@gobing-ai/knowledge-kit 0.1.10 → 0.1.12

package/plugins/kk/workflows/kk-daily-ai-voice3.yaml

@@ -24,6 +24,12 @@ vars:
   publish_window: "after-generate"
   publish_preset: ""
   publish_dummy: "false"
+  # 0334 R7: opt-in live consent channel, forwarded verbatim to the nested publish3
+  # `live_channels`. Empty by default — this variable alone can never produce a live send
+  # (ADR-022: only an operator launch that sets it, with tokens the plan stage validates
+  # against the window, promotes rows; `publish_dummy=true` and a non-empty token list
+  # refuse each other at plan time).
+  publish_live_channels: ""
   # Composed by the `prepare` node (`kk daily prepare`), then read back into vars through the
   # single-node read chain below — shell actions cannot set vars, and a concurrent `setVars` merge
   # is last-writer-wins, so the DAG exchanges data by fixed paths under work_dir, never by vars.
@@ -140,6 +146,7 @@ nodes:
         command: >-
           kk stage daily-preflight plugins/kk/workflows/kk-daily-ai-voice2.yaml
           plugins/kk/workflows/kk-daily-safety.yaml
+          plugins/kk/workflows/kk-daily-publish3.yaml
           && kk daily prepare --workflow kk-daily-ai-voice2 --run-date "${vars.run_date}" --ledger-sync
           --run "${vars.__runId}" --definition-digest "${vars.__definitionDigest}"
           --setting window="${vars.window}" --setting language="${vars.language}" --setting vdriver="${vars.vdriver}"
@@ -243,6 +250,31 @@ nodes:
         command: >-
           kk stage daily-qc-content "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}" "${vars.qc_categories}" "${vars.qc_min_quality}" "${vars.qc_min_importance}" "${vars.qc_min_urgency}" "${vars.qc_min_impact}" "${vars.qc_min_episode_items}" "${vars.episode_min_minutes}" "${vars.vdriver}"
 
+  # One guard for the whole pool (0324 R3; 0329 F01/F15): it sits right after `qc-content`, in
+  # front of every token reader, and NEVER exits non-zero — in this engine a failed dependency
+  # never releases its dependents, so a failing gate on an empty pool wedges the graph into
+  # dag-unreachable and turns a thin day into a failed run. The token carries the verdict
+  # instead: PASS opens the content fan-out, EMPTY makes every token-gated node skip, and the
+  # run still closes `done` with a no-content run report.
+  - id: pool-gate
+    description: >-
+      The single pool guard (0324 R3, 0329): `kk store pool-count --min 1` over the candidates
+      file that `qc-content` wrote, recorded once as a token at
+      `.spur/run/<runId>-pool-gate.status`. A token, not a bare dependency, because the engine
+      skips a node only when ALL its dependencies were skipped — so a failed gate beside a done
+      dependency would still admit the node. The gate itself always exits 0 (0329: an empty pool
+      is a no-content day, not a failed run).
+    dependsOn: [qc-content]
+    action:
+      kind: shell
+      options:
+        command: >-
+          OUT=".spur/run/${vars.__runId}-pool-gate.status";
+          mkdir -p "$(dirname "$OUT")";
+          if kk store pool-count "${vars.work_dir}/21-plan/${vars.run_date}_04_quality-control-content_candidates.json" --min 1;
+          then echo PASS > "$OUT";
+          else echo EMPTY > "$OUT"; rm -f "${vars.work_dir}/bundle.json"; fi
+
   - id: select
     description: >-
       Record today's planned set in the store's topic-scoped `selections` ledger (0228). It runs at
@@ -250,7 +282,7 @@ nodes:
       depends on the DAG reaching its tail: a run that fails, pauses at review or skips publish still
       excludes what it planned. Guarded on the QC candidates — a pool that filtered to zero items
       selects nothing.
-    dependsOn: [qc-content]
+    dependsOn: [qc-content, pool-gate]
     condition:
       kind: shell
       options:
@@ -275,7 +307,7 @@ nodes:
 
   - id: plan-translate
     description: "Translate the needsTranslation plan items into the output plan.json via agent.run; onError: continue — plan-translate-retry below is the loud gate (0238 R2)"
-    dependsOn: [qc-content]
+    dependsOn: [qc-content, pool-gate]
     condition:
       kind: shell
       options:
@@ -315,7 +347,7 @@ nodes:
       VALID expectFile (missing or contract-violating JSON), retries the same input on a different
       tier, and carries NO onError — a second miss fails the run loudly instead of letting an
       untranslated or truncated plan flow downstream.
-    dependsOn: [plan-translate]
+    dependsOn: [plan-translate, pool-gate]
     condition:
       kind: shell
       options:
@@ -335,7 +367,7 @@ nodes:
 
