@heretek-ai/epistemic-swarm 0.7.12 → 0.7.13

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "epistemic-swarm",
-  "version": "0.7.12",
+  "version": "0.7.13",
   "description": "High-Integrity Dialectic Research Agent Harness for Claude Code enforcing empirical evidence over parametric hallucination.",
   "author": {
     "name": "Heretek AI",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heretek-ai/epistemic-swarm",
-  "version": "0.7.12",
+  "version": "0.7.13",
   "description": "IUMBTEMS (Epistemic Swarm) — High-Integrity Dialectic Research Agent Harness for Claude Code, OpenCode V2, Pi (pi.dev), OMP (oh-my-pi), Gemini CLI, Codex CLI, and AntiGravity",
   "main": "bin/cli.js",
   "bin": {

package/prompts/agent_darkharvest.md

@@ -33,6 +33,17 @@ partial per capability), benchmark/API quotes, and per-feature harvest
 proposals. Every cell needs `[VERIFIED: <hash>]` from
 `.research/sources/<sha256>.md` or `file://<path>#L<start>-L<end>`.
 
+Discover and cache every cited source before you cite it (zero-key, no API keys):
+
+```bash
+python3 skills/epistemic_search/scripts/search.py "<query>"
+python3 skills/research_cache/hasher.py cache --url "<URL>" --content "$(cat fetched.md)" --title "<TITLE>"
+```
+
+Confirm a repository actually exists (`owner/repo`) before citing it. A run that
+never searches caches zero sources and is flagged `WARNING_LOW_GROUNDING` — the
+runner prints `retrieval: N queries, M results, K cached` as evidence either way.
+
 ### Beta — Red Team
 License gate (LICENSE file + package metadata → SPDX), transitive weight,
 CVE/takeover notes, staleness (`⚠️ STALE` when >12mo or solo-maintainer),
@@ -51,7 +62,9 @@ AND what we lack). Gates are warn-only: badge inline, never auto-skip.
 ## 4. OUTPUT SPECIFICATION
 
 Per scope write `alpha_dossier.json` / `beta_dossier.json` with
-`candidate_repositories[]` entries:
+`candidate_repositories[]` entries. Every entry MUST carry `source_hash` **and**
+`verbatim_quote` (an exact substring of the cached `.research/sources/<hash>.md`);
+entries without both are rejected as unverified by the audit.
 
 ```json
 {
@@ -59,6 +72,7 @@ Per scope write `alpha_dossier.json` / `beta_dossier.json` with
   "name": "owner/repo",
   "url": "https://github.com/owner/repo",
   "source_hash": "<sha256>",
+  "verbatim_quote": "<exact substring of the cached source>",
   "license": "Apache-2.0",
   "license_risk": "SAFE | COPYLEFT_WARNING | PROHIBITIVE",
   "harvest_policy": "depend-or-vendor | clean-room-rebuild-only",
@@ -89,3 +103,8 @@ candidates.
 3. No unverified harvest verdicts. Metadata ranks; only VERIFIED harvests.
 4. No unbounded expansion past `--max-repos` or per-repo caps without user
    confirmation. Firecrawl missing → gap note, never abort.
+5. **Do NOT self-report audit results.** Never emit `epistemic_audit`,
+   `confidence`, `verified_*`, `unverified_*`, `mean_epistemic_score`, or any
+   `*.verified` / `*.total_sources` field. The runner computes verification from
+   cached witnesses; agent-declared counts are ignored (renamed to
+   `self_reported_*`) and only mislead a human reader.

package/runner/auditor_engine.py

@@ -5,6 +5,7 @@ Verifies quote authenticity against content-addressed source cache,
 calculates divergence metrics, prunes ungrounded claims, and generates synthesis reports.
 """
 
+import os
 import sys
 import json
 from pathlib import Path
@@ -17,6 +18,22 @@ from skills.research_cache.hasher import SourceHasher
 from runner.state_machine import ResearchStateMachine, ScopeStatus
 from runner.refinement import compute_epistemic_score
 
+from runner.darkharvest_claims import (
+    RepoValidator,
+    cross_check_repos,
+    normalize_dossier_claims,
+    sanitize_self_reported,
+)
+
+
+def _repo_validation_enabled() -> bool:
+    return os.environ.get("IUMBTEMS_REPO_VALIDATE", "1").strip().lower() not in (
+        "0",
+        "false",
+        "no",
+        "off",
+    )
+
 
 def _mark_rejected_claims(score_claims: list, *result_lists: list) -> None:
     """Mirror the auditor's UNVERIFIED_REJECTED verdict onto ClaimWitness records."""
