samagotchi 0.125.0 → 0.126.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d36716e229ef5ccac918c840a3b55d878257811aeffdf594d2588c3bf067533
-  data.tar.gz: fb632ff225b0a9f5dfbbc869ce8df2842df811b6858caa3d714362879a3e4287
+  metadata.gz: 2704d1d3f6cb8fa560e7f903ac58ac12d468fcd006b2a8782dcea02aede223a8
+  data.tar.gz: 49f91663fa29e4f77b41dae067efe8bba85917eef2682f1911af7ed7225db8fd
 SHA512:
-  metadata.gz: d16837760eae98a5f26bef1349f70d6fecf80b2400858d2fab12d0a39b11cb5ed125901b21e99bede021585cd9ad60c44adb6a3dad0416a7c4302ebaed459950
-  data.tar.gz: 8210416816fda4da83f18801d6e2b991335c41054cfd5459361c9b478d5c633a02ac58855d9f77520d05269c2f64e004cd600c7e56b36ac12d71efe612965430
+  metadata.gz: 0f2ed298f6d733e3f90e926b2124348c40fc119c934106d9661aa3fdb0cfd060535263516d31789ee5be3a043abe3a4c3c844754323d6bdf9e44e527587739b4
+  data.tar.gz: e3d1196a4881d05ae6fcc9f94700cc4e180a024b9d725de02baa42de3d46ae1b78146a8493aa5b42c707919476f410d23e059e9df24e3d9c1fa955362921afe3

data/CHANGELOG.md

@@ -7,6 +7,29 @@ and commands may change between minor versions. How releases are made:
 [docs/releasing.md](docs/releasing.md).
 ## [Unreleased]
 
+## [0.126.0] - 2026-10-27
+
+### Added
+
+- chi web places each completed Verify verdict on its source claim, links to the checking turn, and sends a phone
+  notification with the verdict and a short reason (including for short turns).
+- **Verify fresh** on an unclear verdict's card (owner or participant): a new agent checks the claim in the session's
+  folder with none of its context; its verdict lands on the same card. A participant's runs under their own access
+  and spend cap.
+
+### Changed
+
+- A pair participant's page header reads "<name> · pairing" instead of "<name>'s review", and its tools overview's
+  disclosure triangle matches the text's size.
+
+### Fixed
+
+- The known-names hook lets through a protected name's CamelCase form (`CoffeeAssistant` or `coffeeAssistant` for a
+  repo named `coffee_assistant`) instead of rejecting it as a misspelling; `coffee-assistant` and `coffeeassistant`
+  are still caught.
+- The known-names hook ignores separators at a word's start or end, so `grep coffee_assistant-` or
+  `.coffee_assistant` is no longer rejected as a misspelling; `mode: correct` keeps those separators.
+
 ## [0.125.0] - 2026-10-27
 
 ### Added
@@ -4740,7 +4763,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.125.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.126.0...HEAD
+[0.126.0]: https://github.com/dm1try/samagotchi/compare/v0.125.0...v0.126.0
 [0.125.0]: https://github.com/dm1try/samagotchi/compare/v0.124.0...v0.125.0
 [0.124.0]: https://github.com/dm1try/samagotchi/compare/v0.123.0...v0.124.0
 [0.123.0]: https://github.com/dm1try/samagotchi/compare/v0.122.0...v0.123.0

data/docs/guardrails.md

@@ -452,6 +452,28 @@ can send out in a URL), plugin and MCP tools, `memory_read` and `context_read`,
 does that the command checks don't read (a script file's body, an interpreter's
 `-e` code). Share a working session only with people you would let type in it.
 
+## A Verify fresh child's boundary
+
+A [Verify fresh](internals/participants.md#what-a-participant-sees) child (a
+delegate child chi web starts for an unclear verdict) runs a participant's
+check under **the boundary that participant has in the parent**. A verdict a
+participant recorded is always checked again as them, even when the owner
+clicks (the claim is their text; their link must still be live), so it never
+runs with the owner's rules or System 1's auto-allows. The mode is decided once,
+at the start, from their grant's mode there (`ParticipantMode.live_for`) and
+saved on the child (`verify_fresh.mode`): `review` keeps every turn of it
+inside `ReviewBoundary` (read only), `pair` inside `PairBoundary`.
+`GuardrailWiring#turn_mode` reads the saved mode and never looks it up again,
+and every turn of the child carries the participant as its author, whoever
+started it, so the boundary can't fall away for a turn the owner typed into it
+or for an author lookup that finds nobody (the child has no
+`participants.json`; revoke and cap read the parent's). It fails closed: a
+`verify_fresh` field that doesn't read is a participant nobody has, under
+review, whose turns are refused. `ChildBoundary` applies on top, as for every
+delegate child, and its asks go to the owner (once only, as a participant's
+do; System 1 skips them). The owner's own fresh child is an ordinary delegate
+child: the owner's turns, `ChildBoundary`.
+
 ## Rules in config.yml
 
 ```yaml

data/docs/internals/participants.md

@@ -315,7 +315,8 @@ fields: a field added to an event later reaches nobody until it is named there.