   - id: article-write
     description: "Write the tech-sharing prose article from the translated plan via agent.run (3-format split: surfdash gets prose, not a news list); onError: continue — article-write-retry below is the loud gate (0238 R2)"
-    dependsOn: [qc-content, plan-translate, plan-translate-retry]
+    dependsOn: [qc-content, plan-translate, plan-translate-retry, pool-gate]
     condition:
       kind: shell
       options:
@@ -369,7 +401,7 @@ nodes:
       Bounded recovery for article-write (0238 R2): runs only when the primary settled without its
       expectFile, retries the same input on a different tier, and carries NO onError — a second miss
       fails the run loudly instead of publishing an article nobody wrote.
-    dependsOn: [article-write]
+    dependsOn: [article-write, pool-gate]
     condition:
       kind: shell
       options:
@@ -394,7 +426,7 @@ nodes:
       this node: a done dependency in the mix keeps it runnable) as well as on both authoring nodes
       AND their retry siblings, and it carries the same candidates guard — a pool that filtered to
       zero items must not build an empty article.
-    dependsOn: [qc-content, plan-translate, plan-translate-retry, article-write, article-write-retry]
+    dependsOn: [qc-content, plan-translate, plan-translate-retry, article-write, article-write-retry, pool-gate]
     condition:
       kind: shell
       options:
@@ -411,7 +443,7 @@ nodes:
     # 0238 R3: reads 21-plan/<date>_03_plan_plan.json, so it must not start before the plan
     # producers settle. `qc-content` stays in the list: a done dependency in the mix keeps this node
     # runnable when the plan-authoring nodes are disabled (all-skipped deps skip a node).
-    dependsOn: [qc-content, plan-translate, plan-translate-retry]
+    dependsOn: [qc-content, plan-translate, plan-translate-retry, pool-gate]
     condition:
       kind: shell
       options:
@@ -458,7 +490,7 @@ nodes:
 
   - id: script-style
     description: "Snapshot the shipped zh style contract into the work dir (separate node: it is also an audit input for the revision loop)"
-    dependsOn: [qc-content]
+    dependsOn: [qc-content, pool-gate]
     condition:
       kind: shell
       options:
@@ -475,7 +507,7 @@ nodes:
     # 0238 R3: reads 21-plan/<date>_03_plan_plan.json, so it must not start before the plan
     # producers settle. `script-style` stays first in the list: a done dependency in the mix keeps
     # this node runnable when the plan-authoring nodes are disabled (all-skipped deps skip a node).
-    dependsOn: [script-style, plan-translate, plan-translate-retry]
+    dependsOn: [script-style, plan-translate, plan-translate-retry, article, pool-gate]
     condition:
       kind: shell
       options:
@@ -505,7 +537,7 @@ nodes:
       Compile the episode plan Doc[] into structured broadcast VoiceScript YAML Content. Depends on
       `article` so the node still runs when the plan-authoring nodes were disabled or skipped (the
       builder falls back to templates) — but not when the whole content branch is skipped.
-    dependsOn: [article, script-style, script-write]
+    dependsOn: [article, script-style, script-write, pool-gate]
     condition:
       kind: shell
       options:
@@ -558,7 +590,7 @@ nodes:
 
   - id: wrap-docs
     description: "Wrap VoiceScript into Doc[] input for the voice generator plugin (the generate-side variant input)"
-    dependsOn: [script, review]
+    dependsOn: [script, review, pool-gate]
     condition:
       kind: shell
       options:
@@ -574,7 +606,7 @@ nodes:
     description: "Voice tier, primary driver (vars.vdriver — voxcpm; its 40 ms lattice is known and monitored, see the vdriver comment). onError: continue — the fallback siblings below are the loud chain (same pattern as 0238 R2)."
     # wrap-docs is a data dependency, not a sibling: daily-generate reads its _10_wrap-docs_docs.json
     # as the TTS input. Without this edge the two nodes race in the same wave (0212 dogfood finding).
-    dependsOn: [script, safety, review, wrap-docs]
+    dependsOn: [script, safety, review, wrap-docs, pool-gate]
     condition:
       kind: shell
       options:
@@ -582,8 +614,8 @@ nodes:
         command: 'test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
     action:
       kind: shell
+      onError: continue
       options:
-        onError: continue
         command: >-
           OMNIVOICE_SPEED=1.06 kk stage daily-generate "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}" "${vars.transcode_mp3}" "${vars.vdriver}" "1" "${vars.episode_max_minutes}" "${vars.episode_min_minutes}"
 
