@gmickel/gno 1.19.0 → 1.21.0

package/spec/db/schema.sql

@@ -19,6 +19,8 @@
 --   retrieval_traces - Opt-in private retrieval trace headers
 --   retrieval_trace_runs/events/judgments - Bounded trace outcome records
 --   retrieval_trace_exports/export_traces - Export manifests and trace joins
+--   document_changes - Bounded metadata-only document lifecycle journal
+--   document_change_journal_state - Monotonic cursor/retention boundary
 
 -- ─────────────────────────────────────────────────────────────────────────────
 -- Schema Metadata
@@ -361,6 +363,64 @@ CREATE TABLE IF NOT EXISTS retrieval_trace_export_traces (
 -- and an absolute 100,000 subordinate-record safety cap per trace. Runtime
 -- retention applies the lower configured maxRecordsPerTrace bound.
 
+-- ─────────────────────────────────────────────────────────────────────────────
+-- Document Change Journal
+-- ─────────────────────────────────────────────────────────────────────────────
+
+-- Append-only while retained. Rows contain identity, hashes, active state, and
+-- compact structural summaries only; source and converted bodies are excluded.
+
+CREATE TABLE IF NOT EXISTS document_changes (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  document_id INTEGER NOT NULL CHECK (document_id > 0),
+  collection TEXT NOT NULL,
+  change_kind TEXT NOT NULL
+    CHECK (change_kind IN ('create', 'update', 'rename', 'inactivate', 'reactivate')),
+  old_rel_path TEXT,
+  new_rel_path TEXT,
+  old_docid TEXT,
+  new_docid TEXT,
+  old_uri TEXT,
+  new_uri TEXT,
+  old_source_hash TEXT,
+  new_source_hash TEXT,
+  old_mirror_hash TEXT,
+  new_mirror_hash TEXT,
+  old_active INTEGER CHECK (old_active IS NULL OR old_active IN (0, 1)),
+  new_active INTEGER CHECK (new_active IS NULL OR new_active IN (0, 1)),
+  heading_delta_json TEXT NOT NULL DEFAULT '{"added":[],"removed":[]}',
+  link_delta_json TEXT NOT NULL DEFAULT '{"added":[],"removed":[]}',
+  typed_edge_delta_json TEXT NOT NULL DEFAULT '{"added":[],"removed":[]}',
+  date_delta_json TEXT NOT NULL
+    DEFAULT '{"added":[],"removed":[],"changed":[]}',
+  structure_truncated INTEGER NOT NULL DEFAULT 0
+    CHECK (structure_truncated IN (0, 1)),
+  observed_at_ms INTEGER NOT NULL CHECK (observed_at_ms >= 0),
+  byte_size INTEGER NOT NULL CHECK (byte_size > 0 AND byte_size <= 131072),
+  CHECK (length(CAST(heading_delta_json AS BLOB)) <= 16384),
+  CHECK (length(CAST(link_delta_json AS BLOB)) <= 16384),
+  CHECK (length(CAST(typed_edge_delta_json AS BLOB)) <= 16384),
+  CHECK (length(CAST(date_delta_json AS BLOB)) <= 16384)
+);
+
+CREATE INDEX IF NOT EXISTS idx_document_changes_collection_sequence
+  ON document_changes(collection, sequence);
+CREATE INDEX IF NOT EXISTS idx_document_changes_document_sequence
+  ON document_changes(document_id, sequence);
+CREATE INDEX IF NOT EXISTS idx_document_changes_retention
+  ON document_changes(observed_at_ms, sequence);
+
+CREATE TABLE IF NOT EXISTS document_change_journal_state (
+  singleton_id INTEGER PRIMARY KEY CHECK (singleton_id = 1),
+  last_sequence INTEGER NOT NULL DEFAULT 0 CHECK (last_sequence >= 0),
+  retention_floor INTEGER NOT NULL DEFAULT 0
+    CHECK (retention_floor >= 0 AND retention_floor <= last_sequence),
+  retained_entries INTEGER NOT NULL DEFAULT 0
+    CHECK (retained_entries >= 0),
+  retained_bytes INTEGER NOT NULL DEFAULT 0
+    CHECK (retained_bytes >= 0)
+);
+
 -- ─────────────────────────────────────────────────────────────────────────────
 -- Document Tags
 -- ─────────────────────────────────────────────────────────────────────────────
@@ -440,3 +500,113 @@ CREATE TABLE IF NOT EXISTS doc_edges (
 
