kairos-chain 3.90.0 → 3.92.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b1f38307df012164fc2070ff3a5a7489f651c678e4bcb75f4d93ef2ba65dec6d
-  data.tar.gz: 11f40f3abe1a502600d451ffb4e6fe757f1cd351fa7f9af7c4c09fe0669f776c
+  metadata.gz: 3cea3a83409113bb9513f6da35f8e202ed84762f726997b55d4c0807e3764565
+  data.tar.gz: e88354debd6836834ffcf28b905f361b4e9d0d154d22d68f6112a20076fc45c1
 SHA512:
-  metadata.gz: 5886c559503ae2223da85857a13e8fa2b365271f5988c3a24b77675ce56215ca481fb581d60f82f523dfe9a1cce4fb81e8b5cfc70f81fb68beec4142183c4450
-  data.tar.gz: de3e9624a91ef9bbc9eaf3712cf64e6367f8b13523c1f3ace774cd31d0c7be4aa5560d60d7f8bfda9197802165dea0ab8a5dd7c74cb2bf666f4c903b26603249
+  metadata.gz: 811debe565ba6b2815b24860edc7d43a1cec1f3c0da9a8b4d4aed0c52d88052ddbd8f53b544575b253860da2ad669d197f9c5a105ffdc08a8d8e9fb002aade2b
+  data.tar.gz: 9682dc5d58a0264960323374db889ad4074e0c063685a0062866e811ec04eb1c91a94fef720a4260b58f69d26f12f9640087213c713dc8c9c1438fb0f836089f

