kairos-chain 3.77.0 → 3.79.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca968a084e8868b9cbeaa3283850dd7e56095a503d661ce6e74158ec7555f0e3
-  data.tar.gz: 7a410b2edb98cd9bf02c8396f11d1d411e9b190456ea87402789d9a95aea5f16
+  metadata.gz: 22b92a50151e63d6f243858700e0a0982dd569ce6df05133362dcda4077d6fd6
+  data.tar.gz: d6d5559901257355633ba3a9d26a43af62293757b67f98c011bd795be4dee8f7
 SHA512:
-  metadata.gz: 5cea432521cb70bcc7ed1f354bb0a4abe1165d16a25ed185d8b3c46af5db0d00d57c459737e3a52f290a356d29356033cce8e6ef4c56e7526438eb6f7eba30d3
-  data.tar.gz: cf536e54e866a943d95d0209741c1a6658e6df62421f9a5e0e082983e98025057aa4e4dfc04ad08a4f96e7acfd9a982e69bde253d6f3986302325d9dd7ab65f3
+  metadata.gz: 8f1bdd48fc2dd110b151e1bc2a8aff18278ea2bc0d97d801dcf3bdd086462e8d6d97b27fdd0a81b75dac820f84aa0786a076eeef84b8ae44d5012e1e435141c0
+  data.tar.gz: 0c401f4330cff3dc4af3bf6a4277fcf68412e93fec79acc6eb50a12f7e19c84c6eec298ba5527938e8fc8e2dc983a192383f7babec0c1741dde0e47aca993985

data/CHANGELOG.md

@@ -4,6 +4,89 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.79.0] - 2026-08-26
+
+### Fixed
+
+- **Field defect D4 — the delegated worker's watchdog killed healthy slow
+  cycles at minute 25, and killed them silently.** 3.77.0's first night of
+  field use ran the agent SkillSet on real goals; twice, a worker died with
+  nothing written, and the second death gave the mechanism away: spawn 20:31,
+  last heartbeat 20:56 — spawn plus exactly `WORKER_SELF_TIMEOUT_SECONDS`
+  (1500). The watchdog's design assumption was that only a HUNG gated call
+  reaches the bound; a healthy cycle with several LLM subprocess calls
+  routinely runs past 25 minutes. The bound is now two-fold: a stall bound
+  (default 45 min) measured against real session-dir activity — heartbeats
+  and lock files excluded, because the heartbeat thread outlives a hung main
+  thread and would blind the detector — and an absolute hard cap (default
+  3 h). Both are env-overridable (`KAIROS_WORKER_STALL_SECONDS`,
+  `KAIROS_WORKER_TIMEOUT_SECONDS`), and both write a `worker_exit.json`
+  record before `exit!(124)`. Every other exit the worker can see coming —
+  superseded, trapped signal, setsid failure, bootstrap failure, uncaught
+  error, normal completion — now leaves the same one-line record, and a
+  `crashed` report from `agent_wait` / `agent_status` carries the record (or
+  says explicitly that the process vanished without one, which is what a
+  SIGKILL still looks like). The record is deliberately NOT a result file:
+  the collector's crash path stays the crash path, so a committed advance is
+  still recovered from the gate log and never masked.
+
+- **Field defect D5 — a reviewer reply that defeats parsing lost both the
+  cycle and the evidence.** The high-complexity plan review extracts JSON
+  from the reviewer's reply; a long reply can contain several JSON blocks
+  (echoed plan fragments in code fences, code in findings), and taking the
+  first parseable one produced a hash with no `overall_verdict` — REVISE by
+  fallback, twice, then `review_max_retries` with zero cycles run, while the
+  5,819-character reply itself was discarded (snapshots keep metadata only).
+  The parser now scans all candidate blocks — whole reply, every fenced
+  block, every balanced object around an `"overall_verdict"` occurrence —
+  and prefers the one carrying a String verdict; and when parsing still
+  falls back, the raw reply is persisted beside the session records
+  (`review_raw_<ts>.txt`, 64 KiB cap) with the path named in the review's
+  findings.
+
+### Added
+
+- **Norm (g)** in the agent's standing norms, from field defect D2: what
+  `operator_report` receives must already be the finished text. The executor
+  feeds no step's output into another step's arguments, so a body written as
+  an assembly instruction is delivered verbatim as the report — cycle 1 of
+  the first field run did exactly that, and cycle 2 corrected it on its own.
+  The norm makes the correction standing.
+
+- `test_agent_worker_exit_and_review_parse.rb` — 19 tests, 42 assertions:
+  exit-record round-trip and token matching, stall-clock exclusion of
+  heartbeats and locks, env-overridable bounds, decoy-JSON regression for
+  the review parser, raw-reply persistence, norm (g) presence.
+
+Field context: defects D1 (worker bootstrap vs host-profile add-on guards,
+fixed and proven in 3.77.0's field night) through D5 are ledgered in L2
+`agent_3_77_0_field_defects` with the two field runs that surfaced them.
+D3 (read-only status calls queue behind a blocking wait on the stdio
+transport) remains open and recorded.
+
+## [3.78.0] - 2026-08-26
+
+### Fixed
+
+- **`readable_gate` — a failed note write no longer leaves an earlier turn's
+  note in place.** The carry-over note (shipped in 3.77.0) records which
+  record the gate blocked, so the recheck measures only what came after it. A
+  leftover note from an interrupted turn — 28 of 240 blocks draw no recheck —
+  survived the next block's failed note write, checked out as valid, and the
+  recheck judged the message that block had just made. A record with no uuid
+  was input enough. Every write failure now spends the leftover: deleted, or —
+  when deletion is refused — truncated in place, since deletion needs
+  directory-write while truncation needs only file-write, and an emptied note
+  fails the parse on every later read whatever the directory permits by then.
+  Only a leftover refusing both deletion and truncation survives, and the
+  design declares that state rather than claiming it closed. Found by
+  conformance review rounds 2-4: six reading contexts per round answering a
+  fixed claim list (21 → 4 → 2 → 1 claims), each finding reproduced end-to-end
+  before its fix, and round 4 closing with zero claims disputed. 133 tests /
+  815 assertions; 54 mutations killed 54/54; first-read stdout byte-identical
+  to the 3.74.0 baseline across up to 2,520 inputs measured by four
+  independent contexts.
+
 ## [3.77.0] - 2026-08-26
 