 CREATE INDEX IF NOT EXISTS idx_doc_edges_src_type ON doc_edges(src_doc_id, edge_type);
 CREATE INDEX IF NOT EXISTS idx_doc_edges_dst_type ON doc_edges(dst_doc_id, edge_type);
+
+-- ─────────────────────────────────────────────────────────────────────────────
+-- Saved Context Capsules (metadata only)
+-- ─────────────────────────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS saved_capsule_registrations (
+  registration_id TEXT PRIMARY KEY,
+  file_path TEXT NOT NULL UNIQUE,
+  file_hash TEXT NOT NULL,
+  capsule_id TEXT NOT NULL,
+  index_name TEXT NOT NULL,
+  question TEXT,
+  label TEXT,
+  notification_preference TEXT NOT NULL DEFAULT 'none'
+    CHECK (notification_preference IN ('none', 'local')),
+  registered_at_ms INTEGER NOT NULL CHECK (registered_at_ms >= 0),
+  updated_at_ms INTEGER NOT NULL CHECK (updated_at_ms >= registered_at_ms),
+  last_attempted_sequence INTEGER NOT NULL DEFAULT 0
+    CHECK (last_attempted_sequence >= 0),
+  registration_generation INTEGER NOT NULL DEFAULT 0
+    CHECK (registration_generation >= 0),
+  CHECK (length(registration_id) BETWEEN 1 AND 128),
+  CHECK (length(CAST(file_path AS BLOB)) BETWEEN 1 AND 8192),
+  CHECK (length(file_hash) = 64 AND file_hash NOT GLOB '*[^0-9a-f]*'),
+  CHECK (length(capsule_id) = 64 AND capsule_id NOT GLOB '*[^0-9a-f]*'),
+  CHECK (length(CAST(index_name AS BLOB)) BETWEEN 1 AND 128),
+  CHECK (question IS NULL OR length(CAST(question AS BLOB)) <= 8192),
+  CHECK (label IS NULL OR length(CAST(label AS BLOB)) <= 512)
+);
+
+CREATE INDEX IF NOT EXISTS idx_saved_capsules_index
+  ON saved_capsule_registrations(index_name, registration_id);
+
+CREATE TABLE IF NOT EXISTS saved_capsule_evidence (
+  registration_id TEXT NOT NULL,
+  evidence_id TEXT NOT NULL,
+  canonical_uri TEXT NOT NULL,
+  collection TEXT NOT NULL,
+  source_hash TEXT NOT NULL,
+  mirror_hash TEXT NOT NULL,
+  passage_hash TEXT NOT NULL,
+  PRIMARY KEY (registration_id, evidence_id),
+  FOREIGN KEY (registration_id)
+    REFERENCES saved_capsule_registrations(registration_id)
+    ON DELETE CASCADE,
+  CHECK (length(evidence_id) = 64 AND evidence_id NOT GLOB '*[^0-9a-f]*'),
+  CHECK (length(CAST(canonical_uri AS BLOB)) BETWEEN 1 AND 8192),
+  CHECK (length(CAST(collection AS BLOB)) BETWEEN 1 AND 256),
+  CHECK (length(source_hash) = 64 AND source_hash NOT GLOB '*[^0-9a-f]*'),
+  CHECK (length(mirror_hash) = 64 AND mirror_hash NOT GLOB '*[^0-9a-f]*'),
