pwn 0.5.721 → 0.5.723

data/lib/pwn/ai/agent/policy.rb

@@ -44,11 +44,20 @@ module PWN
         MAX_TRAJ   = 2_000
         GOLD_MIN   = 0.6
         VISITS_MIN = 2
+        CONTEXT_VISITS_MIN = 3
         COLD_EPISODES = 8
         WARM_EPISODES = 40
         TASK_MOD   = 16
         ACTION_MOD = 16
         EP_KEY     = :pwn_policy_episode
+        OPERATIONS = %w[read list search inspect write create update delete execute start stop status poll].freeze
+        RESULT_TYPES = %w[success failure timeout enoent eacces auth_required network syntax exit127 exit126 nonzero_exit handler_error invalid_payload].freeze
+        ARGUMENT_ROLES = {
+          'action' => 'operation', 'operation' => 'operation', 'op' => 'operation',
+          'path' => 'path', 'file' => 'path', 'directory' => 'path',
+          'command' => 'program', 'code' => 'program', 'query' => 'query',
+          'url' => 'url', 'timeout' => 'control', 'limit' => 'control'
+        }.freeze
 
         # ----------------------------------------------------------------
         # Feature → discrete state
@@ -110,7 +119,7 @@ module PWN
           tab[:q].each_value { |acts| pairs += acts.length if acts.is_a?(Hash) }
           return true if warmed && pairs >= COLD_EPISODES
 
-          traj_n = trajectories(limit: COLD_EPISODES).length
+          traj_n = trajectories(limit: COLD_EPISODES).count { |ep| !ep[:score].nil? }
           warmed && traj_n >= COLD_EPISODES
         rescue StandardError
           false
@@ -145,7 +154,7 @@ module PWN
           )
           ep = {
             session_id: sid,
-            request: opts[:request].to_s[0, 240],
+            request: opts[:request].to_s.dup,
             kind: normalize_kind(raw: opts[:kind]),
             intent: opts[:intent].to_s,
             engine: opts[:engine].to_s,
@@ -168,6 +177,9 @@ module PWN
         # step = PWN::AI::Agent::Policy.observe_step(
         #   session_id: 'optional - must match begin_episode when set',
         #   action: 'required - tool name',
+        #   args: 'optional - arguments, reduced to fixed roles/types, never stored raw',
+        #   operation: 'optional - known operation override; otherwise derived from args',
+        #   result_type: 'optional - Reward.semantic_ok shape; fixed allowlist only',
         #   ok: 'required - Boolean, Reward.semantic_ok',
         #   duration: 'optional - Float seconds',
         #   ts_state: 'optional - TaskSummarizer state',
@@ -211,9 +223,14 @@ module PWN
             engine: ep[:engine],
             ts_state: opts[:ts_state]
           )
+          context = action_context(opts)
+          context_s2 = contextual_state(state: s2, action: action, context: context)
           trans = {
             state: s,
             action: action,
+            action_context: context,
+            context_state: ep[:context_state],
+            next_context_state: context_s2,
             reward: reward,
             next_state: s2,
             ok: ok,
@@ -222,6 +239,7 @@ module PWN
           }
           ep[:steps] << trans
           ep[:state] = s2
+          ep[:context_state] = context_s2
           ep[:last_action] = action
           trans
         rescue StandardError => e
@@ -278,15 +296,19 @@ module PWN
           ep[:steps].last[:terminal] = true
           ep[:score] = opts[:score]
           ep[:verdict] = opts[:verdict]
-          ep[:return] = discounted_return(steps: ep[:steps])
+          ep[:return] = opts[:score].nil? ? nil : discounted_return(steps: ep[:steps])
           ep[:ended_at] = Time.now.utc.iso8601
 
