kairos-chain 3.88.0 → 3.88.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ab07b57ae1574d18326409b3db66f61dabd697c9bc8d52e6ba20b00ee078bb6
-  data.tar.gz: ad59a3b0ddaca3913faffcd102cf7a361ad4772b90dcd0950c703884f6a8d0b9
+  metadata.gz: c37ee945277e2917d116b02aeb8b47957f97363d8428aae7b54e17a732ca0d94
+  data.tar.gz: 62df9a6d5f05afd01c3aae950959d6398a22e979270183a154e4fd211d2b78c8
 SHA512:
-  metadata.gz: bed9eb85e62df8c52384e0ead71655d1c44b375abd79cf4dc85797e910644ce8360743073572d12edd52d515c1bae9eecdf524c22811a44c444cca0766839a1c
-  data.tar.gz: 39d2c4d7b801d8cfb9f73e3f2075e87178d7ea2d2bbbb57dd967b24dbf69f72a3812a4f9782c793bebd7a27525793f144226fb7a00ae6712851ef276ceefee6e
+  metadata.gz: 74101139a4c243c77119530a5a723c0e1de9fdb6224c1b5f776f78b250040c1e4aade60b93cb75d5cbef3afac2609e2832763a079fc38bddd6ecac84e73f2c32
+  data.tar.gz: 0bf5337f8e6b5985967711300dfe64554e7ff55bb67f7f1dff1d3fca1aefa28fa74677477d5ed3c32cc9b843556434ca692a7254d26a74d68a32807408091621

data/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.88.1] - 2026-10-06
+
+### Fixed — agent guard: the verdict reaches the record
+
+Found in a guarded trial on 3.88.0. The guard judged correctly, but its
+judgment never reached the record: the chain held only autoexec's "execution
+complete" for an act the guard had failed, progress said `completed`, and the
+FAIL survived only in a mutable session file.
+
+- **The verdict is chain-recorded.** Right after judging, before any halt
+  checkpoint and before any merge, the driver records `kind:
+  agent_guard_verdict`: the verdict, the pinned spec hash, the failed checks,
+  the planned route, and the act's error if it had one.
+- **A verdict the chain does not take stops the loop.** Whatever the verdict,
+  nothing merges and the cycle halts for the operator. The halt reason names
+  the lost verdict and its reason, why the record failed, and whether the act
+  already took effect (in-process) or stays quarantined (confined). Responses
+  and the progress `guard_record` carry `verdict_recorded: false` and
+  `lost_verdict`. On a backend whose chain cannot be appended to (sqlite and
+  postgresql do not declare a ledger path), every guarded cycle now halts
+  this way instead of running unrecorded.
+- **Progress and responses follow the verdict.** A failed verdict is recorded
+  and reported as `failed`, not `completed`; REFLECT is shown the verdict, and
+  the next cycle's executor context says the cycle failed. Manual responses
+  carry `guard` (verdict, failed checks) and `act_error`. The manual risk-resume
+  path reports a guard halt as `guard_halt`, not `ok`. Autonomous responses
+  carry the halt reason and, per cycle, `guard_verdict`, `guard_reason` and
+  `verdict_recorded`; steps set aside for a person are still listed when a
+  cycle halts. A result carrying only an error is no longer reported as
+  `completed`.
+
+Not fixed here: the confined route still cannot run. `agent_execute` is not
+registered by the agent SkillSet, so a plan naming a file tool fails at ACT
+(with the guard on, that FAIL is now recorded), and a file acceptance check
+cannot PASS in this version. Wiring it is separate work.
+
+Also ships `minimum_nomic`'s `bin/run_gm.rb` instance-local changes (a11d103),
+so `system_upgrade` stops reverting them.
+
 ## [3.88.0] - 2026-09-30
 
 ### Added — `multi_llm_review` 0.11.1: an artifact named by path and sha256

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.88.0"
+  VERSION = "3.88.1"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/agent/test/test_agent_guard_verdict_record.rb