data/CHANGELOG.md

@@ -4,6 +4,113 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.92.0] - 2026-10-13
+
+### Added — agent: judgment precedents the shadow judge reads, distilled from your answers
+
+The shadow judge is a fresh model at every point, so it does not improve with
+use. It can now also read an instance L1 entry, `agent_judgment_precedents`,
+that generalizes your terminal answers and their reasons. The entry is drafted
+by a separate model and reaches the judge only after you adopt it at the
+terminal. **The judge's answer still changes nothing**; every row stays
+`shadow`.
+
+- **What the driver records**: when an answer at either point commits, the
+  plans it covered are filed in the session (`point_facts.jsonl`), fixed at
+  the moment you answered (an approve at an autonomous checkpoint never
+  covers the cycles it starts): each step's tool name and effect where the
+  act-route table classified it, counts elsewhere. A step the table does not classify is never named. The ruling
+  carries the digest of the filed line.
+- **Drafting**: after ten new answers you typed at the terminal with a reason,
+  a separate process (`bin/agent_distill.rb`, `claude-opus-5-5` at `xhigh`
+  through `llm_call`, sandboxed) drafts the entry again from all your attested
+  answers, their terminal reasons, the filed facts and your edits to earlier
+  drafts. It never reads the agent's text, the judge's verdicts or an earlier
+  entry. Every statement names the answers it rests on, all at one point,
+  and its count and that point's totals are computed by code. It runs only while the delegation table is in force, one
+  at a time, off the answer path; a failure waits for ten more answers. The
+  draft is recorded on the chain (`agent_distill_draft`).
+- **Adoption**: edit the draft's `.edit.md` copy under
+  `.kairos/storage/agent_distill/drafts/`, then
+  `ruby .kairos/skillsets/agent/bin/agent_rule.rb adopt`. It checks the draft
+  against its chain record, refuses while any session is mid-run (checked
+  again after you confirm), shows your changes and the difference from the
+  entry in force, asks for the nonce, and records one delegation ruling that
+  pins exactly the bytes adopted; on any failure or interrupt the previous
+  entry is put back. When the entry has left its pin (an interrupted
+  adoption, a hand edit), adoption is also the way back. `agent_rule.rb
+  distill` drafts now, whatever the count; `agent_rule.rb status` shows the
+  count, the last run and waiting drafts.
+- **Only adoption pins new precedents**: any other ruling of the delegation
+  table refuses while the entry differs from its last pin.
+- **Counting per version**: `agent_rule.rb shadow` reports agreement apart for
+  each combination of the two tables, what the judge read and the judge's own
+  prompt (now carried on every seal as `judge_prompt_sha256`). A new adoption
+  or an instruction-mode edit starts a new count.
+- The terminal's reason prompt now says that reasons may be distilled into
+  this entry, which the agent can read.
+
+**After upgrading, rule the delegation table again** where it was in force:
+the shipped table now names `judgment_precedents`, so the judge stops (hash
+mismatch) until you run
+`ruby .kairos/skillsets/agent/bin/agent_rule.rb activate --table delegation`,
+which pins the entry as absent. An instance with no delegation ruling is
+unaffected and drafts nothing.
+
+## [3.91.0] - 2026-10-07
+
+### Added — agent: a shadow judge beside the operator (approval delegation, phase 1)
+
+At the points the new delegation table covers, a fresh model answers the
+operator's question beside the operator, and the two answers are compared
+later. **In this phase the judge's answer changes nothing**: every point still
+waits for you.
+
+- **The delegation table** (`lib/agent/delegation_table.yml`) names two
+  points: plan approval in a manual session (`plan_proposed`) and the
+  scheduled checkpoint (`cycle_checkpoint`). Every row is `shadow`; the loader
+  refuses a table with any other mode or with an `mlr` approver. Like the
+  act-route table it is in force only by your terminal ruling, which also pins
+  the instruction mode the judge reads; editing that mode takes the table out
+  of force until you rule again:
+
+      ruby .kairos/skillsets/agent/bin/agent_rule.rb activate --table delegation
+
+  With no ruling, behaviour is as before.
+- **Which points are judged**: only when the act route classifies every step of
+  the plan, no step is marked for a person, nothing touches L0, and the goal is
+  unchanged since the run started. Rows and precedents are chosen only by
+  signals the driver observes from the plan's structure — never by the plan's
+  summary wording or its own risk labels.
+- **The judge** is a separate process (`bin/agent_shadow_judge.rb`) started
+  once the session has stopped at the point; nothing waits for it. It asks
+  `claude-opus-5-5` at effort `xhigh` through `llm_call` (`claude -p`,
+  sandboxed, no fallback provider) with the plan, the driver's signals, the
+  goal, your instruction mode and up to five of your earlier terminal answers
+  at the same kind of stop. Anything but a clear answer from that model counts
+  as "hand back to the operator".
+- **Sealed, then shown**: the verdict goes on the chain as a salted commitment
+  (`agent_shadow_seal`) and is shown only after your answer at that point has
+  committed — in that `agent_step` response and in `agent_status` under
+  `shadow`. Before then `agent_status` says only `judging`, `sealed` or
+  `failed`. The verdict file sits in the session directory; reading it before
+  you answer defeats the comparison.
+- **Counting**: `agent_rule.rb shadow` counts agreement only for answers you
+  typed at the terminal whose seal came first, approve and non-approve apart.
+- Each judged point is one Opus call at `xhigh`.
+
+### Changed — agent: a run with a failed act is not the scheduled checkpoint
+
+An autonomous run now stops as `cycle_checkpoint` only when every act of the
+run succeeded — including an act resumed after a risk pause. A run in which an
+act failed without an act error (a step failed or was denied, the guard failed
+it) stops as `act_failed`, as a failed manual-mode act already did.
+
+### Fixed — agent: a torn read of the chain no longer empties the act-route table
+
+The table loaders retry a read that overlaps a chain append, as the answer
+reader already did.
+
 ## [3.90.0] - 2026-10-07
 
 ### Added — agent: every answer is a ruling on the chain, and an answer typed at a terminal binds

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.90.0"
+  VERSION = "3.92.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/agent/bin/agent_distill.rb