@@ -114,10 +131,16 @@ def _apply_living_dossiers_degradation(
 
 
 class EpistemicAuditorEngine:
-    def __init__(self, base_dir: Optional[Path] = None):
+    def __init__(
+        self,
+        base_dir: Optional[Path] = None,
+        repo_validator: Optional[Any] = None,
+    ):
         self.base_dir = base_dir or Path(".research")
         self.hasher = SourceHasher(base_dir=self.base_dir)
         self.state_machine = ResearchStateMachine(base_dir=self.base_dir)
+        # Ground-truth repo checks for darkharvest; injectable for tests/offline.
+        self.repo_validator = repo_validator
 
     def audit_scope(
         self,
@@ -149,16 +172,26 @@ class EpistemicAuditorEngine:
         with open(beta_file, "r", encoding="utf-8") as f:
             beta_dossier = json.load(f)
 
+        # Darkharvest dossiers emit `candidate_repositories[]`, not the standard
+        # claim keys, and may self-report audit-shaped fields (#5 layers 1 & 3).
+        for label, dossier in (("alpha", alpha_dossier), ("beta", beta_dossier)):
+            _, renamed = sanitize_self_reported(dossier)
+            if renamed:
+                print(
+                    f"  [Audit] ignored agent self-reported audit fields "
+                    f"({label}): {', '.join(sorted(renamed))}"
+                )
+
         self.state_machine.update_scope_status(scope_id, ScopeStatus.AUDITING)
 
-        # 1. Audit Alpha Claims
+        # 1. Audit Alpha Claims (normalized from either schema)
         alpha_results, alpha_verified, alpha_rejected = self._verify_claims(
-            alpha_dossier.get("affirmative_claims", []), constitution=constitution
+            normalize_dossier_claims(alpha_dossier, "alpha"), constitution=constitution
         )
 
         # 2. Audit Beta Claims
         beta_results, beta_verified, beta_rejected = self._verify_claims(
-            beta_dossier.get("falsification_claims", []), constitution=constitution
+            normalize_dossier_claims(beta_dossier, "beta"), constitution=constitution
         )
 
         counts = {
@@ -196,6 +229,28 @@ class EpistemicAuditorEngine:
             alpha_dossier, beta_dossier
         )
 
+        # 4b. Darkharvest: license cross-check + repo ground truth. A dialectic
+        # that recommends `depend-or-vendor` on an unstated license must not pass
+        # as CERTIFIED (observed: MIT vs NOASSERTION for the same repo, #5).
+        harvest_findings: List[Dict[str, Any]] = []
+        if mode == "darkharvest":
+            validator = self.repo_validator
+            if validator is None:
+                validator = RepoValidator(enabled=_repo_validation_enabled())
+            harvest_findings = cross_check_repos(
+                alpha_dossier, beta_dossier, validator=validator
+            )
+
+        blocking_findings = [
+            f for f in harvest_findings if f.get("severity") == "BLOCKING"
+        ]
+        if blocking_findings:
+            verdict = "WARNING_LICENSE_CONFLICT"
+        elif epistemic_score >= accept_threshold:
+            verdict = "CERTIFIED"
+        else:
+            verdict = "WARNING_LOW_GROUNDING"
+
         # 5. Build Audit Report
         audit_report = {
             "auditor": "Epistemic Auditor Engine v1.0",
@@ -209,13 +264,13 @@ class EpistemicAuditorEngine:
                 "epistemic_score": epistemic_score,
                 "divergence_score": divergence_score,
                 "mode": mode,
-                "verdict": "CERTIFIED"
-                if epistemic_score >= accept_threshold
-                else "WARNING_LOW_GROUNDING",
+                "blocking_findings": len(blocking_findings),
+                "verdict": verdict,
             },
             "alpha_claims_audit": alpha_results,
             "beta_claims_audit": beta_results,
             "divergence_matrix": divergence_matrix,
+            "harvest_findings": harvest_findings,
             "degradation": degradation,
         }
 
@@ -397,7 +452,9 @@ class EpistemicAuditorEngine:
         return lines
 
     @staticmethod
-    def _render_rejected_section(claims: list) -> List[str]:
+    def _render_rejected_section(
+        claims: list, summary: Optional[Dict[str, Any]] = None
+    ) -> List[str]:
         lines = ["\n## 3. Rejected & Unverified Assertions"]
         rejected = [c for c in claims if c["audited_tag"] == "UNVERIFIED_REJECTED"]
         if rejected:
@@ -405,9 +462,26 @@ class EpistemicAuditorEngine:
                 lines.append(
                     f'- ⚠️ **PURGED**: "{r["statement"]}" — *Reason: {r["reason"]}*'
                 )
+            return lines
+
+        # No rejected claims is only "all verified" when the audit actually
+        # verified something. Otherwise this is static text contradicting the
+        # verdict (observed in darkharvest: 0 verified + "100% verified", #5).
+        summary = summary or {}
+        verified = summary.get("verified_passed", 0)
+        if summary.get("verdict") == "WARNING_LICENSE_CONFLICT":
+            lines.append(
+                f"No claims rejected, but {summary.get('blocking_findings', 0)} "
+                "blocking license/ground-truth finding(s) require review before acting."