           n_td = 0
           n_pg = 0
           ep[:steps].each_with_index do |tr, idx|
-            n_td += 1 if update_q!(transition: tr)
+            next if opts[:score].nil?
+
             g = discounted_return(steps: ep[:steps][idx..])
-            n_pg += 1 if update_pg!(state: tr[:state], action: tr[:action], advantage: g - value(state: tr[:state]))
+            transition_variants(transition: tr).each do |variant|
+              n_td += 1 if update_q!(transition: variant)
+              n_pg += 1 if update_pg!(state: variant[:state], action: variant[:action], advantage: g - value(state: variant[:state]))
+            end
           end
 
           persist_episode!(episode: ep)
@@ -401,11 +423,16 @@ module PWN
 
           tab = load
           visits = read_visit(table: tab, state: s, action: a)
-          qsa = smoothed_q(table: tab, state: s, action: a)
+          context = opts[:context_state]
+          context = nil unless context.to_s.start_with?("#{s}~ctx:")
+          contextual_visits = read_visit(table: tab, state: context, action: a)
+          qsa = routing_q(table: tab, state: s, context_state: context, action: a)
           # Tiny visit counts stay at 0 unless the value is already decisive.
-          return 0.0 if visits < VISITS_MIN && qsa.abs < 0.08
+          return 0.0 if contextual_visits < CONTEXT_VISITS_MIN && visits < VISITS_MIN && qsa.abs < 0.08
 
-          (qsa - max_q(table: tab, state: s)).round(4)
+          actions = ((tab[:q][s.to_s.to_sym] || {}).keys + (tab[:q][context.to_s.to_sym] || {}).keys).uniq
+          baseline = actions.map { |act| routing_q(table: tab, state: s, context_state: context, action: act) }.max || 0.0
+          (qsa - baseline).clamp(-1.0, 1.0).round(4)
         rescue StandardError
           0.0
         end
@@ -432,7 +459,8 @@ module PWN
           return { action: actions.sample, reason: :explore, state: s, epsilon: eps } if rand < eps
 
           tab = load
-          scored = actions.map { |a| [a, smoothed_q(table: tab, state: s, action: a)] }
+          context = opts.key?(:context_state) ? opts[:context_state] : (current_context_state if s == current_state)
+          scored = actions.map { |a| [a, routing_q(table: tab, state: s, context_state: context, action: a)] }
           best = scored.max_by { |_, v| v }
           { action: best[0], q: best[1].round(4), reason: :greedy, state: s, ranked: scored.sort_by { |_, v| -v } }
         rescue StandardError => e
@@ -448,6 +476,13 @@ module PWN
           Thread.current[EP_KEY]
         end
 
+        # Previous action features are available BEFORE the next tool choice;
+        # the candidate's own result must never leak into its decision state.
+        public_class_method def self.current_context_state
+          ep = current_episode
+          ep.is_a?(Hash) ? ep[:context_state] : nil
+        end
+
         # Hermes split: snapshot + clear the live episode so Loop.maybe_finish_policy
         # is a no-op on the user-visible path while TurnFinalizer re-attaches it
         # on the background review thread.
@@ -538,7 +573,7 @@ module PWN
         # Does not write. Used by task 7 (evaluate policy quality).
 
         public_class_method def self.evaluate(opts = {})
-          rows = trajectories(limit: opts[:limit] || 200)
+          rows = trajectories(limit: opts[:limit] || 200).reject { |ep| ep[:score].nil? }
           return { n: 0, mean_return: nil, greedy_match: nil, mean_abs_td: nil } if rows.empty?
 
           tab = load
@@ -705,6 +740,9 @@ module PWN
             #{self}.observe_step(
               session_id: 'optional - must match begin_episode when set',
               action: 'required - tool name',
+              args: 'optional - arguments reduced to fixed roles/types only',
+              operation: 'optional - allowlisted operation override',
+              result_type: 'optional - allowlisted semantic result shape',
               ok: 'required - Boolean, Reward.semantic_ok',
               duration: 'optional - Float seconds',
               ts_state: 'optional - TaskSummarizer state',
@@ -750,13 +788,15 @@ module PWN
             # Q(s,a) − V(s). Unknown / cold-start pairs return 0 so rank is unchanged
             #{self}.advantage(
               state: 'optional - state value consumed by #advantage (defaults to current_state)',
-              action: 'optional - action value consumed by #advantage'
+              action: 'optional - action value consumed by #advantage',
+              context_state: 'optional - previous action context supplied by Registry'
             )
 