@@ -0,0 +1,124 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+#
+# The distiller's process (distillation design v0.2, INV-K1 / INV-K4).
+# Started detached by the driver after an attested, reasoned answer at a
+# delegable point commits, or in the foreground by `agent_rule.rb distill`.
+# Counting, the one-draft lock, the table's status and the inputs are all
+# decided here, off the response path; DistillRun does the run.
+#
+# It loads no agent tool and never opens a session's advance lock. What it
+# reads is what the operator authored and what the driver observed: the
+# attested answers on the chain, the terminal-sourced reasons they name, the
+# point facts they name, and the operator's changes recorded at adoption.
+#
+# The model is reached through llm_call as the shadow judge reaches it:
+# provider claude_code with sandbox_mode, no fallback.
+#
+# argv: [--manual]   run whatever the count (the operator asked for it)
+# env:  KAIROS_SERVER_LIB   lib dir to load kairos_mcp from
+#       KAIROS_DATA_DIR     the server's data dir (the chain read and written)
+#       KAIROS_PROJECT_ROOT the server's working directory (its .kairos/storage)
+
+require 'json'
+
+manual = ARGV.include?('--manual')
+
+begin
+  Process.setsid unless manual
+rescue StandardError
+  # Already a group leader (spawned with pgroup): acceptable.
+end
+
+begin
+  Dir.chdir(ENV['KAIROS_PROJECT_ROOT']) if ENV['KAIROS_PROJECT_ROOT'] && Dir.exist?(ENV['KAIROS_PROJECT_ROOT'])
+  $LOAD_PATH.unshift(ENV['KAIROS_SERVER_LIB']) if ENV['KAIROS_SERVER_LIB'] && !ENV['KAIROS_SERVER_LIB'].empty?
+  require 'kairos_mcp'
+  KairosMcp.data_dir = ENV['KAIROS_DATA_DIR'] if ENV['KAIROS_DATA_DIR'] && !ENV['KAIROS_DATA_DIR'].empty?
+  require 'kairos_mcp/kairos_chain/chain'
+
+  lib = File.expand_path('../lib', __dir__)
+  %w[session admission mandate_adapter act_classification answer_ruling delegation point_facts distiller
+     distill_run distiller_prompt].each { |f| require File.join(lib, 'agent', f) }
+  require 'kairos_mcp/tools/base_tool'
+  # agent depends on llm_client; both are installed side by side.
+  require File.expand_path('../../llm_client/tools/llm_call', __dir__)
+rescue ScriptError, StandardError => e
+  warn JSON.generate({ 'status' => 'failed', 'reason' => "bootstrap: #{e.class}: #{e.message[0, 200]}" })
+  exit 1
+end
+
+agent = KairosMcp::SkillSets::Agent
+ar = agent::AnswerRuling
+pf = agent::PointFacts
+sessions = agent::Session.storage_path('agent_sessions')
+dir = agent::Session.storage_path('agent_distill')
+
+session_dir = lambda do |sid|
+  next nil unless sid.to_s.match?(/\A[\w-]+\z/)
+
+  d = File.join(sessions, sid.to_s)
+  File.directory?(d) ? d : nil
+end
+
+# The reason the operator typed at the terminal, matched by the digest the
+# ruling names. A caller's text is never the operator's reason.
+reason = lambda do |sid, anchor, sha|
+  d = session_dir.call(sid)
+  next nil unless d
+
+  ar.texts_at(d, anchor, source: 'terminal').map { |t| t['rationale'] }.find { |r| r && ar.sha256(r) == sha }
+end
+
+# The plans the answer covered, as the driver filed them when the answer
+# committed; nil unless the filed line is the one the ruling names. An answer
+# at a point always covers a plan, so an empty window is facts not recorded.
+# Only what the driver observed passes: the cycle, and per step the tool and
+# effect the table gave it, the unclassified count and the step count. The
+# plan's own marks for a person are the agent's declaration and stay behind.
+facts = lambda do |sid, anchor, sha|
+  d = session_dir.call(sid)
+  next nil unless d
+
+  entry, line_sha = pf.answer_facts(d, anchor)
+  plans = entry && line_sha == sha ? entry['plans'] : nil
+  next nil unless plans.is_a?(Array) && !plans.empty?
+  next nil unless plans.all? { |p| p.is_a?(Hash) && p['facts'].is_a?(Hash) }
+
+  plans.map do |p|
+    f = p['facts']
+    { 'cycle' => p['cycle'], 'facts' => f.slice('steps', 'unclassified', 'step_count') }
+  end
+end
+
+edits = Dir.glob(File.join(dir, 'adoptions', '*.json')).sort.filter_map do |f|
+  e = JSON.parse(File.read(f))
+  e.is_a?(Hash) ? e.slice('adopted_block', 'changes') : nil
+rescue StandardError
+  nil
+end.sort_by { |e| e['adopted_block'].to_i }
+
+llm = lambda do |system:, user:, model:, effort:, provider:|
+  out = KairosMcp::SkillSets::LlmClient::Tools::LlmCall.new(nil).call(
+    'messages' => [{ 'role' => 'user', 'content' => user }], 'system' => system, 'model' => model,
+    'effort' => effort, 'sandbox_mode' => true, 'provider_override' => provider
+  )
+  payload = JSON.parse(Array(out).first[:text])
+  raise "llm_call #{payload.dig('error', 'type')}: #{payload.dig('error', 'message')}" unless payload['status'] == 'ok'
+
+  payload['response'].merge('provider' => payload['provider'])
+end
+
+records, records_error = ar.chain_records
+if records_error
+  warn JSON.generate({ 'status' => 'failed', 'reason' => "chain unreadable: #{records_error}" })
+  exit 1
+end
+
+result = agent::DistillRun.run(
+  dir: dir, delegation_status: agent::Delegation.load_effective['status'], records: records,
+  facts: facts, reason: reason, edits: edits, llm: llm, chain: KairosMcp::KairosChain::Chain.new,
+  judge: agent::Delegation::JUDGE, prompts: agent::DistillerPrompt, manual: manual
+)
+(manual ? $stdout : $stderr).puts JSON.generate(result)
+exit(%w[failed].include?(result['status']) ? 1 : 0)

