@aria_asi/cli 0.2.39 → 0.2.41

package/dist/runtime/lib/kernel/deterministic-cognitive-kernel.mjs

@@ -0,0 +1,906 @@
+import { createHash } from 'node:crypto';
+
+export const TADABBUR_STAGES = [
+  'embed',
+  'excavate',
+  'root_trace',
+  'multi_lens',
+  'pattern',
+  'consequence',
+  'dwelling',
+  'collapse',
+  'principle',
+  'inversion',
+  'personal',
+  'voice',
+];
+
+export const QIYAS_PERSPECTIVES = [
+  'owner_now',
+  'owner_future',
+  'operator_client',
+  'investor_or_buyer',
+  'llm_consumer',
+  'human_end_user',
+  'skeptic',
+  'compliance',
+  'engineering_quality',
+  'cognitive_load',
+  'scale',
+  'islamic_scholar',
+  'clinical_scholar',
+  'red_team_attacker',
+  'future_self',
+];
+
+const SEVERITY_WEIGHT = {
+  critical: 100,
+  high: 80,
+  medium: 55,
+  low: 25,
+  info: 5,
+};
+
+export const MANDATORY_KERNEL_SKILLS = Object.freeze([
+  'aria-first-class-operating-contract',
+]);
+
+// Output-emit failure action_classes — produced by classify() when the
+// observation describes an assistant emission whose attrs reveal a
+// known doctrine-violation shape. Listed here so consumers (and the
+// evaluate-with-kernel helper) can map these to `force_reauthor`
+// without re-implementing the detection rules.
+export const OUTPUT_EMIT_FAILURE_CLASSES = Object.freeze([
+  'claim_without_evidence',
+  'sycophancy_shape',
+  'mechanism_description_only',
+  'restatement_no_advance',
+]);
+
+// A3 (2026-05-17) — atlas orchestrates per-turn skill + runtime selection.
+// Keyed by observation.kind. Returned from compileCognitiveOptions as
+// selectedSkillIds / selectedRuntimeIds INSIDE compilationCore so they
+// participate in the deterministic compilation_hash. Autoload consumer
+// UNIONs selectedSkillIds with the manifest floor (additive, fallback-safe).
+export const SKILL_SELECTION_MAP = Object.freeze({
+  output_emit: [
+    'aria-readable-output',
+    'aria-harness-output-discipline',
+    'aria-aristotle-post-phase',
+    'aria-harness-substrate-binding',
+  ],
+  goal_contract_eval: [
+    'aria-cognition-autofire',
+    'aria-aristotle-pre-phase',
+    'aria-readable-output',
+  ],
+  edit: [
+    'never-guess',
+    'aria-repo-doctrine',
+    'aria-quality-audit',
+    'aria-aristotle-pre-phase',
+    'aria-aristotle-post-phase',
+    'aria-harness-substrate-binding',
+  ],
+  deploy: [
+    'never-guess',
+    'aria-quality-audit',
+    'aria-axioms-first-principles',
+    'aria-aristotle-pre-phase',
+    'aria-aristotle-post-phase',
+    'predictor',
+    'aria-harness-no-stripping',
+  ],
+  sensitive_artifact_in_tool_input: [
+    'never-guess',
+    'aria-harness-no-stripping',
+    'aria-axioms-first-principles',
+    'fitrah-guard',
+  ],
+  default: [
+    'never-guess',
+    'mizan',
+    'aria-cognition-autofire',
+    'aria-aristotle-pre-phase',
+    'aria-aristotle-post-phase',
+    'aria-readable-output',
+  ],
+});
+
+export const RUNTIME_SELECTION_MAP = Object.freeze({
+  output_emit: ['tadabbur:12', 'qiyas:15', 'noor:recognition', 'mizan:proportion'],
+  goal_contract_eval: ['tadabbur:12', 'qiyas:15', 'mizan:proportion'],
+  edit: ['tadabbur:12', 'qiyas:15', 'noor:recognition', 'mizan:proportion'],
+  deploy: ['tadabbur:12', 'qiyas:15', 'noor:recognition', 'mizan:proportion', 'aristotle:8-lens'],
+  sensitive_artifact_in_tool_input: ['mizan:proportion', 'fitrah:axiom-guard', 'noor:recognition'],
+  default: ['tadabbur:12', 'qiyas:15', 'noor:recognition'],
+});
+
+// Reinforcement by classification.action_class — adds skills when a known
+// failure shape is detected. Stacks on top of the kind-keyed base set.
+export const ACTION_CLASS_REINFORCE_MAP = Object.freeze({
+  sycophancy_shape: ['aria-harness-substrate-binding', 'aria-harness-output-discipline', 'never-guess', 'aria-axioms-first-principles'],
+  claim_without_evidence: ['never-guess', 'aria-quality-audit', 'aria-harness-substrate-binding', 'aria-aristotle-post-phase'],
+  mechanism_description_only: ['aria-readable-output', 'aria-harness-output-discipline', 'aria-cognition-autofire'],
+  restatement_no_advance: ['aria-readable-output', 'aria-cognition-autofire', 'aria-aristotle-post-phase'],
+  sensitive_artifact_emit: ['never-guess', 'aria-harness-no-stripping', 'fitrah-guard'],
+});
+
+// A4 (2026-05-17) — recent end-phase court verdicts feed back into next-turn
+// skill selection. When the previous turn's court verdict ∈ FAILURE set,
+// reinforce quality + audit skills. This is the closed-loop upgrade
+// mechanism that makes hard-gating unnecessary at run-of-turn boundary.