+  CHECK (length(passage_hash) = 64 AND passage_hash NOT GLOB '*[^0-9a-f]*')
+);
+
+CREATE INDEX IF NOT EXISTS idx_saved_capsule_evidence_uri
+  ON saved_capsule_evidence(canonical_uri, registration_id);
+CREATE INDEX IF NOT EXISTS idx_saved_capsule_evidence_source
+  ON saved_capsule_evidence(source_hash, registration_id);
+CREATE INDEX IF NOT EXISTS idx_saved_capsule_evidence_mirror
+  ON saved_capsule_evidence(mirror_hash, registration_id);
+
+CREATE TABLE IF NOT EXISTS saved_capsule_verifications (
+  registration_id TEXT PRIMARY KEY,
+  trigger_kind TEXT NOT NULL CHECK (trigger_kind IN ('manual', 'journal')),
+  from_sequence INTEGER NOT NULL CHECK (from_sequence >= 0),
+  through_sequence INTEGER NOT NULL CHECK (through_sequence >= from_sequence),
+  operation_status TEXT NOT NULL CHECK (operation_status IN ('completed', 'failed')),
+  affected_question_state TEXT NOT NULL
+    CHECK (affected_question_state IN ('unaffected', 'affected', 'unknown')),
+  affected_reasons_json TEXT NOT NULL,
+  receipt_json TEXT,
+  receipt_hash TEXT,
+  error_code TEXT,
+  error_message TEXT,
+  verified_at_ms INTEGER NOT NULL CHECK (verified_at_ms >= 0),
+  FOREIGN KEY (registration_id)
+    REFERENCES saved_capsule_registrations(registration_id)
+    ON DELETE CASCADE,
+  CHECK (length(CAST(affected_reasons_json AS BLOB)) <= 4096),
+  CHECK (receipt_json IS NULL OR length(CAST(receipt_json AS BLOB)) <= 16777216),
+  CHECK (receipt_hash IS NULL OR (
+    length(receipt_hash) = 64 AND receipt_hash NOT GLOB '*[^0-9a-f]*'
+  )),
+  CHECK (error_code IS NULL OR length(CAST(error_code AS BLOB)) <= 256),
+  CHECK (error_message IS NULL OR length(CAST(error_message AS BLOB)) <= 4096),
+  CHECK (
+    (
+      operation_status = 'completed'
+      AND receipt_json IS NOT NULL
+      AND receipt_hash IS NOT NULL
+      AND error_code IS NULL
+      AND error_message IS NULL
+    )
+    OR
+    (
+      operation_status = 'failed'
+      AND receipt_json IS NULL
+      AND receipt_hash IS NULL
+      AND error_code IS NOT NULL
+      AND error_message IS NOT NULL
+    )
+  )
+);
+
+CREATE TABLE IF NOT EXISTS saved_capsule_reverification_state (
+  singleton_id INTEGER PRIMARY KEY CHECK (singleton_id = 1),
+  last_processed_sequence INTEGER NOT NULL DEFAULT 0
+    CHECK (last_processed_sequence >= 0),
+  registration_epoch INTEGER NOT NULL DEFAULT 0
+    CHECK (registration_epoch >= 0)
+);