 - **Events** (`.event`, the stream). `EVENTS` names the types a participant gets, each rebuilt by its own method:
   `turn_started` (turn id, its wall time `at`, the author and name, `mine` for their own, the prompt only when a person sent the turn:
   `ClientId.human?`, else `automatic`; `continue`), the turn's end (`turn_completed`, `turn_canceled`, `turn_failed`:
-  type and turn id), `generation_chunk` (its visible `text` only; a thinking-only chunk is dropped),
+  type and turn id; `turn_completed` may also carry an allowlisted verdict card), `generation_chunk` (its visible
+  `text` only; a thinking-only chunk is dropped),
   `generation_retrying` (`restarted`), `tool_call_started` (the tool's name, and for a file tool the path relative to
   the session's folder when it is inside it; never when that folder is home or `/`), `tool_call_completed` (its status word), and bare markers (the type
   alone) for the queue (`turn_enqueued`, `turn_dequeued`, `input_merged`), the owner's question, approval or Continue
@@ -414,6 +415,72 @@ fields: a field added to an event later reaches nobody until it is named there.
   cookie is one name: a second participant link redeemed there replaces the first), and **the owner opening a
   participant's invite link** in their own browser swaps their owner cookie for that grant (the page asks first). A
   continue archives the session and revokes its grants: re-share, and links to the old session stay on it.
+- **Verify verdict cards** (`verdict_card.js`). The built-in Verify preset carries the selected source turn id and quote
+  with the submitted turn, without changing its prompt text. A completed Verify reply whose final non-empty line has
+  a valid `Verdict: confirmed|refuted|unclear — <reason>` appends a verdict to the session. Both pages place its card
+  after the source turn, name its author, show the reason and quote, and link to the checking turn; a live completion
+  adds the card without a reload. The participant view receives only the card fields through its allowlist, with the
+  quote and reason redacted by the view's normal rules, never the full reply.
+- **Verify fresh** (`VerifyFresh`, `verdict_fresh.js`). An `unclear` card has a **Verify fresh** button (the owner's
+  page always; a participant's while `can_comment`, i.e. while their grant could run a turn now; never in the owner's
+  participant view). It is `POST /api/sessions/:id/verdicts/:check_turn_id/fresh` (`VerifyFreshRoutes`, `:owner`
+  and `:participant`), which starts a **fresh child**: a delegate child (`spawn_session`, `delegate: true`,
+  `parent_id`) in the session's own folder (no worktree; a folder outside git too), on its model, whose first and only
+  prompt is the claim, quoted, and "Verify this claim against the files here. You have none of the original session's
+  context. End with a line `Verdict: confirmed|refuted|unclear — <one-line reason>`." No parent history. Its first
+  turn is a Verify turn on the same anchor, so its verdict is parsed. Refused: a verdict the session doesn't have (404
+  `not_found`; a fresh verdict itself is never the target, its original is), one that isn't unclear (409
+  `not_unclear`), and, checked together under `verify_fresh.lock`: a fresh check of that verdict still running (409
+  `fresh_running`), a fresh child of the same requester still running (409 `fresh_busy`: one at a time per
+  participant, and one for the owner; each start passes the cap on saved spend, so parallel children would multiply
+  it), and the parent already running `session.max_children` children of any kind (409 `children_full`, so fresh
+  checks never crowd out the owner's own delegates). For a participant also what refuses their turn: their cap (429
+  `cap_reached`, counting their fresh children) and a live worker that predates participants' turns (409
+  `review_unavailable`). A start that involves a participant is audited in the parent's trail (`verify_fresh`:
+  `participant` whose child it is, `asked_by` the clicking participant's id or `owner`, `of`, `status`, the child and
+  mode, or the reason); the answer is `{of, running: true}`, the owner's with `child_id` too.
+  - **Whose child it is.** A verdict a participant's turn recorded (`by: p:<id>`) is checked again **as that
+    participant**, whoever clicks, the owner included: the claim is their text (the quote their Verify turn sent),
+    so it never runs with the owner's power (the owner's rules, System 1's auto-allows). Their grant must still be
+    live in this session, else 409 `author_link_ended` ("Sam's link has ended: …"), and their cap and the worker's
+    features are checked as for their turn (a participant who clicks passes their own checks first). An owner's
+    verdict (`by` none) is checked again as whoever clicks: an owner's child for the owner, the clicking
+    participant's own for a participant.
+  - **The child is its requester's.** Its session file carries `verify_fresh: {author, mode, of, anchor}`
+    (`VerifyFreshOrigin`), saved before its worker starts. `author` is the participant's (`p:<id>`), none for the
+    owner. `mode` is the participant's grant's mode in the parent at that moment (`ParticipantMode.live_for`:
+    `pair` only for a grant stamped to act in a working session whose worker runs pair turns, else `review`). Every
+    turn of a participant's child is theirs, whoever starts it (the owner typing into it, a continue, a reminder):
+    `VerifyFreshOrigin#origin_for` sets the author in `Engine#begin_turn` and in the worker, so their boundary
+    (`GuardrailWiring#turn_mode` reads the saved mode, never a lookup), their System 1 skip, their once-only asks to
+    the owner and the stamps on their messages follow. The child has no `participants.json`: its participant lookups
+    (`Session#participants_source_id`) read the parent's, so a revoke, an expiry or the parent's archive refuses the
+    child's next turn and stops a pair turn mid-turn, as in the parent; their audit lines go to the parent's
+    `participants.jsonl`. A field that doesn't read is `VerifyFreshOrigin::INVALID`: a participant author nobody
+    has, under review, so its turns are refused, never run as the owner's. Its approvals wait on the child for the
+    owner (D2); the owner's page links to it.