@@ -0,0 +1,448 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# The guard verdict reaches the record, and what is reported follows it.
+#
+# Field observation (guarded trial on another instance, gem 3.88.0, 2026-10-06):
+# the guard FAILed an act that produced no file, but the chain held only
+# autoexec's "internal_execute_complete", progress said "completed", and the
+# FAIL survived only in the mutable advance_log.jsonl.
+#
+# These probes drive the REAL agent_start / agent_step and the REAL
+# chain_record tool through the registry, with the REAL TaskDsl, Verdict and
+# Confinement. Stubbed: llm_call, autoexec_plan/run, knowledge_get, the merge
+# target directory, the storage underneath chain_record (never the real
+# chain), and agent_execute.
+#
+# agent_execute is injected into the registry here. In a real server it is not
+# registered (skillset.json tool_classes does not list it), so the confined
+# route is not reachable yet; wiring it is separate work. The confined probes
+# below test the driver's verdict/record/merge ordering, not that route.
+# Usage: ruby test_agent_guard_verdict_record.rb
+
+$LOAD_PATH.unshift File.expand_path('../../lib', __dir__)
+$LOAD_PATH.unshift File.expand_path('../../../../lib', __dir__)
+
+require 'json'
+require 'yaml'
+require 'fileutils'
+require 'tmpdir'
+require 'digest'
+require 'time'
+require 'securerandom'
+require 'kairos_mcp/invocation_context'
+require 'kairos_mcp/tools/base_tool'
+require 'kairos_mcp/tools/chain_record'
+require 'kairos_mcp/tool_registry'
+require_relative '../lib/agent'
+require_relative '../tools/agent_start'
+require_relative '../tools/agent_step'
+require File.expand_path('../autoexec/lib/autoexec/task_dsl', File.dirname(__dir__))
+# TaskDsl.validate reads Autoexec.config (normally provided by autoexec.rb).
+module Autoexec
+  def self.config = {} unless respond_to?(:config)
+end
+
+$pass = 0
+$fail = 0
+
+def assert(description)
+  result = yield
+  if result
+    $pass += 1
+    puts "  PASS: #{description}"
+  else
+    $fail += 1
+    puts "  FAIL: #{description}"
+  end
+rescue StandardError => e
+  $fail += 1
+  puts "  FAIL: #{description} (#{e.class}: #{e.message})"
+  puts "        #{e.backtrace.first(3).join("\n        ")}"
+end
+
+def section(title)
+  puts "\n#{'=' * 60}\nTEST: #{title}\n#{'=' * 60}"
+end
+
+TMPDIR = Dir.mktmpdir('agent_guard_record_test')
+PROJECT_ROOT = File.join(TMPDIR, 'project')
+FileUtils.mkdir_p(File.join(PROJECT_ROOT, '.kairos'))
+
+module Autonomos
+  @storage_base = TMPDIR
+  def self.storage_path(subpath)
+    path = File.join(@storage_base, subpath)
+    FileUtils.mkdir_p(path)
+    path
+  end
+
+  def self.config
+    {}
+  end
+end
+
+require File.expand_path('../autonomos/lib/autonomos/mandate', File.dirname(__dir__))
+require File.expand_path('../autonomos/lib/autonomos/ooda', File.dirname(__dir__))
+
+Session = KairosMcp::SkillSets::Agent::Session
+Verdict = KairosMcp::SkillSets::Agent::Verdict
+Confinement = KairosMcp::SkillSets::Agent::Confinement
+
+# The storage under the real chain_record tool. Chain.new must never reach the
+# real chain: the prepended initialize does not call super.
+module FakeChainStore
+  class << self
+    attr_accessor :blocks, :raise_with, :on_add
+  end
+  self.blocks = []
+end
+KairosMcp::KairosChain::Chain.prepend(Module.new do
+  def initialize(*); end
+
+  def add_block(logs)
+    raise FakeChainStore.raise_with if FakeChainStore.raise_with
+
+    FakeChainStore.on_add&.call(logs)
+    FakeChainStore.blocks << logs
+    Struct.new(:index, :hash).new(200 + FakeChainStore.blocks.size, 'cd' * 32)
+  end
+end)
+
+# The shipped agent.yml has the guard off; these probes need it on.
+GUARD_ON = Module.new do
+  def load_config
+    super.merge('guard' => { 'enabled' => true, 'admission' => { 'extra_denied_tools' => [] } })
+  end
+end
+KairosMcp::SkillSets::Agent::Tools::AgentStart.prepend(GUARD_ON)
+
+# ---- Mocks: only the external seams the driver calls ----
+
+class MockLlmCall < KairosMcp::Tools::BaseTool
+  @@responses = []
+  @@seen = []
+  def self.queue(r) = @@responses << r
+  def self.seen = @@seen
+
+  def self.clear!
+    @@responses.clear
+    @@seen.clear
+  end
+
+  def name = 'llm_call'
+  def description = 'mock'
+  def input_schema = { type: 'object', properties: {} }
+
+  def call(arguments)
+    @@seen << JSON.generate(arguments)
+    resp = @@responses.shift ||
+           { 'content' => 'default', 'tool_use' => nil, 'stop_reason' => 'end_turn' }
+    text_content(JSON.generate({ 'status' => 'ok', 'provider' => 'mock', 'model' => 'mock-1',
+                                 'response' => resp,
+                                 'usage' => { 'input_tokens' => 1, 'output_tokens' => 1 },
+                                 'snapshot' => { 'model' => 'mock-1', 'timestamp' => Time.now.iso8601 } }))
+  end
+end
+
+class MockAutoexecPlan < KairosMcp::Tools::BaseTool
+  def name = 'autoexec_plan'
+  def description = 'mock'
+  def input_schema = { type: 'object', properties: {} }
+
+  def call(arguments)
+    task_json = JSON.parse(arguments['task_json'])
+    text_content(JSON.generate({ 'status' => 'ok', 'task_id' => task_json['task_id'],
+                                 'plan_hash' => Digest::SHA256.hexdigest(arguments['task_json'])[0..15],
+                                 'steps' => task_json['steps']&.length || 0 }))
+  end
+end
+
+# autoexec reports the run complete — exactly what it told the chain in the field.
+class MockAutoexecRun < KairosMcp::Tools::BaseTool
+  def name = 'autoexec_run'
+  def description = 'mock'
+  def input_schema = { type: 'object', properties: {} }
+
+  def call(_arguments)
+    text_content(JSON.generate({ 'task_id' => 'mock_task', 'mode' => 'internal_execute',
+                                 'outcome' => 'internal_execute_complete',
+                                 'steps_processed' => 1, 'steps' => [] }))
+  end
+end
+
+# Stands in for the confined executor: writes into its own scratch area and
+# returns the driver-visible evidence the real tool returns.
+class MockAgentExecute < KairosMcp::Tools::BaseTool
+  @@content = "implementation e9d9ef1\nanalysis fe66272\n"
+  def name = 'agent_execute'
+  def description = 'mock'
+  def input_schema = { type: 'object', properties: {} }
+
+  def call(_arguments)
+    scratch = Dir.mktmpdir('agent_act_', TMPDIR)
+    FileUtils.mkdir_p(File.join(scratch, 'out'))
+    File.write(File.join(scratch, 'out', 'note.md'), @@content)
+    text_content(JSON.generate({ 'status' => 'ok', 'result' => 'done',