+export const COURT_FAILURE_VERDICTS = Object.freeze([
+  'partial',
+  'blocked',
+  'force_reauthor',
+  'unverified',
+  'block',
+]);
+
+export const COURT_FAILURE_REINFORCE_SKILLS = Object.freeze([
+  'aria-quality-audit',
+  'aria-harness-no-stripping',
+  'never-guess',
+  'aria-aristotle-post-phase',
+  'aria-harness-substrate-binding',
+]);
+
+export function selectSkillsAndRuntimes(observation = {}, classification = {}, priorCourtVerdicts = []) {
+  const kind = observation && typeof observation.kind === 'string' ? observation.kind : 'default';
+  const baseKey = Object.prototype.hasOwnProperty.call(SKILL_SELECTION_MAP, kind) ? kind : 'default';
+  const skills = new Set([
+    ...MANDATORY_KERNEL_SKILLS,
+    ...(SKILL_SELECTION_MAP[baseKey] || SKILL_SELECTION_MAP.default),
+  ]);
+  const runtimes = new Set(RUNTIME_SELECTION_MAP[baseKey] || RUNTIME_SELECTION_MAP.default);
+  const actionClass = classification && typeof classification.action_class === 'string' ? classification.action_class : null;
+  const reinforce = actionClass ? ACTION_CLASS_REINFORCE_MAP[actionClass] : null;
+  if (Array.isArray(reinforce)) for (const s of reinforce) skills.add(s);
+  let courtFeedbackApplied = false;
+  const failureVerdictsObserved = [];
+  if (Array.isArray(priorCourtVerdicts)) {
+    for (const v of priorCourtVerdicts) {
+      const verdictStr = typeof v === 'string' ? v : (v && typeof v.verdict === 'string' ? v.verdict : null);
+      if (verdictStr && COURT_FAILURE_VERDICTS.includes(verdictStr)) {
+        courtFeedbackApplied = true;
+        failureVerdictsObserved.push(verdictStr);
+        for (const s of COURT_FAILURE_REINFORCE_SKILLS) skills.add(s);
+      }
+    }
+  }
+  return {
+    selectedSkillIds: [...skills].sort(),
+    selectedRuntimeIds: [...runtimes].sort(),
+    selectionMeta: {
+      schema: 'aria.deterministic_cognitive_kernel.skill_runtime_selection.v1',
+      keyUsed: baseKey,
+      actionClassReinforced: actionClass && Array.isArray(reinforce) ? actionClass : null,
+      courtFeedbackApplied,
+      priorCourtVerdictCount: Array.isArray(priorCourtVerdicts) ? priorCourtVerdicts.length : 0,
+      failureVerdictsObserved,
+    },
+  };
+}
+
+function isOutputEmitKind(observation) {
+  return observation.kind === 'output_emit' || observation.kind === 'goal_contract_eval';
+}
+
+// Tool-input sealed-material branch — produced when a caller (pre-tool gate,
+// post-tool gate) has run a structural-shape detector over a tool's source
+// payload (Edit.new_string, Write.content, Bash command body) and found a
+// match. The caller does the shape detection (it's policy-bound to a
+// specific list of vendor prefixes / markers); the kernel routes the
+// classified finding through the same option-set machinery as every other
+// hard-risk class so blast_radius + reversibility are policy-driven, not
+// inline-regex driven.
+function isSensitiveArtifactKind(observation) {
+  return observation.kind === 'sensitive_artifact_in_tool_input';
+}
+
+function classifySensitiveArtifact(observation) {
+  if (!isSensitiveArtifactKind(observation)) return null;
+  const a = observation.attrs || {};
+  // shapeMatched=true means the caller's shape detector confirmed structural
+  // sealed-material presence (PEM marker, vendor prefix, JWT bearer header,
+  // high-entropy env assignment, etc). shapeMatched=false → not a leak.
+  return a.shapeMatched === true ? 'sensitive_artifact_emit' : null;
+}
+
+// Doctrine-violation branch — produced by aria-repo-doctrine-gate.mjs and
+// any other hook that detects stub / mock / placeholder / pending semantics
+// in doctrine-bound source paths. The caller does the pattern detection
+// (with line-aware guards: comment-only, multiline-string-masked, policy-
+// rule-definition lines excluded); the kernel classifies the surfaced
+// violations through the same option-set machinery as every other risk
+// class so blast_radius + reversibility are policy-driven.
+function isDoctrineViolationKind(observation) {
+  return observation.kind === 'doctrine_violation_check';
+}
+
+function classifyDoctrineViolation(observation) {
+  if (!isDoctrineViolationKind(observation)) return null;
+  const a = observation.attrs || {};
+  // violationCount > 0 with at least one rule that classifies as production-
+  // path-breaking (stub_semantics, placeholder_semantics, todo_stub_semantics,
+  // http_501_pending, mock_import, direct_llm_bypass, direct_llm_sdk_bypass)
+  // → block. violationCount === 0 → null (caller need not block).
+  return Number(a.violationCount || 0) > 0 ? 'doctrine_violation' : null;
+}
+
+// Mizan-service R8 — silent fallback default detection. Used by the mizan
+// /v1/mizan/check service when scanning code drafts for `|| 'unknown'` /
+// `|| 'default'` / `|| 'fallback'` patterns that mask config failures.
+// Migration target: the mizan service's current vocabulary regex moves to
+// caller-side detection + this kernel kind for blast_radius routing.
+function isSilentFallbackDefaultKind(observation) {
+  return observation.kind === 'silent_fallback_default_check';
+}
+
+function classifySilentFallbackDefault(observation) {
+  if (!isSilentFallbackDefaultKind(observation)) return null;
+  const a = observation.attrs || {};
+  // matchedSites: caller-side count of `|| 'unknown'/'default'/'fallback'`
+  // patterns found in the draft. > 0 → block; 0 → null.