 ### Added

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.77.0"
+  VERSION = "3.79.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/agent/bin/agent_step_worker.rb

@@ -62,6 +62,17 @@ rescue ScriptError, StandardError => e
   write_raw_result(session_dir, boot_identity,
                    { 'status' => 'error',
                      'error' => "worker bootstrap failed: #{e.class}: #{e.message}" })
+  # StepDelegation itself failed to load, so write the exit record by hand
+  # (field defect D4: every exit this worker can see coming leaves one).
+  begin
+    File.write(File.join(session_dir, 'worker_exit.json'),
+               JSON.generate({ 'timestamp' => Time.now.utc.iso8601, 'pid' => Process.pid,
+                               'exit_class' => 'bootstrap_failure',
+                               'step_token' => boot_identity['step_token'],
+                               'error' => "#{e.class}: #{e.message}" }))
+  rescue StandardError
+    # best effort
+  end
   exit 1
 end
 
@@ -81,6 +92,7 @@ rescue StandardError => e
   delegation.write_result({ 'status' => 'error',
                             'error' => "worker setsid failed: #{e.message}" },
                           identity: boot_identity)
+  delegation.write_worker_exit(boot_identity, 'setsid_failure', 'error' => e.message)
   exit 125
 end
 
@@ -96,16 +108,36 @@ heartbeat_thread = Thread.new do
   end
 end
 
-# Self-timeout watchdog: a hung gated call would otherwise hold the advance
-# lock forever. Exiting the process releases its flock; the driver then sees
-# 'crashed' and re-issues safely. We deliberately write NO result here so the
-# collector takes the crash path — if the gated advance had already committed,
-# crashed_response recovers its outcome from the gate log; an error result
-# would instead mask that committed advance.
-timeout_s = KairosMcp::SkillSets::Agent::StepDelegation.worker_self_timeout_seconds
+# Watchdog (field defect D4, 2026-08-26): two bounds instead of one wall
+# clock. A hung gated call must not hold the advance flock forever — but the
+# old fixed 1500 s assumed only a hung call could reach it, and killed
+# healthy LLM-bound cycles at minute 25 with nothing written. Now the worker
+# dies when the session dir has gone SILENT for the stall bound (heartbeats
+# and locks excluded — the heartbeat thread outlives a hung main thread), or
+# when the hard cap elapses, whichever comes first. Either firing writes a
+# worker_exit record BEFORE exit!(124). That record is not a result, so the
+# collector still takes the crash path and a committed advance is still
+# recovered from the gate log, never masked.
+worker_started = Time.now
+stall_s = KairosMcp::SkillSets::Agent::StepDelegation.worker_stall_seconds
+cap_s   = KairosMcp::SkillSets::Agent::StepDelegation.worker_hard_cap_seconds
 watchdog = Thread.new do
-  sleep timeout_s
-  exit!(124)
+  loop do
+    sleep 30
+    elapsed = (Time.now - worker_started).round
+    silent  = (Time.now - delegation.last_activity_time).round
+    if elapsed > cap_s
+      delegation.write_worker_exit(boot_identity, 'self_timeout_hard_cap',
+                                   'elapsed_seconds' => elapsed,
+                                   'silent_seconds' => silent)
+      exit!(124)
+    elsif silent > stall_s
+      delegation.write_worker_exit(boot_identity, 'self_timeout_stalled',
+                                   'elapsed_seconds' => elapsed,
+                                   'silent_seconds' => silent)
+      exit!(124)
+    end
+  end
 end
 
 begin
@@ -115,6 +147,12 @@ begin
   # KAIROS_DATA_DIR was set in the worker env by spawn_worker so ToolRegistry
   # / Session resolve the server's effective .kairos even under --data-dir.
   require 'kairos_mcp/tool_registry'
+  # Host-profile add-on SkillSets (codex_projection, opencode_projection) guard
+  # their lib entry point with `raise unless defined?(PluginProjector::HostProfile)`.
+  # The server satisfies that guard as a side effect of protocol.rb; this worker
+  # bootstraps only tool_registry, so it must load the core explicitly or
+  # Skillset#load! trips the guard and the whole registry bootstrap dies.
+  require 'kairos_mcp/plugin_projector'
 
   pending = delegation.pending
   raise "no pending delegation in #{session_dir}" unless pending
@@ -126,6 +164,8 @@ begin
   # worker owns this delegation, and the gate would replay/serialize our stale
   # call anyway. Exiting leaves the current handle to its rightful worker.
   if my_token.nil? || pending['step_token'] != my_token
+    delegation.write_worker_exit(boot_identity, 'superseded',
+                                 'current_token' => pending['step_token'])
     exit 0
   end
 
@@ -136,7 +176,10 @@ begin
   args = (pending['arguments'] || {}).merge('session_id' => session_id)
   args.delete('execution') # never recurse into another delegation
 
-  exit 130 if shutdown[:requested]
+  if shutdown[:requested]
+    delegation.write_worker_exit(boot_identity, 'trapped_signal')
+    exit 130
+  end
 
   registry = KairosMcp::ToolRegistry.new
   raw = registry.call_tool('agent_step', args)
@@ -158,6 +201,7 @@ begin
   # races a concurrently-opened fresh delegation by clearing state it may no
   # longer own or by mislabeling its result as a newer delegation's.
   delegation.write_result(response, identity: identity)
+  delegation.write_worker_exit(identity, 'normal')
   exit 0
 rescue SystemExit, SignalException
   # A deliberate exit (including our own `exit 0`) or a signal is not a
@@ -176,6 +220,11 @@ rescue Exception => e # rubocop:disable Lint/RescueException
   rescue StandardError
     # best effort
   end
+  begin
+    delegation.write_worker_exit(boot_identity, 'uncaught', 'error' => "#{e.class}: #{e.message}")
+  rescue StandardError
+    # best effort
+  end
   exit 1
 ensure
   watchdog&.kill

data/templates/skillsets/agent/lib/agent/step_delegation.rb

@@ -44,14 +44,23 @@ module KairosMcp
         HEARTBEAT_FILE = 'delegation.heartbeat'
         RESULT_FILE    = 'delegation_result.json'
         LOG_FILE       = 'delegation_worker.log'
+        WORKER_EXIT_FILE = 'worker_exit.json'
 