+  - **What follows from that.** The owner typing into a participant's child is that participant's turn: charged to
+    their cap and run under their boundary (open an ordinary session to act with the owner's own). A revoke (or an
+    expiry, or the parent's archive) stops a pair-mode child mid-turn, as a pair turn; a review-mode child finishes
+    the turn it is in and is refused at its next turn's start, as a review turn. A continue of the parent archives it
+    (and revokes its grants) and moves a running fresh child to the new link with the other open delegates: the
+    turn it is in still forwards its verdict to the archived link (the parent it started under), which shows it
+    there, and its next turn is refused (its requester's grant isn't on the new link). Nothing reaches the new link's
+    card: fails closed.
+  - **Spend.** The parent's `verify_fresh.jsonl` (one line per child: `child_id`, `of`, `author`, `at`) is the
+    rollup's index: a participant's cap check in chi web (`#participant_saved_spend`), their usage line, and the
+    worker's (`Worker#participant_spend`) add their fresh children's saved spend (`VerifyFresh.children_spend`); a
+    child's worker adds the parent's saved spend and its siblings'. A child's spend counts from its turns' ends, as
+    a turn's does.
+  - **The verdict lands on the card**, never in the parent's conversation: the child's worker writes each verdict
+    its turn recorded into the parent's `fresh_verdicts/<check turn>.json` (`fresh: true`, `of`, `child_id`) after its
+    save, and a fresh child never rings its parent (no delegate report, `ChildRing.ring`). The parent's worker takes
+    them into its `verdicts` between turns (`Worker#absorb_fresh_verdicts`), saves, deletes the files and announces
+    `:verdict_recorded`; chi web shows the ones still waiting (`VerifyFresh.verdicts_of`: the summary, the review
+    data). The card shows "Verifying fresh…" while the child runs (the summary's `verify_fresh` `{of, child_id}`,
+    the review data's `fresh_running`, ids only) and the fresh verdict as a `fresh: ✅ confirmed — …` line on the same
+    card. The participant view passes `fresh` and `of`, never the child's id (a participant can't open it). No push
+    for a fresh verdict yet (`Attention` pushes a verdict at a turn's end).
 - **The comment box** is the owner's composer (`composer_mount.js`, styled by the shared `composer.css`), mounted by
   `participant.js` with a subset on. It has: the height that grows with the text, the grip (drag to resize,
   double-click resets, click or drag down folds it; folded, the grip is the handle on the dock's edge and typing on the
@@ -532,7 +599,8 @@ invited to has none: its files stay byte for byte as they were.
   remembered and audited; or `what: command`, a participant's `/word` or
   `!line` the Bridge or the worker refused), `turn` (chars, `status: accepted` with its enqueued id, or `refused` with
   the reason: `not_permitted`, `too_many_turns`, `cap_reached`, `review_unavailable`, `worker_timeout`), `cap` (a new
-  cap). It goes with the session (retention, delete).
+  cap), `verify_fresh` (`of`, `status`, the child and mode or the reason). A Verify fresh child's participants' lines
+  are its parent's. It goes with the session (retention, delete).
 - **`participants.lock`** (0600, empty): the lock a participant's turn file is counted and written under when no
   worker runs ([Turns](#turns)).
 

data/docs/internals/web-push.md

@@ -1,7 +1,8 @@
 # Web Push (internals)
 
 chi web pushes to the owner's phone when a session needs them, for what the tab notifies for: an approval, a
-question, a step-limit question, a card with actions, a failed turn, and (per device, off by default) a done one. The
+question, a step-limit question, a card with actions, a failed turn, a recorded Verify verdict, and (per device,
+off by default) a done one. The
 phone runs chi web as a Home Screen app (iOS 16.4+), its bell subscribes the device, and chi web, the only sender,
 pushes through the device's push service (Apple's `web.push.apple.com`). The user side is in
 [configuration.md](../configuration.md#phone-notifications-web-push). This page is how it is built (P1, P2a and P2b of the
@@ -146,17 +147,20 @@ the top and in `pending_question` / `pending_card`, strings in `last_turn`), `no
      3.5 s (notify.js `RELAY_HOLD_MS`): its parent may relay it.
   2. a new `pending_card` id: `card`, key `"<sid>:card:<cid>"`.
   3. a top-level turn whose `last_turn["ended_at"]` changed (a delegated child's is its parent's to report):
-     `failed`, or `done` when `completed` and `seconds` ≥ `DONE_MIN_SECONDS` 10 or its origin is in
-     `UNWATCHED_ORIGINS` (`delegate_report`, `context`, `task`); key `"<sid>:<ended_at>"`. A reminder turn follows
-     the same rules (no reminder event of its own).