+                                 'scratch_dir' => scratch,
+                                 'manifest' => Confinement.manifest(scratch),
+                                 'files_modified' => [], 'tool_calls_count' => 1 }))
+  end
+end
+
+class MockKnowledgeGet < KairosMcp::Tools::BaseTool
+  def name = 'knowledge_get'
+  def description = 'mock'
+  def input_schema = { type: 'object', properties: {} }
+  def call(args) = text_content(JSON.generate({ 'name' => args['name'], 'content' => 'mock' }))
+end
+
+def build_registry
+  registry = KairosMcp::ToolRegistry.allocate
+  registry.instance_variable_set(:@safety, KairosMcp::Safety.new)
+  KairosMcp::ToolRegistry.clear_gates!
+  registry.instance_variable_set(:@tools, {
+    'llm_call' => MockLlmCall.new(nil, registry: registry),
+    'knowledge_get' => MockKnowledgeGet.new(nil, registry: registry),
+    'autoexec_plan' => MockAutoexecPlan.new(nil, registry: registry),
+    'autoexec_run' => MockAutoexecRun.new(nil, registry: registry),
+    'agent_execute' => MockAgentExecute.new(nil, registry: registry),
+    'chain_record' => KairosMcp::Tools::ChainRecord.new(nil, registry: registry),
+    'agent_start' => KairosMcp::SkillSets::Agent::Tools::AgentStart.new(nil, registry: registry),
+    'agent_step' => KairosMcp::SkillSets::Agent::Tools::AgentStep.new(nil, registry: registry)
+  })
+  registry
+end
+
+REGISTRY = build_registry
+START_TOOL = REGISTRY.instance_variable_get(:@tools)['agent_start']
+STEP_TOOL = REGISTRY.instance_variable_get(:@tools)['agent_step']
+# A PASS merges into the live tree; point that at a scratch project, never the repo.
+STEP_TOOL.define_singleton_method(:project_root_for_merge) { PROJECT_ROOT }
+MERGED = File.join(PROJECT_ROOT, 'out', 'note.md')
+
+ACCEPTANCE = {
+  'acceptance' => [
+    { 'type' => 'file_exists', 'path' => 'out/note.md' },
+    { 'type' => 'file_contains', 'path' => 'out/note.md', 'substring' => 'e9d9ef1' },
+    { 'type' => 'file_contains', 'path' => 'out/note.md', 'substring' => 'fe66272' },
+    { 'type' => 'manifest_not_empty' },
+    { 'type' => 'execution_completed' }
+  ],
+  'layer_surface' => []
+}.freeze
+
+def decision(tool_name, args)
+  JSON.generate({
+    'summary' => "plan via #{tool_name}",
+    'task_json' => {
+      'task_id' => "t_#{SecureRandom.hex(3)}", 'meta' => { 'description' => 't', 'risk_default' => 'low' },
+      'steps' => [{ 'step_id' => 's1', 'action' => 'produce the note', 'tool_name' => tool_name,
+                    'tool_arguments' => args, 'risk' => 'low', 'depends_on' => [],
+                    'requires_human_cognition' => false }]
+    },
+    'review_hint' => { 'needed' => false, 'reason' => nil, 'urgency' => nil },
+    'complexity_hint' => { 'level' => 'low', 'signals' => [] }
+  })
+end
+
+REPORT_PLAN = decision('operator_report', { 'title' => 'Guard trial', 'body' => 'e9d9ef1 fe66272' })
+WRITE_PLAN = decision('file_write', { 'file_path' => 'out/note.md',
+                                      'content' => "implementation e9d9ef1\nanalysis fe66272\n" })
+
+def reset_chain!
+  FakeChainStore.blocks = []
+  FakeChainStore.raise_with = nil
+  FakeChainStore.on_add = nil
+end
+
+def start_proposed(plan)
+  sid = JSON.parse(START_TOOL.call({ 'goal_name' => "guard_record_#{SecureRandom.hex(3)}",
+                                     'guard' => ACCEPTANCE })[0][:text])['session_id']
+  MockLlmCall.clear!
+  MockLlmCall.queue({ 'content' => 'orient', 'tool_use' => nil, 'stop_reason' => 'end_turn' })
+  MockLlmCall.queue({ 'content' => plan, 'tool_use' => nil, 'stop_reason' => 'end_turn' })
+  r = JSON.parse(STEP_TOOL.call({ 'session_id' => sid, 'action' => 'approve' })[0][:text])
+  [sid, r]
+end
+
+def act(sid)
+  MockLlmCall.queue({ 'content' => JSON.generate({ 'confidence' => 0.9, 'achieved' => ['done'],
+                                                   'remaining' => [] }),
+                      'tool_use' => nil, 'stop_reason' => 'end_turn' })
+  JSON.parse(STEP_TOOL.call({ 'session_id' => sid, 'action' => 'approve' })[0][:text])
+end
+
+def verdict_records
+  FakeChainStore.blocks.flatten.map { |l| JSON.parse(l) }.select { |r| r['kind'] == 'agent_guard_verdict' }
+end
+
+# ------------------------------------------------------------------
+
+section 'Field case reproduced: in-process act, no file, guard FAIL'
+
+reset_chain!
+sid5, proposed5 = start_proposed(REPORT_PLAN)
+assert('DECIDE produced a proposal') { proposed5['state'] == 'proposed' }
+r5 = act(sid5)
+pinned_sha = File.read(File.join(Session.load(sid5).guard_dir, Verdict::SHA_FILE)).strip
+rec5 = verdict_records.last
+
+assert('the FAIL verdict is written to the chain through the real chain_record') do
+  rec5 && rec5['verdict'] == Verdict::FAIL
+end
+assert('the chain record carries the pinned spec hash') { rec5 && rec5['spec_sha256'] == pinned_sha }
+assert('the chain record names the failed checks') do
+  rec5 && rec5['failed_checks'].map { |c| c['type'] }.sort ==
+    %w[file_contains file_contains file_exists manifest_not_empty]
+end
+assert('the chain record names the planned route as in_process') { rec5 && rec5['planned_route'] == 'in_process' }
+assert("the response reports 'failed', not 'completed'") { r5['act_summary'] == 'failed' }
+assert('the response shows the verdict and its failed checks') do
+  r5.dig('guard', 'verdict') == Verdict::FAIL && r5.dig('guard', 'failed_checks').include?('file_exists')
+end
+assert('REFLECT was shown the verdict, not only the executor\'s "completed"') do
+  MockLlmCall.seen.last.include?('guard_verdict_summary') && MockLlmCall.seen.last.include?(Verdict::FAIL)
+end
+
+prog5 = Session.load(sid5).load_progress.last
+assert("progress records 'failed', not 'completed'") { prog5['act_summary'] == 'failed' }
+assert('the progress guard_record carries the verdict') { prog5.dig('guard_record', 'verdict') == Verdict::FAIL }
+assert('the progress guard_record says the verdict was recorded, and where') do
+  prog5.dig('guard_record', 'verdict_recorded') == true &&
+    prog5.dig('guard_record', 'verdict_chain_block', 'index').is_a?(Integer)
+end
+assert('the next cycle is told the previous cycle failed') do
+  STEP_TOOL.send(:build_agent_execute_context, Session.load(sid5)).include?('Cycle 1: failed')
+end
+
+section 'Confined PASS: the verdict is recorded first, then the file is merged'
+
+reset_chain!
+FileUtils.rm_rf(File.join(PROJECT_ROOT, 'out'))
+merged_at_record_time = nil
+FakeChainStore.on_add = ->(_logs) { merged_at_record_time = File.exist?(MERGED) }
+sid6, = start_proposed(WRITE_PLAN)
+r6 = act(sid6)