@@ -595,7 +627,7 @@ nodes:
 
   - id: generate-fallback
     description: "Voice tier fallback 1: gemini (gemini-tts) when the primary driver left no valid Content — the measured-dry escape hatch from voxcpm's lattice"
-    dependsOn: [generate]
+    dependsOn: [generate, pool-gate]
     condition:
       kind: shell
       options:
@@ -605,14 +637,14 @@ nodes:
           && ! jq -e '(.metadata.generator == "kk:voxcpm-tts" or .metadata.generator == "kk:gemini-tts") and .metadata.qc.passed == true' "${vars.work_dir}/30-audio/${vars.run_date}_11_generate_content.json"
     action:
       kind: shell
+      onError: continue
       options:
-        onError: continue
         command: >-
           kk stage daily-generate "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}" "${vars.transcode_mp3}" "gemini" "1" "${vars.episode_max_minutes}" "${vars.episode_min_minutes}"
 
   - id: generate-fallback2
     description: "Voice tier fallback 2 (last, loud): omni-voice-gen when neither voxcpm nor gemini delivered"
-    dependsOn: [generate-fallback]
+    dependsOn: [generate-fallback, pool-gate]
     condition:
       kind: shell
       options:
@@ -626,9 +658,17 @@ nodes:
         command: >-
           OMNIVOICE_SPEED=1.06 kk stage daily-generate "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}" "${vars.transcode_mp3}" "ominivoice" "1" "${vars.episode_max_minutes}" "${vars.episode_min_minutes}"
 
+  # 0329 F15: a script-gate refusal produces no audio, but the sting must not fail the day —
+  # the refusal artifact admits intro (and duration closes the run as no-content on it).
   - id: intro
     description: "Prepend the 8s intro sting (intro_music var; empty = skip), update duration/audioPath"
     dependsOn: [generate, generate-fallback, generate-fallback2]
+    condition:
+      kind: shell
+      options:
+        command: >-
+          test -f "${vars.work_dir}/30-audio/${vars.run_date}_11_generate_content.json"
+          -o -f "${vars.work_dir}/30-audio/${vars.run_date}_11_generate_content_duration-refusal.json"
     action:
       kind: shell
       options:
@@ -658,32 +698,39 @@ nodes:
         onError: continue
 
   - id: duration
-    description: "Measured duration gate: under episode_min_minutes the run refuses and closes as no-content (refusal artifact + emptied candidates, exit 0 — 0266); above episode_max_minutes it still fails loud. Duration is authoritative."
+    description: "Measured duration gate: under episode_min_minutes the run refuses and closes as no-content (refusal artifact + emptied candidates + publish-path invalidation, exit 0 — 0266/0329); above episode_max_minutes it still fails loud. Duration is authoritative."
     dependsOn: [intro]
     action:
       kind: shell
       options:
         command: >-
-          kk stage daily-episode-duration "${vars.work_dir}" "${vars.run_date}" "${vars.episode_min_minutes}" "${vars.episode_max_minutes}" "${vars.vdriver}"
+          kk stage daily-episode-duration "${vars.work_dir}" "${vars.run_date}" "${vars.episode_min_minutes}" "${vars.episode_max_minutes}" "${vars.vdriver}" "${vars.__runId}"
 
   - id: quality
     description: >-
-      Verify audio quality, speech rate, and silence/repetition QC metrics over the assembled
-      episode. Depends on the audio tail and wrap-docs: voice3 no longer packages a publish-prep
-      Content, so the audited bytes are the generated episode itself.
-    dependsOn: [duration, wrap-docs]
+      Print the daily QC table (daily-quality-report) and then gate on it (0329 F23): the print
+      alone never gated anything — a 41/100 episode sailed into show-notes, the bundle and the
+      publish windows. The verdict stage fails loud when the generator's audio qc verdict is
+      missing or `passed` is false, so a bad episode dies here instead of at a tier-0 send.
+    dependsOn: [duration, wrap-docs, pool-gate]
+    condition:
+      kind: shell
+      options:
+        # 0324 R3: the pool verdict is `pool-gate`'s token, never a repeated `kk store pool-count`.
+        command: 'test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
     action:
       kind: shell
       options:
         command: >-
           kk stage daily-quality-report "${vars.work_dir}" "${vars.run_date}"
+          && kk stage run daily-quality-verdict "${vars.work_dir}" "${vars.run_date}"
 
