Watch runs each declared guardian once, records the observation, and compares it with the previous recorded state. Passing -c checks 1 behavior without a declaration. 3 outcomes, each meaning something precise.

the 3 outcomes

baseline stored: first observation, nothing to compare yet. behavior stable: state matches last run, nothing caught fire. drift detected: state changed since last time, and this is where watch earns its keep.

cause classification

On drift, watch compares the recorded code & environment signatures with the current ones. Code hash unchanged, environment hash moved: cause class environment. No commit will ever blame correctly, so the search is skipped. Code hash changed: cause class code, and the full blame pipeline runs automatically.

drift reports

The pipeline produces 3 things. The flip commit, found by the same search who uses. The essential diff, minimized & verified. And a markdown report at .crux/reports/<name>-<timestamp>.md with the transition, the commit, the essential lines & output excerpts from the broken present and the working past. It's written to be pasted into a PR without editing.

Any guardian violation or any drift exits 1. Put crux watch in the pipeline & a behavior change fails the build at the PR that introduced it, evidence attached, instead of surfacing 3 days later in production.