públicos: `schema/task-contract-v1.schema.json`,
+`schema/artifact-manifest-v1.schema.json` e `schema/handoff-contract-v1.schema.json`.
+
 ## Cerca de escopo para ferramentas
 
 O `change-guard` também é projetado para o `PreToolUse` do Codex. Antes de uma mutação Git ou de

package/docs/pt-BR/commands/sessions-and-import.md

@@ -141,3 +141,10 @@ confirmada de um lock ocupado ou de um caminho que foi pulado, sem reabrir a ses
 
 Leia [Perfis de Operação](operating-profiles.md), [importação retroativa](retroactive-import.md),
 [custos e observabilidade](costs-and-observability.md) e [notas](notes-and-knowledge.md).
+# Handoff Contract v1
+
+Em active context causal, o SessionStop projeta um handoff tipado com task, artifacts, Evidence
+Envelope, decisões, próximas ações, blockers e hashes de HEAD/tarefas/spec. ASSURE bloqueia a
+publicação quando esse contrato verificado não pode ser produzido; outros perfis preservam o
+fallback opcional. Handoffs históricos continuam `legacy-reported`. Veja
+[Changes e verificação](changes-and-verification.md).

package/docs/pt-BR/commands/verify.md

@@ -155,3 +155,11 @@ destrutivo automático. Falha mantém `published-recovery-required`.
 Volte ao [ciclo de changes](changes-and-verification.md) para archive, confira os
 [Perfis de Operação](operating-profiles.md) ou consulte
 [manutenção](maintenance-and-diagnostics.md) quando não houver change.
+# Gate de Task Contract
+
+Depois de executar sensores e gravar o Evidence Envelope atual, `verify` avalia os Task Contracts
+do active context causal. Checkbox aberta, requisito/sensor/artifact ausente, dependência aberta ou
+binding stale bloqueia exit `1`, preserva `evidencia.json`, grava `task-evaluation.json` e não cria
+o pacote deep. Tasks explicitamente autoradas com `[phase:verify]` ficam fora apenas desta
+transição porque dependem do pacote deep; continuam abertas para o gate de archive. Veja
+[Changes e verificação](changes-and-verification.md).

package/hooks/change-core.mjs

@@ -283,18 +283,36 @@ export function parseTasks(md) {
   const re = /^-\s+\[( |x)\]\s+(\S+)\s+(.*)$/gm;
   const sensorReG = /\[sensor:\s*([\w.-]+)\]/g;
   const reqReG = new RegExp(`\\[req:\\s*(${REQ_ID_RE_SRC})\\]`, 'g');
+  const dependencyReG = /\[depends:\s*([\w.-]+)\]/g;
+  const artifactReG = /\[artifact:\s*([\w.-]+)\]/g;
+  const phaseReG = /\[phase:\s*([\w.-]+)\]/g;
   let m;
   while ((m = re.exec(String(md))) !== null) {
     let text = m[3].trim();
     const sensors = [...new Set([...text.matchAll(sensorReG)].map((entry) => entry[1]))];
     const reqs = [...text.matchAll(reqReG)].map((r) => r[1]);
+    const dependencies = [...new Set([...text.matchAll(dependencyReG)].map((entry) => entry[1]))];
+    const artifacts = [...new Set([...text.matchAll(artifactReG)].map((entry) => entry[1]))];
+    const phases = [...new Set([...text.matchAll(phaseReG)].map((entry) => entry[1]))];
     const sensor = sensors[0];
     if (sensors.length) text = text.replace(sensorReG, '');
     if (reqs.length) text = text.replace(reqReG, '');
+    if (dependencies.length) text = text.replace(dependencyReG, '');
+    if (artifacts.length) text = text.replace(artifactReG, '');
+    if (phases.length) text = text.replace(phaseReG, '');
     text = text.replace(/\s+/g, ' ').trim();
     // `sensor` stays as alias of the first id — older consumers keep working.
     // `req` stays as alias of the first id — older consumers keep working.
-    tasks.push({ id: m[2], text, done: m[1] === 'x', ...(sensor ? { sensor, sensors } : {}), ...(reqs.length ? { req: reqs[0], reqs } : {}) });
+    tasks.push({
+      id: m[2],
+      text,
+      done: m[1] === 'x',
+      ...(sensor ? { sensor, sensors } : {}),
+      ...(reqs.length ? { req: reqs[0], reqs } : {}),
+      ...(dependencies.length ? { dependencies } : {}),
+      ...(artifacts.length ? { artifacts } : {}),
+      ...(phases.length ? { phase: phases[0] } : {}),
+    });
   }
   return tasks;
 }

