pwn 0.5.723 → 0.5.724

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5ba71758dbd8a3d5231af6489af4c3dd2bd25c0c16df3fd3292b14a77abdf851
-  data.tar.gz: 31c99dda2f5bac281c8ba2b4cc7b7b4493f6c3f09cbbe6788a1067d177ec5ecc
+  metadata.gz: b1c409d6b05e3c061837ef187c74d22ff5e24d361aee4531be0943714a8f713b
+  data.tar.gz: dacfce51246aee0f02c84b5a8eae1651fe2853db2e0f192343c5fc8cfbc5462b
 SHA512:
-  metadata.gz: 5f17d3c8729c22425cfef5b71746c82bc03eaec569b2d470a83e0734a72e8f411bf8542bc302091211f5f6dc578e5fb64b5a72f97fdb2d8d2f4b8f9f7601100d
-  data.tar.gz: 6359d1601fa3cc2f340c3edd8efbe71578c0d580c1c7da6dcc212cd2ab56011455cb10578e11d7be9c359c406b2da5d33a6c1eedaa46f73a5a2a0e59d12c8199
+  metadata.gz: 6c29fd2cde7775f1923249f166af195dcc99ed0614c86536d3aeb56bcc7a3d29a28a3483b1b2c25bb736b2b78b28ab92a0906d690cd71d002ff335c41e1e5d78
+  data.tar.gz: cbcf28e1681df68a21a1da6f247bf645de861ee2a752af2f3735f09f2a59501bdd9d5fb5bf238dcc39ae2734ea173a3d515ddb3df1de2d7548de4fbbb67c5ea7

data/documentation/Policy-Benchmark.md

@@ -18,8 +18,9 @@ bundle exec rubocop scripts/benchmark_policy.rb
 The experiment uses Ruby and its standard libraries; it does not require the
 full application boot sequence. Use a fresh Ruby process, not the live agent
 console. JSON is printed to stdout and optionally written to `--output`.
-`--self-check` runs independent scorer tests and both complete experimental arms;
-it prints a short pass message instead of a report. Use the options separately.
+`--self-check` runs independent scorer tests, both complete experimental arms,
+and two fresh snapshot workers; it prints short pass messages instead of a
+report. Use the options separately.
 The benchmark exits nonzero if persistence changes during evaluation, splits
 overlap, a negative control succeeds, or a positive control fails. Self-checks
 also require actual training updates in the on arm and none in the off arm.
@@ -36,8 +37,9 @@ not `Reward.judge`, model prose, or a previously assigned reward. It calls
 training. This is not a test of Reward's verification-record binding, the live
 Loop, Metrics learning, memory retrieval, or adapter training.
 
-The new `scripts/` directory keeps this experimental driver outside the installed
-CLI and production module tree; no module manifest or generated skill is needed.
+The experimental driver remains in `scripts/`. The opt-in `PolicyEvaluation`
+module launches only this fixed runner; it does not load the live agent in its
+workers. Its module autoload does not enable evaluation or promotion.
 
 ## Protocol
 
@@ -60,6 +62,10 @@ CLI and production module tree; no module manifest or generated skill is needed.
    answer keys to choose actions. Each call writes into a fresh task directory.
    Exact artifact correctness supplies a binary training label to Policy; the
    off arm executes the same work but Policy declines to update.
+   Each call has an explicit action ID. Only after the independent artifact
+   check, `finish` receives a `controlled_comparison` attribution receipt naming
+   that ID. This is a one-action isolated experiment, not a claim that the last
+   action in an arbitrary live trace caused the outcome.
 4. **Held-out evaluation.** Only after training, materialize eight distinct
    held-out inputs with literal answer keys: four numeric and four inventory
    tasks. Assert no training input appears in evaluation. Task families and
@@ -117,6 +123,9 @@ No fixed gains are embedded in the report.
 