             # Run recommend and return its result
             #{self}.recommend(
               state: 'optional - default current episode state',
               actions: 'required - Array of tool names',
+              context_state: 'optional - previous action context (default live context)',
               epsilon: 'optional - explore probability (default EPSILON)'
             )
 
@@ -766,6 +806,9 @@ module PWN
             # Run current episode and return its result
             #{self}.current_episode
 
+            # Sanitized previous-action state used for advisory routing
+            #{self}.current_context_state
+
             # Hermes split: snapshot + clear the live episode so Loop.maybe_finish_policy
             #{self}.detach_episode!
 
@@ -832,6 +875,74 @@ module PWN
           { q: {}, h: {}, visits: {}, returns: [], n_updates: 0, td_abs_sum: 0.0, updated_at: nil }
         end
 
+        private_class_method def self.contextual_state(opts = {})
+          "#{opts[:state]}~ctx:a#{action_bucket(name: opts[:action])}:#{JSON.generate(opts[:context])}"
+        end
+
+        private_class_method def self.transition_variants(opts = {})
+          tr = opts[:transition]
+          return [tr] if tr[:context_state].to_s.empty?
+
+          [tr, tr.merge(state: tr[:context_state], next_state: tr[:next_context_state])]
+        end
+
+        # Shrink sparse contextual values toward the existing broad Q table.
+        # A strict sample floor prevents a single unusual call moving rank.
+        private_class_method def self.routing_q(opts = {})
+          broad = smoothed_q(table: opts[:table], state: opts[:state], action: opts[:action])
+          context = opts[:context_state]
+          return broad unless context.to_s.start_with?("#{opts[:state]}~ctx:")
+
+          n = read_visit(table: opts[:table], state: context, action: opts[:action])
+          return broad if n < CONTEXT_VISITS_MIN
+
+          specific = read_q(table: opts[:table], state: context, action: opts[:action])
+          weight = n.to_f / (n + CONTEXT_VISITS_MIN)
+          ((weight * specific) + ((1.0 - weight) * broad)).round(5)
+        end
+
+        # No arbitrary keys, values, lengths, hashes, paths, or class names.
+        # Nested containers are represented by type only, not traversed.
+        private_class_method def self.action_context(opts = {})
+          args = opts[:args]
+          operation = opts[:operation]
+          operation = args[:operation] || args['operation'] || args[:action] || args['action'] || args[:op] || args['op'] if operation.nil? && args.is_a?(Hash)
+          operation ||= 'execute' if %w[shell pwn_eval].include?(opts[:action].to_s)
+          operation = operation.to_s.downcase
+          operation = 'other' unless OPERATIONS.include?(operation)
+          arguments = { shape: feature_type(value: args) }
+          if args.is_a?(Hash)
+            size = if args.empty?
+                     'empty'
+                   elsif args.length <= 4
+                     'few'
+                   else
+                     'many'
+                   end
+            features = args.map do |key, value|
+              role = ARGUMENT_ROLES.fetch(key.to_s, 'other')
+              "#{role}:#{feature_type(value: value)}"
+            end.uniq.sort
+            arguments.merge!(size: size, features: features)
+          end
+          result = opts[:result_type].to_s
+          result = opts[:ok] ? 'success' : 'failure' if result.empty?
+          result = 'other' unless RESULT_TYPES.include?(result)
+          { operation: operation, arguments: arguments, result_type: result }
+        end
+
+        private_class_method def self.feature_type(opts = {})
+          case opts[:value]
+          when Hash then 'object'
+          when Array then 'array'
+          when String, Symbol then 'string'
+          when Numeric then 'number'
+          when true, false then 'boolean'
+          when nil then 'null'
+          else 'other'
+          end
+        end
+
         private_class_method def self.normalize_kind(opts = {})
           raw = opts[:raw].to_s.downcase
           return 'goal' if raw.empty?
@@ -1073,6 +1184,7 @@ module PWN
           vals = []
           tab[:q].each do |key, acts|
             next unless acts.is_a?(Hash) && acts.key?(act)
+            next if key.to_s.include?('~ctx:')
 