package/spec/evals-agentic.md

@@ -22,6 +22,8 @@ evals/agentic/
   fixture-db.ts
   scoring.ts
   promotion.ts
+  verified-ask-outcome.ts
+  verified-ask-promotion.ts
   registry.ts
   report.ts
   report-artifacts.ts
@@ -51,7 +53,13 @@ evals/fixtures/agentic-retrieval/
   agent-model.lock.json
   baseline/
     README.md
-    fixture-agent/{report.json,canonical.json,observations.json,report.md}
+    fixture-agent/
+      report.json
+      canonical.json
+      observations.json
+      report.md
+      verified-ask-promotion.json
+      verified-ask-promotion.md
     optional/{qmd,local-model}/     # local opt-in evidence; not authoritative
 ```
 
@@ -400,7 +408,9 @@ and hashes, and promotion results remain included. `report.json` is schema
 valid. `canonical.json` contains that exact projection. `observations.json`
 holds environment, build observations, and full-identity receipt observations;
 committed temporary paths are projected to `<temp>`. `report.md` is the readable
-summary. The four files are staged and directory-renamed as one baseline set.
+summary. The six files are staged and directory-renamed as one baseline set.
+The verified Ask files are a separate attributable outcome lane; they do not
+rename the Capsule retrieval promotion in `report.json`.
 
 ## Deterministic scoring
 
@@ -455,6 +465,19 @@ Claim linkage is:
 linkedSupportedClaims_capsule / substantiveClaims_capsule >= 0.95
 ```
 
+Unsupported substantive claims must strictly decrease on a comparable paired
+cohort:
+
+```text
+unsupportedClaims_capsule < unsupportedClaims_gno
+1 - unsupportedClaims_capsule / unsupportedClaims_gno
+```
+
+The report records both counts and the reduction. A missing paired baseline,
+an identity mismatch, or a zero unsupported-claim baseline makes this reduction
+unavailable/non-comparable; GNO reports that state rather than fabricating an
+improvement.
+
 All denominators must be non-zero. Abstention-only tasks use their completion
 predicate and do not fabricate substantive claims. Every fixture-agent Capsule
 task must also emit byte-identical canonical Capsule payload JSON and matching
@@ -464,6 +487,64 @@ duplicates, identity mismatches,
 pairwise or aggregate accuracy loss, denominator failure, threshold miss, or
 nondeterminism fails promotion.
 
+## Verified Ask promotion formulas
+
+The authoritative fixture-agent write additionally runs a separate 22-task
+outcome lane. It excludes only the two declared expected-missing/abstention
+tasks. Every included task must contain exactly one required substantive claim;
+missing, duplicate, extra, or mismatched pairs fail closed.
+
+The compatible cohort is an independent frozen contract, not inferred from the
+artifact under validation:
+
+```text
+t012ab3c t0a1b2c3 t123bc4d t1b2c3d4 t2c3d4e5 t3d4e5f6
+t456ef70 t4e5f607 t567f081 t5f60718 t6071829 t6780192
+t718293a t7891a03 t8293a4b t93a4b5c ta4b5c6d tb5c6d7e
+tc6d7e8f td7e8f90 te8f901a tf901a2b
+```
+
+The exact exclusions are `t234cd5e` and `t345de6f`, both with reason
+`expected_missing_evidence`. Removing or replacing a complete receipt/score
+pair and resealing every derived fingerprint still fails validation.
+
+The baseline executes the production raw Ask path:
+`searchHybrid` → `generateGroundedAnswer` → `processAnswerResult`. The candidate
+executes production `buildVerifiedAsk`. Each pair shares the immutable native
+index, task goal, collection, structured search modes, deterministic answer
+agent/model fingerprint, and initial answer draft. Receipt and score identities
+bind task, lane, trial, seed, and agent. Pairing also requires identical fixture,
+index, request, and model fingerprints.
+
+Four fixed, diverse tasks receive an unsupported deterministic draft in both
+lanes. The other 18 receive the oracle-supported draft. This controlled
+adversarial subset tests enforcement at the product boundary; it does not claim
+general model quality.
+
+For every pair and in aggregate:
+
+```text
+answerAccuracy_verified(p) >= answerAccuracy_raw(p)
+mean(answerAccuracy_verified) >= mean(answerAccuracy_raw)
+unsupportedSubstantiveClaims_verified < unsupportedSubstantiveClaims_raw
+```
+
+`verified-ask-promotion.json` contains canonical receipts, identity-bearing
+scores, exact cohort/exclusions, metrics, and the gate result.
+`verified-ask-promotion.md` is its readable projection. Temporary collection
+paths and timings are excluded from the canonical contract; fixture, index,
+request, model, exact answer, citation hashes, verification status, and scored
+outcome remain bound. The evaluator parses the typed claim from the exact final
+product answer and scores it against the independent fn-97 oracle; it
+recomputes receipt, answer, score, and artifact fingerprints rather than
+trusting harness-assigned claim or score fields. Raw and verified lane semantics
+are validated independently. A supported final answer is exactly one encoded
+typed claim followed by its lane citation (`[1].` or one
+`[evidence:<sha256>].`); prefixes, extra claims, and trailing prose are invalid.
+An abstention must equal the production abstention text and contain no
+citations. Authoritative generation refuses a dirty Git checkout and records
+the exact clean source commit.
+
 ## Commands
 