data/templates/skillsets/agent/bin/agent_rule.rb

@@ -2,23 +2,33 @@
 # frozen_string_literal: true
 #
 # The operator's terminal rulings for the agent (design v0.3, INV-A2 / INV-D8):
-# the act-route allow-list, and answers at a stopped session.
+# the act-route allow-list, the delegation table, and answers at a stopped
+# session.
 #
 #   ruby .kairos/skillsets/agent/bin/agent_rule.rb activate   # rule the current table into force
 #   ruby .kairos/skillsets/agent/bin/agent_rule.rb withdraw   # take it out of force
 #   ruby .kairos/skillsets/agent/bin/agent_rule.rb status     # show what is in force (records nothing)
 #   ruby .kairos/skillsets/agent/bin/agent_rule.rb answer SESSION_ID
 #                         # answer a stopped session; the MCP answer there must then match
+#   ruby .kairos/skillsets/agent/bin/agent_rule.rb shadow     # count the shadow judge's agreement
+#                                                             # with your answers, per version of what
+#                                                             # shaped the judge (records nothing)
+#   ruby .kairos/skillsets/agent/bin/agent_rule.rb distill    # draft judgment precedents now, whatever
+#                                                             # the count (calls the distiller model)
+#   ruby .kairos/skillsets/agent/bin/agent_rule.rb adopt [STAMP]
+#                         # adopt a draft (the newest by default) after editing its .edit.md copy
 #
-# Options: --data-dir DIR     the instance data dir whose chain is written
+# Options: --table NAME       activate / withdraw: act_classification (default)
+#                             or delegation
+#          --data-dir DIR     the instance data dir whose chain is written
 #                             (default: the .kairos this script is installed in)
-#          --project-dir DIR  answer only: the directory the MCP server runs in,
-#                             whose .kairos/storage holds its agent sessions
+#          --project-dir DIR  answer / shadow: the directory the MCP server runs
+#                             in, whose .kairos/storage holds its agent sessions
 #                             (default: the directory holding the data dir).
 #                             Needed when the server runs with --data-dir
 #                             pointing at another project's .kairos.
 #
-# activate, withdraw and answer read a nonce typed back at /dev/tty and refuse to run
+# activate, withdraw, answer and adopt read a nonce typed back at /dev/tty and refuse to run
 # without a terminal. That keeps an MCP call from producing a ruling through
 # this path. It does not prove a person typed: any process that can start
 # programs can open a pseudo-terminal, read the nonce and type it back (shown
@@ -27,11 +37,19 @@
 # was at the keyboard (INV-D8 boundary; the constrained party is the agent).
 