+  return Number(a.matchedSites || 0) > 0 ? 'silent_fallback_default' : null;
+}
+
+// Mizan-service R11 — console.log secrets detection. Used by the mizan
+// service when scanning code drafts for `console.log(...)` calls that
+// reference TOKEN/PASSWORD/SECRET/API_KEY/JWT/BEARER identifier shapes.
+// Caller-side detection feeds matchedSites + identifierShape; the kernel
+// routes via blast_radius=owner_trust_or_breach.
+function isConsoleLogSecretsKind(observation) {
+  return observation.kind === 'console_log_secrets_check';
+}
+
+function classifyConsoleLogSecrets(observation) {
+  if (!isConsoleLogSecretsKind(observation)) return null;
+  const a = observation.attrs || {};
+  return Number(a.matchedSites || 0) > 0 ? 'console_log_secrets' : null;
+}
+
+function classifyOutputEmit(observation) {
+  if (!isOutputEmitKind(observation)) return null;
+  const a = observation.attrs || {};
+  const hasCompletionLang = a.hasCompletionLang === true;
+  const hasAgreementLang = a.hasAgreementLang === true;
+  const hasAdvanceLang = a.hasAdvanceLang === true;
+  const hasVerifyBlock = a.hasVerifyBlock === true;
+  const evidenceAnchorCount = Number(a.evidenceAnchorCount || 0);
+  const lensCount = Number(a.lensCount || 0);
+  const codeBlockCount = Number(a.codeBlockCount || 0);
+  const continuationRequested = a.continuationRequested === true;
+  const textLength = Number(a.textLength || 0);
+
+  // Order matters: most specific first. Completion-claim-without-evidence
+  // is the highest-severity failure (false done is the worst owner harm).
+  if (hasCompletionLang && !hasVerifyBlock && evidenceAnchorCount < 1) {
+    return 'claim_without_evidence';
+  }
+  // Agreement-shape with no evidence backing it — the "you're right" pattern.
+  if (hasAgreementLang && evidenceAnchorCount < 2) {
+    return 'sycophancy_shape';
+  }
+  // Goal-contract case: user asked for continuation, response describes
+  // mechanism instead of advancing concrete state. Requires textLength > 500
+  // so short planning text ("continue. edit X to add Y") doesn't trip this —
+  // pre-execution planning emits are short by nature and aren't the failure
+  // mode we're trying to catch; the failure mode is long emits that explain
+  // *instead of* doing the work.
+  if (observation.kind === 'goal_contract_eval' && continuationRequested && !hasAdvanceLang && textLength > 500) {
+    return 'mechanism_description_only';
+  }
+  // Long output emission with zero concrete advance verbs and no cognition
+  // lenses — text-without-thinking.
+  if (observation.kind === 'output_emit' && textLength > 500 && !hasAdvanceLang && lensCount === 0 && codeBlockCount === 0) {
+    return 'restatement_no_advance';
+  }
+  return null; // No failure pattern detected; classify() falls through
+}
+
+function stableStringify(value) {
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(',')}]`;
+  if (value && typeof value === 'object') {
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(',')}}`;
+  }
+  return JSON.stringify(value);
+}
+
+export function stableHash(value) {
+  return createHash('sha256').update(stableStringify(value)).digest('hex');
+}
+
+function coerceEvidence(evidence = []) {
+  return evidence.map((anchor, index) => ({
+    anchor_id: anchor.evidence_sha256 || anchor.evidenceSha256 || stableHash({ index, anchor }),
+    anchor_type: anchor.anchor_type || anchor.anchorType || 'unknown',
+    source: anchor.source_path_or_endpoint || anchor.sourcePathOrEndpoint || anchor.source || 'unknown',
+    observed: anchor.observed || '',
+    expected: anchor.expected || null,
+    freshness: anchor.collected_at || anchor.collectedAt || null,
+  }));
+}
+
+function sourceTrust(observation, evidence) {
+  const directEvidence = evidence.some((anchor) => ['command', 'endpoint', 'runtime', 'exception'].includes(anchor.anchor_type));
+  if (directEvidence) return 'direct_observed';
+  if (observation.source === 'atlas' || observation.source === 'hive') return 'substrate_recorded';
+  if (evidence.length > 0) return 'evidence_attached';
+  return 'unverified';
+}
+
+function classify(observation, evidence) {
+  const source = observation.source || 'unknown';
+  const kind = observation.kind || 'unknown';
+  const attrs = observation.attrs || {};
+  const title = observation.title || '';
+
+  // Doctrine-violation branch: when aria-repo-doctrine-gate (or any other
+  // hook) has detected stub / mock / placeholder / pending semantics in
+  // doctrine-bound source paths, classification short-circuits here.
+  // action_class drives downstream constraint mutations capping autonomy
+  // and producing a class-specific recovery directive.
+  const doctrineViolationClass = classifyDoctrineViolation(observation);
+  if (doctrineViolationClass) {
+    return {
+      domain: 'agent_repo_doctrine',
+      action_class: doctrineViolationClass,
+      resource_class: source,
+      environment: 'workspace',
+      blast_radius: 'file_or_module',
+      reversibility: 'edit_revertible',
+      has_tests: false,
+      evidence_strength: evidence.length >= 2 ? 'multi_anchor' : evidence.length === 1 ? 'single_anchor' : 'none',
+    };
+  }
+
+  // Mizan R8 — silent fallback default detection in code drafts.