+     a newly recorded verdict is `verdict`, keyed by `"<sid>:<check_turn_id>"`; otherwise `failed`, or `done` when
+     `completed` and `seconds` ≥ `DONE_MIN_SECONDS` 10 or its origin is in `UNWATCHED_ORIGINS`
+     (`delegate_report`, `context`, `task`), keyed by `"<sid>:<ended_at>"`. A verdict wins over the done/no-event
+     rule, including for a short turn. A reminder turn follows the same rules (no reminder event of its own).
 - `WAITING` (approval, question, continue, card) are the reasons that stay open until answered: badged, in `open`,
-  cleaned up, and pushed only while still open. A failed or done turn has nothing to answer.
+  cleaned up, and pushed only while still open. A failed, done or verdict turn has nothing to answer.
 - `Attention.closed_keys(prev, next)`: the question answered, replaced, newly relayed; the card resolved or
   replaced; both when the session is gone.
 - `Attention.text(summary, reason)`: notify.js `attentionText`'s words: the session's name as its card has it
   (title, auto title, the recap's first sentence, first preview, last prompt — the same order `format.js cardName`
   uses) clipped to 61, and "needs approval" / "needs an answer" / "hit its step limit" / "needs you" / "turn
-  failed" / "done in N s" (`last_turn["seconds"]` rounded). Never the question or the command.
+  failed" / "done in N s" (`last_turn["seconds"]` rounded) / "<who>: <icon> <verdict> — <reason>" (reason clipped
+  to 120 characters). A verdict names its participant from the session's participant sidecar, or says "You" for the
+  owner; only verdicts use that push copy, never the full reply. Never the question or the command.
 
 `Notifier#call(event)` is a `SessionHub` sink. **The hub calls it under its Monitor**, from the tick thread and also
 from chi web's request threads (`SessionHub#touch`, from the stop/archive/delete routes), so it only enqueues: a push

data/docs/sessions.md

@@ -4,6 +4,8 @@ Sessions are plain files — no DB. Each session is `~/.local/state/samagotchi/s
 
 **Message times:** an entry of `messages` may carry `at`, when it happened: a local-offset ISO time with milliseconds (`2026-10-24T14:32:05.120+02:00`). User prompts, lines merged into a turn and steers, reminders, context and task notes, and the model's replies have one (a note's is its `created_at`); tool results, `!cmd` messages and chi's own turn notes don't, nor does anything saved before chi stamped messages (no backfill). It is for the UIs only (the gap dividers, a bubble's time): it never goes to the model, so it changes nothing in the requests or their prompt cache. The one time the model reads is the reminders': due reminders go into a turn as a system message headed `[SYSTEM: REMINDERS DUE 2026-10-24 14:32 local]` (the turn's local time; `ReminderQueue#inject!`), written into the saved content then, so a later request sends the same text.
 
+**Verify verdicts:** a web Verify turn stamps its opening user message with `verify: {turn_id, quote}` (the selected source turn and quote; metadata only, never added to the prompt). When that turn completes and the final assistant reply's last non-empty line is a valid `Verdict: confirmed|refuted|unclear — <reason>`, the session file appends `{anchor: {turn_id, quote}, verdict, reason, by, check_turn_id, at}` to its optional `verdicts` array. `by` is the turn's author (nil for the owner), `check_turn_id` names the Verify turn, and `at` is its timestamp. The array is append-only; older files without it have no saved verdicts. An `unclear` verdict can be checked again by **Verify fresh** (a delegate child that gets only the claim; see *Delegating*): its verdict is appended to the parent's `verdicts` with `fresh: true`, `of` (the verdict it checked again) and `child_id`, from the parent's `fresh_verdicts/` dir, which its worker takes between turns. Verdicts are display state: none enters a prompt.
+
 **Input files:** a message for a session's worker waits in `input/<timestamp>.json` (`SessionInbox.write_input`: `prompt`, `client_id`, `enqueued_id`, and `images`, `no_interrupt` and `delivery` when they apply; `delivery` is written only for `"queue"`). While a turn runs, the worker merges them at each step boundary in name order, except a queued one or one with images: those wait for the turn's end and run one turn each, in name order, and a file after them still merges (`Worker#pending_input_drain`). A queue is sent only to a worker whose `bridge.json` names the `delivery` feature; an older one would steer it, so `SessionManager.deliver_turn` refuses it (409 `delivery_unavailable`), and any other 4xx the Bridge answers is a refusal too, never a fallback file (except a 413, a body over its size limit: that one still goes in as a file, its `delivery` kept). A session command recognized in a file runs without a turn; its outcome is kept at `input/settled/<enqueued_id>` (`completed`, `failed` for a command error, `canceled` with `cancel_reason` `busy` or `dropped` for one refused mid-turn or dropped as the worker left; `origin: command`) so `chi send --wait` ends instead of waiting for a turn that will not run, its detail saying `the command failed` or `the command was refused (busy)` rather than a turn's words. **Reply files:** a turn that ends with visible text leaves its reply in `output/<timestamp>.txt`, or `output/<timestamp>-<enqueued_id>.txt` when the turn ran an input file with an id (`SessionInbox.write_output`), and the session's `last_turn` keeps that `enqueued_id`; so a wait for one queued message (`chi send --queue --wait`, `ReplyWait`'s `turn:`) finds its own turn's reply or end, never another turn's. The names still sort by time, and every reader takes `*.txt`.