 Contract tests are ordinary offline tests:
@@ -486,9 +567,10 @@ lifecycles, and the fixture agent. qmd is lazily registered and never runs by
 default. A requested unavailable qmd lane produces the complete requested
 harness-error matrix/report and exits `2`; it never disappears or downgrades.
 
-Exit `0` means a complete run and, when applicable, passing promotion. Exit `1`
-means the complete Capsule promotion gate failed. Exit `2` means invalid CLI,
-preflight, harness, or requested-adapter failure. `--write` accepts only a full
+Exit `0` means a complete run and, when applicable, both promotions pass. Exit
+`1` means the complete Capsule or verified Ask promotion gate failed. Exit `2`
+means invalid CLI, preflight, harness, or requested-adapter failure. `--write`
+accepts only a full
 24-task/two-lifecycle lane: the fixture-agent three-adapter lane writes the
 authoritative baseline, while qmd and the three-trial cached-local-model lane
 write only under `baseline/optional/`. Filtered or mixed writes are refused and

package/spec/mcp.md

@@ -151,7 +151,8 @@ Collection names are case-insensitive on input and normalized to lowercase in re
 ### Private retrieval metadata
 
 When local tracing is enabled, successful `gno_search`, `gno_vsearch`,
-`gno_query`, `gno_get`, and `gno_context` results include non-model-visible
+`gno_query`, `gno_get`, `gno_context`, and `gno_ask` results include
+non-model-visible
 top-level response metadata:
 
 ```json
@@ -196,6 +197,54 @@ content or a filesystem path. Aggregate exports reject open/missing traces and
 preserve each stored terminal state without treating partial, failed, or
 cancelled as negative feedback.
 
+### gno_ask
+
+Generate and verify one answer against a closed Context Capsule. This is a
+separate read-only tool; raw retrieval remains on `gno_query`, and trace
+mutation authority is not widened.
+
+Required input:
+
+```json
+{
+  "query": "Who owns the launch decision?",
+  "verify": true
+}
+```
+
+`verify` must be the literal `true`; implicit or raw Ask requests are rejected.
+Optional fields are `collection`, `limit` (default 5), `minScore`, `lang`,
+`intent`, `candidateLimit`, `exclude`, `queryModes`, `tagsAll`, `tagsAny`,
+`since`, `until`, `categories`, `author`, `graph`, `noGraph`, `noRerank`,
+`maxAnswerTokens`, `contextBudgetTokens`, and `contextBudgetBytes`. Input
+objects are closed.
+
+`structuredContent` uses the
+[`ask`](./output-schemas/ask.schema.json) contract. Its `verification` object
+contains the canonical Capsule, freshness receipt, four-state per-claim
+verdicts, exact support/conflict evidence IDs and line spans, coverage, gaps,
+semantic verifier capability, and explicit abstention. Every substantive claim
+must be supported; otherwise the draft is withheld and `answerStatus` is
+`abstained`. Contradiction is never inferred from missing evidence.
+
+Model-visible text renders the same answer status, coverage, semantic state,
+per-claim verdicts, exact `gno://` line spans, evidence IDs, gaps, and cited
+sources. Capability degradation comes from the Capsule's
+requested/attempted/outcome states.
+
+Verification is a closed-Capsule support classification, not a factual
+guarantee. It does not assert that the indexed corpus is complete or that source
+statements are true. Unavailable, incapable, failed, or malformed semantic
+verification cannot produce support; unresolved substantive claims remain
+uncertain and force abstention.
+
+The server-owned effective index is used for both Capsule compilation and
+freshness verification. One Ask-owned trace covers retrieval, Context,
+generation, verification, and exact retained citations. The trace ID remains
+transport-only in `_meta`; no dead ID is emitted after retention eviction.
+Support/conflict spans are inspectable and explicitly labelable, but they do
+not create implicit relevance judgments.
+
 ### gno_context
 
 Compile a deterministic, extractive Context Capsule. The active MCP server
@@ -213,8 +262,9 @@ Required input:
 ```
 