 - **Completion:** tasks with at least one objectively successful attempt divided
   by evaluated tasks. A failed attempt does not count as task completion.
+- **Artifact check score:** each attempt earns 1.0 only for an exact correct
+  artifact with unchanged input, otherwise 0.0; phase score is its mean across
+  attempts. Report rows retain the actual artifact body as well as its hash.
 - **False-success count/rate:** attempts claiming `ok: true` without achieving the
   task; rate denominator is executed attempts, not tasks. This is false reporting
   by the handler, not acceptance of that report by the independent checker.
@@ -149,3 +158,139 @@ would undermine the no-network/no-credentials guarantee. A future live-model
 study should use a separately reviewed runner, identical model/tool budgets,
 external objective verifiers, frozen held-out evaluation, and actual provider
 usage records. Do not present this controller experiment as that study.
+
+## Opt-in independent snapshot evaluation (R5)
+
+The original commands and `off`/`on` report shape still work. To additionally
+export snapshots and run repeated evaluations in **fresh subprocesses**, use:
+
+```sh
+ruby scripts/benchmark_policy.rb --heldout \
+  --snapshot-dir /tmp/pwn-policy-snapshots \
+  --output /tmp/pwn-policy-heldout.json
+```
+
+The snapshot directory must be **new**, below `/tmp`, with no symlink parents.
+`off.json` and `on.json` are genuine Policy JSON tables after the same real
+training schedule. Exported `updated_at` metadata is normalized to `null` for
+reproducible snapshot digests; no Q entries or rewards are fabricated. Export
+happens before that arm's evaluation. Neither `--heldout` nor `--snapshot-dir`
+promotes anything or discovers/reads a real home-directory policy.
+
+The added `heldout` array contains protocol `pwn-policy-heldout-v2`, for suite
+indices 0 and 1. Each worker runs three frozen arms: `off` (baseline snapshot,
+policy disabled), `baseline` (baseline enabled), and `candidate` (candidate
+enabled). Workers never call begin/observe/finish, warmup, or reset the caller's
+policy. Resets and snapshot installation occur only inside temporary HOME.
+Only fixed local handlers are registered; no provider, shell tool, credential,
+user config, or network client is loaded. Environment variables, including Ruby
+startup hooks, are removed before spawning Ruby. Workers have a 30-second
+deadline; stalled children are killed and reaped. Snapshot inputs must be regular
+non-symlink files, at most 4 MiB, with valid numeric `q`, `h`, `visits`, `returns`,
+`n_updates`, and `td_abs_sum` fields. Parent directories cannot be symlinks.
+
+Suite indices 0..7 are bounded deterministic variations, **not random trials**.
+Numeric inputs and separate literal answer keys are scaled by `seed + 1`;
+inventory IDs and separate answer keys are offset by `100 * seed`. This does not
+call a candidate algorithm to construct its answer key. Even indices use flat
+paths and compact JSON; odd indices use nested paths containing spaces, pretty
+JSON, and read-only inputs. Every arm runs eight tasks, 16 negative controls and
+eight positive controls. Training fixtures remain unchanged and disjoint.
+These are two task families and two filesystem configurations, not unseen tools
+or broad environment generalization. Both environment types are required for
+promotion eligibility.
+For externally supplied snapshots, `disjoint_inputs` describes the harness's
+fixture sets, not proof of the snapshot's training history; that history is not
+attested by this runner.
+
+Explicit snapshots from another controlled experiment can be evaluated without
+booting the application:
+
+```ruby
+require './lib/pwn/ai/agent/policy_evaluation'
+evaluator = PWN::AI::Agent::PolicyEvaluation
+reports = [0, 1].map do |seed|
+  evaluator.evaluate(baseline: '/tmp/baseline.json',
+                     candidate: '/tmp/candidate.json', seed: seed)
+end
+```
+
+With fixed source revisions and snapshot bytes, snapshot reports reproduce all
+fields except `elapsed_seconds`. They contain no wall-clock timestamps, random
+IDs or temporary paths. The original training report still contains the timing
+and metadata variability described above.
+
+## Explicit promotion and rollback
+
+This is an **operator-invoked local eligibility gate**, not automatic online
+policy promotion. `Policy.finish` and Loop do not call it. The existing online
