GitHub is the ground truth (not the agent)

When an agent reports "task done", drobek does not believe it. The verification engine takes over.

What gets verified

• PR exists on the right branch.
• PR is merged.
• Required check runs are green (per repo required_check_runs config).
• Expected files changed (if the task declared an output contract).

Only when all four hold does the task transition to done.

needs_review is not a failure

When verification can't prove the work — PR isn't there, files don't match, CI is red — the task goes to needs_review. A human decides. That isn't a bug; it's the gate that makes the rest of the system trustable.

Why this matters

Without verification, "done" means "the agent said so". With it, "done" means "the agent shipped it and CI agreed". Procurement, your tech lead, and you-six-months-from-now all benefit.