   - id: show-notes
     description: >-
       Render timeline show notes from the episode plan — content, not publishing: the publish half
       ships them as the episode variant's `metadata.showNotes`, and the link placeholders stay
       unresolved until a send resolves them."
-    dependsOn: [quality]
+    dependsOn: [quality, pool-gate]
     condition:
       kind: shell
       options:
@@ -694,13 +741,36 @@ nodes:
       options:
         command: >-
           kk stage daily-show-notes "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}" "${vars.title}"
+
+  # 0329 F02: voice3 lost daily-publish-prep in the migration (voice2 keeps it at its :704), so
+  # `31-publish/<date>_13_publish-prep_content.json` — the episode variant's source — was never
+  # written by this workflow, and a freeze only succeeded against a stale same-day voice2 prep
+  # file. Rebuilt per the voice2 template: after duration (it reads the generate content's
+  # mp3Path, and ID3 stamps must land on the final post-intro MP3), pool-gated so a refused
+  # episode packages nothing.
+  - id: publish-prep
+    description: >-
+      Package the publish-ready episode Content (ID3 tags on the final post-intro MP3, cover
+      path, article link) into 31-publish/<date>_13_publish-prep_content.json — the episode
+      variant's source for bundle-variants.
+    dependsOn: [duration, article, safety, pool-gate]
+    condition:
+      kind: shell
+      options:
+        # 0324 R3: the pool verdict is `pool-gate`'s token, never a repeated `kk store pool-count`.
+        command: 'test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
+    action:
+      kind: shell
+      options:
+        command: >-
+          kk stage daily-publish-prep "${vars.work_dir}" "${vars.run_date}" "${vars.podcast_artist}" "${vars.podcast_album}"
   - id: cards-write
     description: "Plan the card series across the episode's plan items via agent.run; onError: continue — a failed plan skips the card series, never the run"
     dependsOn: [script, review, pool-gate]
     condition:
       kind: shell
       options:
-        command: 'test "${vars.cards_enabled}" = "true"'
+        command: 'test "${vars.cards_enabled}" = "true" && test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
     action:
       kind: agent.run
       onError: continue
@@ -720,14 +790,14 @@ nodes:
 
   - id: cards-render
     description: "Render the card series through the pinned xhs-card/xhs-knowledge presets, attach the episode cover last and pair every image with its numbered line (0235 note_scope=episode); onError: continue — the publish node names the missing series and stays soft"
-    dependsOn: [cards-write]
+    dependsOn: [cards-write, pool-gate]
     # A skipped cards-write still admits its dependents, so each card node keeps its own switch:
     # without it a run with cards_enabled=false would re-package a stale same-day 25-xhs/ series.
     # The pool guard is `pool-gate`'s alone in voice3 (0324 R3).
     condition:
       kind: shell
       options:
-        command: 'test "${vars.cards_enabled}" = "true"'
+        command: 'test "${vars.cards_enabled}" = "true" && test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
     action:
       kind: shell
       onError: continue
@@ -737,31 +807,12 @@ nodes:
 