+            )
+        elif verified:
+            lines.append(
+                f"No claims rejected. {verified} claim(s) verified against the source cache."
+            )
         else:
             lines.append(
-                "Zero claims rejected. 100% of cited assertions verified against source cache."
+                "No claims rejected — but **0 claims were verified** (empty source "
+                "cache). Treat every assertion above as unverified."
             )
         return lines
 
@@ -446,8 +520,25 @@ class EpistemicAuditorEngine:
         md.extend(self._render_tensions_section(audit.get("divergence_matrix", [])))
         md.extend(
             self._render_rejected_section(
-                audit["alpha_claims_audit"] + audit["beta_claims_audit"]
+                audit["alpha_claims_audit"] + audit["beta_claims_audit"],
+                summary,
             )
         )
         md.extend(self._render_negative_knowledge_section(alpha, beta))
+        md.extend(self._render_harvest_findings(audit.get("harvest_findings", [])))
         return "\n".join(md)
+
+    @staticmethod
+    def _render_harvest_findings(findings: list) -> List[str]:
+        if not findings:
+            return []
+        lines = ["\n## 5. Harvest Safety Findings"]
+        for f in findings:
+            icon = "⛔" if f.get("severity") == "BLOCKING" else "⚠️"
+            detail = f.get("detail") or f.get("kind", "")
+            resolution = f.get("resolution")
+            suffix = f" → **{resolution}**" if resolution else ""
+            lines.append(
+                f"- {icon} `{f.get('repo', '?')}` — {f.get('kind', '')}: {detail}{suffix}"
+            )
+        return lines

package/runner/darkharvest_claims.py

@@ -0,0 +1,326 @@
+#!/usr/bin/env python3
+"""Darkharvest claim normalization, license cross-check, and repo validation.
+
+Heretek-AI/IUMBTEMS#5: darkharvest dossiers emit `candidate_repositories[]` with
+their own `source_hash` witnesses, but the auditor only reads
+`affirmative_claims` / `falsification_claims` — so `total_claims_audited` was
+always 0 and the dialectic was structurally inert. Separately, alpha and beta
+can disagree about a repo's license (observed: `MIT` vs `NOASSERTION` for the
+same repo, with alpha recommending `depend-or-vendor`) and nothing cross-checked
+them, because the audit produced no claims to compare.
+
+This module supplies the three missing pieces:
+- `normalize_dossier_claims` — fold darkharvest's shape into the standard claim
+  schema so one contract flows to the auditor, PCRB, and ledger.
+- `cross_check_repos` — alpha/beta license disagreement is a blocking finding,
+  resolved conservatively.
+- `RepoValidator` — ground-truth (existence / license / archived) with fail-open
+  offline behavior.
+"""
+
+import json
+import os
+import re
+import urllib.error
+import urllib.request
+from typing import Any, Dict, List, Optional, Tuple
+
+# Top-level dossier keys that *look* like audit output but are agent-authored.
+# Renamed to `self_reported_*` on load so no consumer mistakes them for verified
+# counts (see #5 layer 3).
+AUDIT_SHAPED_KEYS = frozenset(
+    {
+        "epistemic_audit",
+        "confidence",
+        "gaps",
+        "verified_claims",
+        "unverified_claims",
+        "verified_sources",
+        "total_sources",
+        "total_claims",
+        "total_candidates",
+        "claims_total",
+        "claims_verified",
+        "claims_unverified",
+        "claims_falsified",
+        "claims_unverifiable",
+        "rejected_claims",
+        "mean_epistemic_score",
+        "primary_sources",
+        "primary_benchmarks",
+        "technical_specs",
+        "peer_reviewed",
+    }
+)
+
+# Licenses that may be `depend`ed on or `vendor`ed. Everything else (incl.
+# unknown / NOASSERTION) resolves to clean-room-rebuild-only.
+PERMISSIVE_LICENSES = frozenset({"MIT", "APACHE-2.0", "BSD-3-CLAUSE", "ISC"})
+
+UNKNOWN_LICENSES = frozenset({"", "UNKNOWN", "NOASSERTION", "NONE", "OTHER"})
+
+
+def _norm_license(value: Any) -> str:
+    return str(value or "").strip().upper()
+
+
+def _is_permissive(value: Any) -> bool:
+    return _norm_license(value) in PERMISSIVE_LICENSES
+
+
+def sanitize_self_reported(dossier: Dict[str, Any]) -> Tuple[Dict[str, Any], List[str]]:
+    """Rename agent-authored audit-shaped keys; return (dossier, renamed_keys).
+
+    Never deletes — the values are preserved under `self_reported_*` so a human
+    can still see what the agent claimed, but nothing counts them.