+learning behavior is not redirected or promoted by this module. No live policy
+path is defaulted, and writes require `enabled: true` **and** `quiescent: true`.
+The latter is an operator assertion: **stop all agent processes and policy
+writers first**. The existing Policy writer does not share a transaction lock
+with this module; concurrent live learning or concurrent promotions are not
+supported. Restart writers only after the operation and readback complete.
+
+Promotion requires 2..8 reports with distinct valid suite indices covering both
+filesystem configurations. It then **reruns each suite in a fresh worker** using
+the specified snapshot bytes. Every non-timing report field must match the fresh
+execution, including source/harness digests, snapshot digests, input hashes,
+artifact bodies and hashes, action choices, scores, controls, and frozen-policy
+checks. Hashes alone are not signatures or evidence of trusted authorship;
+re-execution is the authority. Model-written `passed: true`, edited scores,
+invented artifact bodies, stale source revisions, or copied duplicate reports
+cannot substitute for those executions. Supplied elapsed times are discarded;
+only newly measured times enter the gate.
+
+For **every** repeated suite, compared with both baseline-on and off:
+
+- completion and mean artifact-check score must not decrease;
+- no previously solved individual task may become unsolved (aggregate gains
+  cannot hide a task/family regression);
+- false-success count **and rate**, repeated mistakes and tool calls must not rise;
+- elapsed time must be at most `baseline_seconds * 1.25 + 0.02`, a fixed local
+  jitter allowance rather than evidence of a statistically established speedup.
+
+Each suite must also improve completion, false-success count, repeated mistakes,
+or calls relative to baseline-on. Better training returns, more updates, or a
+timing-only change cannot qualify. The gate fails closed when verification fails.
+Snapshots, source digests and live-baseline bytes must still match. An explicit
+live target must already exist and equal the evaluated baseline byte-for-byte.
+The previous policy is saved beside it as a digest-named rollback JSON before a
+same-directory atomic replacement and exact readback. No trajectory file is
+modified. Preserve the returned receipt for rollback.
+
+A disposable demonstration using the opt-in benchmark output above:
+
+```ruby
+require './lib/pwn/ai/agent/policy_evaluation'
+evaluator = PWN::AI::Agent::PolicyEvaluation
+baseline = '/tmp/pwn-policy-snapshots/off.json'
+candidate = '/tmp/pwn-policy-snapshots/on.json'
+reports = JSON.parse(File.read('/tmp/pwn-policy-heldout.json'), symbolize_names: true).fetch(:heldout)
+live = '/tmp/pwn-policy-demo-live.json' # NOT the real online policy
+File.open(live, File::WRONLY | File::CREAT | File::EXCL, 0o600) { |f| f.write(File.binread(baseline)) }
+receipt = evaluator.promote(enabled: true, quiescent: true,
+                            baseline: baseline, candidate: candidate,
+                            reports: reports, live_path: live)
+raise receipt.inspect unless receipt[:promoted]
+restored = evaluator.rollback(enabled: true, quiescent: true,
+                              live_path: live, receipt: receipt)
+raise restored.inspect unless restored[:rolled_back]
+```
+
+Rollback verifies the receipt's explicit target, backup path and prior digest,
+validates the backup schema, and refuses if the live file no longer matches the
+promoted candidate digest. Missing, altered or symlink backups/targets fail
+closed. Both methods default to a disabled result; rejected operations return
+`promoted: false` or `rolled_back: false` with a reason. `evaluate` raises on an
+invalid snapshot, worker failure, or deadline. Force-killing a worker can leave
+its temporary directory; this is not an OS sandbox for untrusted code.
+
+**Limit:** this gate measures only the fixed benchmark action vocabulary and
+public task families. A real online policy containing unrelated tools may show
+no gain and be rejected; passing does not validate those unrelated routes or
+establish live LLM gains. A production rollout still needs separately reviewed,
+representative objective tasks and operator judgment. Do not interpret this
+small public held-out set as a secret test or optimize repeatedly against it
+and then claim independent generalization.