+  const silentFallbackClass = classifySilentFallbackDefault(observation);
+  if (silentFallbackClass) {
+    return {
+      domain: 'agent_repo_doctrine',
+      action_class: silentFallbackClass,
+      resource_class: source,
+      environment: 'workspace',
+      blast_radius: 'file_or_module',
+      reversibility: 'edit_revertible',
+      has_tests: false,
+      evidence_strength: evidence.length >= 2 ? 'multi_anchor' : evidence.length === 1 ? 'single_anchor' : 'none',
+    };
+  }
+
+  // Mizan R11 — console.log secrets detection in code drafts.
+  const consoleLogSecretsClass = classifyConsoleLogSecrets(observation);
+  if (consoleLogSecretsClass) {
+    return {
+      domain: 'agent_safety',
+      action_class: consoleLogSecretsClass,
+      resource_class: source,
+      environment: 'workspace',
+      blast_radius: 'owner_trust_or_breach',
+      reversibility: 'unrecoverable_if_emitted',
+      has_tests: false,
+      evidence_strength: evidence.length >= 2 ? 'multi_anchor' : evidence.length === 1 ? 'single_anchor' : 'none',
+    };
+  }
+
+  // Sensitive-artifact branch: when a tool-input shape-detector confirms
+  // structural sealed material (PEM marker, vendor prefix, JWT bearer,
+  // high-entropy env assignment) in the tool source body, classification
+  // short-circuits here. action_class drives downstream constraint mutations
+  // that cap autonomy at observe_only — the artifact MUST NOT be emitted.
+  const sensitiveArtifactClass = classifySensitiveArtifact(observation);
+  if (sensitiveArtifactClass) {
+    return {
+      domain: 'agent_safety',
+      action_class: sensitiveArtifactClass,
+      resource_class: source,
+      environment: 'tool_input_payload',
+      blast_radius: 'owner_trust_or_breach',
+      reversibility: 'unrecoverable_if_emitted',
+      has_tests: false,
+      evidence_strength: evidence.length >= 2 ? 'multi_anchor' : evidence.length === 1 ? 'single_anchor' : 'none',
+    };
+  }
+
+  // Output-emit branch: when the observation describes an assistant emission
+  // whose attrs reveal a doctrine-violation shape, classification short-circuits
+  // here. action_class drives downstream constraint mutations and the helper's
+  // force_reauthor decision.
+  const outputEmitClass = classifyOutputEmit(observation);
+  if (outputEmitClass) {
+    return {
+      domain: 'agent_output_quality',
+      action_class: outputEmitClass,
+      resource_class: source,
+      environment: 'agent_output',
+      blast_radius: 'owner_trust',
+      reversibility: 're_authorable',
+      has_tests: false,
+      evidence_strength: evidence.length >= 2 ? 'multi_anchor' : evidence.length === 1 ? 'single_anchor' : 'none',
+    };
+  }
+  // Output-emit observations that did NOT match any failure pattern still
+  // classify into a benign output-emit class so constrainOptions can leave
+  // them untouched (and the helper returns decision=allow).
+  if (isOutputEmitKind(observation)) {
+    return {
+      domain: 'agent_output_quality',
+      action_class: 'output_emit_ok',
+      resource_class: source,
+      environment: 'agent_output',
+      blast_radius: 'owner_trust',
+      reversibility: 're_authorable',
+      has_tests: false,
+      evidence_strength: evidence.length >= 2 ? 'multi_anchor' : evidence.length === 1 ? 'single_anchor' : 'none',
+    };
+  }
+
+  const isLiveInfra = source === 'k8s' || source === 'systemd' || source === 'runtime-health';
+  const isCliState = source === 'cli-state' || kind.includes('gate') || title.toLowerCase().includes('gate');
+  const isRepoState = source === 'repo-state';
+  const isDependencyAudit = source === 'dependency-audit' || kind === 'npm_vulnerability';
+  const isCompositeRisk = source === 'sentinel-composite';
+  const isCode = source === 'codebase' || source === 'repo' || isRepoState || isDependencyAudit || isCompositeRisk || kind.includes('code') || Boolean(attrs.path);
+  const hasTests = Boolean(attrs.hasTests || attrs.testCommand || attrs.test_command);
+  const environment = isLiveInfra ? 'live_runtime' : isCode ? 'workspace' : 'unknown';
+  const blastRadius = isLiveInfra ? 'service_or_cluster' : isCompositeRisk ? 'app_or_repo' : isDependencyAudit ? 'dependency_graph' : isRepoState ? 'file_or_commit_group' : isCode ? 'file_or_module' : 'unknown';
+  return {
+    domain: isLiveInfra ? 'runtime_operations' : isCliState ? 'agent_control' : isCompositeRisk ? 'compound_app_risk' : isDependencyAudit ? 'dependency_security' : isRepoState ? 'repo_state' : isCode ? 'codebase' : observation.domain || 'general',
+    action_class: isLiveInfra ? 'live_system_repair' : isCliState ? 'control_plane_repair' : isCompositeRisk ? 'compound_repair_plan' : isDependencyAudit ? 'dependency_update' : isRepoState ? 'repo_organization' : isCode ? 'code_change' : 'triage',
+    resource_class: source,
+    environment,
+    blast_radius: blastRadius,
+    reversibility: isLiveInfra ? 'requires_explicit_rollback' : isDependencyAudit ? 'lockfile_revertible' : isRepoState ? 'git_revertible' : isCode ? 'branch_revertible' : 'unknown',
+    has_tests: hasTests,
+    evidence_strength: evidence.length >= 2 ? 'multi_anchor' : evidence.length === 1 ? 'single_anchor' : 'none',
+  };
+}
+
+function baseOptions(observation, classification, verificationPredicate) {
+  const common = {
+    observation_id: observation.id || observation.observation_id || observation.dedupe_key || stableHash(observation).slice(0, 16),
+    domain: classification.domain,
+    verification_predicate: verificationPredicate,
+    learning_target: `${classification.domain}:${observation.kind || 'unknown'}`,
+  };
+  return [
+    {
+      ...common,
+      option_id: 'observe_only',
+      action_class: 'observe',
+      autonomy_level: 1,
+      title: 'Preserve evidence and explain',
+      expected_outcome: 'The operator sees the issue, evidence, impact, and next verification predicate.',