+    """
+    renamed: List[str] = []
+    if not isinstance(dossier, dict):
+        return dossier, renamed
+    for key in list(dossier.keys()):
+        if key in AUDIT_SHAPED_KEYS:
+            dossier[f"self_reported_{key}"] = dossier.pop(key)
+            renamed.append(key)
+    return dossier, renamed
+
+
+def _repo_key(candidate: Dict[str, Any]) -> Optional[str]:
+    """Stable key for a candidate repo: `owner/repo`, lowercased."""
+    raw = str(candidate.get("name") or candidate.get("repo") or "").strip()
+    if not raw:
+        url = str(candidate.get("url") or "").strip()
+        match = re.search(r"github\.com/([^/]+/[^/#?]+)", url)
+        if match:
+            raw = match.group(1)
+    raw = raw.removesuffix(".git").strip("/")
+    return raw.lower() if raw else None
+
+
+def _verdict_claims(role: str, candidate: Dict[str, Any]) -> List[Dict[str, Any]]:
+    """One standard claim per candidate verdict (verifiable when a quote exists)."""
+    name = candidate.get("name") or candidate.get("url") or "unknown-repo"
+    source_hash = candidate.get("source_hash")
+    source_url = candidate.get("url")
+    quote = candidate.get("verbatim_quote")
+    out: List[Dict[str, Any]] = []
+    for i, verdict in enumerate(candidate.get("verdicts") or [], start=1):
+        if not isinstance(verdict, dict):
+            continue
+        rid = candidate.get("repo_id") or name
+        out.append(
+            {
+                "claim_id": f"{rid}-{role}-V{i}",
+                "tag": "VERIFIED",
+                "statement": (
+                    f"{name}: {verdict.get('feature', '?')} → "
+                    f"{verdict.get('verdict', '?')} ({verdict.get('reason', '')})"
+                ),
+                "source_hash": source_hash,
+                "source_url": source_url,
+                # Prefer a verdict-specific quote; fall back to the candidate's.
+                "verbatim_quote": verdict.get("verbatim_quote") or quote,
+            }
+        )
+    return out
+
+
+def normalize_dossier_claims(
+    dossier: Dict[str, Any], role: str
+) -> List[Dict[str, Any]]:
+    """Standard-schema claims for a dossier.
+
+    Uses the canonical keys when present; otherwise (darkharvest) derives them
+    from `candidate_repositories[]` so the auditor has something to verify.
+    """
+    if not isinstance(dossier, dict):
+        return []
+    standard = dossier.get("affirmative_claims") or dossier.get("falsification_claims")
+    if isinstance(standard, list) and standard:
+        return [c for c in standard if isinstance(c, dict)]
+
+    out: List[Dict[str, Any]] = []
+    for candidate in dossier.get("candidate_repositories") or []:
+        if isinstance(candidate, dict):
+            out.extend(_verdict_claims(role, candidate))
+    return out
+
+
+def _resolved_policy(alpha: Dict[str, Any], beta: Dict[str, Any]) -> str:
+    """Conservative harvest policy when the two dossiers disagree."""
+    for side in (alpha, beta):
+        policy = str(side.get("harvest_policy") or "").lower()
+        risk = str(side.get("license_risk") or "").upper()
+        if policy == "clean-room-rebuild-only" or risk in (
+            "COPYLEFT_WARNING",
+            "PROHIBITIVE",
+        ):
+            return "clean-room-rebuild-only"
+    for side in (alpha, beta):
+        if not _is_permissive(side.get("license")):
+            return "clean-room-rebuild-only"
+    return "depend-or-vendor"
+
+
+class RepoValidator:
+    """Ground-truth repo checks via the GitHub API.
+
+    Fail-open: any network/timeout error yields `exists=None` and blocks nothing,
+    so an offline or rate-limited run degrades rather than aborting.
+    """
+
+    def __init__(
+        self,
+        token: Optional[str] = None,
+        timeout: float = 5.0,
+        enabled: bool = True,
+    ):
+        self.token = token if token is not None else os.environ.get("GITHUB_TOKEN")
+        self.timeout = timeout
+        self.enabled = enabled
+        self._cache: Dict[str, Dict[str, Any]] = {}
+
+    def validate(self, owner_repo: str) -> Dict[str, Any]:
+        key = owner_repo.strip().lower()
+        if key in self._cache:
+            return self._cache[key]
+        result = {"exists": None, "license": None, "archived": None}
+        if self.enabled and key:
+            result = self._fetch(owner_repo)
+        self._cache[key] = result
+        return result
+
+    def _fetch(self, owner_repo: str) -> Dict[str, Any]:
+        request = urllib.request.Request(
+            f"https://api.github.com/repos/{owner_repo}",
+            headers={
+                "Accept": "application/vnd.github+json",
+                "User-Agent": "iumbtems-darkharvest-audit",
+                **({"Authorization": f"Bearer {self.token}"} if self.token else {}),
+            },
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=self.timeout) as resp:
+                data = json.loads(resp.read().decode("utf-8", errors="replace"))
+            license_field = data.get("license") or {}
+            return {
+                "exists": True,
+                "license": license_field.get("spdx_id"),
+                "archived": bool(data.get("archived")),
+            }
+        except urllib.error.HTTPError as e:
+            if e.code == 404:
+                return {"exists": False, "license": None, "archived": None}
+            return {"exists": None, "license": None, "archived": None}
+        except Exception:
+            return {"exists": None, "license": None, "archived": None}
+
+
+def cross_check_repos(
+    alpha_dossier: Dict[str, Any],
+    beta_dossier: Dict[str, Any],
+    validator: Optional[RepoValidator] = None,
+) -> List[Dict[str, Any]]:
+    """Blocking findings for license disagreement and ground-truth failures.