data/documentation/Reinforcement-Learning.md

@@ -47,10 +47,10 @@ This is the live numeric controller. It does not replace planning.
 
 | Piece | What it is |
 |---|---|
-| State | request kind, task family, plan quality, answer completeness, usable-result, last action, fail bin, and engine |
+| State | request kind, task family, plan quality, answer completeness, usable-result, last action, fail bin, engine, and sanitized host-observed capability/verification scope |
 | Action | tool name, or `final` |
 | Step reward | 0; −0.01 per tool after 8 |
-| Terminal reward | `Reward.judge` × confidence (sole large R). `plan_coverage` is a tag, not the score. |
+| Terminal reward | Resolved training score mapped to −1..1 × confidence (sole large R), attributed only to independently linked actions. `plan_coverage` is a tag, not the score. |
 | Updates | Q-learning (`alpha=0.15`, `gamma=0.85`) and REINFORCE (`alpha=0.05`). Stored trajectories replay twice on warmup so a short table is not empty advice. |
 | Budget | Eight finished episodes (live or warmup-credited) unlock greedy suggestions. Until then the prompt omits them. |
 | Steer | Q-advantage in `Registry.rank` once the episode budget is met; keyword fit and CORE_TOOLS still come first. Suggested actions follow `Registry.preference_order` (`ai.agent.tool_preference`). |
@@ -81,6 +81,58 @@ current session request and invalidated by subsequent tool execution. The API
 trusts the host verifier to cover the complete request; it cannot infer missing
 criteria or automatically verify arbitrary tasks. LLM judgments remain fallible.
 
+### Executed acceptance checks and artifact attribution
+
+For stronger verification, pass a host-owned `verification_contract` to
+`Loop.run`, or use `Reward.run_verification(request:, session_id:, contract:)`.
+The contract contains `root`, `requirements` (distinct verbatim clauses of the
+original request), and `checks`. Each check names its `requirement` and kind:
+
+- `file`: an in-root regular `path` whose bytes equal `expected`.
+- `json`: an in-root regular `path` whose parsed JSON equals `expected`.
+- `command`: a literal `argv`, expected `exit_code` (default zero), and optional
+  expected stdout. Requires `allow_commands: true`.
+- `http`: an exact `url` listed in `allowed_urls`, expected response bytes, and
+  expected `status` (default 200). GET only, with no redirects.
+
+Check failures are negative evidence. Missing requirements, unavailable checks,
+and timeouts stay unknown even if the LLM judge awards a high score. Later tool
+execution invalidates a runner report without falling back to presumed success.
+The runner records output digests, not raw command output or expected values.
+Artifact reads use no-follow descriptors, validate their actual location through
+Linux `/proc/self/fd`, and enforce the byte limit while reading. If descriptor
+location validation is unavailable, the check stays unknown rather than using
+an unsafe pathname fallback.
+The caller must supply the complete acceptance checklist: matching clauses to
+the original text is not semantic proof that the checklist covers every intent.
+
+Commands have a cleared environment, private HOME set to the selected root,
+bounded output and timeout, and process-group cleanup. This is **not an OS
+sandbox**: opt-in commands retain the process's filesystem/network permissions.
+Only run trusted checks, using an external sandbox for untrusted programs.
+
+At the final boundary, Loop executes the contract and publishes a verification
+event through `on_tool`. Around dispatched actions it snapshots declared
+artifact digests. Matching the final checked digest to its last observed writer
+produces an `independent_verifier` attribution receipt. This establishes artifact
+provenance, not universal causal proof. Controlled comparisons in isolated
+evaluation can supply a separate `controlled_comparison` receipt.
+
+Policy distributes the existing terminal reward across uniquely linked action
+IDs. Unlinked actions receive no positive training credit; an accounting-only
+final row retains unattributed terminal reward. Adding successful no-op commands
+does not create more reward. Known per-step cost remains; unknown task outcomes
+still do not train. Ordinary model-judged runs without attribution may retain
+outcome/lesson records, but do not positively reinforce guessed tool contributions.
+
+`Loop.run(trusted_context:)` accepts host observations, not model arguments.
+Policy stores only fixed environment/capability/failure/verification categories;
+state backoff stays within that observed scope. Registry checks declared tool
+prerequisites before ranking, including core tools, so a known absent prerequisite
+cannot be outweighed by a historical success score. Unknown availability is not
+treated as absence. Default local scope observes the Ruby runtime and `/bin/sh`;
+callers must supply observations for remote/container-specific capabilities.
+
 Policy observations also capture allowlisted operation, argument-role/type
 features, and result classification, without retaining raw argument values.
 These condition next-tool ranking only after enough contextual samples exist,