package/hooks/session-stop.mjs

@@ -27,6 +27,11 @@ import {
 import { enqueueMemoryEvent, projectMemoryOutbox } from './memory-store.mjs';
 import { detectMemoryMode } from './memory-mode.mjs';
 import { sanitizeMemoryText } from './memory-schema.mjs';
+import {
+  buildStructuredTaskHandoff,
+  buildTaskContractSnapshot,
+  evaluateTaskContracts,
+} from '../src/task-contracts.mjs';
 import { assertVaultPathSafe } from './vault-path-safety.mjs';
 import {
   projectStopMemoryAttempt,
@@ -1406,6 +1411,40 @@ export async function main({
       summary: finalSummary,
       noteRel: sessionRel,
     });
+    let structuredSharedHandoff = sharedHandoff;
+    const effectiveProfile = String(
+      handoffEvidenceAuthority?.context?.operating_profile_task?.profile
+      || entry?.operating_profile_task?.profile
+      || 'GOVERN',
+    ).toUpperCase();
+    if (handoffEvidenceAuthority?.mode === 'contextual') {
+      try {
+        const taskSnapshot = activeContextChangeSlug
+          ? buildTaskContractSnapshot({
+            vaultBase,
+            projectRoot: input.cwd || process.cwd(),
+            changeSlug: activeContextChangeSlug,
+            identity: handoffEvidenceAuthority.identity,
+          })
+          : null;
+        structuredSharedHandoff = buildStructuredTaskHandoff({
+          profile: effectiveProfile,
+          sessionId,
+          snapshot: taskSnapshot,
+          evaluations: taskSnapshot ? evaluateTaskContracts(taskSnapshot) : [],
+          context: handoffEvidenceAuthority.context,
+          shared: sharedHandoff,
+        });
+      } catch (error) {
+        if (effectiveProfile === 'ASSURE') {
+          const detail = `${error?.code || 'HANDOFF_STRUCTURED_REQUIRED'}: ${error?.message || error}`;
+          process.stderr.write(`[wendkeep] Stop ASSURE bloqueado: ${detail}\n`);
+          writeHookOutput({ systemMessage: `wendkeep: Stop ASSURE exige handoff estruturado: ${detail}` });
+          return;
+        }
+        structuredSharedHandoff = sharedHandoff;
+      }
+    }
     memoryHandoff = {
       projectId,
       identity,
@@ -1418,7 +1457,7 @@ export async function main({
       observedAt: turnIdentity.observedAt || new Date(0).toISOString(),
       summary: finalSummary,
       evidence: memoryEvidence,
-      ...(sharedHandoff ? { shared: sharedHandoff } : {}),
+      ...(structuredSharedHandoff ? { shared: structuredSharedHandoff } : {}),
     };
     memoryAttempt = stageMemory(vaultBase, {
       handoff: memoryHandoff,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.79.0",
+  "version": "0.80.0",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [
@@ -41,7 +41,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "precheck": "node --check src/change.mjs && node --check src/archive-operation-lock.mjs && node --check src/worktree.mjs && node --check src/worktree-cleanup.mjs && node --check src/provenance-gate.mjs && node --check src/provenance-sources.mjs && node --check src/receipt-ledger.mjs && node --check src/evidence-envelope.mjs && node --check src/context.mjs && node --check src/active-context-health.mjs && node --check src/active-context-runtime.mjs && node --check hooks/active-context-store.mjs && node --check hooks/change-core.mjs && node --check hooks/brain-inject.mjs && node --check hooks/change-context.mjs && node --check packages/vault/src/worktree-metadata.mjs && node --check packages/vault/src/evidence-envelope.mjs",
+    "precheck": "node --check src/task-contracts.mjs && node --check src/task-leases.mjs && node --check src/task.mjs && node --check src/change.mjs && node --check src/archive-operation-lock.mjs && node --check src/worktree.mjs && node --check src/worktree-cleanup.mjs && node --check src/provenance-gate.mjs && node --check src/provenance-sources.mjs && node --check src/receipt-ledger.mjs && node --check src/evidence-envelope.mjs && node --check src/context.mjs && node --check src/active-context-health.mjs && node --check src/active-context-runtime.mjs && node --check hooks/active-context-store.mjs && node --check hooks/change-core.mjs && node --check hooks/brain-inject.mjs && node --check hooks/change-context.mjs && node --check hooks/session-stop.mjs && node --check packages/vault/src/worktree-metadata.mjs && node --check packages/vault/src/evidence-envelope.mjs && node --check packages/vault/src/memory-handoff.mjs",
     "check": "node --check scripts/release.mjs && node --check scripts/release-plan.mjs && node --check scripts/release-provenance.mjs && node --check scripts/run-scope.mjs && node --check src/release-provenance.mjs && node --check bin/wendkeep.mjs && node --check packages/cli/src/index.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/active-context-health.mjs && node --check src/project-vault.mjs && node --check src/observer-auth.mjs && node --check src/observer-privacy.mjs && node --check src/observer-snapshot.mjs && node --check src/observer-store.mjs && node --check src/observer-memory.mjs && node --check src/observer-memory-publish.mjs && node --check src/observer-sql-store.mjs && node --check src/observer-sql-migrate.mjs && node --check src/observer-sql-publish.mjs && node --check src/observer-transcript-store.mjs && node --check src/observer-server.mjs && node --check src/observer.mjs && node --check src/observer-publish.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check src/work-kind.mjs && node --check src/delivery.mjs && node --check web/observer/app.mjs && node --check hooks/observer-publish.mjs && node --check hooks/evidence-context.mjs && node --check hooks/active-context-handoff-evidence.mjs && node --check hooks/evidence-recall.mjs && node --check hooks/memory-scope.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/operating-profile-task-store.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/flow-store.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/integrations/src/host-hooks.mjs && node --check packages/integrations/src/hook-envelope.mjs && node --check packages/integrations/src/prompt-content.mjs && node --check packages/integrations/src/transcript-usage.mjs && node --check packages/integrations/src/transcripts.mjs && node --check packages/integrations/src/session-identity.mjs && node --check packages/integrations/src/index.mjs && node --check packages/mcp/src/config.mjs && node --check packages/mcp/src/index.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/locale.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-scope.mjs && node --check packages/vault/src/memory-candidate-policy.mjs && node --check packages/vault/src/evidence-recall.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
     "test": "node --test --test-concurrency=2",
     "test:core": "node scripts/run-scope.mjs core",