+      evidence_required: ['current observation evidence'],
+      blast_radius: 'none',
+      reversibility: 'not_applicable',
+      constraints_applied: [],
+      rejected: false,
+      rejection_reasons: [],
+    },
+    {
+      ...common,
+      option_id: 'propose_repair',
+      action_class: 'proposal',
+      autonomy_level: 2,
+      title: 'Propose repair with verification',
+      expected_outcome: 'The operator receives a repair plan, command or patch plan, verification, and rollback path.',
+      evidence_required: ['current observation evidence', 'verification command or probe'],
+      blast_radius: classification.blast_radius,
+      reversibility: classification.reversibility,
+      constraints_applied: [],
+      rejected: false,
+      rejection_reasons: [],
+    },
+    {
+      ...common,
+      option_id: 'sandbox_repair',
+      action_class: classification.action_class === 'code_change' ? 'branch_patch' : 'controlled_workspace_action',
+      autonomy_level: 3,
+      title: 'Apply in safe workspace',
+      expected_outcome: 'The repair is applied only in a controlled workspace or branch and verified before merge or live action.',
+      evidence_required: ['tests or isolated probe', 'rollback path'],
+      blast_radius: classification.blast_radius,
+      reversibility: classification.reversibility,
+      constraints_applied: [],
+      rejected: false,
+      rejection_reasons: [],
+    },
+    {
+      ...common,
+      option_id: 'allowlisted_repair',
+      action_class: 'allowlisted_execution',
+      autonomy_level: 4,
+      title: 'Execute allowlisted repair',
+      expected_outcome: 'A pre-approved low-risk action executes and is verified with readback.',
+      evidence_required: ['allowlist match', 'preflight', 'verification readback', 'rollback path'],
+      blast_radius: classification.blast_radius,
+      reversibility: classification.reversibility,
+      constraints_applied: [],
+      rejected: false,
+      rejection_reasons: [],
+    },
+  ];
+}
+
+function rejectOption(option, reason, constraint) {
+  return {
+    ...option,
+    rejected: true,
+    rejection_reasons: Array.from(new Set([...(option.rejection_reasons || []), reason])),
+    constraints_applied: Array.from(new Set([...(option.constraints_applied || []), constraint])),
+  };
+}
+
+function constrainOptions(options, observation, classification, trust) {
+  const mutations = [];
+  let next = options.map((option) => ({ ...option }));
+  const addMutation = (stage, mutation_type, reason, changed_field = 'options') => {
+    mutations.push({ stage, mutation_type, reason, changed_field });
+  };
+
+  // Output-emit failure classes — block every repair option (autonomy >= 2),
+  // leaving observe_only as the survivor. Class-specific reasons run BEFORE
+  // the generic trust=unverified block so rejection_reasons[0] carries the
+  // class-specific recovery directive, not the boilerplate unverified prose.
+  if (classification.action_class === 'doctrine_violation') {
+    // Severity-respecting authority. High severity (multi-rule or critical
+    // rule like direct_llm_bypass) → reject observe_only too, forcing
+    // decision='block'. Medium → keep observe_only viable (decision will be
+    // observe_only) but reject higher autonomy. Low → kernel can downgrade
+    // the gate's block to advisory by leaving observe_only as the only
+    // viable option. This is what makes the kernel AUTHORITATIVE rather
+    // than additive on the doctrine-gate's block decision.
+    const sev = observation.severity || 'medium';
+    if (sev === 'high' || sev === 'critical') {
+      next = next.map((option) => rejectOption(option, 'High-severity doctrine violation: multiple violations or critical rule (direct_llm_bypass / mock_import). Production path cannot ship — isolate under tests/specs/fixtures/examples/demos/mocks or add explicit ARIA_ALLOW_STUB marker.', 'truth_over_deception'));
+      addMutation('inversion', 'option_rejected', 'High-severity doctrine violation — all options rejected, block authoritative.');
+    } else if (sev === 'medium') {
+      next = next.map((option) => option.autonomy_level >= 2
+        ? rejectOption(option, 'Doctrine-bound source path carries stub / mock / placeholder / pending semantics. Re-author with real implementation or move pattern under tests/fixtures/examples/mocks.', 'truth_over_deception')
+        : option);
+      addMutation('root_trace', 'option_rejected', 'Medium-severity doctrine violation — re-author required at observe_only floor.');
+    } else {
+      // Low severity — keep observe_only viable; kernel decision will be
+      // observe_only, allowing the gate to downgrade its block to advisory.
+      next = next.map((option) => option.autonomy_level >= 3
+        ? rejectOption(option, 'Single low-impact doctrine violation — observe-only path: surface evidence to operator before any state-changing action.', 'reflection_before_action')
+        : option);
+      addMutation('consequence', 'option_rejected', 'Low-severity doctrine violation — observe-only path remains viable.');
+    }
+  }
+
+  if (classification.action_class === 'sensitive_artifact_emit') {
+    next = next.map((option) => option.autonomy_level >= 2
+      ? rejectOption(option, 'Structural sealed-material shape detected in tool input payload — emission would be unrecoverable. Redact the artifact, re-author the tool input, then resubmit. Observe-only path: surface evidence to operator without state change.', 'sacred_trust')
+      : option);
+    addMutation('inversion', 'option_rejected', 'Sensitive artifact in tool input — emission would breach trust irreversibly.');
+  }
+
+  // Mizan R8 — silent fallback default (|| 'unknown' / 'default' / 'fallback')
+  // masks config failures. Reject above observe_only — caller must surface
+  // the masked config rather than ship the silent fallback.