data/etc/default_skills/pwn/ai/agent/policy/SKILL.md

@@ -12,7 +12,7 @@ metadata:
 
 # PWN::AI::Agent::Policy
 
-PWN::AI::Agent::Policy is the LIVE tabular RL controller that pwn-ai did not have before R5. Everything else in the harness is retrieval-plus-policy: scores are written to disk and re-injected as prose, or exported later for optional LoRA. This module is the missing MDP: state s — discretized (kind, task, plan, completeness, usable, last, fail) action a — tool name, or "final" reward r — step: 0 (spam cost −0.01 after 8 tools); terminal: judge × confidence next s' — state after the tool result Each Loop turn is one episode. Transitions land in ~/.pwn/policy_traj.jsonl. Q(s,a) and REINFORCE logits H(s,a) are updated from those tuples and persisted in ~/.pwn/policy.json. The learned Q values are an ADVISORY term in Registry.rank. They never replace TaskSummarizer planning, plan_first, or CORE_TOOLS. Disable with PWN::Env[:ai][:agent][:policy] = false.
+PWN::AI::Agent::Policy is the LIVE tabular RL controller that pwn-ai did not have before R5. Everything else in the harness is retrieval-plus-policy: scores are written to disk and re-injected as prose, or exported later for optional LoRA. This module is the missing MDP: state s — discretized (kind, task, plan, completeness, usable, last, fail) action a — tool name, or "final" reward r — step: 0 (spam cost −0.01 after 8 tools); terminal: judge × confidence next s' — state after the tool result Each Loop turn is one episode. Trusted environment/prerequisite bins scope fallback history; independently evidenced terminal attribution uses isolated action targets, not future-return credit for busywork. Transitions land in ~/.pwn/policy_traj.jsonl. Q(s,a) and REINFORCE logits H(s,a) are updated from those tuples and persisted in ~/.pwn/policy.json. The learned Q values are an ADVISORY term in Registry.rank. They never replace TaskSummarizer planning, plan_first, or CORE_TOOLS. Disable with PWN::Env[:ai][:agent][:policy] = false.
 
 ## When to use
 
@@ -34,6 +34,8 @@ PWN::AI::Agent::Policy.state(opts)
 ## Public methods
 
 - `state`
+- `observed_state`
+- `observed_context`
 - `cold`
 - `warm`
 - `episode_budget_met`

data/etc/default_skills/pwn/ai/agent/policy_evaluation/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: pwn-ai-agent-policyevaluation
+description: Drive PWN::AI::Agent::PolicyEvaluation from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::Agent::PolicyEvaluation
+  source: pwn/ai/agent/policy_evaluation.rb
+---
+
+# PWN::AI::Agent::PolicyEvaluation
+
+Opt-in, fixed local held-out evaluation. Never loaded by the online loop.
+
+## When to use
+
+Call `PWN::AI::Agent::PolicyEvaluation` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/policy_evaluation.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::Agent::PolicyEvaluation.help
+PWN::AI::Agent::PolicyEvaluation.evaluate(opts)
+```
+
+## Public methods
+
+- `evaluate`
+- `authors`
+- `promote`
+- `rollback`
+- `help`
+
+## Source
+
+`pwn/ai/agent/policy_evaluation.rb`
+
+## Verification
+
+`PWN::AI::Agent::PolicyEvaluation.respond_to?(:evaluate)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/registry/SKILL.md

@@ -44,8 +44,10 @@ PWN::AI::Agent::Registry.register(opts)
 - `discover`
 - `eager_load`
 - `selftest`
+- `available`
 - `authors`
 - `help`
+- `available?`
 - `eager_load!`
 