+
+    A dialectic that produces a `depend-or-vendor` verdict on an unstated license
+    must not reach a human as `divergence: 0`. Each finding carries the
+    conservative resolution.
+    """
+    alpha = {
+        key: c
+        for c in (alpha_dossier.get("candidate_repositories") or [])
+        if isinstance(c, dict) and (key := _repo_key(c))
+    }
+    beta = {
+        key: c
+        for c in (beta_dossier.get("candidate_repositories") or [])
+        if isinstance(c, dict) and (key := _repo_key(c))
+    }
+
+    findings: List[Dict[str, Any]] = []
+    for key in sorted(set(alpha) | set(beta)):
+        a = alpha.get(key)
+        b = beta.get(key)
+        if a and b:
+            alic, blic = (
+                _norm_license(a.get("license")),
+                _norm_license(b.get("license")),
+            )
+            if alic != blic:
+                findings.append(
+                    {
+                        "repo": key,
+                        "kind": "LICENSE_DISAGREEMENT",
+                        "severity": "BLOCKING",
+                        "alpha": {
+                            "license": a.get("license"),
+                            "risk": a.get("license_risk"),
+                        },
+                        "beta": {
+                            "license": b.get("license"),
+                            "risk": b.get("license_risk"),
+                        },
+                        "resolution": _resolved_policy(a, b),
+                    }
+                )
+            elif str(a.get("harvest_policy") or "") != str(
+                b.get("harvest_policy") or ""
+            ):
+                findings.append(
+                    {
+                        "repo": key,
+                        "kind": "POLICY_DISAGREEMENT",
+                        "severity": "BLOCKING",
+                        "alpha": {"policy": a.get("harvest_policy")},
+                        "beta": {"policy": b.get("harvest_policy")},
+                        "resolution": _resolved_policy(a, b),
+                    }
+                )
+
+        # Ground truth (fail-open when the API is unreachable).
+        if validator is not None:
+            for side_name, side in (("alpha", a), ("beta", b)):
+                if not side:
+                    continue
+                truth = validator.validate(key)
+                if truth.get("exists") is False:
+                    findings.append(
+                        {
+                            "repo": key,
+                            "kind": "REPO_UNRESOLVABLE",
+                            "severity": "BLOCKING",
+                            "source": side_name,
+                            "detail": "GitHub API returned 404",
+                            "resolution": "reject-citation",
+                        }
+                    )
+                    break
+                if truth.get("archived") is True:
+                    findings.append(
+                        {
+                            "repo": key,
+                            "kind": "REPO_ARCHIVED",
+                            "severity": "WARNING",
+                            "detail": "repository is archived",
+                        }
+                    )
+                    break
+                truth_license = _norm_license(truth.get("license"))
+                if (
+                    truth.get("exists")
+                    and truth_license
+                    and not _is_permissive(truth.get("license"))
+                    and _is_permissive(side.get("license"))
+                ):
+                    findings.append(
+                        {
+                            "repo": key,
+                            "kind": "LICENSE_CONTRADICTS_GROUND_TRUTH",
+                            "severity": "BLOCKING",
+                            "source": side_name,
+                            "detail": f"dossier says {side.get('license')}, GitHub says {truth.get('license')}",
+                            "resolution": "clean-room-rebuild-only",
+                        }
+                    )
+                    break
+    return findings

package/runner/research_swarm.py

@@ -270,7 +270,17 @@ class SwarmRunner:
         self.state_machine = ResearchStateMachine(
             base_dir=self.base_dir, mode=self.mode
         )
-        self.auditor = EpistemicAuditorEngine(base_dir=self.base_dir)
+        from runner.auditor_engine import _repo_validation_enabled
+        from runner.darkharvest_claims import RepoValidator
+
+        self.auditor = EpistemicAuditorEngine(
+            base_dir=self.base_dir,
+            # Ground-truth repo checks are for real runs; mock dossiers are
+            # synthetic, so the unit suite must stay offline.