 
 **Removing a queued message:** a message queued for after the running turn (`chi send --queue`, the web's Alt+Enter, `/queue TEXT` in a terminal), or one with images (it waits for the turn's end too), can be taken back while it still waits: the worker's Bridge (`POST /session/:id/turn/dequeue {enqueued_id}`, the `unqueue` feature) deletes its input file and every UI drops it (`:turn_dequeued`). It is a race with the turn's end, decided by the same rename the worker uses to take the file: once a turn took it the answer is `409 already_started` (it runs), and an id the worker no longer knows is `404 unknown_enqueued_id`. A plain message sent without `--queue` is not removable (`409 not_queued`): a running turn's next step may take it at any moment. A wait for its turn (`chi send --queue --wait`, a delegate follow-up's wait) ends at once with `removed` (the tombstone `input/removed/<enqueued_id>` says so), and a `chi -p` run whose queued prompt went ends with exit 1. The `200` carries the removed `prompt`: the web and the attached terminal put it back into the composer to edit (not its images). The images a removed message named stay in the session's `images/`. Not removable: a queued session command (`/queue /model x`: it waits in the worker, not in `input/`), a message in a stopped worker's inbox (the next worker runs it), and the plain REPL's (`--no-shared`) own queue.
@@ -384,6 +386,7 @@ The `delegate` tool hands a task to a **child session**: an ordinary chi session
 - Every child starts with the shipped `delegated` system memory preloaded (`preloaded_memory_names: ["system/delegated"]`; `--mute delegated` would hide it): put everything in the final reply, don't delegate further, don't write memories or change config, stay in the folder. Its system prompt also says `Delegated by session <parent id>`. The parent's own `--mute` list does not carry over.
 - **A child asks before it changes anything outside its folder** (the work tree top of the folder it started in): a write or edit there, mutating git in another checkout, a command that isn't read-only run from outside it or naming the main checkout or a sibling worktree. It's a core guardrail, on in every mode and without the guardrails bundle, and answered once or for the child's session ([Guardrails](guardrails.md#a-delegate-childs-boundary)); the approval relays to the parent's user as any other.
 - Limits: a child cannot `delegate` (depth 1; the tool refuses), and one session may have at most `session.max_children` (default `4`, env `SAMAGOTCHI_SESSION_MAX_CHILDREN`) children running at a time, counted from the session files (a finished or idle-exited child does not count; one whose worker is still starting does, for 15 s). A refused call creates no session. Nothing stops children with the parent: `chi sessions stop ID` does.
+- **Verify fresh children** (a web card's Verify fresh, [Participants: Verify fresh](internals/participants.md)) are delegate children chi web starts, not the model: in the parent's own folder, with only the claim as their task and none of the parent's history. Their session file carries `verify_fresh: {author, mode, of, anchor}`; a participant's child runs every turn as that participant's (their boundary, saved at the start; their cap, counted with the parent's spend; the parent's `participants.json`). One never rings its parent: its verdict goes to the parent's verdict card (`fresh_verdicts/`), not its conversation, and the parent's `verify_fresh.jsonl` lists them for the spend rollup and the running check (one per verdict at a time). They count among the parent's `session.max_children` while they run.
 - The link is the session's `parent_id`, written before the worker starts, so a respawn keeps it (and `delegate: true`, which a fork's `parent_id` doesn't come with; a child saved before that field is known by its `system/delegated` memory); `GET /api/sessions`, `/api/sessions/:id` and the web hub's `session` frames carry it and `delegate` (a fork is `false`; the web parent's children chip counts delegates only); `SessionManager.children_of` lists a parent's children.
 ## Restart fallback
 

data/lib/samagotchi/bridge.rb

@@ -1071,6 +1071,7 @@ module Samagotchi
       # request's principal; the Bridge is loopback and trusts its caller).
       author = fetched(parsed, "author")
       author = nil unless author.is_a?(String) && !author.empty?
+      verify = VerifyAnchor.from(fetched(parsed, "verify"))
       if sid.to_s.strip.empty? || prompt.to_s.strip.empty?
         return [{ "Allow" => "POST" }, 400,
                 { error: "missing_fields", detail: "session_id and prompt are required" }]
@@ -1132,7 +1133,7 @@ module Samagotchi
         delivery = Delivery::QUEUE if @accumulator.participant_turn?
         queued_behind_turn = Delivery.queue?(delivery) && !@accumulator.current_turn.nil?