+rec6 = verdict_records.last
+assert('the PASS verdict is written to the chain') { rec6 && rec6['verdict'] == Verdict::PASS }
+assert('the chain record names the planned route as confined') { rec6 && rec6['planned_route'] == 'confined' }
+assert('nothing had been merged when the verdict was recorded') { merged_at_record_time == false }
+assert('the file reached the project tree after the record') { File.read(MERGED).include?('fe66272') }
+assert("the response reports 'completed' with a PASS verdict") do
+  r6['act_summary'] == 'completed' && r6.dig('guard', 'verdict') == Verdict::PASS
+end
+
+section 'A PASS the chain does not take: halt for the operator, nothing merged'
+
+reset_chain!
+FileUtils.rm_rf(File.join(PROJECT_ROOT, 'out'))
+sid7, = start_proposed(WRITE_PLAN)
+FakeChainStore.raise_with = RuntimeError.new('storage unavailable')
+r7 = act(sid7)
+FakeChainStore.raise_with = nil
+assert('nothing was merged into the project tree') { !File.exist?(MERGED) }
+assert('the response is a guard halt, not success and not a plain failure') { r7['status'] == 'guard_halt' }
+assert('the response says the verdict was not recorded') { r7['verdict_recorded'] == false }
+assert('the halt reason names the lost verdict, the cause, and that results stay quarantined') do
+  reason = r7['guard_reason'].to_s
+  reason.include?("verdict #{Verdict::PASS} (") && reason.include?('RuntimeError: storage unavailable') &&
+    reason.include?('quarantined')
+end
+prog7 = Session.load(sid7).load_progress.last
+assert('progress records the halt, that the verdict was not recorded, and which verdict was lost') do
+  prog7['act_summary'].start_with?('guard halt') && prog7.dig('guard_record', 'verdict_recorded') == false &&
+    prog7.dig('guard_record', 'lost_verdict') == Verdict::PASS
+end
+
+section 'A FAIL the chain does not take also halts (it must not cycle on silently)'
+
+reset_chain!
+sid9, = start_proposed(REPORT_PLAN)
+FakeChainStore.raise_with = RuntimeError.new('storage unavailable')
+r9 = act(sid9)
+FakeChainStore.raise_with = nil
+assert('the response is a guard halt') { r9['status'] == 'guard_halt' && r9['verdict_recorded'] == false }
+assert('the halt reason names the lost FAIL and that the in-process act already took effect') do
+  r9['guard_reason'].to_s.include?("verdict #{Verdict::FAIL} (") && r9['guard_reason'].to_s.include?('already took effect')
+end
+
+section 'Guard HALT before ACT (tampered spec) is recorded and reported as a halt'
+
+reset_chain!
+sid8, = start_proposed(REPORT_PLAN)
+File.write(File.join(Session.load(sid8).guard_dir, Verdict::SPEC_FILE), '{"acceptance":[],"layer_surface":[]}')
+r8 = act(sid8)
+rec8 = verdict_records.last
+assert('the HALT verdict is written to the chain') { rec8 && rec8['verdict'] == Verdict::HALT }
+assert('the response is a guard halt, not a completion') { r8['status'] == 'guard_halt' && r8['verdict_recorded'] == true }
+
+section 'Pre-ACT HALT whose record fails: the diagnostic names both problems'
+
+reset_chain!
+sid10, = start_proposed(REPORT_PLAN)
+File.write(File.join(Session.load(sid10).guard_dir, Verdict::SPEC_FILE), '{"acceptance":[],"layer_surface":[]}')
+FakeChainStore.raise_with = RuntimeError.new('storage unavailable')
+r10 = act(sid10)
+FakeChainStore.raise_with = nil
+assert('the response is a guard halt with the verdict not recorded') do
+  r10['status'] == 'guard_halt' && r10['verdict_recorded'] == false
+end
+assert('the reason keeps the original tamper reason and adds the record failure') do
+  r10['guard_reason'].to_s.include?('tamper') && r10['guard_reason'].to_s.include?('storage unavailable') &&
+    r10['guard_reason'].to_s.include?('did not run')
+end
+
+section 'Manual risk-resume path: a guard halt is reported as a halt, not as ok'
+
+reset_chain!
+risky = decision('knowledge_update', { 'name' => 'x', 'content' => 'y' })
+sid11, = start_proposed(risky)
+paused = act(sid11)
+assert('a medium-risk plan under a low budget pauses first') { paused['state'] == 'paused_risk' }
+# The operator raises the budget, as the pause response asks, then resumes.
+m11 = ::Autonomos::Mandate.load(Session.load(sid11).mandate_id)
+m11[:risk_budget] = 'medium'
+::Autonomos::Mandate.save(m11[:mandate_id], m11)
+FakeChainStore.raise_with = RuntimeError.new('storage unavailable')
+MockLlmCall.queue({ 'content' => '{"confidence":0.9}', 'tool_use' => nil, 'stop_reason' => 'end_turn' })
+r11 = JSON.parse(STEP_TOOL.call({ 'session_id' => sid11, 'action' => 'approve' })[0][:text])
+FakeChainStore.raise_with = nil
+assert('resuming from the risk pause reports guard_halt with the verdict not recorded') do
+  r11['status'] == 'guard_halt' && r11['verdict_recorded'] == false
+end
+
+section 'Autonomous loop: a guard halt carries its reason and the record state'
+
+reset_chain!
+sid12 = JSON.parse(START_TOOL.call({ 'goal_name' => "guard_auto_#{SecureRandom.hex(3)}", 'guard' => ACCEPTANCE,
+                                     'autonomous' => true })[0][:text])['session_id']
+MockLlmCall.clear!
+MockLlmCall.queue({ 'content' => 'orient', 'tool_use' => nil, 'stop_reason' => 'end_turn' })
+MockLlmCall.queue({ 'content' => REPORT_PLAN, 'tool_use' => nil, 'stop_reason' => 'end_turn' })
+FakeChainStore.raise_with = RuntimeError.new('storage unavailable')
+r12 = JSON.parse(STEP_TOOL.call({ 'session_id' => sid12, 'action' => 'approve' })[0][:text])
+FakeChainStore.raise_with = nil
+row12 = Array(r12['cycle_results']).last || {}
+assert('the autonomous warning carries the halt reason and says the verdict was not recorded') do
+  r12['warning'].to_s.include?('could not be recorded') && r12['warning'].to_s.include?('verdict not recorded')
+end
+assert('the autonomous cycle row says guard_halt, the reason, and verdict_recorded false') do
+  row12['act_summary'] == 'guard_halt' && row12['guard_reason'].to_s.include?('storage unavailable') &&
+    row12['verdict_recorded'] == false
+end
+
+section 'Summaries in autonomous cycle_results and error-only results'
+
+halt_r = STEP_TOOL.send(:guard_halt_result, Session.load(sid8), { 'guard_halt' => true },
+                        Verdict.halt_verdict('x'))
+assert("a guard-halt cycle result summarises as 'guard_halt'") do
+  STEP_TOOL.send(:response_act_summary, halt_r) == 'guard_halt'
+end
+assert("a result carrying only an error is not reported as 'completed'") do
+  STEP_TOOL.send(:response_act_summary, { act_error: 'No decision payload found', llm_calls: 0 }) == 'failed'
+end
+
+FileUtils.rm_rf(TMPDIR)
+puts "\n#{'=' * 60}\nRESULT: #{$pass} passed, #{$fail} failed\n#{'=' * 60}"
+exit($fail.zero? ? 0 : 1)