         HEARTBEAT_INTERVAL_SECONDS        = 2
         HEARTBEAT_STALE_THRESHOLD_SECONDS = 15
         STARTUP_GRACE_SECONDS             = 30
-        # Wall-clock ceiling for a delegated step; past it the worker exits so
-        # a hung gated call cannot hold the advance lock forever (a dead
-        # process releases its flock). Generous: real steps are LLM-bound.
-        WORKER_SELF_TIMEOUT_SECONDS       = 1500
+        # Two-bound watchdog for the delegated worker (field defect D4,
+        # 2026-08-26). The original single 1500 s wall clock assumed only a
+        # hung call could reach it; a healthy cycle with several LLM
+        # subprocess calls routinely runs past 25 minutes, so the clock killed
+        # sound workers — silently, because its exit wrote nothing. The stall
+        # bound frees a hung call's flock once the session dir has gone quiet
+        # (heartbeats and locks excluded: the heartbeat thread outlives a hung
+        # main thread, so it must not count as activity); the hard cap remains
+        # the absolute ceiling. Both are env-overridable per run and both
+        # record their firing in WORKER_EXIT_FILE before exiting.
+        WORKER_STALL_SECONDS_DEFAULT      = 2700
+        WORKER_HARD_CAP_SECONDS_DEFAULT   = 10800
 
         WORKER_SCRIPT = File.expand_path('../../bin/agent_step_worker.rb', __dir__)
 
@@ -195,6 +204,68 @@ module KairosMcp
           atomic_write(result_path, JSON.pretty_generate(payload))
         end
 
+        # ---- worker exit record (field defect D4) ----
+
+        # One line, written by the worker at every exit it can see coming
+        # (self-timeout, supersession, trapped signal, setsid/bootstrap
+        # failure, uncaught error, normal completion). Deliberately NOT the
+        # result file: the collector's crash path must stay the crash path, so
+        # a committed advance is still recovered from the gate log and never
+        # masked by an error result. Overwrites are fine — readers match on
+        # step_token, so a stale record for an older worker is ignored.
+        def write_worker_exit(identity, exit_class, detail = {})
+          payload = {
+            'timestamp'    => Time.now.utc.iso8601,
+            'pid'          => Process.pid,
+            'exit_class'   => exit_class.to_s,
+            'step_token'   => identity && identity['step_token'],
+            'issue_anchor' => identity && identity['issue_anchor']
+          }.merge(detail)
+          atomic_write(worker_exit_path, JSON.generate(payload))
+          payload
+        rescue StandardError
+          nil
+        end
+
+        def worker_exit
+          JSON.parse(File.read(worker_exit_path))
+        rescue Errno::ENOENT, JSON::ParserError
+          nil
+        end
+
+        # The exit record for THIS token, or a positive "no record" marker —
+        # so a 'crashed' report can say WHY (e.g. self_timeout_stalled after
+        # N s of silence) or say explicitly that the process vanished without
+        # writing anything (SIGKILL and kin, or a pre-3.78 worker).
+        def crash_detail(token)
+          rec = worker_exit
+          if rec && rec['step_token'] == token
+            rec
+          else
+            { 'exit_class' => 'no_record',
+              'note' => 'process gone without an exit record (killed, or a pre-3.78 worker)' }
+          end
+        end
+
+        # Most recent write anywhere in the session dir EXCLUDING liveness and
+        # locking artifacts: heartbeats tick every 2 s even when the main
+        # thread hangs, so counting them would blind the stall bound.
+        def last_activity_time
+          newest = nil
+          Dir.glob(File.join(@dir, '*')).each do |f|
+            base = File.basename(f)
+            next if base.start_with?(HEARTBEAT_FILE)
+            next if base == LOCK_FILE || base.end_with?('.lock')
+            t = begin
+              File.mtime(f)
+            rescue StandardError
+              next
+            end
+            newest = t if newest.nil? || t > newest
+          end
+          newest || Time.now
+        end
+
         # Collect-once, atomically and self-contained: under the lock, consume
         # the result ONLY if it belongs to the CURRENT pending handle (same
         # issue_anchor + action_key + step_token), clearing both the result and
@@ -274,8 +345,12 @@ module KairosMcp
           pid
         end
 
-        def self.worker_self_timeout_seconds
-          WORKER_SELF_TIMEOUT_SECONDS
+        def self.worker_stall_seconds
+          (ENV['KAIROS_WORKER_STALL_SECONDS'] || WORKER_STALL_SECONDS_DEFAULT).to_i
+        end
+
+        def self.worker_hard_cap_seconds
+          (ENV['KAIROS_WORKER_TIMEOUT_SECONDS'] || WORKER_HARD_CAP_SECONDS_DEFAULT).to_i
         end
 
         private
@@ -338,6 +413,7 @@ module KairosMcp
         def pending_path   = File.join(@dir, PENDING_FILE)
         def heartbeat_path(token) = File.join(@dir, "#{HEARTBEAT_FILE}.#{token}")
         def result_path    = File.join(@dir, RESULT_FILE)
+        def worker_exit_path = File.join(@dir, WORKER_EXIT_FILE)
       end
     end
   end