package/packages/cli/src/index.mjs

@@ -64,6 +64,8 @@ Usage:
   wendkeep context repair --key <repository:worktree:work-session> --revision <n> --reason <text> --session <id> [--json]
                            Inspect or explicitly recover a quarantined causal scope conflict.
                            Repair revalidates orphan/removed contexts or expired request leases without deleting history.
+  wendkeep task <sub>          Typed task contracts: list | show | evaluate | claim | release.
+                           Resolves the change from the causal active context; supports --session/--change/--json.
   wendkeep change <sub>        Change lifecycle: new [--simple|--guide] | use | bind <slug> --session <id> | continue | list | show |
                            status | done <id> | undone <id> | diff | archive [--force] | abandon | relink | backlink.
                            --session <id> selects the causal active_context for implicit change operations.
@@ -292,6 +294,11 @@ async function main(argv) {
       runChange(rest);
       break;
     }
+    case 'task': {
+      const { runTask } = await import('../../../src/task.mjs');
+      process.exit(runTask(rest));
+      break;
+    }
     case 'session': {
       const { runSession } = await import('../../../src/session.mjs');
       runSession(rest);

package/packages/vault/src/memory-handoff.mjs

@@ -61,6 +61,10 @@ export function normalizeSharedHandoff(shared) {
     const value = sanitizeValue(shared[field]);
     if (hasMeaningfulValue(value)) normalized[field] = value;
   }
+  if (Object.hasOwn(shared, 'handoff_contract')) {
+    const contract = sanitizeValue(shared.handoff_contract);
+    if (hasMeaningfulValue(contract)) normalized.handoff_contract = contract;
+  }
 
   return Object.keys(normalized).length ? normalized : null;
 }
@@ -257,6 +261,17 @@ export function buildSessionMemoryEvents({
   const events = [];
 
   if (normalizedShared) {
+    if (normalizedShared.handoff_contract) {
+      const contract = normalizedShared.handoff_contract;
+      events.push(makeEvent(context, {
+        memoryKey: 'handoff.latest',
+        value: contract,
+        authority: contract.schema_version === 1 && contract.authority === 'verified'
+          ? 'verified' : 'reported',
+        evidence: Array.isArray(contract.evidence) && contract.evidence.length
+          ? contract.evidence : [noteRel],
+      }));
+    }
     for (const [field, memoryKey] of SHARED_HANDOFF_FIELDS) {
       if (!Object.hasOwn(normalizedShared, field)) continue;
       events.push(makeEvent(context, {