 Optional input fields are `query`, `collections`, `uriPrefix`, `queryModes`,
-`tagsAll`, `tagsAny`, `categories`, `author`, `lang`, `since`, `until`, `graph`,
-`limit`, `candidateLimit`, `budgetBytes`, `safetyMarginTokens`,
+`tagsAll`, `tagsAny`, `categories`, `author`, `lang`, `intent`, `exclude`,
+`minScore`, `since`, `until`, `graph`, `noRerank`, `limit`, `candidateLimit`,
+`budgetBytes`, `safetyMarginTokens`,
 `safetyMarginBytes`, `depthPolicy` (`fast`, `balanced`, or `thorough`), and
 `format` (`json` or `md`). Input objects are closed: unknown fields return
 `invalid_input`. Unknown collections return `invalid_filter` before model or
@@ -1476,6 +1526,28 @@ Use for explicit relationship questions over typed edges such as `works_at`,
 `attended`, or `mentions` after a seed ref is known. Use `gno_query` first if
 the seed document is unknown.
 
+### gno_changes
+
+Read-only metadata journal listing. Input fields: `since` (ISO-8601 time or
+opaque cursor), `collection`, and `limit` (1-1000, default 100). Structured
+content is contract-identical to CLI/REST/SDK `changes.schema.json`; it never
+contains source bodies.
+
+### gno_diff
+
+Read-only structural diff for `ref`, optionally selecting opaque `change`.
+Structured content is `document-diff.schema.json`. Expired/purged history and
+metadata-only content are explicit output states, while unavailable prior
+structure is derived from `structureDelta.truncated`.
+
+### gno_impact
+
+Read-only inbound dependency traversal for `ref`. Inputs `maxDepth`,
+`maxNodes`, `maxEdges`, `frontierLimit`, and `visitedLimit` use the same bounds
+as CLI/REST/SDK. Structured content is `impact.schema.json`; each impacted
+document includes a deterministic evidence path over typed or backlink
+projections. Truncation is explicit when any cap is reached.
+
 ---
 
