Evidence

PitWay checks work against declared verification, not vibes.

Three check types

Every acceptance criterion in a contract maps to one verification check of one of three types, defined in the contract's frontmatter:

• command -- an actual shell command PitWay runs and records the result of.
• manual -- a human-performed check, recorded by the developer.
• review -- a review finding, recorded through milestone review.

Approval before execution

Command-type checks are hash-approved at milestone-confirm time via verification_approved_hash. PitWay never executes an unapproved, agent-authored command -- if the approved commands change, verify refuses on a hash mismatch until the contract is re-confirmed.

Recording evidence

pitway task-verify T001    # runs T001's own approved command
pitway verify M001         # runs every approved command-type check

Verification results live in their own verification-results.yaml, kept separate from the contract itself -- one authoritative source per fact, with no derived Git data (like commit SHAs) persisted; those are resolved from commit trailers instead.

Token usage: the same honesty

Usage is recorded only from what the runtime actually reports, never estimated -- usage: null renders as N/A rather than a guessed number. Usage accumulates across retries, and planning/QA usage is tracked separately from task usage, so nothing is double-counted. Milestone progress follows the same rule: no per-task percentages, only completed required tasks / total required tasks.