 require 'json'
+require 'rbconfig'
 
-action = ARGV.find { |a| %w[activate withdraw status answer].include?(a) }
-abort 'usage: agent_rule.rb activate|withdraw|status|answer SESSION_ID [--data-dir DIR]' unless action
+action = ARGV.find { |a| %w[activate withdraw status answer shadow distill adopt].include?(a) }
+abort 'usage: agent_rule.rb activate|withdraw [--table act_classification|delegation]|status|answer SESSION_ID|shadow|' \
+      'distill|adopt [STAMP] [--data-dir DIR] [--project-dir DIR]' unless action
 session_id = action == 'answer' ? ARGV[ARGV.index('answer') + 1].to_s : nil
 abort 'usage: agent_rule.rb answer SESSION_ID [--data-dir DIR]' if session_id&.then { |s| s.empty? || s.start_with?('-') }
+stamp = action == 'adopt' ? ARGV[ARGV.index('adopt') + 1] : nil
+stamp = nil if stamp.to_s.start_with?('-')
+
+tidx = ARGV.index('--table')
+table = tidx ? ARGV[tidx + 1].to_s : 'act_classification'
+abort "--table must be act_classification or delegation, not #{table.inspect}" unless %w[act_classification delegation].include?(table)
 
 idx = ARGV.index('--data-dir')
 data_dir = idx ? File.expand_path(ARGV[idx + 1].to_s) : File.expand_path('../../..', __dir__)
@@ -50,30 +68,41 @@ lib = File.expand_path('../lib', __dir__)
 require File.join(lib, 'agent', 'admission')
 require File.join(lib, 'agent', 'mandate_adapter')
 require File.join(lib, 'agent', 'act_classification')
+require File.join(lib, 'agent', 'answer_ruling')
+require File.join(lib, 'agent', 'delegation')
+require File.join(lib, 'agent', 'shadow_judge')
+require File.join(lib, 'agent', 'point_facts')
+require File.join(lib, 'agent', 'distiller')
+require File.join(lib, 'agent', 'distill_run')
+require File.join(lib, 'agent', 'adoption')
 ac = KairosMcp::SkillSets::Agent::ActClassification
+dl = KairosMcp::SkillSets::Agent::Delegation
 path = ac::BASE_PATH
 