+  if (classification.action_class === 'silent_fallback_default') {
+    next = next.map((option) => option.autonomy_level >= 2
+      ? rejectOption(option, "Silent fallback default detected (`|| 'unknown'` / `|| 'default'` / `|| 'fallback'`). These mask config failures. Replace with explicit validation that surfaces missing config, or refuse the action.", 'truth_over_deception')
+      : option);
+    addMutation('root_trace', 'option_rejected', 'Silent fallback default — config failure must be surfaced, not masked.');
+  }
+
+  // Mizan R11 — console.log with secret-shape identifiers (TOKEN/PASSWORD/
+  // SECRET/API_KEY/JWT/BEARER) reachable by caller's pattern matcher. Reject
+  // ALL options including observe_only — emitted logs persist; this is
+  // unrecoverable_if_emitted.
+  if (classification.action_class === 'console_log_secrets') {
+    next = next.map((option) => rejectOption(option, 'console.log call references a secret-shape identifier (TOKEN/PASSWORD/SECRET/API_KEY/JWT/BEARER). Logs persist; emission is unrecoverable. Remove the log statement or redact the value before logging.', 'sacred_trust'));
+    addMutation('inversion', 'option_rejected', 'console.log secret — emission would breach trust irreversibly; all options rejected.');
+  }
+
+  if (classification.action_class === 'claim_without_evidence') {
+    next = next.map((option) => option.autonomy_level >= 2
+      ? rejectOption(option, 'Completion language present but no verify-block and no command-anchor evidence — claim cannot stand. Re-author with verify-block citing probe output OR explicit refusal-to-claim.', 'evidence_ledger_before_readiness_claim')
+      : option);
+    addMutation('root_trace', 'option_rejected', 'Completion claim emitted without evidence — false-done risk.');
+  }
+
+  if (classification.action_class === 'sycophancy_shape') {
+    next = next.map((option) => option.autonomy_level >= 2
+      ? rejectOption(option, 'Agreement-shape detected with thin evidence backing — re-author with concrete state words (committed, ran, observed, verified) anchored to command output, OR push back on the user with substrate-cited reasoning.', 'truth_over_deception')
+      : option);
+    addMutation('inversion', 'option_rejected', 'Sycophancy shape — agreement without earned truth content.');
+  }
+
+  if (classification.action_class === 'mechanism_description_only') {
+    next = next.map((option) => option.autonomy_level >= 2
+      ? rejectOption(option, 'User requested continuation but response describes mechanism rather than advancing state — re-author with concrete state changes (file edits, commands run, predicates verified).', 'complete_implementation_not_claim_only')
+      : option);
+    addMutation('consequence', 'option_rejected', 'Mechanism described, goal not advanced.');
+  }
+
+  if (classification.action_class === 'restatement_no_advance') {
+    next = next.map((option) => option.autonomy_level >= 2
+      ? rejectOption(option, 'Long output with no advance verbs and zero cognition lenses — text without thinking. Re-author with substrate-anchored cognition that changes the artifact.', 'reflection_before_action')
+      : option);
+    addMutation('voice', 'option_rejected', 'Restatement without advance.');
+  }
+
+  if (trust === 'unverified') {
+    next = next.map((option) => option.autonomy_level > 1
+      ? rejectOption(option, 'Evidence is absent; action requires observation first.', 'truth_over_deception')
+      : option);
+    addMutation('embed', 'option_rejected', 'Unverified observations cannot produce repair actions.');
+  }
+
+  if (classification.action_class === 'live_system_repair') {
+    next = next.map((option) => option.autonomy_level > 2
+      ? rejectOption(option, 'Live runtime or cluster repair requires explicit authority and separate preflight.', 'no_harm')
+      : option);
+    addMutation('consequence', 'option_rejected', 'Live infra findings are capped at proposal level until authority and preflight exist.');
+  }
+
+  if (classification.action_class === 'control_plane_repair') {
+    next = next.map((option) => option.autonomy_level > 2
+      ? rejectOption(option, 'Control-plane repair can deadlock agent surfaces; require proposal and replay evidence first.', 'sacred_trust')
+      : option);
+    addMutation('inversion', 'option_rejected', 'Gate or CLI-state repairs require replay proof before higher autonomy.');
+  }
+
+  if (classification.action_class === 'code_change' && !classification.has_tests) {
+    next = next.map((option) => option.autonomy_level > 2
+      ? rejectOption(option, 'Code repair lacks tests; branch mutation must wait for a verification fixture.', 'verified_behavior_not_assumption')
+      : option);
+    addMutation('root_trace', 'verification_added', 'Code action requires tests or fixture before branch-level autonomy.');
+  }
+
+  if (classification.action_class === 'dependency_update') {
+    const allowlistedDependencyUpdate = Boolean(observation.attrs?.allowlistedDependencyUpdate);
+    next = next.map((option) => {
+      if (option.autonomy_level > 2 && (!allowlistedDependencyUpdate || !classification.has_tests)) {
+        return rejectOption(
+          option,
+          allowlistedDependencyUpdate
+            ? 'Dependency update lacks test evidence; lockfile mutation cannot exceed proposal level.'