 ## Source

data/etc/default_skills/pwn/ai/agent/reward/SKILL.md

@@ -35,6 +35,7 @@ PWN::AI::Agent::Reward.judge(opts)
 
 - `judge`
 - `resolve_outcome`
+- `run_verification`
 - `record_verification`
 - `promote_to_success`
 - `prm`

data/etc/default_skills/pwn/ai/agent/verification/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: pwn-ai-agent-verification
+description: Drive PWN::AI::Agent::Verification from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::Agent::Verification
+  source: pwn/ai/agent/verification.rb
+---
+
+# PWN::AI::Agent::Verification
+
+Explicit host-owned acceptance checks, not a model-facing tool.
+
+## When to use
+
+Call `PWN::AI::Agent::Verification` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/verification.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::Agent::Verification.help
+PWN::AI::Agent::Verification.run(opts)
+```
+
+## Public methods
+
+- `run`
+- `snapshot`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/ai/agent/verification.rb`
+
+## Verification
+
+`PWN::AI::Agent::Verification.respond_to?(:run)` after the
+module is loaded. Read the source for parameter names.

data/lib/pwn/ai/agent/learning.rb

@@ -713,6 +713,7 @@ module PWN
             Policy.finish(
               session_id: session_id,
               score: v[:training_score],
+              attribution: v.dig(:verification, :runner_version) == 1 ? v.dig(:verification, :attribution) : nil,
               confidence: v[:confidence],
               verdict: v[:verdict],
               proxy_ok: ok,