data/templates/skillsets/agent/tools/agent_step.rb

@@ -527,23 +527,53 @@ module KairosMcp
             # is not an act at all — it must checkpoint WITHOUT running REFLECT,
             # recording a cycle, or consuming a mandate cycle. Short-circuit here.
             if act_result.is_a?(Hash) && act_result['guard_halt']
+              halt = act_result['guard_verdict'] ||
+                     verdict_const.halt_verdict(act_result['error'].to_s)
+              block = record_guard_verdict(session, decision_payload, act_result, halt)
+              return guard_halt_result(session, act_result, halt, verdict_block: block) if block
+
               return guard_halt_result(session, act_result,
-                                       act_result['guard_verdict'] ||
-                                       verdict_const.halt_verdict(act_result['error'].to_s))
+                                       unrecorded_verdict_halt(halt, act_result),
+                                       verdict_recorded: false, lost_verdict: halt['verdict'])
             end
 
             # Guard track (AGT-3): the mechanical verdict decides cycle success
             # from driver-observed evidence, before and above REFLECT. On HALT or
             # FAIL the cycle is not a success no matter what REFLECT later says.
             guard_verdict = guard_judge(session, act_result)
+
+            # The verdict goes on the chain before anything acts on it — before
+            # the halt checkpoint and before the merge. Without this the chain
+            # held only autoexec's "execution complete" for an act the verdict
+            # had FAILed, and the FAIL survived only in a mutable session file
+            # (observed 2026-10-06 in a guarded trial).
+            verdict_block = guard_verdict && record_guard_verdict(session, decision_payload,
+                                                                  act_result, guard_verdict)
+
+            # A verdict the chain did not take stops the loop for the operator,
+            # whatever the verdict was. Nothing merges, so no change reaches the
+            # live tree without the record that licenses it. Counting the act as
+            # failed instead would invite the next cycle to redo effects that an
+            # in-process act has already applied, and a FAIL would otherwise
+            # keep cycling with its record missing — the original defect again.
+            if guard_verdict && verdict_block.nil?
+              return guard_halt_result(session, act_result, unrecorded_verdict_halt(guard_verdict, act_result),
+                                       verdict_recorded: false, lost_verdict: guard_verdict['verdict'])
+            end
             if guard_verdict && guard_verdict['verdict'] == verdict_const::HALT
-              return guard_halt_result(session, act_result, guard_verdict)
+              return guard_halt_result(session, act_result, guard_verdict, verdict_block: verdict_block)
             end
 
             # AGT-1 return path: a PASS delegated act's results reach the live
             # tree only now, through the driver's verdict-gated merge. A FAIL
             # verdict leaves the scratch area unmerged (quarantined).
-            merge_guard_pass(session, act_result, guard_verdict)
+            if guard_verdict && guard_verdict['verdict'] == verdict_const::PASS
+              merge_guard_pass(session, act_result, guard_verdict)
+            end
+
+            # REFLECT reads the act result; without this it would see only the
+            # executor's own "completed" for an act the verdict failed.
+            act_result['guard_verdict_summary'] = guard_verdict_summary(guard_verdict) if guard_verdict
 
             session.update_state('reflecting')
             reflect_loop = CognitiveLoop.new(self, session)
@@ -572,10 +602,11 @@ module KairosMcp
             record_agent_cycle(session, decision_payload, act_result, reflect_result,
                                force_evaluation: forced)
 
-            act_summary = act_result['summary'] || act_result['error'] || 'completed'
+            act_summary = reported_act_summary(act_result, guard_failed)
             decision_summary = decision_payload['summary'] || ''
             session.save_progress(reflect_result, session.cycle_number + 1, act_summary, decision_summary,
-                                  guard_record: build_guard_record(act_result, guard_verdict))
+                                  guard_record: build_guard_record(act_result, guard_verdict,
+                                                                   verdict_block: verdict_block))
 
             session.increment_cycle
             session.save
@@ -589,17 +620,101 @@ module KairosMcp
 
             result = { act: act_result, reflect: reflect_result, cycle: session.cycle_number,
                        act_error: act_result['error'], act_succeeded: act_succeeded,
-                       llm_calls: reflect_loop.total_calls }
+                       act_summary: act_summary, llm_calls: reflect_loop.total_calls }
             result[:guard_verdict] = guard_verdict if guard_verdict
             result
           end
 
+          # What the record and every response call this act. A failing guard
+          # verdict outranks the executor's own summary: an executor reporting
+          # "completed" for an act the verdict failed is the very case the guard
+          # exists to catch. This string is also what the next cycle's executor
+          # is told about this one (build_agent_execute_context), so a false
+          # "completed" here would mislead the next cycle, not only the reader.
+          def reported_act_summary(act_result, guard_failed)
+            return 'failed' if guard_failed
+
+            act_result['summary'] || act_result['error'] || 'completed'
+          end
+
+          # The summary a response shows for a cycle result. Prefers the one the
+          # driver recorded; a guard halt result carries 'guard_halt'. A result
+          # that carries only an error is not reported as 'completed'.
+          def response_act_summary(result)
+            result[:act_summary] || result.dig(:act, 'summary') ||
+              (result[:act_error] ? 'failed' : 'completed')
+          end
+
+          # What a response shows the operator about the guard for one cycle.
+          # nil when the guard was off.
+          def guard_verdict_summary(guard_verdict)
+            return nil unless guard_verdict.is_a?(Hash)
+
+            {
+              'verdict' => guard_verdict['verdict'],
+              'failed_checks' => failed_guard_checks(guard_verdict).map { |c| c['type'] },
+              'reason' => guard_verdict['reason'].to_s[0, 200]
+            }
+          end
+
+          # The halt that replaces a verdict the chain did not take. Constant
+          # verdict keys are kept. The reason says which verdict was lost and
+          # why it was given, why the record failed, and what already happened
+          # to the act — an operator reading "nothing was merged" for an
+          # in-process act whose effects have landed would redo it.
+          def unrecorded_verdict_halt(guard_verdict, act_result)
+            act = act_result.is_a?(Hash) ? act_result : {}
+            scratch = act['scratch_dir'] || act.dig('execution', 'scratch_dir')
+            effects = if act['guard_halt']
+                        'the act did not run'
+                      elsif scratch
+                        'the confined results stay quarantined, not merged'
+                      else
+                        'the in-process act already took effect; do not re-run it blindly'
+                      end
+            cause = @guard_record_error || 'unknown'
+            {
+              'verdict' => ::KairosMcp::SkillSets::Agent::Verdict::HALT,
+              'checks' => guard_verdict['checks'] || [],
+              'spec_sha256' => guard_verdict['spec_sha256'],
+              'reason' => "guard verdict #{guard_verdict['verdict']} (#{guard_verdict['reason'].to_s[0, 160]}) " \
+                          "could not be recorded on the chain (#{cause[0, 200]}); #{effects}. " \
+                          'The loop stopped for the operator.'
+            }
+          end
+
+          def guard_halt_warning(result)
+            reason = result[:act_error].to_s[0, 300]
+            note = result[:verdict_recorded] == false ? ' [verdict not recorded on the chain]' : ''
+            "guard_halt: human review required — #{reason}#{note}"
+          end
+
+          # The response for a cycle that ended in a guard halt. Shared by the
+          # manual approve path and the manual risk-resume path, so neither can
+          # present a halt as an ordinary 'ok'.
+          def guard_halt_response(session, result)
+            gv = result[:guard_verdict] || {}
+            resp = {
+              'status' => 'guard_halt', 'session_id' => session.session_id,
+              'state' => 'checkpoint',
+              'act_summary' => 'guard_halt',
+              'guard_reason' => gv['reason'] || result[:act_error],
+              'guard_verdict' => gv,
+              'verdict_recorded' => result[:verdict_recorded] == true
+            }
+            resp['permission_advisory'] = session.permission_advisory if session.permission_advisory
+            resp
+          end
+
           # Slice 2 NB-2 (R1 F7): the per-cycle constitutive record naming which
           # executable carried the act — closure digest alongside the pinned
           # spec hash, plus substrate identity. Empty for the CLI substrate
           # (no staged closure) beyond the substrate label. Returns {} when
           # there is nothing to record so save_progress omits the field.
-          def build_guard_record(act_result, guard_verdict)
+          # The verdict itself and the chain block holding it are part of the
+          # record too: the spec hash alone said what was asked, not what was found.
+          def build_guard_record(act_result, guard_verdict, verdict_block: nil, verdict_recorded: nil,
+                                 lost_verdict: nil)
             return {} unless act_result.is_a?(Hash)
 