+            : 'Dependency updates require explicit allowlist, lockfile diff review, and tests before mutation.',
+          'no_harm',
+        );
+      }
+      return option;
+    });
+    addMutation('consequence', 'option_rejected', 'Dependency security findings are capped at proposal level until allowlist and tests exist.');
+  }
+
+  if (classification.action_class === 'compound_repair_plan') {
+    next = next.map((option) => option.autonomy_level > 2
+      ? rejectOption(option, 'Compound app-risk remediation spans multiple findings and requires an approved grouped repair plan before mutation.', 'mizan')
+      : option);
+    addMutation('multi_lens', 'option_rejected', 'Compound app-risk findings stay at proposal level until linked findings and tests are scoped together.');
+  }
+
+  if (classification.action_class === 'repo_organization') {
+    const hiveOwned = Boolean(observation.attrs?.hiveOwned || observation.attrs?.hiveTouch);
+    const allowlistedRepoAction = Boolean(observation.attrs?.allowlistedRepoAction);
+    next = next.map((option) => {
+      if (option.autonomy_level > 3 || (!hiveOwned && option.autonomy_level > 2)) {
+        return rejectOption(
+          option,
+          hiveOwned
+            ? 'Repo organization is git-revertible but still needs explicit allowlist before level-4 execution.'
+            : 'Repo state has no matching Hive ownership; only proposal-level organization is allowed.',
+          'sacred_trust',
+        );
+      }
+      if (!allowlistedRepoAction && option.autonomy_level > 3) {
+        return rejectOption(option, 'Repo organization lacks an allowlisted action contract.', 'no_harm');
+      }
+      return option;
+    });
+    addMutation('consequence', 'option_rejected', hiveOwned
+      ? 'Hive-owned repo state can reach safe-workspace organization but not allowlisted execution by default.'
+      : 'Unowned repo state is capped at proposal level until a Hive owner or explicit authority is present.');
+  }
+
+  const needsOwnerDecision = (observation.severity === 'critical' || observation.severity === 'high') && classification.blast_radius !== 'none';
+  if (needsOwnerDecision) {
+    next = next.map((option) => option.autonomy_level >= 2
+      ? {
+          ...option,
+          evidence_required: Array.from(new Set([...(option.evidence_required || []), 'owner approval or scoped authority'])),
+          constraints_applied: Array.from(new Set([...(option.constraints_applied || []), 'sacred_trust'])),
+        }
+      : option);
+    addMutation('multi_lens', 'verification_added', 'High-impact findings require authority evidence before action.');
+  }
+
+  if (mutations.length === 0) {
+    next = next.map((option) => ({
+      ...option,
+      learning_target: `${option.learning_target}:baseline_no_change_guard`,
+    }));
+    addMutation('principle', 'learning_signal_added', 'No risk-specific mutation appeared; record baseline fixture for future comparison.', 'learning_target');
+  }
+
+  return { options: next, mutations };
+}
+
+function tadabburPass(options, observation, classification, trust, baseMutations) {
+  const byStage = new Map(baseMutations.map((mutation) => [mutation.stage, mutation]));
+  const rows = TADABBUR_STAGES.map((stage) => byStage.get(stage) || {
+    stage,
+    mutation_type: 'uncertainty_recorded',
+    reason: `${stage} preserved uncertainty for ${classification.domain}.`,
+    changed_field: 'uncertainty',
+  });
+  const meaningful = rows.some((row) => row.mutation_type !== 'uncertainty_recorded');
+  return {
+    ok: meaningful,
+    stage_count: rows.length,
+    rows,
+    invalid_reason: meaningful ? null : 'tadabbur produced no downstream option, constraint, verification, or learning mutation',
+    source_trust: trust,
+    object: observation.title || observation.kind || observation.id || 'observation',
+  };
+}
+
+function qiyasVerdict(perspective, option, observation, classification) {
+  if (option.rejected) {
+    return {
+      verdict: 'reject',
+      reason: option.rejection_reasons[0] || 'Option rejected by prior constraints.',
+      changed_field: 'option.rejected',
+      required_evidence: null,
+      learning_implication: `${perspective}: rejected option remains a training negative.`,
+    };
+  }
+  if (option.autonomy_level >= 3 && classification.action_class !== 'code_change') {
+    return {
+      verdict: 'downgrade',
+      reason: 'Higher autonomy does not survive cross-perspective review for non-code live or control-plane actions.',
+      changed_field: 'autonomy_level',
+      required_evidence: 'explicit scoped authority, preflight, and rollback proof',
+      learning_implication: `${perspective}: cap non-code live autonomy.`,
+    };
+  }
+  if (perspective === 'skeptic' || perspective === 'compliance' || perspective === 'engineering_quality') {
+    return {
+      verdict: 'requires_evidence',
+      reason: 'The option needs a concrete readback predicate before it can be trusted externally.',
+      changed_field: 'verification_predicate',
+      required_evidence: option.verification_predicate,
+      learning_implication: `${perspective}: evidence requirement must render in the option.`,
+    };
+  }
+  if (perspective === 'red_team_attacker' && (observation.severity === 'critical' || observation.severity === 'high')) {
+    return {
+      verdict: 'requires_evidence',
+      reason: 'High-impact actions can be abused if authority boundaries are missing.',
+      changed_field: 'evidence_required',
+      required_evidence: 'authority boundary and audit receipt',
+      learning_implication: 'red_team_attacker: authority evidence should be mandatory for high-impact actions.',
+    };
+  }
+  return {
+    verdict: 'accept',