             ks = key.to_s.split('|')
             next unless ks[0] == kind && ks[1] == task && ks[-1] == eng
@@ -1092,11 +1204,19 @@ module PWN
           return { skipped: :no_traj } unless File.exist?(TRAJECTORY_FILE)
 
           tab = load
-          rows = trajectories(limit: opts[:limit] || 400)
+          rows = trajectories(limit: opts[:limit] || 400).reject { |ep| ep[:score].nil? }
+          context_counts = Hash.new(0)
+          rows.each do |ep|
+            Array(ep[:steps]).each do |tr|
+              next if tr[:context_state].to_s.empty? || tr[:action].to_s.empty?
+
+              context_counts[[tr[:context_state].to_s.to_sym, tr[:action].to_s.to_sym]] += 1
+            end
+          end
           n = 0
           2.times do
             rows.reverse_each do |ep|
-              Array(ep[:steps]).each do |tr|
+              Array(ep[:steps]).flat_map { |tr| transition_variants(transition: tr) }.each do |tr|
                 s = tr[:state].to_s
                 a = tr[:action].to_s
                 next if s.empty? || a.empty?
@@ -1109,13 +1229,19 @@ module PWN
                 target = r + (GAMMA * max_n)
                 td = target - qsa
                 write_q!(table: tab, state: s, action: a, value: qsa + (ALPHA * td))
-                bump_visit!(table: tab, state: s, action: a)
+                bump_visit!(table: tab, state: s, action: a) unless s.include?('~ctx:')
                 tab[:n_updates] = tab[:n_updates].to_i + 1
                 tab[:td_abs_sum] = tab[:td_abs_sum].to_f + td.abs
                 n += 1
               end
             end
           end
+          # Replay is not new evidence: restore observed counts, never count
+          # the two passes (or repeated warmups) as independent samples.
+          context_counts.each do |(s, a), count|
+            tab[:visits][s] ||= {}
+            tab[:visits][s][a] = [tab[:visits][s][a].to_i, count].max
+          end
           # Credit stored returns toward the episode budget so greedy
           # suggestions are not omitted after a successful replay of a
           # table that never finished COLD_EPISODES live turns.
@@ -1151,12 +1277,12 @@ module PWN
           return unless ep.is_a?(Hash)
 
           tab = load
-          tab[:returns] = (Array(tab[:returns]) + [ep[:return].to_f]).last(200)
+          tab[:returns] = (Array(tab[:returns]) + [ep[:return].to_f]).last(200) unless ep[:score].nil?
           save(table: tab)
           FileUtils.mkdir_p(File.dirname(TRAJECTORY_FILE))
           row = {
             session_id: ep[:session_id],
-            request: ep[:request],
+            request_family: task_family(text: ep[:request]),
             kind: ep[:kind],
             engine: ep[:engine],
             started_at: ep[:started_at],

data/lib/pwn/ai/agent/registry.rb

@@ -276,7 +276,7 @@ module PWN
             ucb   = defined?(Metrics) && Metrics.respond_to?(:ucb) ? Metrics.ucb(name: e.name) : 0.5
             prm   = defined?(Metrics) && Metrics.respond_to?(:prm_advantage) ? Metrics.prm_advantage(name: e.name) : 0.0
             qadv  = if eps_q.positive? && pol_state
-                      Policy.advantage(state: pol_state, action: e.name)
+                      Policy.advantage(state: pol_state, action: e.name, context_state: Policy.current_context_state)
                     else
                       0.0
                     end