         enqueue_turn(prompt: prompt, client_id: client_id, enqueued_id: enqueued_id,
-                     no_interrupt: no_interrupt, images: images, delivery: delivery, author: author).tap do |ok|
+                     no_interrupt: no_interrupt, images: images, delivery: delivery, author: author, verify: verify).tap do |ok|
           next unless ok
 
           enqueued_event = { type: :turn_enqueued, enqueued_id: enqueued_id, client_id: client_id, prompt: prompt.to_s }
@@ -1296,9 +1297,9 @@ module Samagotchi
 
     # Write a turn into this session's input dir, reusing the file IPC the
     # worker polls. Never calls run_turn across the boundary.
-    def enqueue_turn(prompt:, client_id: nil, enqueued_id: nil, no_interrupt: false, images: [], delivery: nil, author: nil)
+    def enqueue_turn(prompt:, client_id: nil, enqueued_id: nil, no_interrupt: false, images: [], delivery: nil, author: nil, verify: nil)
       SessionInbox.write_input(session_dir, prompt: prompt, client_id: client_id, enqueued_id: enqueued_id,
-                                            no_interrupt: no_interrupt, images: images, delivery: delivery, author: author)
+                                            no_interrupt: no_interrupt, images: images, delivery: delivery, author: author, verify: verify)
     end
 
     # ── HTTP plumbing ────────────────────────────────────────────────────────

data/lib/samagotchi/bridge_client.rb

@@ -14,6 +14,10 @@ require_relative "bridge_client/event_stream"
 require_relative "bridge_client/stream_request"
 
 module Samagotchi
+  # Loaded on first use (a Verify turn): keeps the bundle test kit's load
+  # budget (spec/samagotchi/testing/sandbox_spec.rb).
+  autoload :VerifyAnchor, File.expand_path("verify_anchor", __dir__)
+
   # Client side of a session worker's Bridge: the 127.0.0.1 HTTP + SSE server
   # each SessionManager worker runs for its Engine (see Bridge). Discovery goes
   # through WorkerLink (the worker's `bridge.json` sidecar, WorkerSidecar, in
@@ -182,13 +186,16 @@ module Samagotchi
     #   owner; sent only when given (SessionManager.deliver_turn)
     # @param pending_limit [Integer, nil] with a participant's +author+: how
     #   many of their turns may be running or waiting (429 too_many_turns past it)
-    def post_turn(prompt:, client_id: nil, no_interrupt: false, images: nil, delivery: nil, author: nil, pending_limit: nil)
+    def post_turn(prompt:, client_id: nil, no_interrupt: false, images: nil, delivery: nil, author: nil, pending_limit: nil,
+                  verify: nil)
       body = { session_id: @session_id, prompt: prompt, client_id: client_id }
       body[:no_interrupt] = true if no_interrupt
       body[:author] = author if author
       body[:pending_limit] = pending_limit if author && pending_limit
       body[:images] = images if images && !images.empty?
       body[:delivery] = delivery unless delivery.nil? || Delivery.next_step?(delivery)
+      anchor = VerifyAnchor.from(verify)
+      body[:verify] = anchor.to_file if anchor
       body[:deadline] = deadline
       post("turn", body, read_body: true)
     end

data/lib/samagotchi/bundles/known-names/hooks/known_names.rb

@@ -26,6 +26,8 @@ class KnownNames
   # name after it is what is checked.
   TOKEN_SPLIT = %r{[/\s"'=:,;|&()<>@~#]+}
   PART_SPLIT = /[-_.]+/
+  # Separators at a token's start or end, dropped before it is compared.
+  EDGE_SEPARATORS = /\A[-_.]+|[-_.]+\z/
   # A candidate with a shell glob character is not checked: `workato*`
   # is a pattern over the name, not a misspelling of it.
   GLOB = /[*?\[\]{}]/
@@ -94,15 +96,22 @@ class KnownNames
     return nil if names.empty?
 
     scan_targets(event).each do |where, text|
-      candidates(text).each do |candidate|
+      candidates(text).each do |token|
+        next if names.key?(token.downcase)
+
+        # "coffee_assistant-" (a prefix search) is the name, not a misspelling.
+        candidate = token.gsub(EDGE_SEPARATORS, "")
         down = candidate.downcase
-        next if names.key?(down)
+        next if candidate.empty? || names.key?(down)
 
         names.each do |name_down, name|
+          next if camel_case?(candidate, name)
+
           max = @max_distance || (name.length < 10 ? 1 : 2)
-          next if (candidate.length - name.length).abs > max
+          bare = name_down.gsub(EDGE_SEPARATORS, "")
+          next if (candidate.length - bare.length).abs > max
 
-          d = self.class.distance(down, name_down)
+          d = self.class.distance(down, bare)
           return { miss: candidate, name: name, distance: d, where: where } if d.between?(1, max)
         end
       end
@@ -110,6 +119,18 @@ class KnownNames
     nil
   end
 
+  # "CoffeeAssistant" or "coffeeAssistant" for "coffee_assistant": the
+  # name's own class or variable form, not a misspelling of it. Only a
+  # form with a capital: "coffeeassistant" and "coffee-assistant" are
+  # still near misses.