+            repo_validator=RepoValidator(
+                enabled=(not self.mock_mode) and _repo_validation_enabled()
+            ),
+        )
         self.hasher = SourceHasher(base_dir=self.base_dir)
         self.prompts_dir = PROJECT_ROOT / "prompts"
 
@@ -1252,11 +1262,30 @@ Output ONLY valid JSON representing the scope decomposition conforming to prompt
         )
         report_path = self._compile_master_synthesis(objective)
         self.state_machine.update_session_status(SessionStatus.COMPLETED)
+        self._write_orphan_report()
 
         duration = (datetime.now(timezone.utc) - start_time).total_seconds()
         print(f"   {self._retrieval_banner()}")
         print(f"\n🎉 Swarm run completed in {duration:.1f}s. Report: {report_path}")
 
+    def _write_orphan_report(self) -> None:
+        """Record scope dirs absent from every manifest (mark-only, never delete)."""
+        try:
+            orphans = self.state_machine.find_orphan_scopes()
+        except Exception:  # noqa: BLE001 - hygiene must not fail the run
+            return
+        if not orphans:
+            return
+        path = self.base_dir / "orphans.json"
+        try:
+            path.write_text(json.dumps(orphans, indent=2), encoding="utf-8")
+        except OSError:
+            return
+        print(
+            f"   ⚠️ {len(orphans)} orphaned scope dir(s) not referenced by any "
+            f"manifest -> {path.name} (not deleted)"
+        )
+
     def _retrieval_banner(self) -> str:
         """One-line retrieval summary for the current run (issue #3).
 

package/runner/state_machine.py

@@ -219,6 +219,41 @@ class ResearchStateMachine:
     def get_scope_dir(self, scope_id: str) -> Path:
         return self.scratchpads_dir / scope_id
 
+    def find_orphan_scopes(self) -> List[Dict[str, Any]]:
+        """Scope dirs not referenced by any manifest — marked, never deleted.
+
+        A dir may belong to a concurrently running session, so this reports
+        rather than prunes (issue #5 layer 6: 14 manifest-only leftovers).
+        """
+        referenced: set = set()
+        manifests = [self.manifest_file, *self.base_dir.glob("manifest.*.json")]
+        for manifest_path in manifests:
+            if not manifest_path.exists():
+                continue
+            try:
+                data = json.loads(manifest_path.read_text(encoding="utf-8"))
+            except (OSError, ValueError):
+                continue
+            for scope in data.get("scopes") or []:
+                if isinstance(scope, dict) and scope.get("scope_id"):
+                    referenced.add(scope["scope_id"])
+
+        orphans: List[Dict[str, Any]] = []
+        if not self.scratchpads_dir.is_dir():
+            return orphans
+        for scope_dir in sorted(self.scratchpads_dir.iterdir()):
+            if not scope_dir.is_dir() or scope_dir.name in referenced:
+                continue
+            orphans.append(
+                {
+                    "scope_id": scope_dir.name,
+                    "path": str(scope_dir),
+                    "alpha_dossier": (scope_dir / "alpha_dossier.json").exists(),
+                    "beta_dossier": (scope_dir / "beta_dossier.json").exists(),
+                }
+            )
+        return orphans
+
     def _read_scope_unlocked(self, scope_id: str) -> Dict[str, Any]:
         scope_manifest_file = self.get_scope_dir(scope_id) / MANIFEST_FILENAME
         if not scope_manifest_file.exists():

package/runner/tests/test_darkharvest_audit.py

@@ -0,0 +1,290 @@
+#!/usr/bin/env python3
+"""Darkharvest audit regressions (issue #5).
+
+Covers the three layers that made darkharvest ungrounded by construction:
+claim-schema normalization (auditor could not see darkharvest claims), the
+alpha/beta license cross-check (MIT vs NOASSERTION reached a human as
+divergence 0), and self-reported verification fields that must never count.