             execution = act_result['execution'] || {}
@@ -610,22 +725,94 @@ module KairosMcp
             rec['substrate'] = substrate if substrate
             rec['closure_sha256'] = closure_sha if closure_sha
             rec['spec_sha256'] = spec_sha if spec_sha
+            if guard_verdict.is_a?(Hash)
+              rec['verdict'] = guard_verdict['verdict']
+              failed = failed_guard_checks(guard_verdict)
+              rec['failed_checks'] = failed.map { |c| c['type'] } unless failed.empty?
+              rec['verdict_chain_block'] = verdict_block if verdict_block
+              rec['verdict_recorded'] = verdict_recorded.nil? ? !verdict_block.nil? : verdict_recorded
+              rec['lost_verdict'] = lost_verdict if lost_verdict
+            end
             rec
           end
 
+          def failed_guard_checks(guard_verdict)
+            Array(guard_verdict['checks']).reject do |c|
+              c['result'] == ::KairosMcp::SkillSets::Agent::Verdict::PASS
+            end
+          end
+
+          # Guard verdict -> chain (Proposition 5). Driver-authored, written on
+          # the driver's own context: the ACT context denies chain_record by
+          # design (admission.rb), and the act is not the one judging itself.
+          # Returns { 'index', 'hash' } of the block, or nil when the write did
+          # not land — success is read from chain_record's own confirmation,
+          # never assumed.
+          def record_guard_verdict(session, decision_payload, act_result, guard_verdict)
+            act = act_result.is_a?(Hash) ? act_result : {}
+            execution = act['execution'].is_a?(Hash) ? act['execution'] : {}
+            # Check details name files by their absolute scratch path; the chain
+            # keeps the workspace-relative part, not a temporary directory.
+            scratch = act['scratch_dir'] || execution['scratch_dir']
+            relative = ->(d) { scratch ? d.to_s.sub("#{scratch}/", '') : d.to_s }
+            @guard_record_error = nil
+            # The route the plan asked for; whether the act ran there is told
+            # by act_error (an unreachable executor fails before running).
+            planned = requires_file_operations?(decision_payload && decision_payload['task_json']) ? 'confined' : 'in_process'
+            record = {
+              'kind' => 'agent_guard_verdict',
+              'session_id' => session.session_id,
+              'mandate_id' => session.mandate_id,
+              'cycle' => session.cycle_number + 1,
+              'planned_route' => planned,
+              'verdict' => guard_verdict['verdict'],
+              'spec_sha256' => guard_verdict['spec_sha256'],
+              'reason' => guard_verdict['reason'].to_s[0, 200],
+              'failed_checks' => failed_guard_checks(guard_verdict).map { |c|
+                { 'type' => c['type'], 'detail' => relative.call(c['detail'])[0, 160] }
+              },
+              'recorded_at' => Time.now.utc.iso8601
+            }
+            substrate = act['substrate'] || execution['substrate']
+            closure = act['closure_sha256'] || execution['closure_sha256']
+            record['substrate'] = substrate if substrate
+            record['closure_sha256'] = closure if closure
+            record['act_error'] = relative.call(act['error'])[0, 200] if act['error']
+
+            out = invoke_tool('chain_record', { 'logs' => [JSON.generate(record)] })
+            text = Array(out).map { |b| b[:text] || b['text'] }.compact.join
+            m = text.match(/Block #(\d+) recorded successfully\.\s*Hash: (\h+)/)
+            unless m
+              @guard_record_error = "chain_record replied: #{text[0, 160]}"
+              log_agent(:warn, 'guard_verdict_unrecorded', session, detail: text[0, 160])
+              return nil
+            end
+            { 'index' => m[1].to_i, 'hash' => m[2] }
+          rescue StandardError => e
+            @guard_record_error = "#{e.class}: #{e.message}"
+            log_agent(:warn, 'guard_verdict_unrecorded', session, error: e.message)
+            nil
+          end
+
           # AGT-6: build the checkpoint result for a guard halt without running
           # REFLECT, recording a cycle, or consuming a mandate cycle. The human
           # sees the halt reason, never a false "completed".
-          def guard_halt_result(session, act_result, guard_verdict)
+          def guard_halt_result(session, act_result, guard_verdict, verdict_block: nil, verdict_recorded: nil,
+                                lost_verdict: nil)
+            recorded = verdict_recorded.nil? ? !verdict_block.nil? : verdict_recorded
             session.update_state('checkpoint')
             session.save_progress({ 'confidence' => 0.0, 'guard_verdict' => guard_verdict },
                                   session.cycle_number + 1,
                                   "guard halt: #{guard_verdict['reason']}", '',
-                                  guard_record: build_guard_record(act_result, guard_verdict))
+                                  guard_record: build_guard_record(act_result, guard_verdict,
+                                                                   verdict_block: verdict_block,
+                                                                   verdict_recorded: recorded,
+                                                                   lost_verdict: lost_verdict))
             session.save
             log_agent(:warn, 'guard_halt', session, reason: guard_verdict['reason'].to_s[0..120])
             { act: act_result, reflect: { 'confidence' => 0.0 }, cycle: session.cycle_number,
               act_error: guard_verdict['reason'], act_succeeded: false, guard_halt: true,
+              act_summary: 'guard_halt', verdict_recorded: recorded,
               guard_verdict: guard_verdict, llm_calls: 0 }
           end
 