   # ---- generate-side payloads and the frozen bundle (0324 R2/R3) ----
 
-  # One guard for the whole pool (0324 R3): every node that used to repeat `kk store pool-count`
-  # depends on this one, so a refused pool empties the candidates file once and the rest of the
-  # graph skips through the engine's all-deps-skipped rule.
-  - id: pool-gate
-    description: >-
-      The single pool guard (0324 R3): `kk store pool-count --min 1` over the candidates file that
-      `qc-content` wrote, recorded once as a token at `.spur/run/<runId>-pool-gate.status`. voice2
-      repeated the same guard on twenty-one conditions. A token, not a bare dependency, because the
-      engine skips a node only when ALL its dependencies were skipped — so a failed gate beside a
-      done dependency would still admit the node. Everything downstream reads the token.
-    dependsOn: [qc-content]
-    action:
-      kind: shell
-      options:
-        command: >-
-          OUT=".spur/run/${vars.__runId}-pool-gate.status";
-          if kk store pool-count "${vars.work_dir}/21-plan/${vars.run_date}_04_quality-control-content_candidates.json" --min 1;
-          then echo PASS > "$OUT";
-          else echo EMPTY > "$OUT"; exit 1; fi
-
   - id: social-write
     description: >-
-      Author one short post per social platform (x, weibo, threads) from the approved plan, in zh,
-      inside each platform's character cap. `daily-bundle-variants` truncates as a backstop, so a
-      missed cap degrades rather than fails; a missing file simply skips that platform's variant.
+      Author one short post per social platform (x, weibo, threads, linkedin) from the approved
+      plan, in zh, inside each platform's character cap. `daily-bundle-variants` truncates as a
+      backstop, so a missed cap degrades rather than fails; a missing file simply skips that
+      platform's variant.
     dependsOn: [quality]
     action:
       kind: agent.run
@@ -771,10 +822,11 @@ nodes:
         agent: ${vars.agent}
         input: |
           Read the approved episode plan at ${vars.work_dir}/21-plan/${vars.run_date}_03_plan_plan.json.
-          Write three short zh posts, one per file:
+          Write four short zh posts, one per file:
           - ${vars.work_dir}/26-social/x.md — at most 280 weighted characters (this feed counts CJK as 2, so ~140 汉字 or 280 Latin letters)
           - ${vars.work_dir}/26-social/weibo.md — at most 2000 characters
           - ${vars.work_dir}/26-social/threads.md — at most 500 characters
+          - ${vars.work_dir}/26-social/linkedin.md — at most 3000 characters
           Each post: the day's single most interesting item, one concrete number or name from the
           plan, no hashtag spam, no emoji, no "点击链接", no invented facts. Plain text, no markdown
           headings. Deliver with your file-write tool; each file must be non-empty.
@@ -784,35 +836,83 @@ nodes:
     description: >-
       Build the channel payloads from the run's own artifacts (0327 builders): `30-variants/<key>`
       for article / episode / cards plus the channel-specific keys and the social posts, all with
-      `{{article_url}}` / `{{podcast_url}}` placeholders because nothing is published yet.
-    dependsOn: [quality, social-write]
+      `{{article_url}}` / `{{podcast_url}}` placeholders because nothing is published yet. 0329
+      F16: depends on every producer it reads (the 0324 file order alone was not a guarantee),
+      wipes stale variants first, and follows the cards/cover switches so a disabled producer's
+      variant is a skip, not a stale re-read.
+    dependsOn: [quality, social-write, publish-prep, cover-normalize, cards-render, pool-gate]
+    condition:
+      kind: shell
+      options:
+        # 0324 R3: the pool verdict is `pool-gate`'s token, never a repeated `kk store pool-count`.
+        command: 'test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
     action:
       kind: shell
       options:
         command: >-
           kk stage run daily-bundle-variants "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}"
+          "${vars.cards_enabled}" "${vars.cover_enabled}"
+
+  - id: safety-variants
+    description: >-
+      Final-variant safety review through the same nested kk-daily-safety machine (0331): the
+      manifest stage registers every `30-variants/*.content.json` first, then the machine runs in
+      the variants scope (`safety_scope_dir=4-safety-variants` re-roots its stages, guards and
+      prompts; the drafts review above is untouched). On an admitted outcome the machine leaves
+      `4-safety-variants/safety.json` — status, exclusion record and the sha256 of every reviewed
+      variant's current bytes — which publish-matrix-bundle freezes into the bundle so live
+      launches and social edits are gated on exactly the reviewed bytes. Fails closed: a block or
+      an integrity failure fails this node (the drafts scope's non-zero = never publish contract).
+    dependsOn: [bundle-variants, pool-gate]
+    condition:
+      kind: shell
+      options:
+        # 0324 R3: the pool verdict is `pool-gate`'s token, never a repeated `kk store pool-count`.
+        command: 'test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
+    action:
+      kind: shell
+      options:
+        command: >-
+          kk stage run daily-safety-manifest "${vars.work_dir}" "${vars.run_date}" &&
+          env -u SPUR_WORKFLOW_RUN_ACTIVE -u SPUR_EXPECTED_DEFINITION_DIGEST
+          spur workflow run plugins/kk/workflows/kk-daily-safety.yaml
+          --vars "{\"work_dir\":\"${vars.work_dir}\",\"run_date\":\"${vars.run_date}\",\"safety_max_revise\":\"${vars.safety_max_revise}\",\"safety_platforms\":\"${vars.safety_platforms}\",\"agent\":\"${vars.agent}\",\"safety_scope_dir\":\"4-safety-variants\"}"
+          --quiet --no-plan
 
