Verification

Evidence publication, the delivery pipeline, and brief revisions. The table records what has run, never that a change may merge.

Nine ordered gates

Intent

Rebase

observes the candidate against its base branch without ever rewriting it

Review

Test

blocked until required screenshot, screencast, or red/green evidence exists

Document

Lint

runs whatever lint task the project itself declares

Push

fast-forward pushes the reported candidate and nothing else

observed, never watched; read at pr reconcile and on demand

Derived from the task's own records and rendered as a status table in one marked  block of the reconciled PR, beside the evidence block. CI is observed, never watched, because sum runs no daemon and polls nothing: a green row means green as of the time shown.

./bin/sumctl pipeline run TASK_ID            # gates in order through opening and reconciling the PR; stops at first failure
./bin/sumctl pipeline run TASK_ID --no-pr    # stops after Push
./bin/sumctl pipeline ci TASK_ID             # re-read the checks GitHub reports
./bin/sumctl verify TASK_ID --accept-missing-evidence   # the user waives required evidence; recorded

Evidence publication into the PR

On by default: pr reconcile runs the evidence publisher for every evidence run the worker's handoff lists, and sumctl pr evidence repeats it on demand. Validated before/after media (hashes, containment, size, type, secret checks) is uploaded through gh pr edit --attach (GitHub CLI 2.99+) into one marked block of the reconciled PR; receipts per content hash and destination so a second publish uploads nothing; prose outside the block preserved; a foreign or hand-edited block refused; every failure leaves the previous body and the local originals intact. "evidence": {"auto_publish": false} in .sum/settings.json turns the automatic step off.

Brief revisions

A worker brief is generated from the record: the approved task text, base, repository, and kind (immutable input), the decisions recorded so far, the current worker procedure, and the return-channel commands. Each task keeps a versions.json sidecar with a numbered list of brief revisions. The file at brief_path and every earlier revision are never rewritten, so a worker mid-read keeps a valid brief.

./bin/sumctl brief list TASK_ID
./bin/sumctl report TASK_ID --file r.md --handoff h.json               # worker
./bin/sumctl review TASK_ID --verdict changes-requested --candidate SHA --file f.md   # reviewer
./bin/sumctl verify TASK_ID --candidate SHA --result pass --text '...'  # coordinator
./bin/sumctl verify TASK_ID --candidate SHA --execute                  # run VERIFY.md in a separate checkout
./bin/sumctl pr reconcile TASK_ID --number N
./bin/sumctl brief regenerate TASK_ID
./bin/sumctl brief request TASK_ID rN
./bin/sumctl brief adopt TASK_ID rN                                    # worker