 puts "Data dir: #{data_dir}"
-if action == 'answer'
+if %w[answer shadow status distill adopt].include?(action)
   require 'kairos_mcp/invocation_context'
   require File.join(lib, 'agent', 'session')
   require File.join(lib, 'agent', 'advance_gate')
-  require File.join(lib, 'agent', 'answer_ruling')
   # The server keeps agent sessions under <its working directory>/.kairos/storage
   # (Session.storage_path without Autonomos loaded), and its chain under its
   # data dir. The two can differ; the answer is read from the first and
   # recorded on the second, the chain the server reads.
   pidx = ARGV.index('--project-dir')
-  abort 'usage: agent_rule.rb answer SESSION_ID --project-dir DIR' if pidx && ARGV[pidx + 1].to_s.then { |v| v.empty? || v.start_with?('-') }
+  if pidx && ARGV[pidx + 1].to_s.then { |v| v.empty? || v.start_with?('-') }
+    abort "usage: agent_rule.rb #{action == 'answer' ? 'answer SESSION_ID' : action} --project-dir DIR"
+  end
   project_dir = pidx ? File.expand_path(ARGV[pidx + 1].to_s) : File.dirname(data_dir)
   abort "no project dir at #{project_dir}" unless File.directory?(project_dir)
   Dir.chdir(project_dir)
-  session = KairosMcp::SkillSets::Agent::Session.load(session_id)
-  unless session
-    abort "no agent session #{session_id} under #{File.join(Dir.pwd, '.kairos', 'storage', 'agent_sessions')} " \
-          '(if the MCP server runs in another directory, pass --project-dir)'
-  end
   puts "Sessions from: #{project_dir}"
+  if action == 'answer'
+    session = KairosMcp::SkillSets::Agent::Session.load(session_id)
+    unless session
+      abort "no agent session #{session_id} under #{File.join(Dir.pwd, '.kairos', 'storage', 'agent_sessions')} " \
+            '(if the MCP server runs in another directory, pass --project-dir)'
+    end
+  end
 end
 if action == 'status'
   eff = ac.load_effective(path: path)
@@ -82,6 +111,78 @@ if action == 'status'
   puts "  ruled sha256: #{eff['ruled_sha256'] || '(none)'}"
   puts "  detail: #{eff['detail']}" if eff['detail']
   puts "  tools in force: #{eff['tools'].keys.sort.join(', ')}" unless eff['tools'].empty?
+  deff = dl.load_effective
+  puts "Table #{dl::TABLE_ID}: #{deff['status']}"
+  puts "  file sha256:  #{deff['sha256']}"
+  puts "  detail: #{deff['detail']}" if deff['detail']
+  deff['rows'].each { |r| puts "  row #{r['id']} at #{r['point']} (#{r['mode']})" }
+  deff['reads'].each do |p|
+    puts(p['absent'] ? "  judge reads #{p['name']}: #{p['path']} (absent: nothing adopted yet)" :
+                       "  judge reads #{p['name']}: #{p['path']} (sha256 #{p['sha256']})")
+  end
+  # Drafting (distillation design v0.2 INV-K4): shown here, never in an advance.
+  distill_dir = KairosMcp::SkillSets::Agent::Session.storage_path('agent_distill')
+  drun = KairosMcp::SkillSets::Agent::DistillRun
+  st = drun.state(distill_dir)
+  records, rerr = KairosMcp::SkillSets::Agent::AnswerRuling.chain_records
+  counted = rerr ? "unknown (#{rerr})" :
+                   KairosMcp::SkillSets::Agent::Distiller.count_new(records, high_water: st['high_water'].to_i)
+  puts 'Judgment precedents drafting:'
+  puts "  reasoned answers since the last draft: #{counted} (a draft starts at #{KairosMcp::SkillSets::Agent::Distiller::THRESHOLD}; " \