+  def camel_case?(candidate, name)
+    parts = name.split(PART_SPLIT)
+    return false if parts.size < 2
+
+    upper = parts.map(&:capitalize).join
+    [upper, upper[0].downcase + upper[1..]].include?(candidate)
+  end
+
   # [where, text] pairs to scan: the command, the cwd a command names,
   # each path, and a write/edit call's own path (in case normalisation
   # dropped it). Not file contents.

data/lib/samagotchi/bundles/known-names/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: known-names
-version: 0.1.6
+version: 0.1.7
 scope: system
 description: Catches a near-miss of a protected name (home folder, login, git name, repo name, names from config) in a tool call and rejects it with the right spelling; mode ask / correct optional
 trust_level: reviewed
@@ -8,7 +8,7 @@ files:
   known_names.md: sha256:d5348b95b6c655017b541910b36e384220da280818160201f6ec9a50e1e4287c
 hooks:
   known_names.rb:
-    sha256: sha256:7743adea25655d019d308793e7616043fc29e3d664e1572b50d0b27bf3a9238f
+    sha256: sha256:a851637e9292f825dc5b8877cd060184de976aa4297b114dab412a89fa3cf091
     event: before_tool_call
     on_error: log
     priority: 50

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.125.0
+version: 0.126.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/child_reports.rb

@@ -64,6 +64,9 @@ module Samagotchi
     def ring(child, why:, state_dir:, wake: nil)
       return nil if mode == "off"
       return nil unless child&.delegate?
+      # A Verify fresh child's verdict reaches its parent's card
+      # (VerifyFresh.forward), never its conversation.
+      return nil if child.verify_fresh
 
       parent_id = Session.parent_override(child.id, state_dir: state_dir) || child.parent_id
       return nil unless parent_id

data/lib/samagotchi/children_status.rb

@@ -86,11 +86,16 @@ module Samagotchi
                 state: state_of(session, row, reply), waiting: row[:waiting], live: !!row[:live],
                 delegate: session.delegate?, cwd: session.working_directory, branch: GitHead.branch(session.working_directory),
                 last_reply: reply && first_line(session.id, reply, state_dir: state_dir),
-                last_reply_at: reply && reply_time(reply), reported: !reply.nil? && cursor.reply_file == reply,
+                last_reply_at: reply && reply_time(reply), reported: !reply.nil? && reported?(session, cursor, reply),
                 updated_at: session.updated_at, archived: !!row[:archived])
     end
     private_class_method :child
 
+    # A reply the parent was given; a Verify fresh child's always counts
+    # (its verdict goes to the parent's card, never a report).
+    def reported?(session, cursor, reply) = !session.verify_fresh.nil? || cursor.reply_file == reply
+    private_class_method :reported?
+
     def state_of(session, row, reply)
       return "waiting" if row[:waiting]
       return "running" if Tools::Delegate.running?(row)

data/lib/samagotchi/engine.rb

@@ -15,6 +15,8 @@ require_relative "steer"
 require_relative "turn_note"
 require_relative "turn_endings"
 require_relative "turn_origin"
+require_relative "verify_anchor"
+require_relative "verdict"
 require_relative "model_profile"
 require_relative "effective_model"
 require_relative "session_setting"
@@ -901,10 +903,12 @@ module Samagotchi
 
     # Event types #announce accepts: facts about the session's input queue,
     # a failed turn's prompt handed back and the continue offer, which live
-    # UIs need in the event log, emitted outside any turn's stream.
+    # UIs need in the event log, emitted outside any turn's stream; a
+    # Verify fresh child's verdict landing on its card (:verdict_recorded).
     ANNOUNCEABLE_EVENTS = %i[turn_enqueued turn_dequeued input_merged prompt_restored continue_offered continue_resolved
                              command_queued command_ran context_added card hook_notice guardrail_warning
-                             plugin_init_started plugin_init_finished working_set_updated participants_changed].freeze
+                             plugin_init_started plugin_init_finished working_set_updated participants_changed
+                             verdict_recorded].freeze
 
     # Put a transport-level event into the ordered event log. Unlike turn
     # events it reaches only persistent observers (no turn sink, no memory
@@ -1589,7 +1593,10 @@ module Samagotchi
       seconds = turn.elapsed
       synchronize_events do
         kept, event = yield(seconds)
+        stamp_verify_anchor(kept, turn)
         replace_session_messages(turn.session, kept) if kept
+        verdict = record_verdict(turn, outcome)
+        event[:verdict] = verdict if verdict
         emit_working_set(turn.on_event, turn.session, turn.session.messages)
         turn.session.status = Session::STATUS_IDLE
         record_last_turn(turn.session, outcome, seconds, turn.origin, event, limit: exhausted ? turn.limit : nil)
@@ -1602,6 +1609,31 @@ module Samagotchi
     end
     private :end_turn
 
+    def stamp_verify_anchor(messages, turn)
+      return unless turn.verify && messages.is_a?(Array)
+
+      opening = messages.reverse.find do |message|
+        (message[:role] || message["role"]).to_s == "user" &&
+          (message[:turn_id] || message["turn_id"]).to_s == turn.id
+      end
+      opening[:verify] = turn.verify.to_h if opening
+    end
+    private :stamp_verify_anchor
+
+    def record_verdict(turn, outcome)
+      return unless outcome == "completed" && turn.verify
+
+      answer = AnswerTail.find(turn.session.messages, turn_id: turn.id)
+      parsed = Verdict.parse(answer && (answer[:content] || answer["content"]))
+      return unless parsed
+
+      record = { anchor: turn.verify.to_h, verdict: parsed.verdict, reason: parsed.reason,
+                 by: turn.origin.author, check_turn_id: turn.id, at: Time.now.iso8601(3) }
+      turn.session.verdicts = turn.session.verdicts + [record]
+      record
+    end
+    private :record_verdict
+
     def save_quietly(session)
       session.save(state_dir: session_state_dir)