data/lib/pwn/ai/agent/reward.rb

@@ -143,21 +143,26 @@ module PWN
           #       confidence handles that in the bandit blend.
           eng = (PWN::Env.dig(:ai, :active) if defined?(PWN::Env)).to_s.downcase
           local = eng == 'ollama' || eng.empty?
-          if v[:source].to_s == 'heuristic'
-            v[:confidence] = local ? 0.35 : 0.5
+          if v[:source].to_s == 'heuristic' || v[:source].to_s.start_with?('heuristic')
+            toolbacked = Array(trace).any?
+            v[:heuristic_class] = toolbacked ? :toolbacked : :textual
+            v[:source] = :heuristic
+            v[:confidence] = if toolbacked
+                               local ? 0.55 : 0.7
+                             else
+                               local ? 0.35 : 0.5
+                             end
             raw = v[:score].to_f
             v[:score_raw] = raw
-            # preserve empty / failure-language / polite floors exactly (raw <= 0.15)
-            # and pass-through non-capped heuristics via the default arm.
-            if local && raw > 0.15 && trace.empty? && raw >= 0.6 && final.length < 400
+            if !toolbacked && local && raw > 0.15 && trace.empty? && raw >= 0.6 && final.length < 400
               v[:score] = [raw, 0.45].min
               v[:rationale] = "#{v[:rationale]} | P1:local_no_trace_cap"
-            elsif local && raw > 0.15 && trace.length < 2 && raw >= 0.85
-              # thin-evidence local highs: mild shrink toward 0.5
+            elsif !toolbacked && local && raw > 0.15 && trace.length < 2 && raw >= 0.85
               v[:score] = (0.5 + ((raw - 0.5) * 0.7)).round(3).clamp(0.0, 1.0)
             else
               v[:score] = raw
             end
+
             v[:verdict] = if v[:score] >= 0.6 then :solved
                           elsif v[:score] >= 0.3 then :partial
                           else :wrong
@@ -168,59 +173,33 @@ module PWN
 
           ground = verify_as_reward(final: final)
           unless ground.nil?
-            # Ground-truth override: a browser-refuted claim caps score at
-            # 0.2 regardless of how confident the judge was; a confirmed
-            # claim floors it at 0.6. E3.
+            # A refuted claim is negative evidence. Confirming one claim
+            # does not establish completion of the entire operator request.
             v[:score] = [v[:score], 0.2].min if ground[:verdict] == :refuted
-            v[:score] = [v[:score], 0.6].max if ground[:verdict] == :confirmed
             v[:grounded] = ground
             v[:confidence] = [v[:confidence].to_f, ground[:confidence].to_f].max if ground[:confidence]
           end
 