data/templates/skillsets/agent/test/test_agent_worker_exit_and_review_parse.rb

@@ -0,0 +1,241 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Field defects D4 and D5 (2026-08-26, ledger: L2 agent_3_77_0_field_defects).
+#
+#   D4 — the delegated worker's watchdog killed healthy slow cycles at a fixed
+#        1500 s and exited with exit!(124) writing nothing. Covered here:
+#        the two-bound configuration (stall / hard cap, env-overridable), the
+#        worker exit record round-trip, crash_detail's token matching and its
+#        positive "no record" marker, and last_activity_time's exclusion of
+#        heartbeat and lock files (counting heartbeats would blind the stall
+#        bound: the heartbeat thread outlives a hung main thread).
+#   D5 — a reviewer reply carrying several JSON blocks defeated the parser
+#        (first parseable block had no overall_verdict). Covered here: the
+#        candidate scan prefers the block that carries a String verdict, the
+#        fallback reasons stay honest, and an unparseable reply is persisted
+#        raw beside the session records.
+#
+# Reads the SHIPPED template copies, not the instance copies under .kairos.
+# Usage: ruby test_agent_worker_exit_and_review_parse.rb
+
+require 'minitest/autorun'
+require 'json'
+require 'fileutils'
+require 'tmpdir'
+require 'rbconfig'
+
+$test_kairos_dir = Dir.mktmpdir('agent_worker_exit_test')
+
+module Autoexec
+  def self.loaded?
+    true
+  end
+end
+
+module KairosMcp
+  def self.data_dir
+    $test_kairos_dir
+  end
+
+  module Tools
+    class BaseTool
+      def text_content(text)
+        text
+      end
+    end
+  end
+end
+
+require File.expand_path('../autonomos/lib/autonomos', File.dirname(__dir__))
+require_relative '../lib/agent/mandate_adapter'
+
+$LOAD_PATH.unshift File.expand_path('../../../lib', __dir__)
+$LOAD_PATH.unshift File.expand_path('../lib', __dir__)
+$LOAD_PATH.unshift File.expand_path('../../autoexec/lib', __dir__)
+require 'kairos_mcp/invocation_context'
+require 'kairos_mcp/tools/base_tool'
+require 'kairos_mcp/tool_registry'
+require_relative '../lib/agent'
+require_relative '../tools/agent_step'
+require_relative '../lib/agent/step_delegation'
+
+StepDelegation = KairosMcp::SkillSets::Agent::StepDelegation
+AgentStepTool  = KairosMcp::SkillSets::Agent::Tools::AgentStep
+
+FakeSession = Struct.new(:session_dir)
+
+class TestWorkerExitRecord < Minitest::Test
+  def setup
+    @dir = Dir.mktmpdir('wx_')
+    @delegation = StepDelegation.new(@dir)
+    @identity = { 'step_token' => 'tok-1', 'issue_anchor' => '1:checkpoint:1' }
+  end
+
+  def teardown
+    FileUtils.remove_entry(@dir)
+  end
+
+  def test_write_and_read_round_trip
+    @delegation.write_worker_exit(@identity, 'self_timeout_stalled',
+                                  'elapsed_seconds' => 100, 'silent_seconds' => 90)
+    rec = @delegation.worker_exit
+    assert_equal 'self_timeout_stalled', rec['exit_class']
+    assert_equal 'tok-1', rec['step_token']
+    assert_equal 90, rec['silent_seconds']
+    assert_equal Process.pid, rec['pid']
+    refute_nil rec['timestamp']
+  end
+
+  def test_crash_detail_matches_token
+    @delegation.write_worker_exit(@identity, 'superseded')
+    assert_equal 'superseded', @delegation.crash_detail('tok-1')['exit_class']
+  end
+
+  def test_crash_detail_ignores_other_tokens_record
+    @delegation.write_worker_exit(@identity, 'normal')
+    detail = @delegation.crash_detail('tok-2')
+    assert_equal 'no_record', detail['exit_class']
+  end
+
+  def test_crash_detail_without_any_record_is_positive_no_record
+    detail = @delegation.crash_detail('tok-1')
+    assert_equal 'no_record', detail['exit_class']
+    assert_match(/without an exit record/, detail['note'])
+  end
+
+  def test_worker_exit_survives_nil_identity
+    rec = @delegation.write_worker_exit(nil, 'bootstrap_failure')
+    assert_equal 'bootstrap_failure', rec['exit_class']
+    assert_nil rec['step_token']
+  end
+end
+
+class TestStallActivityClock < Minitest::Test
+  def setup
+    @dir = Dir.mktmpdir('act_')
+    @delegation = StepDelegation.new(@dir)
+  end
+
+  def teardown
+    FileUtils.remove_entry(@dir)
+  end
+
+  def test_heartbeats_and_locks_do_not_count_as_activity
+    old = Time.now - 300
+    content = File.join(@dir, 'progress.jsonl')
+    File.write(content, 'x')
+    File.utime(old, old, content)
+    # Fresh liveness/locking artifacts that must NOT rejuvenate the clock.
+    File.write(File.join(@dir, 'delegation.heartbeat.tok-1'), '')
+    File.write(File.join(@dir, 'delegation.lock'), '')
+    File.write(File.join(@dir, 'advance.lock'), '')
+
+    assert_in_delta old.to_f, @delegation.last_activity_time.to_f, 5.0
+  end
+
+  def test_real_writes_do_count
+    File.write(File.join(@dir, 'llm_snapshots.jsonl'), 'x')
+    assert_in_delta Time.now.to_f, @delegation.last_activity_time.to_f, 5.0
+  end
+
+  def test_empty_dir_falls_back_to_now
+    assert_in_delta Time.now.to_f, @delegation.last_activity_time.to_f, 5.0
+  end
+end
+
+class TestWatchdogBounds < Minitest::Test
+  def test_defaults
+    assert_equal 2700,  StepDelegation.worker_stall_seconds
+    assert_equal 10_800, StepDelegation.worker_hard_cap_seconds
+  end
+
+  def test_env_overrides
+    ENV['KAIROS_WORKER_STALL_SECONDS'] = '60'
+    ENV['KAIROS_WORKER_TIMEOUT_SECONDS'] = '120'
+    assert_equal 60,  StepDelegation.worker_stall_seconds
+    assert_equal 120, StepDelegation.worker_hard_cap_seconds
+  ensure
+    ENV.delete('KAIROS_WORKER_STALL_SECONDS')
+    ENV.delete('KAIROS_WORKER_TIMEOUT_SECONDS')
+  end
+
+  def test_worker_script_parses
+    script = File.expand_path('../bin/agent_step_worker.rb', __dir__)
+    assert system(RbConfig.ruby, '-c', script, out: File::NULL, err: File::NULL),
+           'agent_step_worker.rb must stay syntactically valid'
+  end
+end
+
+class TestReviewParseHardening < Minitest::Test
+  def setup
+    @tool = AgentStepTool.allocate
+  end
+
+  def parse(content)
+    @tool.send(:parse_persona_review, content)
+  end
+
+  def test_clean_json_still_parses
+    r = parse('{"overall_verdict": "approve", "key_findings": []}')
+    assert_equal 'APPROVE', r[:overall_verdict]
+    refute r[:parse_error]
+  end
+
+  def test_verdict_found_past_a_decoy_json_block
+    # D5 regression shape: the first parseable JSON block (echoed plan
+    # fragment in a code fence) has no overall_verdict; the real verdict
+    # object comes later in prose.
+    content = <<~REPLY
+      Looking at the plan first:
+      ```json
+      {"task_id": "t-99", "steps": [{"tool_name": "safe_file_read"}]}
+      ```
+      My assessment as a panel follows.
+      {"overall_verdict": "revise", "key_findings": ["step 3 unclear"]}
+    REPLY
+    r = parse(content)
+    assert_equal 'REVISE', r[:overall_verdict]
+    assert_equal ['step 3 unclear'], r[:key_findings]
+    refute r[:parse_error]
+  end
+
+  def test_hash_without_verdict_still_falls_back_honestly
+    r = parse('{"verdict": "APPROVE"}')
+    assert r[:parse_error]
+    assert_match(/invalid overall_verdict type: NilClass/, r[:key_findings].first)
+    assert_equal 'REVISE', r[:overall_verdict]
+  end
+
+  def test_no_json_at_all_falls_back
+    r = parse('The plan looks fine to me, ship it.')
+    assert r[:parse_error]
+    assert_match(/no JSON found/, r[:key_findings].first)
+  end
+
+  def test_fenced_verdict_object_parses
+    content = "verdict below\n```json\n{\"overall_verdict\": \"REJECT\"}\n```\n"
+    assert_equal 'REJECT', parse(content)[:overall_verdict]
+  end
+
+  def test_persist_raw_review_writes_capped_file
+    Dir.mktmpdir('raw_') do |dir|
+      session = FakeSession.new(dir)
+      path = @tool.send(:persist_raw_review, session, 'a' * 70_000)
+      refute_nil path
+      assert File.exist?(path)
+      assert_equal 65_536, File.size(path)
+      assert File.basename(path).start_with?('review_raw_')
+    end
+  end
+
+  def test_persist_raw_review_nil_content_is_nil
+    assert_nil @tool.send(:persist_raw_review, FakeSession.new('/tmp'), nil)
+  end
+
+  def test_norm_g_present
+    norms = @tool.send(:permission_norms)
+    assert_match(/\(g\)/, norms)
+    assert_match(/finished text/, norms)
+  end
+end