+    reason: 'Option remains bounded and evidence-aware for this perspective.',
+    changed_field: null,
+    required_evidence: null,
+    learning_implication: `${perspective}: no additional constraint.`,
+  };
+}
+
+function qiyasPass(options, observation, classification) {
+  const rows = [];
+  let next = options.map((option) => ({ ...option }));
+  for (const option of next) {
+    for (const perspective of QIYAS_PERSPECTIVES) {
+      const verdict = qiyasVerdict(perspective, option, observation, classification);
+      rows.push({ option_id: option.option_id, perspective, ...verdict });
+    }
+  }
+  const evidenceRequirements = rows
+    .filter((row) => row.verdict === 'requires_evidence' && row.required_evidence)
+    .map((row) => row.required_evidence);
+  if (evidenceRequirements.length) {
+    next = next.map((option) => option.rejected ? option : ({
+      ...option,
+      evidence_required: Array.from(new Set([...(option.evidence_required || []), ...evidenceRequirements])),
+      constraints_applied: Array.from(new Set([...(option.constraints_applied || []), 'qiyas_evidence_required'])),
+    }));
+  }
+  return {
+    ok: rows.length === options.length * QIYAS_PERSPECTIVES.length,
+    perspective_count: QIYAS_PERSPECTIVES.length,
+    rows,
+    options: next,
+  };
+}
+
+function rankOptions(options, observation, classification) {
+  const severity = SEVERITY_WEIGHT[observation.severity] ?? 0;
+  return options
+    .map((option) => {
+      const rejectionPenalty = option.rejected ? -1000 : 0;
+      const autonomyPenalty = option.autonomy_level * 4;
+      const evidenceBonus = (option.evidence_required || []).length;
+      const usefulness = option.option_id === 'propose_repair' ? 20 : option.option_id === 'observe_only' ? 10 : 5;
+      const score = severity + usefulness + evidenceBonus - autonomyPenalty + rejectionPenalty;
+      return { ...option, rank_score: Number(score.toFixed(2)) };
+    })
+    .sort((a, b) => b.rank_score - a.rank_score || a.autonomy_level - b.autonomy_level || a.option_id.localeCompare(b.option_id));
+}
+
+function reflexionSeed(compilation) {
+  return {
+    schema: 'aria.deterministic_cognitive_kernel.reflexion_seed.v1',
+    prediction: `Option ${compilation.options[0]?.option_id || 'none'} is the safest useful next action for ${compilation.observation.title || compilation.observation.kind}.`,
+    action: 'not_executed_yet',
+    outcome: 'pending',
+    delta: null,
+    lesson: null,
+    promotion_gate: 'Outcome receipt with verification readback is required before rule promotion.',
+    next_compilation_effect: 'pending_outcome',
+  };
+}
+
+export function compileCognitiveOptions(observationInput, { verificationPredicate = null, policy = {} } = {}) {
+  const evidence = coerceEvidence(observationInput.evidence || []);
+  const observation = {
+    id: observationInput.id ?? observationInput.observation_id ?? null,
+    title: observationInput.title || observationInput.summary || observationInput.kind || 'observation',
+    summary: observationInput.summary || observationInput.title || '',
+    source: observationInput.source || 'unknown',
+    kind: observationInput.kind || 'unknown',
+    severity: observationInput.severity || 'medium',
+    attrs: observationInput.attrs || {},
+    evidence,
+  };
+  // A4 (2026-05-17) — caller-supplied prior end-phase court verdicts feed
+  // into skill selection so failure modes from the last turn reinforce the
+  // quality skill set on this turn. Accepted top-level OR under attrs so
+  // both autoload and direct callers can pass them.
+  const priorCourtVerdicts = Array.isArray(observationInput.priorCourtVerdicts)
+    ? observationInput.priorCourtVerdicts
+    : (Array.isArray(observationInput.attrs?.priorCourtVerdicts) ? observationInput.attrs.priorCourtVerdicts : []);
+  const trust = sourceTrust(observation, evidence);
+  const classification = classify(observation, evidence);
+  const verification = verificationPredicate || observationInput.verification_predicate || 'Verify expected state with the domain-specific probe before claiming closure.';
+  const base = baseOptions(observation, classification, verification);
+  const constrained = constrainOptions(base, observation, classification, trust, policy);
+  const tadabbur = tadabburPass(constrained.options, observation, classification, trust, constrained.mutations);
+  const qiyas = qiyasPass(constrained.options, observation, classification);
+  const ranked = rankOptions(qiyas.options, observation, classification);
+  const acceptance = {
+    tadabbur_12: tadabbur.ok && tadabbur.stage_count === 12,
+    qiyas_15: qiyas.ok && qiyas.perspective_count === 15,
+    cognition_mutated_output: constrained.mutations.length > 0,
+    deterministic_hash: true,
+  };
+  // A3 (2026-05-17) — atlas-driven skill + runtime selection. Lives INSIDE
+  // compilationCore so it participates in compilation_hash (caller can
+  // verify selection is deterministic given identical observation +
+  // classification + priorCourtVerdicts).
+  const selection = selectSkillsAndRuntimes(observation, classification, priorCourtVerdicts);
+  const compilationCore = {
+    schema: 'aria.deterministic_cognitive_kernel.compilation.v1',
+    observation,
+    classification,
+    source_trust: trust,
+    options: ranked,
+    tadabbur,
+    qiyas,
+    acceptance,
+    policy,
+    selectedSkillIds: selection.selectedSkillIds,
+    selectedRuntimeIds: selection.selectedRuntimeIds,
+    selectionMeta: selection.selectionMeta,
+  };
+  const compilation = {
+    ...compilationCore,
+    reflexion: null,
+    compilation_hash: stableHash(compilationCore),
+  };
+  compilation.reflexion = reflexionSeed(compilation);
+  return compilation;
+}