   - id: bundle-freeze
     description: >-
       Freeze `bundle.json` (0321 `BundleSchema`): every `30-variants/*` file with its sha256 plus the
       episode title, so the publish half can run later, or three times a day, against exactly these
       bytes. Fails when the article or episode variant is missing — a bundle never advertises what
-      generate did not produce.
-    dependsOn: [bundle-variants]
+      generate did not produce. 0329 F15: token-gated, so a refused episode never freezes — the
+      duration gate also drops this run's bundle.json on a refusal. 0331: after safety-variants, so
+      the freeze reads the review's evidence (or the bundle stays without it, on a skipped run).
+    dependsOn: [bundle-variants, safety-variants, pool-gate]
+    condition:
+      kind: shell
+      options:
+        # 0324 R3: the pool verdict is `pool-gate`'s token, never a repeated `kk store pool-count`.
+        command: 'test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
     action:
       kind: shell
       options:
         command: >-
-          kk stage run publish-matrix-bundle "${vars.work_dir}" --run-date "${vars.run_date}" --run-id "${vars.__runId}"
+          case "${vars.publish_preset}" in '') ARGS='' ;; *) ARGS="--preset ${vars.publish_preset}" ;; esac;
+          kk stage run publish-matrix-bundle "${vars.work_dir}" --run-date "${vars.run_date}" --run-id "${vars.__runId}" $ARGS
 
   - id: generation-report
-    description: "The generate half's report (the publish half writes its own, per window)."
-    dependsOn: [bundle-freeze]
+    description: "The generate half's report (the publish half writes its own, per window). 0329 F15: real run-report flags — the phantom skip flag made every invocation exit 1; the pool/candidates/qc inputs are what let the report record a no-content close. Depends on pool-gate beside bundle-freeze: pool-gate always completes, so the report (and the ledger after it) also land on a no-content close — the design requires the report reachable from extract/QC/no-content, not only bundle-freeze."
+    dependsOn: [bundle-freeze, pool-gate]
     action:
       kind: shell
       options:
         command: >-
-          kk daily run-report --work-dir "${vars.work_dir}" --run-date "${vars.run_date}" --skip-store
+          kk daily run-report --work-dir "${vars.work_dir}" --run-date "${vars.run_date}"
+          --pool "${vars.work_dir}/10-collect/pool.json"
+          --candidates "${vars.work_dir}/21-plan/${vars.run_date}_04_quality-control-content_candidates.json"
+          --plugins-path "${vars.plugins_path}"
+          --qc-min-quality "${vars.qc_min_quality}" --qc-min-importance "${vars.qc_min_importance}"
+          --qc-min-urgency "${vars.qc_min_urgency}" --qc-min-impact "${vars.qc_min_impact}"
 
   - id: publish
     description: >-
@@ -820,18 +920,18 @@ nodes:
       window against the bundle this run just froze. The launcher vars are stripped at the nested
       boundary (the same two voice2 strips for the safety machine), and the nested run's exit code is
       surfaced — a failed publish window is a failed generate run's last step, never a silent one.
-    dependsOn: [generation-report]
+    dependsOn: [generation-report, pool-gate]
     condition:
       kind: shell
       options:
-        command: 'test "${vars.auto_publish}" = "true"'
+        command: 'test "${vars.auto_publish}" = "true" && test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
     action:
       kind: shell
       options:
         command: >-
           env -u SPUR_WORKFLOW_RUN_ACTIVE -u SPUR_EXPECTED_DEFINITION_DIGEST
           spur workflow run plugins/kk/workflows/kk-daily-publish3.yaml
-          --vars "{\"work_dir\":\"${vars.work_dir}\",\"run_date\":\"${vars.run_date}\",\"window\":\"${vars.publish_window}\",\"preset\":\"${vars.publish_preset}\",\"dummy\":\"${vars.publish_dummy}\"}"
+          --vars "{\"work_dir\":\"${vars.work_dir}\",\"run_date\":\"${vars.run_date}\",\"window\":\"${vars.publish_window}\",\"preset\":\"${vars.publish_preset}\",\"dummy\":\"${vars.publish_dummy}\",\"live_channels\":\"${vars.publish_live_channels}\"}"
 
   - id: ledger
     description: "Append this run to the workflow ledger; bookkeeping never fails a generation."

package/plugins/kk/workflows/kk-daily-publish3.yaml

@@ -99,6 +99,18 @@ nodes:
       options:
         command: 'kk stage run publish-matrix-check "${vars.work_dir}" --window "${vars.window}" || true'
 