+"""
+
+import json
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+PROJECT_ROOT = Path(__file__).resolve().parent.parent.parent
+if str(PROJECT_ROOT) not in sys.path:
+    sys.path.insert(0, str(PROJECT_ROOT))
+
+from runner.auditor_engine import EpistemicAuditorEngine  # noqa: E402
+from runner.darkharvest_claims import (  # noqa: E402
+    RepoValidator,
+    cross_check_repos,
+    normalize_dossier_claims,
+    sanitize_self_reported,
+)
+from runner.research_swarm import SwarmRunner  # noqa: E402
+from skills.research_cache.hasher import SourceHasher  # noqa: E402
+
+
+class FakeValidator:
+    def __init__(self, result):
+        self.result = result
+        self.calls = []
+
+    def validate(self, owner_repo):
+        self.calls.append(owner_repo)
+        return self.result
+
+
+def _candidate(license_, risk, policy, shash, quote):
+    return {
+        "repo_id": "DH-01",
+        "name": "getpaseo/paseo",
+        "url": "https://github.com/getpaseo/paseo",
+        "source_hash": shash,
+        "verbatim_quote": quote,
+        "license": license_,
+        "license_risk": risk,
+        "harvest_policy": policy,
+        "verdicts": [
+            {"feature": "worktree isolation", "verdict": "vendor", "reason": "r"}
+        ],
+    }
+
+
+class TestNormalization(unittest.TestCase):
+    def test_darkharvest_shape_becomes_standard_claims(self):
+        dossier = {
+            "candidate_repositories": [
+                _candidate("MIT", "SAFE", "depend-or-vendor", "abc", "q")
+            ]
+        }
+        claims = normalize_dossier_claims(dossier, "alpha")
+        self.assertEqual(len(claims), 1)
+        self.assertEqual(claims[0]["source_hash"], "abc")
+        self.assertEqual(claims[0]["verbatim_quote"], "q")
+
+    def test_standard_keys_win_when_present(self):
+        dossier = {
+            "affirmative_claims": [{"claim_id": "C1", "statement": "s"}],
+            "candidate_repositories": [
+                _candidate("MIT", "SAFE", "depend-or-vendor", "abc", "q")
+            ],
+        }
+        claims = normalize_dossier_claims(dossier, "alpha")
+        self.assertEqual([c["claim_id"] for c in claims], ["C1"])
+
+
+class TestSelfReported(unittest.TestCase):
+    def test_audit_shaped_keys_are_renamed_not_counted(self):
+        dossier = {
+            "epistemic_audit": {"verified_claims": 15},
+            "confidence": "HIGH",
+            "scope_id": "s1",
+        }
+        dossier, renamed = sanitize_self_reported(dossier)
+        self.assertIn("epistemic_audit", renamed)
+        self.assertIn("confidence", renamed)
+        self.assertNotIn("epistemic_audit", dossier)
+        self.assertEqual(
+            dossier["self_reported_epistemic_audit"]["verified_claims"], 15
+        )
+        # Nothing audit-shaped remains to be mistaken for verified counts.
+        self.assertFalse(set(dossier) & {"epistemic_audit", "confidence"})
+
+
+class TestLicenseCrossCheck(unittest.TestCase):
+    def test_mit_vs_noassertion_is_blocking_and_conservative(self):
+        from runner.auditor_engine import _repo_validation_enabled  # noqa: F401
+
+        alpha = {
+            "candidate_repositories": [
+                _candidate("MIT", "SAFE", "depend-or-vendor", "a", "q")
+            ]
+        }
+        beta = {
+            "candidate_repositories": [
+                _candidate(
+                    "NOASSERTION", "PROHIBITIVE", "clean-room-rebuild-only", "a", "q"
+                )
+            ]
+        }
+        findings = cross_check_repos(alpha, beta)
+        kinds = {f["kind"] for f in findings}
+        self.assertIn("LICENSE_DISAGREEMENT", kinds)
+        self.assertTrue(all(f["severity"] == "BLOCKING" for f in findings))
+        self.assertEqual(findings[0]["resolution"], "clean-room-rebuild-only")
+
+    def test_agreement_yields_no_findings(self):
+        alpha = {
+            "candidate_repositories": [
+                _candidate("MIT", "SAFE", "depend-or-vendor", "a", "q")
+            ]
+        }
+        beta = {
+            "candidate_repositories": [
+                _candidate("MIT", "SAFE", "depend-or-vendor", "a", "q")
+            ]
+        }
+        self.assertEqual(cross_check_repos(alpha, beta), [])
+
+    def test_404_is_an_unresolvable_blocking_finding(self):
+        alpha = {
+            "candidate_repositories": [
+                _candidate("MIT", "SAFE", "depend-or-vendor", "a", "q")
+            ]
+        }
+        findings = cross_check_repos(
+            alpha, {}, validator=FakeValidator({"exists": False})
+        )
+        self.assertTrue(any(f["kind"] == "REPO_UNRESOLVABLE" for f in findings))
+
+    def test_offline_fails_open(self):
+        alpha = {
+            "candidate_repositories": [
+                _candidate("MIT", "SAFE", "depend-or-vendor", "a", "q")
+            ]
+        }
+        findings = cross_check_repos(
+            alpha,
+            {},
+            validator=FakeValidator(
+                {"exists": None, "license": None, "archived": None}
+            ),
+        )
+        self.assertEqual(findings, [])
+
+    def test_validator_fail_open_on_error(self):
+        """Network failure must yield exists=None, never raise (offline-safe)."""