     rescue StandardError => e
@@ -2011,7 +2043,7 @@ module Samagotchi
     # +wall+: the wall time it started (MessageTime.now, once): the
     # :turn_started event's at and its user message's (and reminders') stamp.
     Turn = Struct.new(:session, :prompt, :continue, :on_event, :controller, :origin, :started_at, :messages, :ended,
-                      :settings, :id, :limit, :resumed, :resume_from, :wall) do
+                      :settings, :id, :limit, :resumed, :resume_from, :wall, :verify) do
       def resumed? = resumed ? true : false
 
       # The turn's boundary events carry the origin only when it names a
@@ -2083,9 +2115,9 @@ module Samagotchi
     # re-raises; a provider error adds error_kind:, retryable:, host: and a
     # one-line summary:.
     def run_turn(session, prompt, on_event: nil, max_iterations: nil, cancel_controller: nil, max_tool_output_chars: nil, pending_input: nil, continue: false,
-                 origin: TurnOrigin::NONE, images: [], id: nil, resumed: false, resume_from: nil)
+                 origin: TurnOrigin::NONE, images: [], id: nil, resumed: false, resume_from: nil, verify: nil)
       turn = begin_turn(session, prompt, on_event: on_event, cancel_controller: cancel_controller, origin: origin,
-                                         continue: continue, id: id)
+                                         continue: continue, id: id, verify: verify)
       if continue
         turn.resumed = resumed
         turn.resume_from = resume_from
@@ -2133,8 +2165,11 @@ module Samagotchi
     # The turn's state before anything can fail it: the session running,
     # the turn flag, its cancel controller and sink. The cross-thread state
     # is set here and cleared in #release_turn only.
-    def begin_turn(session, prompt, on_event:, cancel_controller:, origin:, continue:, id: nil)
+    def begin_turn(session, prompt, on_event:, cancel_controller:, origin:, continue:, id: nil, verify: nil)
       origin = TurnOrigin.of(origin)
+      # A participant's Verify fresh child: every turn is theirs (their
+      # author, boundary and cap), whoever started it.
+      origin = session.verify_fresh.origin_for(origin) if session.respond_to?(:verify_fresh) && session.verify_fresh
       # Track the active session for recap and status snapshot.
       @session = session
       # status is turn state: running now, idle again before the turn's end
@@ -2157,7 +2192,7 @@ module Samagotchi
 
       Turn.new(session: session, prompt: continue ? nil : prompt, continue: continue, on_event: on_event,
                controller: effective_controller, origin: origin, started_at: Process.clock_gettime(Process::CLOCK_MONOTONIC),
-               id: id || SecureRandom.uuid, wall: MessageTime.now)
+               id: id || SecureRandom.uuid, wall: MessageTime.now, verify: VerifyAnchor.from(verify))
     end
     private :begin_turn
 
@@ -2360,6 +2395,7 @@ module Samagotchi
       unless turn.continue
         user_message = { role: "user", content: turn.prompt, turn_id: turn.id, **author_fields(turn.origin.author),
                          **participant_mode_fields(turn.origin.author), MessageTime::KEY => turn.at }
+        user_message[:verify] = turn.verify.to_h if turn.verify
         user_message[:images] = image_refs unless image_refs.empty?
         turn.messages << user_message
         session.last_prompt = turn.prompt

data/lib/samagotchi/guardrail_wiring.rb

@@ -109,9 +109,18 @@ module Samagotchi
       @git = Guardrails::GitInfo.new
       author = turn_author
       @turn_entry = author && @participant.call(author)
-      @turn_mode = author && ParticipantMode.for_turn(@session_lookup.call, @turn_entry)
+      @turn_mode = author && participant_turn_mode(@session_lookup.call, @turn_entry)
     end
 
+    # A participant's turn's mode: in a Verify fresh child the one saved
+    # on it at spawn (VerifyFreshOrigin#turn_mode: :review unless saved
+    # :pair), never looked up again; elsewhere ParticipantMode.for_turn.
+    def participant_turn_mode(session, entry)
+      fresh = session.respond_to?(:verify_fresh) && session.verify_fresh
+      fresh ? fresh.turn_mode : ParticipantMode.for_turn(session, entry)
+    end
+    private :participant_turn_mode
+
     # The running participant turn's mode (ParticipantMode.for_turn: :pair
     # only in a working session for a participant invited to act), decided
     # at its start; nil for the owner's turns. The boundary in #checks, the

data/lib/samagotchi/llm/chat_loop.rb

@@ -447,6 +447,7 @@ module Samagotchi
           message[:images] = entry[:images] if entry[:images].is_a?(Array) && !entry[:images].empty?
           message[:turn_id] = entry[:turn_id] if entry[:turn_id]
           message[:turn_start] = true if entry[:turn_start] == true
+          message[:verify] = entry[:verify] if entry[:verify].is_a?(Hash)
           message[:thinking] = entry[:thinking] if entry[:thinking].is_a?(String) && !entry[:thinking].empty?
           message[:anthropic_content] = entry[:anthropic_content] if entry[:anthropic_content].is_a?(Array)
           ToolResponse::SAVED_KEYS.each { |key| message[key] = entry[key] if entry[key] }