data/templates/skillsets/agent/tools/agent_status.rb

@@ -71,6 +71,12 @@ module KairosMcp
                   'status' => dstatus,
                   'step_token' => delegation.pending&.dig('step_token')
                 }.compact
+                if dstatus == 'crashed'
+                  # Field defect D4: surface the worker's own exit record so
+                  # the operator sees WHY, not just 'crashed'.
+                  payload['delegation']['worker_exit'] =
+                    delegation.crash_detail(delegation.pending&.dig('step_token'))
+                end
                 if %w[ready still_pending].include?(dstatus)
                   payload['next_move'] = {
                     'tool' => 'agent_wait',

data/templates/skillsets/agent/tools/agent_step.rb

@@ -1843,10 +1843,29 @@ module KairosMcp
             result = review_loop.run_phase('review', persona_review_system_prompt, messages, [])
 
             parsed = parse_persona_review(result['content'])
+            if parsed[:parse_error]
+              # Field defect D5: without the raw reply on disk a parse failure
+              # is undiagnosable — llm_snapshots keeps only metadata.
+              raw_path = persist_raw_review(session, result['content'])
+              parsed[:key_findings] = Array(parsed[:key_findings]) +
+                                      ["raw reviewer reply saved: #{raw_path}"] if raw_path
+            end
             parsed[:llm_calls] = review_loop.total_calls
             parsed
           end
 
+          # Persist an unparseable reviewer reply beside the session records
+          # (capped at 64 KiB). Returns the path, or nil when nothing usable.
+          def persist_raw_review(session, content)
+            return nil if content.nil? || content.to_s.empty?
+            name = "review_raw_#{Time.now.utc.strftime('%Y%m%dT%H%M%SZ')}.txt"
+            path = File.join(session.session_dir, name)
+            File.write(path, content.to_s[0, 65_536])
+            path
+          rescue StandardError
+            nil
+          end
+
           def run_lightweight_review(session, decision_payload, ar_result)
             prompt = build_lightweight_review_prompt(decision_payload, ar_result)
             review_loop = CognitiveLoop.new(self, session)
@@ -2062,18 +2081,76 @@ module KairosMcp
           def parse_persona_review(content)
             return review_parse_fallback('no content') unless content
 
-            json_str = extract_json_from_content(content)
-            return review_parse_fallback('no JSON found') unless json_str
+            # Field defect D5 (2026-08-26): a long reviewer reply can contain
+            # SEVERAL JSON blocks — echoed plan fragments, code in findings —
+            # and taking the first parseable one yielded a hash with no
+            # overall_verdict at all. Scan every candidate and prefer the one
+            # that actually carries a String overall_verdict; fall back to the
+            # first hash only when none does, so the failure reason stays
+            # honest ("invalid overall_verdict type").
+            candidates = extract_json_candidates(content)
+            return review_parse_fallback('no JSON found') if candidates.empty?
+
+            chosen = nil
+            candidates.each do |json_str|
+              parsed = begin
+                JSON.parse(json_str)
+              rescue JSON::ParserError
+                next
+              end
+              next unless parsed.is_a?(Hash)
+              if parsed['overall_verdict'].is_a?(String)
+                chosen = parsed
+                break
+              end
+              chosen ||= parsed
+            end
+            return review_parse_fallback('no JSON found') if chosen.nil?
 