@@ -727,25 +914,16 @@ module KairosMcp
             # cycle increment); the manual-mode response must not paper over it
             # with the act_summary fallback below (guard_halt_result's stated
             # contract: "the human sees the halt reason, never a false completed").
-            if result[:guard_halt]
-              gv = result[:guard_verdict] || {}
-              halt_response = {
-                'status' => 'guard_halt', 'session_id' => session.session_id,
-                'state' => 'checkpoint',
-                'act_summary' => 'guard_halt',
-                'guard_reason' => gv['reason'] || result[:act_error],
-                'guard_verdict' => gv
-              }
-              halt_response['permission_advisory'] = session.permission_advisory if session.permission_advisory
-              return text_content(JSON.generate(halt_response))
-            end
+            return text_content(JSON.generate(guard_halt_response(session, result))) if result[:guard_halt]
 
             response = {
               'status' => 'ok', 'session_id' => session.session_id,
               'state' => 'checkpoint',
-              'act_summary' => result.dig(:act, 'summary') || 'completed',
+              'act_summary' => response_act_summary(result),
               'reflect' => result[:reflect]
             }
+            response['act_error'] = result[:act_error] if result[:act_error]
+            response['guard'] = guard_verdict_summary(result[:guard_verdict]) if result[:guard_verdict]
             response['permission_advisory'] = session.permission_advisory if session.permission_advisory
             text_content(JSON.generate(response))
           end
@@ -1041,8 +1219,12 @@ module KairosMcp
                 if ar_result[:guard_halt]
                   session.update_state('checkpoint')
                   session.save
+                  # Steps the plan set aside for a person are still owed to the
+                  # operator when the cycle halts after an in-process act.
+                  deferred = Array(ar_result.dig(:act, 'deferred'))
                   return finalize_autonomous(session, results, checkpoint: true,
-                                             warning: 'guard_halt: human review required')
+                                             warning: guard_halt_warning(ar_result),
+                                             deferred: deferred.empty? ? nil : deferred)
                 end
                 # Everything that could run has run. What is left needs the
                 # operator: the steps the plan marked for a person, and the
@@ -1156,10 +1338,14 @@ module KairosMcp
               'error' => error,
               'warning' => warning,
               'cycle_results' => cycle_results.map { |r|
-                { 'cycle' => r[:cycle],
-                  'act_summary' => r.dig(:act, 'summary') || 'completed',
-                  'confidence' => clamp_confidence(r.dig(:reflect, 'confidence')),
-                  'remaining_count' => Array(r.dig(:reflect, 'remaining')).size }
+                row = { 'cycle' => r[:cycle],
+                        'act_summary' => response_act_summary(r),
+                        'confidence' => clamp_confidence(r.dig(:reflect, 'confidence')),
+                        'remaining_count' => Array(r.dig(:reflect, 'remaining')).size }
+                row['guard_verdict'] = r[:guard_verdict]['verdict'] if r[:guard_verdict].is_a?(Hash)
+                row['guard_reason'] = r[:act_error] if r[:guard_halt]
+                row['verdict_recorded'] = false if r[:verdict_recorded] == false
+                row
               }
             }
             reports = surface_reports(session)
@@ -1276,8 +1462,10 @@ module KairosMcp
               if ar_result[:guard_halt]
                 session.update_state('checkpoint')
                 session.save
+                deferred = Array(ar_result.dig(:act, 'deferred'))
                 return finalize_autonomous(session, [ar_result], checkpoint: true,
-                                           warning: 'guard_halt: human review required')
+                                           warning: guard_halt_warning(ar_result),
+                                           deferred: deferred.empty? ? nil : deferred)
               end
               if ar_result[:act_error]
                 session.update_state('paused_error')
@@ -1294,12 +1482,17 @@ module KairosMcp
               result = run_act_reflect_internal(session)
               session.update_state('checkpoint')
               session.save
-              text_content(JSON.generate({
+              return text_content(JSON.generate(guard_halt_response(session, result))) if result[:guard_halt]
+
+              response = {
                 'status' => 'ok', 'session_id' => session.session_id,
                 'state' => 'checkpoint',
-                'act_summary' => result.dig(:act, 'summary') || 'completed',
+                'act_summary' => response_act_summary(result),
                 'reflect' => result[:reflect]
-              }))
+              }
+              response['act_error'] = result[:act_error] if result[:act_error]
+              response['guard'] = guard_verdict_summary(result[:guard_verdict]) if result[:guard_verdict]
+              text_content(JSON.generate(response))
             end
           end
 

data/templates/skillsets/minimum_nomic/bin/run_gm.rb

@@ -535,7 +535,27 @@ class Run
         cfg = { 'sandbox_mode' => true, 'timeout_seconds' => t }
         cfg['effort'] = spec[:effort] if spec[:effort]
         LC::ClaudeCodeAdapter.new(cfg)
-      when 'codex'  then LC::CodexAdapter.new('timeout_seconds' => t)
+      when 'codex'
+        # The effort has to be handed to the adapter, not merely written into
+        # the lineup. Harnesses without this branch (up to ccf1dabd, the
+        # template shipped through gem 3.88.0) only wrote it: the effort set
+        # for a codex seat (--codex-effort) or a codex game master (--gm-effort,
+        # default high) was published in the lineup and never passed, so the
+        # CLI ran at whatever ~/.codex/config.toml said. A nil codex effort in
+        # a lineup therefore means "no level was handed to the CLI"; for every
+        # call that reached its first turn, the level that ran is in codex's own
+        # session logs (~/.codex/sessions, per-turn "effort"), not in the lineup.
+        # Two games of 2026-09-05 record "high" without handing it over:
+        # log/minimum_nomic_gm_20260810/astra_g1_seat for the codex seat and
+        # astra_g2_gm for the codex game master. Codex's session logs show every
+        # recorded call of the two games at high. With no -c passed, that level
+        # came from the CLI's own configuration (~/.codex/config.toml, whose
+        # 2026-09-05 content is not on record), so the recorded level is what
+        # ran — but not because the harness set it. A harness with this branch
+        # delivers the level it records.
+        cfg = { 'timeout_seconds' => t }
+        cfg['effort'] = spec[:effort] if spec[:effort]
+        LC::CodexAdapter.new(cfg)
       when 'cursor' then LC::CursorAdapter.new('timeout_seconds' => t)
       else raise "unknown adapter #{spec[:adapter]}"
       end
@@ -652,6 +672,41 @@ class Run
   end
 