+       "only while the delegation table is in force)"
+  last = st['last'] || {}
+  puts "  last run: #{last.empty? ? '(none)' : last.map { |k, v| "#{k} #{v}" }.join(', ')}"
+  if last['status'] == 'running'
+    # A run holds the lock for its whole life; a free lock means it died.
+    # Read the state again while holding the lock: a run that finished in
+    # between released it, and is not dead.
+    died = File.open(File.join(distill_dir, drun::LOCK_FILE), 'a') do |f|
+      f.flock(File::LOCK_EX | File::LOCK_NB) && drun.state(distill_dir).dig('last', 'status') == 'running'
+    end
+    puts '  (no process holds the drafting lock: that run died before it finished)' if died
+  end
+  drafts = drun.drafts(distill_dir)
+  puts "  drafts: #{drafts.empty? ? '(none)' : drafts.first(3).map { |d| d['stamp'] }.join(', ')}"
+  puts "  to adopt the newest: edit #{drafts.first['edit_path']}, then run agent_rule.rb adopt" unless drafts.empty?
+  exit 0
+end
+if action == 'distill'
+  # The worker in the foreground, run by the operator: the same code path a
+  # count starts, without the count.
+  env = { 'KAIROS_PROJECT_ROOT' => Dir.pwd, 'KAIROS_DATA_DIR' => data_dir }
+  env['KAIROS_SERVER_LIB'] = ENV['KAIROS_SERVER_LIB'] if ENV['KAIROS_SERVER_LIB']
+  puts 'Drafting (this calls the distiller model and may take several minutes)...'
+  ok = system(env, RbConfig.ruby, File.expand_path('agent_distill.rb', __dir__), '--manual')
+  exit(ok ? 0 : 1)
+end
+if action == 'shadow'
+  ar = KairosMcp::SkillSets::Agent::AnswerRuling
+  sj = KairosMcp::SkillSets::Agent::ShadowJudge
+  records, error = ar.chain_records
+  abort "The chain could not be read (#{error}); nothing to count." if error
+  sessions = File.expand_path(File.join('.kairos', 'storage', 'agent_sessions'))
+  verdict_dir = lambda do |sid, anchor|
+    sid.to_s.match?(/\A[\w-]+\z/) ? sj.anchor_dir(File.join(sessions, sid.to_s), anchor) : File::NULL
+  end
+  # Counted apart for each version of what shaped the judge (distillation
+  # design v0.2 INV-K5): a new adoption, a mode edit or a new judge prompt
+  # starts a new count; earlier counts are shown, not merged.
+  by = sj.agreement_by_version(records, verdict_dir: verdict_dir)
+  total = by['versions'].sum { |v| v['summary']['pairs'] }
+  puts "Pairs that count as evidence (your terminal answer, sealed before it): #{total}, " \
+       "in #{by['versions'].size} version(s), newest first"
+  by['versions'].each_with_index do |v, i|
+    sum = v['summary']
+    key = v['version']
+    yes = sum['operator_approved']
+    no = sum['operator_did_not_approve']
+    puts "Version #{i + 1} (seals ##{v['first_seal']}..##{v['last_seal']}): judge prompt #{key['judge_prompt'].to_s[0, 12].then { |x| x.empty? ? '(before 3.92.0)' : x }}, " \
+         "reads #{key['reads'].map { |r| r.sub(/:(\h{12})\h+\z/, ':\1') }.join(' ')}"
+    puts "  you approved:          #{yes['n']}; the judge also approved #{yes['judge_agreed']}"
+    puts "  you did not approve:   #{no['n']}; the judge gave the same answer #{no['judge_agreed']}, approved #{no['judge_approved']}"
+    puts "  the judge approved #{sum['judge_approved']} of #{sum['pairs']}"
+  end
+  puts "Not counted: #{by['not_counted'].empty? ? '(none)' : by['not_counted'].map { |k, v| "#{k} #{v}" }.join(', ')}"
   exit 0
 end
 