-          pass = final.match?(/\bPASS\b/) && !(defined?(Learning) && final.match?(Learning::FAILURE_FINAL_RX))
           v[:judge_score] = v[:score].to_f
-          vv = opts[:verifier_verdict]
-          vv = :pass if vv.nil? && (opts[:verifier_pass] == true || pass || (ground && ground[:verdict] == :confirmed))
-          vv = vv.to_s.to_sym if vv
-          v[:verifier_verdict] = vv
-          v[:verdict_class] = taxonomy_class(opts.merge(score: v[:score], verifier_verdict: vv, request: request, final: final))
+          v[:verification] = request_verification(request: request, session_id: opts[:session_id])
+          v = resolve_outcome(outcome: v, critic_pass: opts[:critic_pass])
+          v[:verdict_class] = taxonomy_class(opts.merge(score: v[:score], verifier_verdict: v[:verifier_verdict], request: request, final: final))
           v[:remediation_hint] = taxonomy_hint(verdict_class: v[:verdict_class])
-          prec = verifier_precedence?
-          if prec && vv == :pass
-            v[:success] = true
-          else
-            v[:success] = promote_to_success?(
-              orm: v[:source].to_s != 'heuristic' && v[:score].to_f >= 0.6,
-              verify: if ground.nil?
-                        nil
-                      else
-                        ground[:verdict] == :confirmed
-                      end,
-              critic: opts.key?(:critic_pass) ? opts[:critic_pass] : nil
-            )
-          end
           v[:needs_spot_check] = v[:success] && v[:score].to_f >= 0.85 && (rand < 0.05)
           v[:engine] = eng
           v[:task_class] = request.match?(/analy[sz]e|summar|strength|weakness|fitness/i) ? 'analysis' : 'operational'
-          if pass
-            score = v[:score].to_f
-            v[:score] = [score, 0.6].max
-            v[:success] = true if prec
-            v[:verifier_verdict] ||= :pass
-            v[:verdict] = :solved
-          end
           v[:score_components] ||= {
             judge: v[:score].to_f,
-            overlap: pass ? 0.0 : nil,
+            overlap: nil,
             checks: 0.0,
-            weights: { overlap: pass ? 0.0 : 0.15 }
+            weights: { overlap: 0.15 }
           }
-          v[:score_components][:weights][:overlap] = 0.0 if pass
           if commit && defined?(Learning) && opts[:persist_components]
             Learning.note_outcome(
               task: request[0, 80],
               success: v[:success],
               score: v[:score],
+              outcome: v,
               details: v[:score_components].to_json,
               verifier_verdict: v[:verifier_verdict],
               verdict_class: v[:verdict_class]
@@ -228,7 +207,7 @@ module PWN
           end
           # W3 — write Brier on every judged turn so overconfidence can
           # throttle max_iters/critic even when plan_first never fired.
-          if commit
+          if commit && !v[:training_score].nil?
             pred = opts[:predicted]
             pred = Thread.current[:pwn_plan_predicted] if pred.nil?
             pred = v[:confidence] if pred.nil?
@@ -236,10 +215,103 @@ module PWN
           end
           # P1 — sentinel stores confidence so distrust math can haircut
           # heuristic-heavy windows differently from LLM ORM windows.
-          record_sentinel(proxy: opts[:proxy_ok], judge: v[:score], confidence: v[:confidence], source: v[:source]) if commit
+          record_sentinel(v.slice(:training_score, :decision_version, :verdict, :confidence, :source).merge(proxy: opts[:proxy_ok], judge: v[:training_score])) if commit && !v[:training_score].nil?
           v
         rescue StandardError => e
-          { score: 0.5, verdict: :unknown, rationale: "judge error: #{e.class}", success: !final.strip.empty?, error: e.message, confidence: 0.2, source: :error }
+          resolve_outcome(outcome: { score: nil, rationale: "judge error: #{e.class}", error: e.message, confidence: 0.0, source: :error })
+        end
+
+        # The sole outcome decision. Scores are diagnostic; training_score
+        # is absent when the evaluator cannot supply a reliable label.
+        public_class_method def self.resolve_outcome(opts = {})
+          v = (opts[:outcome] || {}).dup