data/lib/pwn/ai/agent/loop.rb

@@ -1096,6 +1096,8 @@ module PWN
           Policy.finish(
             session_id: opts[:session_id],
             score: opts[:score],
+            confidence: opts[:confidence],
+            attribution: opts[:attribution],
             verdict: opts[:verdict],
             proxy_ok: opts.fetch(:proxy_ok, false),
             final: opts[:final],
@@ -1126,9 +1128,12 @@ module PWN
             rescue JSON::ParserError
               nil
             end
+            observed_context = opts[:trusted_context].merge(failure_category: sem[:semantic_ok] ? 'none' : sem[:shape].to_s) if opts[:trusted_context].is_a?(Hash)
             Policy.observe_step(
               session_id: opts[:session_id],
               action: name,
+              action_id: opts[:action_id],
+              trusted_context: observed_context,
               args: policy_args,
               result_type: sem[:shape],
               ok: sem[:semantic_ok],
@@ -2736,6 +2741,7 @@ module PWN
           on_tool = opts[:on_tool]
           i = 0
           tools_called = 0
+          verified_actions = []
           engine_s = 0.0
           final_chars = 0
           start_debug_session(opts)
@@ -2843,11 +2849,17 @@ module PWN
           # R5 — open the live MDP episode BEFORE the first Registry.rank so
           # Q(s,a) can advise this turn. Planning still owns the task list.
           if defined?(PWN::AI::Agent::Policy) && Policy.respond_to?(:begin_episode)
+            observations = opts[:trusted_context] || {
+              environment: 'local', capabilities: { ruby: true, shell: File.executable?('/bin/sh') },
+              verification_state: opts[:verification_contract] ? 'pending' : 'unknown'
+            }
+            trusted_context = Policy.observed_context(trusted_context: observations)
             Policy.begin_episode(
               session_id: session_id,
               request: request,
               intent: intent,
               engine: engine,
+              trusted_context: trusted_context,
               ts_state: ts_state
             )
           end
@@ -2866,6 +2878,7 @@ module PWN
           tools = Registry.definitions(
             enabled: opts[:enabled_toolsets],
             relevance: request,
+            trusted_context: trusted_context,
             core_only: core_only,
             intent: intent
           )
@@ -2961,7 +2974,8 @@ module PWN
               # Refresh exposure for the next hop without widening its scope
               # or substituting a generated goal for the original request.
               if tools_called.positive?
-                tools = Registry.definitions(enabled: opts[:enabled_toolsets], relevance: request, core_only: core_only, intent: intent)
+                tools = Registry.definitions(enabled: opts[:enabled_toolsets], relevance: request, core_only: core_only, intent: intent,
+                                             trusted_context: Policy.current_episode&.dig(:trusted_context) || trusted_context)
                 no_tools = Array(tools).empty?
                 Thread.current[:pwn_loop_no_tools] = no_tools
               end
@@ -3079,13 +3093,21 @@ module PWN
                   next
                 end
               end
+              verification_outcome = nil
+              if opts[:verification_contract]
+                report = Reward.run_verification(request: request, session_id: session_id, contract: opts[:verification_contract].merge(actions: verified_actions))
+                verification_outcome = Reward.resolve_outcome(outcome: { score: nil, source: :verification, verification: report })
+                on_tool&.call('verification', {}, JSON.generate(report))
+              end
               debug_progress(msg: "final accepted chars=#{text.to_s.length}")
               quiet_debug_tui!(reason: 'final')
               debug_final_text!(text: text)
               final_chars = text.to_s.length
               append_session(session_id: session_id, role: 'assistant', content: text)
               Learning.auto_introspect(session_id: session_id, request: request, final: text, predicted: predicted, ts_state: ts_state) if defined?(Learning) && !nested && !no_tools && should_auto_introspect?(local: local, turn_fails: turn_fails, iter: i)
-              maybe_finish_policy(session_id: session_id, proxy_ok: true, ts_state: ts_state)
+              maybe_finish_policy(session_id: session_id, proxy_ok: true, ts_state: ts_state,
+                                  score: verification_outcome&.dig(:training_score), confidence: verification_outcome&.dig(:confidence),
+                                  verdict: verification_outcome&.dig(:verdict), attribution: verification_outcome&.dig(:verification, :attribution))
               task_summary_flush!(state: ts_state, on_tool: on_tool)
               OpenGoal.clear! if defined?(OpenGoal) && !nested
               return text
@@ -3113,6 +3135,7 @@ module PWN
               argv_s = args.is_a?(String) ? args.to_s : args.inspect
               debug_progress(msg: "tool #{name} start:\n#{argv_s}", keep_newlines: true, cap: 0, tee: nil)
               sig = payload_sig(name: name, args: args)
+              before_artifacts = Verification.snapshot(opts[:verification_contract]) if opts[:verification_contract]
               if Thread.current[:pwn_extinguished].is_a?(Hash) && Thread.current[:pwn_extinguished][sig]
                 raw = no_progress_result(name: name, args: args)
               else
@@ -3121,7 +3144,13 @@ module PWN
                 raw = checkpoint_result(name: name, args: args) if same_n >= 3
               end
               tools_called += 1
-              tele    = record_metrics(name: name, started: started, raw: raw, args: args, session_id: session_id, engine: engine, ts_state: ts_state)
+              if opts[:verification_contract]
+                after_artifacts = Verification.snapshot(opts[:verification_contract])
+                changes = after_artifacts.reject { |path, digest| before_artifacts[path] == digest }
+                verified_actions << { action_id: tc[:id], artifacts: changes }
+              end
+              tele    = record_metrics(name: name, action_id: tc[:id], trusted_context: Policy.current_episode&.dig(:trusted_context) || trusted_context,
+                                       started: started, raw: raw, args: args, session_id: session_id, engine: engine, ts_state: ts_state)
               result  = Result.condition(content: raw, entry: entry)
 
               unless tele[:ok]
@@ -3285,6 +3314,8 @@ module PWN
               enabled_toolsets: 'optional - subset of Registry.toolsets, or nil for all',
               on_tool: 'optional - ->(name, args, result) callback for live UI',
               system_role_content: 'optional - override default system prompt (built from session_id if not provided)',
+              verification_contract: 'optional - host-owned Verification.run checks; execute at final boundary and attribute observed artifacts',
+              trusted_context: 'optional - host-observed capability/prerequisite scope; never copied from model arguments',
               debug: 'optional - debug value consumed by #run',
               from: 'optional - sender account or address to bind as operator',
               account: 'optional - operator account id to bind',