+  - id: validate
+    description: >-
+      Bind the bundle's calendar day before any side effect (0332 R1): normalize the run date
+      (compact `YYYYMMDD` and ISO `YYYY-MM-DD` both accepted), refuse a garbage one, and write the
+      canonical `4-publish/run-date.txt` every later stage derives its day from.
+    dependsOn: []
+    action:
+      kind: shell
+      options:
+        command: >-
+          kk stage run publish-matrix-validate "${vars.work_dir}" --run-date "${vars.run_date}"
+
   - id: send-confirm
     description: >-
       Operator approval of a LIVE send: `pause: true` stops the run and RESUME is the approval;
@@ -119,79 +131,121 @@ nodes:
       Receipts key every target, so a rerun never resends what was delivered, and a dummy row never
       spawns a plugin. `check` is listed beside `send-confirm` on purpose: the engine skips a node only
       when ALL its dependencies were skipped, so a draft window (no live row → `send-confirm` skipped)
-      still sends, while a gated/blocked plan (both ancestors skipped) still stops here.
+      still sends, while a gated/blocked plan (both ancestors skipped) still stops here. A failing
+      target does NOT end the run here — `onError: continue` lets the bounded retry and the outcome
+      assertion decide, so the evidence (report, ledger, outcome) always survives to the operator.
     dependsOn: [check, send-confirm]
     action:
       kind: shell
+      onError: continue
       options:
         command: 'kk stage run publish-matrix-send "${vars.work_dir}" --window "${vars.window}"'
 
+  - id: send-retry
+    description: >-
+      The ONE bounded retry (0333): `--retry` resends only rows whose receipt is a live/draft failure
+      with `effect: none` — a succeeded row is skipped, a live row with an unknown effect is never
+      resent, and a dummy row never spawns a plugin. No unbounded back-edge: one retry node, then the
+      outcome assertion rules. A targeted operator rerun of this node is the recovery path for a
+      window that still ends non-full.
+    dependsOn: [send]
+    condition:
+      kind: shell
+      options:
+        command: 'test "${vars.window}" != "overseas-rss"'
+    action:
+      kind: shell
+      options:
+        command: 'kk stage run publish-matrix-send "${vars.work_dir}" --window "${vars.window}" --retry'
+
   - id: classify
     description: >-
       Turn the window's receipts into `full|partial|none|dummy` (`4-publish/outcome.<window>.json`),
-      always exit 0 — routing is this graph's job, not the classifier's.
-    dependsOn: [send]
+      always exit 0 — routing is this graph's job, not the classifier's. The run date comes from the
+      plans/`run-date.txt` (0332 R1), so a late `run_date` guard is gone; a provided one must match
+      the bundle's own day and the stage refuses a mismatch.
+    dependsOn: [send-retry, send]
     action:
       kind: shell
       options:
         command: >-
-          test -n "${vars.run_date}" || { echo "publish3: classify needs run_date" >&2; exit 1; };
           kk stage run publish-matrix-classify "${vars.work_dir}" --window "${vars.window}" --run-date "${vars.run_date}"
 
   # ── after-generate only: the voice2-era tail stages keep working on the bridged names ─────
-  - id: surfdash-patch
+  - id: patch-surfdash
     description: >-
-      after-generate only: cover and podcast cross-link patching plus the CMS re-sync, whenever tier 0
-      published something. Reads the legacy `31-publish` names the classifier bridged, so voice2's own
-      stage body is reused unchanged.
+      after-generate only: cover and podcast cross-link patching plus the CMS re-sync, and only when
+      a real surfdash receipt exists. The payload is derived from that receipt's aggregate
+      `metadata.postPath` — never from legacy aggregate files or any site-root argument: the plugin
+      resolves its own checkout. A dummy or missing podcast episode yields
+      explicit empty links; there is nothing to patch without a real post. The stage is its own gate:
+      with no real tier-0 post evidence it records an explicit skip and exits 0 (the channel matrix
+      lives in the preset, so the graph cannot name channels here).
     dependsOn: [classify]
     condition:
       kind: shell
       options:
-        command: >-
-          test "${vars.window}" = "after-generate"
-          && grep -qxE 'full|partial' "${vars.work_dir}/4-publish/publish-status.after-generate.txt" 2>/dev/null
+        command: 'test "${vars.window}" = "after-generate"'
 
     action:
       kind: shell
       options:
-        command: >-
-          kk stage run daily-patch-surfdash "${vars.work_dir}" "${vars.run_date}" "$KK_SURFDASH_ROOT" ""
+        command: 'kk stage run publish-matrix-patch-surfdash "${vars.work_dir}" --window "${vars.window}"'
 