+        import urllib.error
+        from unittest import mock
+
+        v = RepoValidator(enabled=True, timeout=0.001)
+        with mock.patch(
+            "urllib.request.urlopen", side_effect=urllib.error.URLError("offline")
+        ):
+            self.assertIsNone(v.validate("owner/repo")["exists"])
+
+    def test_validator_404_is_not_exists(self):
+        import urllib.error
+        from unittest import mock
+
+        v = RepoValidator(enabled=True, timeout=0.001)
+        err = urllib.error.HTTPError("u", 404, "not found", {}, None)
+        with mock.patch("urllib.request.urlopen", side_effect=err):
+            self.assertFalse(v.validate("owner/missing")["exists"])
+
+
+class TestDarkharvestAuditIntegration(unittest.TestCase):
+    def _runner_and_scope(self):
+        tmp = tempfile.mkdtemp()
+        base = Path(tmp) / ".research"
+        runner = SwarmRunner(base_dir=base, mock_mode=True, mode="darkharvest")
+        sm = runner.state_machine
+        sm.init_session("arena")
+        sm.set_scopes([{"scope_id": "s1", "title": "t", "objective": "o"}])
+        hasher = SourceHasher(base_dir=base)
+        shash = hasher.store_source(
+            "https://github.com/getpaseo/paseo",
+            "Paseo archives a clean worktree with no confirmation.",
+            "paseo",
+        )
+        quote = "Paseo archives a clean worktree with no confirmation."
+        scope_dir = sm.get_scope_dir("s1")
+        (scope_dir / "alpha_dossier.json").write_text(
+            json.dumps(
+                {
+                    "scope_id": "s1",
+                    "candidate_repositories": [
+                        _candidate("MIT", "SAFE", "depend-or-vendor", shash, quote)
+                    ],
+                    "epistemic_audit": {"verified_claims": 15, "confidence": "HIGH"},
+                }
+            ),
+            encoding="utf-8",
+        )
+        (scope_dir / "beta_dossier.json").write_text(
+            json.dumps(
+                {
+                    "scope_id": "s1",
+                    "candidate_repositories": [
+                        _candidate(
+                            "NOASSERTION",
+                            "PROHIBITIVE",
+                            "clean-room-rebuild-only",
+                            shash,
+                            quote,
+                        )
+                    ],
+                }
+            ),
+            encoding="utf-8",
+        )
+        return runner, base
+
+    def test_auditor_sees_claims_and_blocks_license_conflict(self):
+        runner, base = self._runner_and_scope()
+        auditor = EpistemicAuditorEngine(
+            base_dir=base,
+            repo_validator=FakeValidator(
+                {"exists": True, "license": "NOASSERTION", "archived": False}
+            ),
+        )
+        report = auditor.audit_scope("s1", mode="darkharvest")
+        summary = report["summary"]
+
+        self.assertGreater(summary["total_claims_audited"], 0)
+        self.assertGreaterEqual(summary["verified_passed"], 1)
+        self.assertEqual(summary["verdict"], "WARNING_LICENSE_CONFLICT")
+        self.assertTrue(
+            any(f["kind"] == "LICENSE_DISAGREEMENT" for f in report["harvest_findings"])
+        )
+
+    def test_synthesis_section_no_longer_claims_one_hundred_percent(self):
+        from runner.auditor_engine import EpistemicAuditorEngine as AE
+
+        lines = AE._render_rejected_section(
+            [], {"verified_passed": 0, "verdict": "WARNING_LOW_GROUNDING"}
+        )
+        text = "\n".join(lines)
+        self.assertIn("0 claims were verified", text)
+        self.assertNotIn("100%", text)
+
+    def test_synthesis_section_reports_license_conflict(self):
+        from runner.auditor_engine import EpistemicAuditorEngine as AE
+
+        lines = AE._render_rejected_section(
+            [],
+            {
+                "verified_passed": 0,
+                "verdict": "WARNING_LICENSE_CONFLICT",
+                "blocking_findings": 2,
+            },
+        )
+        self.assertIn("blocking license/ground-truth finding", "\n".join(lines))
+
+
+class TestOrphanScopes(unittest.TestCase):
+    def test_orphan_detected_and_not_deleted(self):
+        tmp = tempfile.mkdtemp()
+        base = Path(tmp) / ".research"
+        runner = SwarmRunner(base_dir=base, mock_mode=True, mode="research")
+        sm = runner.state_machine
+        sm.init_session("x")
+        sm.set_scopes([{"scope_id": "kept", "title": "t", "objective": "o"}])
+        stray = sm.get_scope_dir("abandoned")
+        stray.mkdir(parents=True, exist_ok=True)
+        (stray / "manifest.json").write_text("{}", encoding="utf-8")
+
+        orphans = sm.find_orphan_scopes()
+        ids = {o["scope_id"] for o in orphans}
+        self.assertIn("abandoned", ids)
+        self.assertNotIn("kept", ids)
+        # Marked, never deleted.
+        self.assertTrue(stray.exists())
+
+
+if __name__ == "__main__":
+    unittest.main()