-            parsed = JSON.parse(json_str)
-            verdict = parsed['overall_verdict']
+            verdict = chosen['overall_verdict']
             unless verdict.is_a?(String)
               return review_parse_fallback("invalid overall_verdict type: #{verdict.class}")
             end
-            parsed['overall_verdict'] = verdict.upcase
-            parsed.transform_keys(&:to_sym)
-          rescue JSON::ParserError => e
-            review_parse_fallback("JSON parse error: #{e.message}")
+            chosen['overall_verdict'] = verdict.upcase
+            chosen.transform_keys(&:to_sym)
+          end
+
+          # All plausible JSON blocks in a reviewer reply, in preference order:
+          # the whole reply, every fenced block, every balanced object around
+          # an "overall_verdict" occurrence, then the crude first-{ to last-}
+          # span. Invalid candidates are skipped by the caller's JSON.parse.
+          def extract_json_candidates(content)
+            begin
+              JSON.parse(content)
+              return [content]
+            rescue JSON::ParserError
+              # fall through to scanning
+            end
+
+            candidates = []
+            content.scan(/```(?:json)?\s*\n?(.*?)\n?```/m) { |m| candidates << m[0] }
+
+            search_from = 0
+            while (key_at = content.index('"overall_verdict"', search_from))
+              open_at = content.rindex('{', key_at)
+              if open_at
+                depth = 0
+                i = open_at
+                while i < content.length
+                  depth += 1 if content[i] == '{'
+                  depth -= 1 if content[i] == '}'
+                  if depth.zero?
+                    candidates << content[open_at..i]
+                    break
+                  end
+                  i += 1
+                end
+              end
+              search_from = key_at + 1
+            end
+
+            candidates << Regexp.last_match(1) if content =~ /(\{.*\})/m
+            candidates.compact.uniq
           end
 
           def review_parse_fallback(reason)
@@ -2401,7 +2478,13 @@ module KairosMcp
             "place it so that everything not depending on it comes first. Marked steps are " \
             "set aside and the rest of the plan still runs; the operator is shown what was " \
             "set aside at the end of the cycle. Do not drop such a step, and do not " \
-            "substitute a reversible half-measure without saying so in the summary."
+            "substitute a reversible half-measure without saying so in the summary.\n" \
+            "  (g) What `operator_report` receives must already be the finished text. " \
+            "The executor does not feed one step's output into another step's " \
+            "arguments, so a body written as an instruction — assemble this, summarize " \
+            "that — is delivered to the operator verbatim as the report. When the " \
+            "deliverable depends on outputs of steps in this plan, deliver it in the " \
+            "next cycle, written from what those steps actually returned."
           end
 
           def reflect_system_prompt

data/templates/skillsets/agent/tools/agent_wait.rb

@@ -174,6 +174,10 @@ module KairosMcp
             text_content(JSON.generate({
               'status' => 'crashed', 'session_id' => session.session_id,
               'step_token' => pending&.dig('step_token'),
+              # Field defect D4: say WHY when the worker left an exit record
+              # (self_timeout_stalled / hard_cap / superseded / uncaught …),
+              # or say explicitly that it vanished without one.
+              'worker_exit' => delegation.crash_detail(pending&.dig('step_token')),
               'next_action' => status_hint(session.session_id,
                                            'the delegated worker died before committing; the gate makes a ' \
                                            're-issue safe (exactly-once) — read agent_status and follow next_move')

data/templates/skillsets/kairos_hook_projector/hooks/readable_gate.rb

@@ -431,27 +431,61 @@ module KairosHookProjector
     # Written to a temporary name and renamed, so a reader can never see a
     # half-written note. The pid is in the temporary name because two modes'
     # gates can run against one session at the same moment.
+    #
+    # After a block, the note is this block's or absent. A write that succeeds
+    # replaces any earlier note through the rename; a write that fails must not
+    # leave one either, because a leftover from an interrupted turn checks out
+    # as valid — fresh, same session, deletable — and the recheck then measures
+    # against the wrong block: round 2 of the conformance review demonstrated
+    # the message this turn blocked being judged a second time. So every
+    # failure path spends whatever note is already at the key.
     def write_note(transcript_path, cfg, uuid)
-      return 'no uuid to record' if uuid.nil? || uuid.to_s.empty?
-
       path = note_path(transcript_path, cfg)
       return nil if path.nil? # no log declared: not a failure, a declared absence
 
-      FileUtils.mkdir_p(File.dirname(path))
-      tmp = "#{path}.#{Process.pid}.tmp"
-      File.write(
-        tmp,
-        JSON.generate(
-          'transcript' => note_key_path(transcript_path).scrub,
-          'mode' => cfg.mode_name.to_s.scrub,
-          'blocked_uuid' => uuid.to_s.scrub,
-          'at' => Time.now.to_f
+      return spend_stale_note(path, 'no uuid to record') if uuid.nil? || uuid.to_s.empty?
+
+      begin
+        FileUtils.mkdir_p(File.dirname(path))
+        tmp = "#{path}.#{Process.pid}.tmp"
+        File.write(
+          tmp,
+          JSON.generate(
+            'transcript' => note_key_path(transcript_path).scrub,
+            'mode' => cfg.mode_name.to_s.scrub,
+            'blocked_uuid' => uuid.to_s.scrub,
+            'at' => Time.now.to_f
+          )
         )
-      )
-      File.rename(tmp, path)
-      nil
-    rescue StandardError => e
-      "#{e.class}: #{e.message}"
+        File.rename(tmp, path)
+        nil
+      rescue StandardError => e
+        spend_stale_note(path, "#{e.class}: #{e.message}")
+      end
+    end
+
+    # Deletion first, truncation as the fallback. "A leftover that cannot be
+    # deleted here cannot be spent at the recheck either" was round 3's found
+    # assumption: it identifies write-time state with read-time state, and a
+    # directory made writable again inside the block-to-recheck window let the
+    # recheck spend a leftover this path had already failed to delete. Deleting
+    # needs directory-write; truncating needs only file-write, so the fallback
+    # usually works exactly where the unlink fails, and an emptied note fails
+    # the parse on every later read whatever the directory permits by then.
+    # Only when both are refused does the leftover stay valid, and that state
+    # is declared in design §7 rather than closed.
+    def spend_stale_note(path, reason)
+      File.unlink(path)
+      "#{reason}; a stale note was deleted"
+    rescue Errno::ENOENT
+      reason
+    rescue StandardError
+      begin
+        File.write(path, '')
+        "#{reason}; a stale note could not be deleted and was emptied instead"
+      rescue StandardError => e
+        "#{reason}; a stale note could not be deleted (#{e.class})"
+      end
     end
 
