verifyOpts derives evidence-verification cwd from dirname(sourcePath), one level short of the repository root

[qmarcelle]

Split out of META-291 Phase 4 (resolution-only path-identity slice) and deliberately not fixed there, to keep that change atomic.

Defect

verifyOpts in src/tools/workspace.ts derives the working directory for evidence verification as:

return isVerifyEnabled() ? { verify: true, cwd: dirname(ws.sourcePath) } : undefined;

The canonical artifact location is .agents/workspace.json (ADR-001, and the first entry in WORKSPACE_JSON_CANDIDATES). For that layout dirname(ws.sourcePath) yields <root>/.agents, not the repository root.

Evidence records are verified by running commands (e.g. git log ...) in that cwd. Running them from .agents/ rather than the repository root means verification can silently fail to reproduce a claim that is in fact reproducible — degrading a VERIFIED tier to OBSERVED. That is a quiet weakening of enforcement strength, not a loud error.

Why it is not fixed in the META-291 slice

That slice introduced NormalizedWorkspace.repositoryRoot, derived centrally from the matched WORKSPACE_JSON_CANDIDATES entry (repositoryRootFor in src/services/workspace.ts), which resolves the .agents layout correctly. The fix here is therefore a one-line change:

cwd: ws.repositoryRoot

But it alters evidence-verification behaviour, which is a different concern from path resolution. Landing it inside the resolution slice would have made that change non-atomic and harder to review or revert independently.

Scope

• Change verifyOpts to use ws.repositoryRoot.
• Add coverage that verification runs from the repository root for the .agents/workspace.json layout.
• Confirm no evidence fixture depended on the .agents-relative cwd.

Reproduction

repositoryRootFor("/repo/.agents/workspace.json") -> /repo, whereas dirname("/repo/.agents/workspace.json") -> /repo/.agents. The repo's own fixture/ uses exactly this layout, so it is the live case rather than a hypothetical.