+          source = (v[:source] || v[:judge_source]).to_s
+          score = v[:score]
+          score = score.to_f.clamp(0.0, 1.0) unless score.nil?
+          verification = v[:verification]
+          checked = verification.is_a?(Hash) && valid_verification_checks?(checks: verification[:checks])
+          vv = if checked
+                 verification[:checks].all? { |c| c[:passed] } ? :pass : :fail
+               end
+          v[:verifier_verdict] = vv
+          v[:confidence] = 1.0 if vv
+          if vv == :fail || v.dig(:grounded, :verdict).to_s == 'refuted'
+            score = [score || 0.0, 0.2].min
+            success = false
+          elsif vv == :pass && verifier_precedence?
+            score = [score || 0.0, 0.6].max
+            success = true
+          elsif score.nil? || source == 'error'
+            success = nil
+          elsif source.start_with?('heuristic')
+            success = false
+          elsif opts[:critic_pass] == false || v[:critic_pass] == false
+            if score >= 0.6
+              success = nil
+            else
+              score = [score, 0.3].min
+              success = false
+            end
+          else
+            success = score >= 0.6
+          end
+          known = !success.nil? && (!source.start_with?('heuristic') || !vv.nil?)
+          verdict = if !known then :unknown
+                    elsif success then :solved
+                    elsif score >= 0.3 then :partial
+                    else :wrong
+                    end
+          v.merge(score: score, success: success, verdict: verdict,
+                  critic_pass: opts.fetch(:critic_pass, v[:critic_pass]),
+                  training_score: known ? score : nil, decision_version: 1)
+        end
+
+        # Trusted host-verifier API, deliberately NOT a model-facing tool.
+        # Caller must actually check every original-request criterion. Never
+        # construct these records by parsing an assistant/tool claim of PASS.
+        public_class_method def self.record_verification(opts = {})
+          request = opts[:request].to_s
+          sid = opts[:session_id].to_s
+          checks = opts[:checks]
+          raise ArgumentError, 'nonempty complete request checks required' unless valid_verification_checks?(checks: checks)
+
+          rows = PWN::Sessions.load(session_id: sid)
+          user = rows.reverse.find { |row| row[:role].to_s == 'user' }
+          raise ArgumentError, 'verification must match the current session request' if request.empty? || !user || user[:content].to_s != request
+
+          record = { request_digest: Digest::SHA256.hexdigest(request), session_id: sid, checks: checks }
+          PWN::Sessions.append(session_id: sid, role: 'verification', content: JSON.generate(record))
+          record
+        end
+
+        private_class_method def self.valid_verification_checks?(opts = {})
+          checks = opts[:checks]
+          checks.is_a?(Array) && !checks.empty? && checks.all? do |check|
+            check.is_a?(Hash) && !check[:criterion].to_s.strip.empty? &&
+              [true, false].include?(check[:passed]) && !check[:evidence].to_s.strip.empty?
+          end
+        end
+
+        private_class_method def self.request_verification(opts = {})
+          sid = opts[:session_id].to_s
+          return nil if sid.empty?
+
+          rows = PWN::Sessions.load(session_id: sid)
+          user_idx = rows.rindex { |row| row[:role].to_s == 'user' }
+          return nil unless user_idx && rows[user_idx][:content].to_s == opts[:request].to_s
+
+          verification_idx = rows.rindex { |entry| entry[:role].to_s == 'verification' }
+          return nil unless verification_idx && verification_idx > user_idx
+          return nil if rows[(verification_idx + 1)..].any? { |entry| entry[:role].to_s == 'tool' }
+
+          row = rows[verification_idx]
+          record = JSON.parse(row[:content].to_s, symbolize_names: true)
+          return nil unless record[:session_id] == sid && record[:request_digest] == Digest::SHA256.hexdigest(opts[:request].to_s)
+          return nil unless valid_verification_checks?(checks: record[:checks])
+
+          record
+        rescue StandardError
+          nil
         end
 