   - id: partial-marker
-    description: "after-generate only: record the partial-publish marker when the classifier said partial."
+    description: >-
+      Record the partial/none recovery marker when the classifier said so: names the exact failed
+      target ids from the receipt-derived outcome and points at the receipt-scoped rerun (`--retry`).
+      A full window deletes any stale marker, so the report never re-flags recovered targets.
     dependsOn: [classify]
     condition:
       kind: shell
       options:
         command: >-
-          test "${vars.window}" = "after-generate"
-          && grep -qx 'partial' "${vars.work_dir}/4-publish/publish-status.after-generate.txt" 2>/dev/null
+          grep -qx 'partial' "${vars.work_dir}/4-publish/outcome.${vars.window}.json" 2>/dev/null ||
+          grep -qx 'none' "${vars.work_dir}/4-publish/outcome.${vars.window}.json" 2>/dev/null
 
     action:
       kind: shell
       options:
-        command: 'kk stage run daily-publish-partial "${vars.work_dir}" "${vars.run_date}"'
+        command: 'kk stage run publish-matrix-partial "${vars.work_dir}" --window "${vars.window}"'
 
-  - id: mark-published
+  - id: settle
     description: >-
-      after-generate only: mark the run's items published in the store once the owned platforms
-      delivered. Keyed by the voice3 run id the bundle records, never by this publish run.
+      Promote the store selection only on receipt-proven completion (0333): every required real row
+      must carry a CURRENT-bundle receipt that is succeeded/confirmed/live — draft preparation and
+      dummy rehearsals HOLD the selection (no store call), never claim a publication. Writes
+      `4-publish/settlement.<window>.json` naming each unresolved row. Keyed to the bundle's
+      parentRunId, never to this publish run. Exit 0 while holding: the outcome assertion owns the
+      run's exit code, so this evidence file always survives.
     dependsOn: [classify]
     condition:
       kind: shell
       options:
-        command: >-
-          test "${vars.window}" = "after-generate"
-          && grep -qxE 'full|partial' "${vars.work_dir}/4-publish/publish-status.after-generate.txt" 2>/dev/null
+        command: 'test "${vars.window}" != "overseas-rss"'
+    action:
+      kind: shell
+      options:
+        command: 'kk stage run publish-matrix-settle "${vars.work_dir}" --window "${vars.window}" --topic ai-news'
+
+  - id: outcome-assert
+    description: >-
+      The run's honest exit (0333): when an outcome exists, every required real row must be
+      succeeded — a partial window with failed required targets fails the run AFTER report and ledger
+      are written, with the outcome, receipts and incident evidence preserved. Gated-miss windows
+      (no outcome file) stay done: the diagnose/repair path already classified them.
+    dependsOn: [ledger]
+    condition:
+      kind: shell
+      options:
+        command: 'test -f "${vars.work_dir}/4-publish/outcome.${vars.window}.json"'
 
     action:
       kind: shell
       options:
         command: >-
-          PARENT="$(jq -r '.parentRunId // .runId' "${vars.work_dir}/bundle.json" 2>/dev/null)";
-          test -n "$PARENT" || { echo "publish3: bundle has no run id" >&2; exit 1; };
-          kk store mark-published --topic ai-news --run "$PARENT"
+          jq -e 'all(.rows[]; .required != true or .dummy == true or .status == "succeeded")' "${vars.work_dir}/4-publish/outcome.${vars.window}.json" >/dev/null
+          || { echo "publish3: required targets failed — see outcome.${vars.window}.json and 5-report" >&2; exit 1; }
 
   # ── the incident path: a gated miss is diagnosed, never silently dropped ─────────────────
   - id: diagnose
@@ -270,6 +324,8 @@ nodes:
           printf '# Publish report — %s — %s\n\n- status: %s\n\n| target | tier | status | effect | dummy |\n| --- | --- | --- | --- | --- |\n'
           "${vars.window}" "${vars.run_date}" "$STATUS" > "$OUT";
           jq -r '.rows[] | "| \(.id) | \(.tier) | \(.status) | \(.effect // "-") | \(.dummy) |"'
+          "${vars.work_dir}/4-publish/outcome.${vars.window}.json" >> "$OUT" 2>/dev/null || true;
+          jq -r '.excluded[]? | "- excluded: \(.id) (\(.plugin)) — \(.reason)"'
           "${vars.work_dir}/4-publish/outcome.${vars.window}.json" >> "$OUT" 2>/dev/null || true
 
   - id: ledger