   # Each seat's capability is declared and recorded, not constrained (INV-31).
+  # What the codex seat reads before it reads the prompt, MEASURED when this
+  # file is loaded (once per run) rather than asserted. The field used to carry
+  # the flat sentence "no AGENTS.md exists in the project root (pilot measured
+  # 0 words)", true when the pilot was played and false whenever the
+  # instruction mode is projected to AGENTS.md, as it was from 2026-09-05 —
+  # 75,012 bytes then, reaching every codex call, the game master's included
+  # once --gm-adapter codex is used. A hardcoded absence is the one claim in
+  # this record that gets falsified by a file appearing next to it, so the file
+  # is read off the filesystem and the reader is told its size and first
+  # heading. Only the run's working directory is measured, and the sentence
+  # names what was not: codex may also read AGENTS.override.md there, the same
+  # files in parent directories up to the git root, and ~/.codex/AGENTS.md, and
+  # it truncates at its project_doc_max_bytes. A file that cannot be read is
+  # recorded as unread instead of stopping the run.
+  AGENTS_MD = File.join(PROJECT_ROOT, 'AGENTS.md')
+  CODEX_UNMEASURED = 'Not measured: AGENTS.override.md in this directory, AGENTS.md or ' \
+                     'AGENTS.override.md in parent directories up to the git root, ' \
+                     "~/.codex/AGENTS.md, and codex's project_doc_max_bytes truncation."
+  CODEX_INSTRUCTION_FILES =
+    begin
+      if File.file?(AGENTS_MD)
+        body = File.binread(AGENTS_MD).force_encoding(Encoding::UTF_8).scrub
+        heading = body.lines.find { |l| l.start_with?('#') }&.strip
+        "AGENTS.md IS PRESENT in the run's working directory: #{File.size(AGENTS_MD)} bytes, " \
+        "#{body.split.length} words, first heading #{heading ? %("#{heading}") : 'none'}. Codex " \
+        'looks here for instruction files for the codex seats and a codex game master; presence ' \
+        "is measured, delivery is not. #{CODEX_UNMEASURED}"
+      else
+        "no AGENTS.md in the run's working directory at run start (measured). #{CODEX_UNMEASURED}"
+      end
+    rescue SystemCallError => e
+      "AGENTS.md in the run's working directory could not be read at run start (#{e.class}); " \
+        "what the codex seats received from it is unknown. #{CODEX_UNMEASURED}"
+    end
+
   # The seats do not run at equal capability and the difference is not being
   # levelled: it is written down so no later reading treats these three as
   # interchangeable. `record_reach` is the honest part — see write_lineup!.
@@ -676,7 +731,7 @@ class Run
       'invocation' => 'codex exec --sandbox read-only, prompt on stdin',
       'tools' => 'read-only filesystem access',
       'cwd' => 'the project root (not chdir\'d)',
-      'instruction_files_reachable' => 'no AGENTS.md exists in the project root (pilot measured 0 words)',
+      'instruction_files_reachable' => CODEX_INSTRUCTION_FILES,
       'record_reach' => 'READ. A read-only sandbox can open this run\'s record files if it looks'
     },
     'cursor' => {
@@ -927,6 +982,53 @@ class Run
   # utterance, so once reasoning reaches the public log the check reads the leak
   # as ordinary quotation and stays green. It counted 5,156 excused matches on
   # this game.
+  #
+  # 2026-09-09, measured. The 2026-08-13 note above describes the form as a
+  # player breaking it. That is not what the record shows. Across the six games
+  # of log/nomic_astra_20260908 the form occurs 24 times. 23 are one shape:
+  # <reasoning> opened AND closed, <utterance> opened, the move written, and no
+  # </utterance> — exactly one closing tag is missing. The 24th (game b3, turn
+  # 23) closes the utterance with a second </reasoning> instead. The regex
+  # below requires </utterance>, so in all 24 `u` is nil and the whole reply —
+  # tags, reasoning and move — becomes the public utterance.
+  #
+  # Downstream, measured: a public log carrying a tag-opened multi-paragraph
+  # block, delivered together with the instruction to produce private reasoning,
+  # is refused by the safeguard with Details: `[reasoning_extraction]`. In
+  # bundle A game 2, 36 of the game's 50 player calls failed after the leak,
+  # and the log is append-only, so the block stays in every later prompt (the
+  # refusing seat, C, still answered once, at turn 44). Only the first failed
+  # prompt was replayed. That replay isolated it on 2026-09-09: neither the
+  # block nor the instruction refused alone, the tag name was immaterial
+  # (<notes> refused too), and a single sentence under the tag did not refuse.
+  # On 2026-09-23 the bare turn-3 prompt, with no block, was refused 10 of 10;
+  # log/nomic_opus55_20260923/NOTE.md (item 2) reads this as the safeguard
+  # having moved between the two dates.
+  #
+  # RULING 2026-09-09 (operator), verbatim:
+  #
+  #   「閉じタグをつけ忘れた」ことも、「閉じタグがないために厳しく解釈した」ことも、
+  #   結果として記録してください。正しく読めるように修正する必要はありません。
+  #   「閉じタグ」がなくても正しく評価（メタ評価）できるかどうか、も LLM の認知能力評価
+  #   になりますし、「閉じタグを忘れた」ことも LLM のタスク実行能力評価に繋がります。
+  #   しっかりとルールを守るように harness 側を構築することはこの nomic-bench の
+  #   主たる方法ではありません。未完成のルールシステムの中で LLM がどう振る舞うか、
+  #   そこがこの nomic-bench の評価するべきポイントなのを忘れないように記録して
+  #   おいてくれませんか？
+  #
+  # The verbatim is also in log/nomic_astra_20260908/NOTE.md. Rendered in
+  # English: record both facts — that the model forgot the closing tag, and
+  # that the harness read its absence strictly — as results; there is no need
+  # to correct them so that the reply reads properly. Whether a model can still evaluate the record correctly
+  # (a meta-evaluation) with the tag missing is itself an evaluation of its
+  # cognition, and forgetting the tag bears on an evaluation of its task
+  # execution. Building the harness so that rules are reliably obeyed is not
+  # this bench's main method. How a language model behaves inside an
+  # incomplete rule system is the point this bench is meant to evaluate.
+  #
+  # Consequences the note draws from the ruling (the note's words, not the
+  # ruling's): this regex is not relaxed to accept an unclosed <utterance>,
+  # and no re-ask is added.
   def split_player_reply(reply)
     return { utterance: nil, reasoning: nil, form: 'call_failed' } if reply.nil?
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kairos-chain
 version: !ruby/object:Gem::Version
-  version: 3.88.0
+  version: 3.88.1
 platform: ruby
 authors:
 - Masaomi Hatakeyama
@@ -423,6 +423,7 @@ files:
 - templates/skillsets/agent/test/test_agent_complexity_review.rb
 - templates/skillsets/agent/test/test_agent_confinement.rb
 - templates/skillsets/agent/test/test_agent_guard_integration.rb
+- templates/skillsets/agent/test/test_agent_guard_verdict_record.rb
 - templates/skillsets/agent/test/test_agent_halt_semantics.rb
 - templates/skillsets/agent/test/test_agent_human_mark_gate.rb
 - templates/skillsets/agent/test/test_agent_interruption_resilience.rb