package/schema/artifact-manifest-v1.schema.json

@@ -0,0 +1,35 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://wendkeep.dev/schema/artifact-manifest-v1.schema.json",
+  "title": "WendKeep Artifact Manifest v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "artifacts"],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "artifacts": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/artifact" }
+    }
+  },
+  "$defs": {
+    "artifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "type"],
+      "properties": {
+        "name": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" },
+        "type": { "enum": ["name", "path", "glob", "file-count"] },
+        "path": { "type": "string" },
+        "glob": { "type": "string" },
+        "min": { "type": "integer", "minimum": 0 },
+        "max": { "type": "integer", "minimum": 0 },
+        "fromFilesystem": { "type": "boolean" }
+      },
+      "allOf": [
+        { "if": { "properties": { "type": { "const": "path" } } }, "then": { "required": ["path"] } },
+        { "if": { "properties": { "type": { "enum": ["glob", "file-count"] } } }, "then": { "required": ["glob"] } }
+      ]
+    }
+  }
+}

package/schema/handoff-contract-v1.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://wendkeep.dev/schema/handoff-contract-v1.schema.json",
+  "title": "WendKeep Handoff Contract v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version", "handoff_id", "from", "to", "active_context_id", "task_id",
+    "task_contract_id", "artifacts", "evidence", "decisions", "next_actions", "blockers",
+    "head_sha", "tasks_sha256", "spec_sha256", "authority"
+  ],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "handoff_id": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "from": { "type": "string", "minLength": 1 },
+    "to": { "type": "string", "minLength": 1 },
+    "active_context_id": { "type": "string", "minLength": 1 },
+    "task_id": { "type": "string" },
+    "task_contract_id": { "type": "string" },
+    "artifacts": { "$ref": "#/$defs/stringArray" },
+    "evidence": { "$ref": "#/$defs/stringArray" },
+    "decisions": { "$ref": "#/$defs/stringArray" },
+    "next_actions": { "$ref": "#/$defs/stringArray" },
+    "blockers": { "$ref": "#/$defs/stringArray" },
+    "head_sha": { "type": "string", "minLength": 1 },
+    "tasks_sha256": { "type": "string", "minLength": 1 },
+    "spec_sha256": { "type": "string", "minLength": 1 },
+    "authority": { "enum": ["verified", "reported"] }
+  },
+  "$defs": {
+    "stringArray": {
+      "type": "array",
+      "items": { "type": "string" },
+      "uniqueItems": true
+    }
+  }
+}

package/schema/task-contract-v1.schema.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://wendkeep.dev/schema/task-contract-v1.schema.json",
+  "title": "WendKeep Task Contract v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version", "contract_id", "task_id", "change_slug", "title", "phase", "status",
+    "inputs", "expected_outputs", "acceptance_criteria", "requirement_ids",
+    "required_sensors", "required_artifacts", "dependencies", "owner", "work_session_id",
+    "evidence_envelope_id", "checked", "authored_sha256", "binding"
+  ],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "contract_id": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "task_id": { "type": "string", "minLength": 1 },
+    "change_slug": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" },
+    "title": { "type": "string" },
+    "phase": { "enum": ["execute", "verify"] },
+    "status": { "enum": ["ready", "blocked", "pending-evaluation", "completed", "stale"] },
+    "inputs": { "$ref": "#/$defs/stringArray" },
+    "expected_outputs": { "$ref": "#/$defs/stringArray" },
+    "acceptance_criteria": { "$ref": "#/$defs/stringArray" },
+    "requirement_ids": { "$ref": "#/$defs/stringArray" },
+    "required_sensors": { "$ref": "#/$defs/stringArray" },
+    "required_artifacts": { "$ref": "#/$defs/stringArray" },
+    "dependencies": { "$ref": "#/$defs/stringArray" },
+    "owner": { "type": ["string", "null"] },
+    "work_session_id": { "type": ["string", "null"] },
+    "evidence_envelope_id": { "type": ["string", "null"] },
+    "checked": { "type": "boolean" },
+    "authored_sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "binding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "project_id", "active_context_id", "head_sha", "tasks_sha256",
+        "effective_spec_sha256", "artifact_manifest_sha256"
+      ],
+      "properties": {
+        "project_id": { "type": "string", "minLength": 1 },
+        "active_context_id": { "type": "string", "minLength": 1 },
+        "head_sha": { "type": "string", "minLength": 1 },
+        "tasks_sha256": { "type": "string", "minLength": 1 },
+        "effective_spec_sha256": { "type": "string", "minLength": 1 },
+        "artifact_manifest_sha256": { "type": "string", "minLength": 1 }
+      }
+    }
+  },
+  "$defs": {
+    "stringArray": {
+      "type": "array",
+      "items": { "type": "string" },
+      "uniqueItems": true
+    }
+  }
+}