 ### gno_graph_neighbors

package/spec/output-schemas/ask.schema.json

@@ -4,7 +4,96 @@
   "title": "GNO Ask Response",
   "description": "Response from gno ask command",
   "type": "object",
+  "additionalProperties": false,
   "required": ["query", "mode", "results", "meta"],
+  "allOf": [
+    {
+      "if": {
+        "properties": { "verification": {} },
+        "required": ["verification"]
+      },
+      "then": {
+        "required": ["answer", "citations"],
+        "properties": {
+          "answer": {},
+          "citations": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": { "evidenceId": {} },
+              "required": ["evidenceId"]
+            }
+          },
+          "meta": {
+            "type": "object",
+            "required": ["verificationRequested", "abstained"],
+            "properties": {
+              "verificationRequested": { "const": true },
+              "abstained": {}
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "meta": {
+            "type": "object",
+            "required": ["verificationRequested"],
+            "properties": { "verificationRequested": { "const": true } }
+          }
+        },
+        "required": ["meta"]
+      },
+      "then": {
+        "properties": { "verification": {} },
+        "required": ["verification"]
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "verification": {
+            "type": "object",
+            "properties": {
+              "claims": {
+                "type": "object",
+                "properties": { "answerStatus": { "const": "abstained" } },
+                "required": ["answerStatus"]
+              }
+            },
+            "required": ["claims"]
+          }
+        },
+        "required": ["verification"]
+      },
+      "then": {
+        "properties": {
+          "citations": { "type": "array", "maxItems": 0 },
+          "meta": {
+            "type": "object",
+            "properties": { "abstained": { "const": true } }
+          }
+        }
+      },
+      "else": {
+        "if": {
+          "properties": { "verification": {} },
+          "required": ["verification"]
+        },
+        "then": {
+          "properties": {
+            "citations": { "type": "array", "minItems": 1 },
+            "meta": {
+              "type": "object",
+              "properties": { "abstained": { "const": false } }
+            }
+          }
+        }
+      }
+    }
+  ],
   "$defs": {
     "searchResult": {
       "type": "object",
@@ -165,8 +254,13 @@
       "description": "Citations for the answer",
       "items": {
         "type": "object",
+        "additionalProperties": false,
         "required": ["docid", "uri"],
         "properties": {
+          "evidenceId": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          },
           "docid": {
             "type": "string",
             "description": "Document ID",
@@ -197,8 +291,106 @@
         "$ref": "#/$defs/searchResult"
       }
     },
+    "verification": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schemaVersion",
+        "mode",
+        "capsule",
+        "freshness",
+        "claims",
+        "semantic"
+      ],
+      "properties": {
+        "schemaVersion": { "const": "1.0" },
+        "mode": { "const": "closed_capsule" },
+        "capsule": {
+          "$ref": "gno://schemas/context-capsule-v1@1.0"
+        },
+        "freshness": {
+          "$ref": "gno://schemas/context-capsule-verification@1.0"
+        },
+        "claims": {
+          "$ref": "gno://schemas/claim-verification@1.0"
+        },
+        "semantic": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "status",
+            "reason",
+            "schemaRequested",
+            "schemaEnforced",
+            "modelFingerprint",
+            "configFingerprint",
+            "verifierFingerprint",
+            "candidateClaims",
+            "verifiedClaims",
+            "unresolvedClaims",
+            "modelCalls",
+            "durationMs"
+          ],
+          "properties": {
+            "status": {
+              "enum": ["completed", "unavailable", "failed"]
+            },
+            "reason": {
+              "enum": [
+                "verified",
+                "no_candidates",
+                "verifier_unavailable",
+                "structured_output_unavailable",
+                "input_limit_exceeded",
+                "generation_failed",
+                "invalid_output"
+              ]
+            },
+            "schemaRequested": { "type": "boolean" },
+            "schemaEnforced": { "type": "boolean" },
+            "modelFingerprint": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "pattern": "^[a-f0-9]{64}$"
+                },
+                { "type": "null" }
+              ]
+            },
+            "configFingerprint": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{64}$"
+            },
+            "verifierFingerprint": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "pattern": "^[a-f0-9]{64}$"
+                },
+                { "type": "null" }
+              ]
+            },
+            "candidateClaims": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "verifiedClaims": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "unresolvedClaims": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "modelCalls": { "enum": [0, 1] },
+            "durationMs": { "type": "number", "minimum": 0 }
+          }
+        }
+      }
+    },
     "meta": {
       "type": "object",
+      "additionalProperties": false,
       "description": "Retrieval metadata",
       "required": ["expanded", "reranked", "vectorsUsed"],
       "properties": {
@@ -250,6 +442,12 @@
           "type": "boolean",
           "description": "Whether an answer was generated"
         },
+        "verificationRequested": {
+          "type": "boolean"
+        },
+        "abstained": {
+          "type": "boolean"
+        },
         "totalResults": {
           "type": "integer",
           "description": "Number of results returned",