         public_class_method def self.promote_to_success?(opts = {})
@@ -505,7 +577,7 @@ module PWN
           need = SENTINEL_WINDOW - have
           limit = (opts[:limit] || [need * 4, 200].max).to_i
           # Prefer scored rows; fall back to success-boolean so local hosts still warm.
-          rows = Learning.outcomes(limit: limit)
+          rows = Learning.outcomes(limit: limit).select { |r| sentinel_outcome_known?(outcome: r) }
           scored, unscored = rows.partition { |r| !r[:score].nil? }
           ordered = scored.reverse + unscored.reverse
           added = 0
@@ -1564,12 +1636,23 @@ module PWN
           nil
         end
 
+        private_class_method def self.sentinel_outcome_known?(opts = {})
+          row = opts[:outcome] || {}
+          return false if row[:verdict].to_s == 'unknown'
+          return !row[:training_score].nil? if row.key?(:training_score) || row.key?(:decision_version)
+
+          source = (row[:source] || row[:judge_source]).to_s
+          return false if source.start_with?('heuristic') || source == 'error'
+
+          !row[:judge].nil? || !row[:score].nil? || [true, false, 'true', 'false', 'soft'].include?(row[:success])
+        end
+
         private_class_method def self.record_sentinel(opts = {})
           s = normalize_sentinel(raw: load_sentinel)
           # Clamp judge to [0,1] — LLM/heuristic should already, but a bad
           # write must not poison rolling means forever.
           judge = opts[:judge].to_f.clamp(0.0, 1.0)
-          entry = { judge: judge, at: Time.now.utc.iso8601 }
+          entry = opts.slice(:training_score, :decision_version, :verdict).merge(judge: judge, at: Time.now.utc.iso8601)
           # P1 — optional per-sample confidence (heuristic < LLM ORM)
           entry[:confidence] = opts[:confidence].to_f.clamp(0.0, 1.0) unless opts[:confidence].nil?
           entry[:source] = opts[:source].to_s unless opts[:source].to_s.empty?
@@ -1642,10 +1725,15 @@ module PWN
         private_class_method def self.normalize_sentinel(opts = {})
           raw = opts.is_a?(Hash) && opts.key?(:raw) ? opts[:raw] : opts
           s = (raw.is_a?(Hash) ? raw.dup : empty_sentinel)
-          s[:window] = Array(s[:window]).map do |e|
-            next nil unless e.is_a?(Hash)
-
-            h = { judge: e[:judge].to_f.clamp(0.0, 1.0) }
+          window = Array(s[:window])
+          known = window.select { |e| e.is_a?(Hash) && sentinel_outcome_known?(outcome: e) }
+          if known.length < window.length
+            s[:proxy_distrust] = 0.0
+            s.delete(:distrust_at)
+            s[:distrust_meta] = { reason: 'unknown_outcomes_removed', cleared: true }
+          end
+          s[:window] = known.map do |e|
+            h = e.slice(:training_score, :decision_version, :verdict).merge(judge: e[:judge].to_f.clamp(0.0, 1.0))
             h[:at] = e[:at] if e[:at]
             h[:source] = e[:source].to_s unless e[:source].to_s.empty?
             h[:confidence] = e[:confidence].to_f.clamp(0.0, 1.0) unless e[:confidence].nil?
@@ -1833,9 +1921,21 @@ module PWN
               critic_pass: 'optional - critic pass value consumed by #judge',
               predicted: 'optional - predicted value consumed by #judge',
               proxy_ok: 'optional - proxy ok value consumed by #judge',
-              persist_components: 'optional - write score_components into the learning ledger',
-              verifier_verdict: 'optional - :pass when a deterministic verifier already succeeded',
-              verifier_pass: 'optional - true as a boolean alias for verifier_verdict :pass'
+              persist_components: 'optional - persist the resolved outcome and score components'
+            )
+
+            # Trusted host verifier only: actually check ALL original-request criteria.
+            # PASS prose, exit zero, and single confirmed claims are not substitutes.
+            #{self}.record_verification(
+              request: 'required - exact current session user request',
+              session_id: 'required - session holding the request and verification',
+              checks: 'required - complete Array of {criterion:, passed: Boolean, evidence:}'
+            )
+
+            # Shared verdict and training eligibility; unknown training_score is nil.
+            #{self}.resolve_outcome(
+              outcome: 'required - outcome Hash from the judge or trusted evaluator',
+              critic_pass: 'optional - false records a critic disagreement'
             )
 
             # Run promote to success and return its result