feat: supersede verdicts by requirement

Author: Panopticon Agent

.gitattributes

@@ -0,0 +1 @@
+.2119/verdicts/*.json linguist-generated=true

src/changed.ts

@@ -268,7 +268,8 @@ function scopeContext(
     if (
       parsed &&
       currentRequirements.has(parsed.requirementId) &&
-      (currentReviewIds.get(parsed.requirementId) === parsed.reviewId ||
+      (parsed.reviewId === undefined ||
+        currentReviewIds.get(parsed.requirementId) === parsed.reviewId ||
         baselineReviewIds.get(parsed.requirementId) === parsed.reviewId)
     ) {
       affected.add(parsed.requirementId);
@@ -294,7 +295,8 @@ function scopeContext(
     const assigned = Boolean(
       parsed &&
         currentRequirements.has(parsed.requirementId) &&
-        (currentReviewIds.get(parsed.requirementId) === parsed.reviewId ||
+        (parsed.reviewId === undefined ||
+          currentReviewIds.get(parsed.requirementId) === parsed.reviewId ||
           baselineReviewIds.get(parsed.requirementId) === parsed.reviewId),
     );
     return assigned ? affected.has(parsed!.requirementId) : changedPaths.has(path);
@@ -319,6 +321,7 @@ function scopeContext(
     lintViolations,
     coverViolations,
     reviewViolations,
+    migrationNotices: current.migrationNotices.filter((notice) => affected.has(notice.requirementId)),
     verifyViolations,
     notInitialized: current.notInitialized && baseline.notInitialized,
     scopedRequirementIds: affected,
@@ -367,8 +370,9 @@ function quotedRequirementId(message: string): string | undefined {
   return message.match(/requirement ID "([^"]+)"/)?.[1];
 }
 
-function verdictReview(path: string): { reviewId: string; requirementId: string } | undefined {
+function verdictReview(path: string): { reviewId?: string; requirementId: string } | undefined {
   const name = basename(path).replace(/\.json$/, "");
   const parsed = splitReviewId(name);
-  return parsed ? { reviewId: name, requirementId: parsed.requirementId } : undefined;
+  if (parsed) return { reviewId: name, requirementId: parsed.requirementId };
+  return /^[A-Za-z0-9.-]+$/.test(name) ? { requirementId: name } : undefined;
 }

src/check.ts

@@ -6,7 +6,7 @@ import { parseSpec } from "./spec.js";
 import { scanAnnotations } from "./annotations.js";
 import { computeCoverage, type CoverageResult } from "./cover.js";
 import { computeReviewTargets, verdictViolations, type ReviewTask } from "./review.js";
-import { scanVerdicts } from "./verdict.js";
+import { legacyMigrationNotices, scanVerdicts, type MigrationNotice } from "./verdict.js";
 import { runVerifyCommands } from "./verify.js";
 import { allRequirements } from "./spec.js";
 import type { Annotation, SpecFile, Verdict, Violation } from "./model.js";
@@ -27,6 +27,7 @@ export interface CheckContext {
   coverViolations: Violation[];
   reviewViolations: Violation[];
   malformedVerdictViolations: Violation[];
+  migrationNotices: MigrationNotice[];
   verifyViolations: Violation[];
   notInitialized: boolean;
   /** Present for `check --changed`; limits report counts and manual output to affected requirements. */
@@ -90,8 +91,11 @@ export function buildContext(root: string, options: BuildOptions = {}): CheckCon
   const allReviewTargets = computeReviewTargets(config, specs, coverage, repoFiles, annotations, markerLineByFile);
   const reviewTargets = config.reviews ? allReviewTargets : [];
   // Malformed verdict files are loud violations, not silent passes or skips (REQ-003.7.2).
-  const { verdicts, violations: malformedVerdicts } = scanVerdicts(root);
-  const reviewViolations = [...malformedVerdicts, ...verdictViolations(reviewTargets, verdicts)];
+  const verdictScan = scanVerdicts(root);
+  const { verdicts, violations: malformedVerdicts, stableFiles } = verdictScan;
+  const currentReviewIds = new Map(reviewTargets.map((target) => [target.requirement.id, target.reviewId]));
+  const migrationNotices = legacyMigrationNotices(verdictScan, currentReviewIds);
+  const reviewViolations = [...malformedVerdicts, ...verdictViolations(reviewTargets, verdicts, stableFiles)];
 