@@ -92,11 +193,19 @@ rescue StandardError => e
 end
 
 begin
-  result = if action == 'answer'
+  result = if action == 'adopt'
+             KairosMcp::SkillSets::Agent::Adoption.interactive_adopt(
+               dir: KairosMcp::SkillSets::Agent::Session.storage_path('agent_distill'),
+               sessions_dir: KairosMcp::SkillSets::Agent::Session.storage_path('agent_sessions'),
+               stamp: stamp, tty_in: tty, tty_out: tty
+             )
+           elsif action == 'answer'
              KairosMcp::SkillSets::Agent::AnswerRuling.interactive_answer(
                session: session, gate: KairosMcp::SkillSets::Agent::AdvanceGate.new(session.guard_dir),
                tty_in: tty, tty_out: tty, reload: -> { KairosMcp::SkillSets::Agent::Session.load(session_id) }
              )
+           elsif table == 'delegation'
+             dl.interactive_rule(action: action, tty_in: tty, tty_out: tty)
            else
              ac.interactive_rule(action: action, tty_in: tty, tty_out: tty, path: path)
            end

data/templates/skillsets/agent/bin/agent_shadow_judge.rb

@@ -0,0 +1,70 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+#
+# The shadow judge's process (design v0.3, INV-D6 / INV-D7). Started detached
+# by the driver after an advance commits, once per anchor, with the packet the
+# driver wrote. It reads the files the packet pins, asks a fresh model the
+# operator's question, writes the verdict beside the packet and appends a
+# salted commitment to it on the chain.
+#
+# It loads no agent tool and never opens the session's advance lock: nothing
+# waits for it, and nothing it does can reach the operator's answer.
+#
+# The model is reached through llm_call (design v0.3 §4), loaded here as a
+# tool object rather than through a registry: provider claude_code (claude -p)
+# with sandbox_mode, the requested model and effort. llm_call falls back to
+# another provider only from a provider other than claude_code, so the judge
+# has none. Its timeout is llm_client's configured one (600 s as shipped).
+#
+# argv: <packet_path>
+# env:  KAIROS_SERVER_LIB  lib dir to load kairos_mcp from
+#       KAIROS_DATA_DIR    the server's data dir (the chain written)
+#       KAIROS_PROJECT_ROOT the server's working directory
+
+require 'json'
+
+packet_path = ARGV[0] or abort 'usage: agent_shadow_judge.rb <packet_path>'
+
+begin
+  Process.setsid
+rescue StandardError
+  # Already a group leader (spawned with pgroup): acceptable.
+end
+
+begin
+  Dir.chdir(ENV['KAIROS_PROJECT_ROOT']) if ENV['KAIROS_PROJECT_ROOT'] && Dir.exist?(ENV['KAIROS_PROJECT_ROOT'])
+  $LOAD_PATH.unshift(ENV['KAIROS_SERVER_LIB']) if ENV['KAIROS_SERVER_LIB']
+  require 'kairos_mcp'
+  KairosMcp.data_dir = ENV['KAIROS_DATA_DIR'] if ENV['KAIROS_DATA_DIR'] && !ENV['KAIROS_DATA_DIR'].empty?
+  require 'kairos_mcp/kairos_chain/chain'
+
+  lib = File.expand_path('../lib', __dir__)
+  require File.join(lib, 'agent', 'answer_ruling')
+  require File.join(lib, 'agent', 'delegation')
+  require File.join(lib, 'agent', 'shadow_judge')
+  require 'kairos_mcp/tools/base_tool'
+  # agent depends on llm_client; both are installed side by side.
+  require File.expand_path('../../llm_client/tools/llm_call', __dir__)
+rescue ScriptError, StandardError => e
+  dir = File.dirname(packet_path)
+  File.write(File.join(dir, 'error.json'),
+             JSON.generate({ 'sealed' => false, 'error' => "bootstrap: #{e.class}: #{e.message[0, 200]}" }))
+  exit 1
+end
+
+llm = lambda do |system:, user:, model:, effort:, provider:|
+  out = KairosMcp::SkillSets::LlmClient::Tools::LlmCall.new(nil).call(
+    'messages' => [{ 'role' => 'user', 'content' => user }], 'system' => system, 'model' => model,
+    'effort' => effort, 'sandbox_mode' => true, 'provider_override' => provider
+  )
+  payload = JSON.parse(Array(out).first[:text])
+  raise "llm_call #{payload.dig('error', 'type')}: #{payload.dig('error', 'message')}" unless payload['status'] == 'ok'
+
+  payload['response'].merge('provider' => payload['provider'])
+end
+
+result = KairosMcp::SkillSets::Agent::ShadowJudge.judge_and_seal(
+  packet_path, llm: llm, chain: KairosMcp::KairosChain::Chain.new
+)
+warn JSON.generate(result)
+exit(result['sealed'] ? 0 : 1)

data/templates/skillsets/agent/lib/agent/act_classification.rb

@@ -92,16 +92,30 @@ module KairosMcp
         end
 
         # [rulings, nil] from the instance chain, or [[], reason] when the
-        # chain cannot be read (which empties the table).
+        # chain cannot be read (which empties the table). The ledger is
+        # rewritten in place on every append, and the shadow judge appends
+        # from its own process at any moment, so a read is retried before a
+        # torn one empties the table (as AnswerRuling.chain_records).
+        READ_ATTEMPTS = 3
+
         def chain_rulings
           return ActClassification.rulings_source.call if ActClassification.rulings_source
 
           require 'kairos_mcp/kairos_chain/chain'
-          chain = ::KairosMcp::KairosChain::Chain.new
-          state = chain.load_state
-          return [[], "chain #{state}"] unless %i[readable absent].include?(state)
-
-          [rulings_from_blocks(chain.chain), nil]
+          reason = nil
+          READ_ATTEMPTS.times do |i|
+            sleep(0.05 * i) if i.positive?
+            begin
+              chain = ::KairosMcp::KairosChain::Chain.new
+              state = chain.load_state
+              return [rulings_from_blocks(chain.chain), nil] if %i[readable absent].include?(state)
+
+              reason = "chain #{state}"
+            rescue StandardError => e
+              reason = "chain unreadable: #{e.class}: #{e.message[0, 120]}"
+            end
+          end
+          [[], reason]
         rescue StandardError, ScriptError => e
           [[], "chain unreadable: #{e.class}: #{e.message[0, 120]}"]
         end