     # [uuid this gate blocked, nil] or [nil, why not].

data/templates/skillsets/kairos_hook_projector/test/mutation_check_readable_gate.rb

@@ -233,8 +233,10 @@ MUTATIONS = [
           note(cfg, "NOTE-WRITE-FAILED: #{failure}")
           out.delete('decision')
         end}],
+  # Retargeted after round 2: the no-uuid return now spends the leftover first,
+  # so the anchor moved with it. The mutation is unchanged in spirit.
   ['N18 write_note records a uuid it was not given',
-   %q{      return 'no uuid to record' if uuid.nil? || uuid.to_s.empty?},
+   %q{      return spend_stale_note(path, 'no uuid to record') if uuid.nil? || uuid.to_s.empty?},
    %q{      uuid = 'unknown' if uuid.nil? || uuid.to_s.empty?}],
   ['N19 the note is written whole rather than renamed into place',
    %q{      File.rename(tmp, path)},
@@ -272,6 +274,47 @@ MUTATIONS = [
         blocked_uuid, why_not = take_note(transcript_path, cfg)
         blocked_uuid, why_not = take_note(transcript_path, cfg) if blocked_uuid},
    ],
+
+  # --- what round 2 of the conformance review found --------------------------
+  #
+  # A leftover note from an interrupted turn is valid on its face, so a block
+  # whose own note write fails must spend it — otherwise the recheck reads the
+  # leftover and judges the message this turn just blocked. One seat of six
+  # found it, by composing two declared behaviours (the 11.7% unconsumed-note
+  # population and the no-uuid write failure) that every fixture had exercised
+  # only in isolation.
+  ['N29 the spend is a no-op that still reports success',
+   %q{    def spend_stale_note(path, reason)
+      File.unlink(path)},
+   %q{    def spend_stale_note(path, reason)
+      return reason if path
+      File.unlink(path)}],
+  ['N30 the no-uuid failure path stops spending the leftover',
+   %q{      return spend_stale_note(path, 'no uuid to record') if uuid.nil? || uuid.to_s.empty?},
+   %q{      return 'no uuid to record' if uuid.nil? || uuid.to_s.empty?}],
+  ['N31 the write\'s exception path stops spending the leftover',
+   %q{        spend_stale_note(path, "#{e.class}: #{e.message}")},
+   %q{        "#{e.class}: #{e.message}"}],
+
+  # --- what round 3 of the conformance review found --------------------------
+  #
+  # Unspendability is not stable: a directory that refuses the unlink at block
+  # time and permits it again before the recheck let the recheck spend the
+  # leftover this block had failed to delete. Three of five verifying contexts
+  # reached the same window independently. The truncation fallback is what
+  # closes it; this deletes the fallback and the window reopens.
+  ['N32 the truncation fallback is deleted, so a lifted window revives the leftover',
+   %q{    rescue StandardError
+      begin
+        File.write(path, '')
+        "#{reason}; a stale note could not be deleted and was emptied instead"
+      rescue StandardError => e
+        "#{reason}; a stale note could not be deleted (#{e.class})"
+      end
+    end},
+   %q{    rescue StandardError => e
+      "#{reason}; a stale note could not be deleted (#{e.class})"
+    end}],
 ].freeze
 
 def run_suite(root)