   // [review: instructions: <path>] pointing at a missing file (REQ-005.1.4),
   // and [review: <globs>] matching nothing — a typo'd glob must fail loudly
@@ -135,6 +139,7 @@ export function buildContext(root: string, options: BuildOptions = {}): CheckCon
     coverViolations: coverage.violations,
     reviewViolations,
     malformedVerdictViolations: malformedVerdicts,
+    migrationNotices,
     verifyViolations,
     notInitialized,
   };
@@ -145,6 +150,7 @@ export interface CheckReport {
   violations: Violation[];
   uncoveredRequirements: string[];
   staleReviews: string[];
+  migrationNotices: string[];
   manualRequirements: { id: string; text: string }[];
   requirementCount: number;
   coveredCount: number;
@@ -160,6 +166,7 @@ export function buildReport(ctx: CheckContext): CheckReport {
     violations,
     uncoveredRequirements: ctx.coverage.uncovered.map((r) => r.id),
     staleReviews: ctx.reviewViolations.map((v) => v.message),
+    migrationNotices: ctx.migrationNotices.map((notice) => notice.message),
     manualRequirements: ctx.coverage.manual.map((r) => ({ id: r.id, text: r.text })),
     requirementCount: enforcedTestReqs.length,
     coveredCount: ctx.coverage.covered.size,

src/cli.ts

@@ -229,6 +229,7 @@ switch (command) {
       console.log(JSON.stringify(report, null, 2));
     } else {
       printViolations(report.violations);
+      for (const notice of report.migrationNotices) console.log(notice);
       if (report.manualRequirements.length > 0) {
         console.log(`\nManual requirements (not automatically checked):`);
         for (const m of report.manualRequirements) console.log(`  - ${m.id}: ${m.text}`);
@@ -247,10 +248,18 @@ switch (command) {
   case "prune": {
     const ctx = buildContext(root);
     requireInitialized(ctx);
-    const current = new Set(ctx.reviewTargets.map((t) => t.reviewId));
-    const pruned = pruneVerdicts(root, current);
-    for (const id of pruned) console.log(`pruned .2119/verdicts/${id}.json`);
-    console.log(`prune: removed ${pruned.length} orphaned verdict(s), kept ${ctx.verdicts.size - pruned.length}`);
+    const current = new Map(ctx.reviewTargets.map((t) => [t.requirement.id, t.reviewId]));
+    const result = pruneVerdicts(root, current);
+    for (const action of result.actions) {
+      if (action.kind === "migrated") {
+        console.log(`migrated .2119/verdicts/${action.source} -> .2119/verdicts/${action.destination}`);
+      } else {
+        console.log(`pruned .2119/verdicts/${action.source}`);
+      }
+    }
+    const removed = result.actions.filter((action) => action.kind === "pruned").length;
+    const migrated = result.actions.filter((action) => action.kind === "migrated").length;
+    console.log(`prune: removed ${removed} orphaned verdict(s), migrated ${migrated}, kept ${result.kept}`);
     break;
   }
 

src/init.ts

@@ -9,7 +9,7 @@ import {
   refreshPinnedArtifacts,
   type AgentName,
 } from "./adapters.js";
-import { ensureReviewStorageRules } from "./verdict.js";
+import { ensureReviewStorageRules, ensureVerdictAttributes } from "./verdict.js";
 
 const CONFIG_TEMPLATE = `# 2119 configuration — https://github.com/Unsupervisedcom/2119
 # All fields optional; these are the defaults unless noted.
@@ -174,6 +174,9 @@ export function runInit(root: string, args: string[]): void {
   if (ensureReviewStorageRules(root)) {
     created.push(".gitignore (2119 review/verdict rules)");
   }
+  if (ensureVerdictAttributes(root)) {
+    created.push(".gitattributes (2119 generated verdict rule)");
+  }
 
   const agentsResult = upsertSection(join(root, "AGENTS.md"), refresh);
   if (agentsResult) created.push(`AGENTS.md (2119 section ${agentsResult})`);

src/review.ts

@@ -7,6 +7,7 @@ import { computeReviewId, fileParts } from "./hash.js";
 import { evidenceBlockParts } from "./annotations.js";
 import { matchGlobs } from "./files.js";
 import { allRequirements } from "./spec.js";
+import type { VerdictFile } from "./verdict.js";
 
 export const REVIEWS_DIR = ".2119/reviews";
 
@@ -79,9 +80,32 @@ export function computeReviewTargets(
 export function verdictViolations(
   targets: Omit<ReviewTask, "instructionPath">[],
   verdicts: Map<string, Verdict>,
+  stableFiles: Map<string, VerdictFile> = new Map(),
 ): Violation[] {
   const out: Violation[] = [];
   for (const t of targets) {
+    const stable = stableFiles.get(t.requirement.id);
+    if (stable) {
+      // Malformed stable files already produce their own fail-closed scan
+      // violation and must never fall back to a legacy pass.
+      if (!stable.verdict) continue;
+      if (stable.verdict.reviewId !== t.reviewId) {
+        out.push({
+          file: `${VERDICTS_DIR_HINT}/${stable.name}`,
+          line: 1,
+          rule: "REQ-003.3.1",
+          message: `${t.requirement.id} has a stale review verdict (recorded ${stable.verdict.reviewId}, current ${t.reviewId}); run \`2119 review\``,
+        });
+      } else if (stable.verdict.verdict === "fail") {
+        out.push({
+          file: `${VERDICTS_DIR_HINT}/${stable.name}`,
+          line: 1,
+          rule: "REQ-003.2.4",
+          message: `${t.requirement.id} has a failing review verdict: ${stable.verdict.summary}`,
+        });
+      }
+      continue;
+    }
     const v = verdicts.get(t.reviewId);
     if (!v) {
       out.push({