data/templates/skillsets/kairos_hook_projector/test/test_readable_gate.rb

@@ -2479,4 +2479,148 @@ class TestReadableGate < Minitest::Test
       assert_includes message, 'stamped ahead of the clock', message
     end
   end
+
+  # --- what round 2 of the conformance review found ---------------------------
+  #
+  # A leftover note from an interrupted turn checks out as valid: fresh, same
+  # session, deletable. When the next block's own note write fails, the recheck
+  # read that leftover and judged the message this turn had just blocked — no
+  # foreign hook involved, no filesystem failure needed (a record with no uuid
+  # is enough). After a block, the note must be this block's or absent.
+
+  def test_a_failed_note_write_also_spends_the_note_an_earlier_turn_left
+    Dir.mktmpdir do |tmp|
+      cfg_path = File.join(tmp, 'cfg.json')
+      tx_path = File.join(tmp, 't.jsonl')
+      log_path = File.join(tmp, 'gate.log')
+      raw = { 'mode_name' => 'test', 'log_path' => log_path, 'max_headings' => 3 }
+      File.write(cfg_path, JSON.generate(raw), encoding: 'UTF-8')
+      File.write(tx_path, rows_json([row_for('assistant', text: BLOCKED, uuid: 'AAA'),
+                                     row_for('assistant', text: BLOCKED)]),
+                 encoding: 'UTF-8')
+      cfg_obj = G::Config.new(raw, cfg_path)
+      assert_nil G.write_note(tx_path, cfg_obj, 'AAA'), 'the interrupted turn left its note'
+
+      out, = run_script(cfg_path, JSON.generate('transcript_path' => tx_path,
+                                                'stop_hook_active' => false))
+      assert_equal 'block', JSON.parse(out)['decision'], 'the turn is still blocked'
+      log = File.read(log_path, encoding: 'UTF-8')
+      assert_includes log, 'NOTE-WRITE-FAILED: no uuid to record; a stale note was deleted', log
+      assert_empty Dir.glob(File.join(File.dirname(G.note_path(tx_path, cfg_obj)), '*')),
+                   'the leftover would name a block this turn did not make'
+
+      _out2, = run_script(cfg_path, JSON.generate('transcript_path' => tx_path,
+                                                  'stop_hook_active' => true))
+      log = File.read(log_path, encoding: 'UTF-8')
+      assert_includes log, 'SKIP-nonote', "the recheck must decline, not judge: #{log}"
+      refute_includes log, 'RECHECK-',
+                      "a verdict here re-judges the message this turn blocked: #{log}"
+    end
+  end
+
+  # When the leftover cannot be spent either, the two failures must compose to
+  # the same refusal: the leftover stays, and the recheck refuses it as the
+  # note it cannot delete.
+  def test_a_leftover_the_failed_write_cannot_spend_is_refused_at_the_recheck
+    Dir.mktmpdir do |tmp|
+      cfg_path = File.join(tmp, 'cfg.json')
+      tx_path = File.join(tmp, 't.jsonl')
+      logs = File.join(tmp, 'logs')
+      FileUtils.mkdir_p(logs)
+      log_path = File.join(logs, 'gate.log')
+      raw = { 'mode_name' => 'test', 'log_path' => log_path, 'max_headings' => 3 }
+      File.write(cfg_path, JSON.generate(raw), encoding: 'UTF-8')
+      File.write(tx_path, rows_json([row_for('assistant', text: BLOCKED, uuid: 'AAA'),
+                                     row_for('assistant', text: BLOCKED, uuid: 'BBB')]),
+                 encoding: 'UTF-8')
+      cfg_obj = G::Config.new(raw, cfg_path)
+      assert_nil G.write_note(tx_path, cfg_obj, 'AAA'), 'the interrupted turn left its note'
+      notes = File.dirname(G.note_path(tx_path, cfg_obj))
+
+      File.chmod(0o555, notes) # neither the new write nor the spend can touch it
+      begin
+        out, = run_script(cfg_path, JSON.generate('transcript_path' => tx_path,
+                                                  'stop_hook_active' => false))
+        assert_equal 'block', JSON.parse(out)['decision'], 'the turn is still blocked'
+        log = File.read(log_path, encoding: 'UTF-8')
+        assert_includes log, 'a stale note could not be deleted',
+                        "the second failure must be visible too: #{log}"
+
+        run_script(cfg_path, JSON.generate('transcript_path' => tx_path,
+                                           'stop_hook_active' => true))
+      ensure
+        File.chmod(0o755, notes)
+      end
+
+      log = File.read(log_path, encoding: 'UTF-8')
+      assert_includes log, 'SKIP-nonote-unspent',
+                      "the unspendable leftover must be refused: #{log}"
+      refute_includes log, 'RECHECK-',
+                      "a verdict here re-judges the message this turn blocked: #{log}"
+    end
+  end
+
+  # Round 3: unspendability is not stable. A directory that refuses the unlink
+  # at block time and permits it again before the recheck let the recheck spend
+  # the leftover this block had failed to delete — round 2's defect through a
+  # transient window. Deleting needs directory-write; truncating needs only
+  # file-write; an emptied note fails the parse on every later read, whatever
+  # the directory permits by then.
+  def test_a_leftover_spent_by_truncation_stays_spent_after_the_window_lifts
+    Dir.mktmpdir do |tmp|
+      cfg_path = File.join(tmp, 'cfg.json')
+      tx_path = File.join(tmp, 't.jsonl')
+      logs = File.join(tmp, 'logs')
+      FileUtils.mkdir_p(logs)
+      log_path = File.join(logs, 'gate.log')
+      raw = { 'mode_name' => 'test', 'log_path' => log_path, 'max_headings' => 3 }
+      File.write(cfg_path, JSON.generate(raw), encoding: 'UTF-8')
+      File.write(tx_path, rows_json([row_for('assistant', text: BLOCKED, uuid: 'AAA'),
+                                     row_for('assistant', text: BLOCKED, uuid: 'BBB')]),
+                 encoding: 'UTF-8')
+      cfg_obj = G::Config.new(raw, cfg_path)
+      assert_nil G.write_note(tx_path, cfg_obj, 'AAA'), 'the interrupted turn left its note'
+      notes = File.dirname(G.note_path(tx_path, cfg_obj))
+
+      File.chmod(0o555, notes) # the write and the unlink both fail; file-write does not
+      begin
+        out, = run_script(cfg_path, JSON.generate('transcript_path' => tx_path,
+                                                  'stop_hook_active' => false))
+        assert_equal 'block', JSON.parse(out)['decision'], 'the turn is still blocked'
+      ensure
+        File.chmod(0o755, notes) # the window lifts before the recheck
+      end
+      log = File.read(log_path, encoding: 'UTF-8')
+      assert_includes log, 'a stale note could not be deleted and was emptied instead', log
+
+      run_script(cfg_path, JSON.generate('transcript_path' => tx_path,
+                                         'stop_hook_active' => true))
+      log = File.read(log_path, encoding: 'UTF-8')
+      refute_includes log, 'RECHECK-',
+                      "the emptied leftover must not yield a verdict once the window lifts: #{log}"
+      assert_includes log, 'SKIP-nonote-mismatch',
+                      "an emptied note fails the parse and is refused by name: #{log}"
+    end
+  end
+
+  # The exception path of the write — not just the no-uuid return — must spend
+  # the leftover too. Driven in-process because the deterministic failure is a
+  # directory squatting the temporary name, and that name carries the pid.
+  def test_a_write_that_raises_spends_the_leftover_before_reporting
+    Dir.mktmpdir do |tmp|
+      c = G::Config.new({ 'mode_name' => 'test', 'log_path' => File.join(tmp, 'gate.log') },
+                        '<inline>')
+      tx = File.join(tmp, 't.jsonl')
+      assert_nil G.write_note(tx, c, 'AAA'), 'the interrupted turn left its note'
+      path = G.note_path(tx, c)
+      FileUtils.mkdir_p("#{path}.#{Process.pid}.tmp") # the write raises, the spend can work
+
+      failure = G.write_note(tx, c, 'BBB')
+      refute_nil failure, 'the write must report its failure'
+      assert_includes failure, 'a stale note was deleted', failure
+      refute File.exist?(path), 'the leftover would name a block this turn did not make'
+      assert_equal [nil, 'nonote'], G.take_note(tx, c),
+                   'the recheck must find nothing rather than the wrong block'
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kairos-chain
 version: !ruby/object:Gem::Version
-  version: 3.77.0
+  version: 3.79.0
 platform: ruby
 authors:
 - Masaomi Hatakeyama
@@ -431,6 +431,7 @@ files:
 - templates/skillsets/agent/test/test_agent_m4.rb
 - templates/skillsets/agent/test/test_agent_native_body.rb
 - templates/skillsets/agent/test/test_agent_verdict.rb
+- templates/skillsets/agent/test/test_agent_worker_exit_and_review_parse.rb
 - templates/skillsets/agent/test/test_decide_prompt_contract.rb
 - templates/skillsets/agent/test/test_review_hint.rb
 - templates/skillsets/agent/tools/agent_execute.rb