@lumoai/cli 1.47.0 → 1.49.0

package/assets/skill/SKILL.md

@@ -31,6 +31,8 @@ The command catalog below is a **map**: it lists every command grouped by domain
 | `task criteria set/list`, drafting the acceptance contract                              | [references/criteria.md](references/criteria.md)               |
 | `verify`, `task status` — machine verification loop, claim-done flow, self-check/resume | [references/verify.md](references/verify.md)                   |
 | `cost` — per-operation (per-tool) token cost read-out; `task lineage` Top-5             | [references/task-context.md](references/task-context.md)       |
+| `outcome show/record/rate` — post-hoc outcome well (falsifier oracle, rejection-only)   | [references/outcome.md](references/outcome.md)                 |
+| `fidelity show` — per-delivery grounding + independence change-pattern read-out         | [references/fidelity.md](references/fidelity.md)               |
 | `project list`, `milestone*`                                                            | [references/milestones.md](references/milestones.md)           |
 | `doc create/update/list/move/bind/share/import` (CRUD)                                  | [references/docs.md](references/docs.md)                       |
 | `doc show --raw/--section`, `doc patch/append/diff/rebuild-source` (editing live docs)  | [references/doc-editing.md](references/doc-editing.md)         |
@@ -92,6 +94,25 @@ The command catalog below is a **map**: it lists every command grouped by domain
 
 - `lumo cost [--task <id>|--session <id>|--since <date>] [--by tool|model|member|session] [--json]` — per-operation token cost read-out, attributing each model step's token delta to the tool(s) it ran. Scope is mutually exclusive (default = workspace last-30-days). For the per-task Top-5 inline, see `lumo task lineage`.
 
+**Criteria audit** — workspace-level referent-kind analytics
+
+- `lumo criteria audit` — workspace-level read-out: count of acceptance criteria by effective referent kind (EXTERNAL_FACT / AGENT_CONSTRUCTED_STATE / PENDING_OUTCOME / UNVERIFIED_ASSERTION / UNCLASSIFIED) + the self-confirming-green ratio
+
+**Outcome well (post-hoc oracle)** — see [outcome.md](references/outcome.md)
+
+- `lumo outcome show <task>` — read the post-hoc outcome well: the **falsifier** verdict (`REJECTED` | `INCONCLUSIVE` — never a "pass") plus its backing rejection signals. `INCONCLUSIVE` = no rejection on record, **not** "satisfied".
+- `lumo outcome record <task> --note "<what reality did>" [--kind <kind>]` — record a human-observed post-hoc **rejection** of a delivery (revert / rollback / CI regression / downstream redirect / bypass). Append-only; **there is no "mark satisfied" counterpart** — the well only asserts rejection. `--note` is required (the observed referent).
+- `lumo outcome rate [--min N] [--json]` — workspace **trust × post-hoc-fate** join (LUM-603, LUM-606): per delivery-time **verification-friction** bucket (`no-verification` / `single-round` / `multi-round-or-sendback` — two raw counts frozen at delivery, replacing the saturating forecast-confidence axis), the post-hoc REJECTED rate from the well. Honest by construction — thin buckets read `insufficient` (no fabricated rate), the single-round-vs-multi comparison stays `inconclusive` until CIs separate, and the rate is a **lower bound** (no signal = INCONCLUSIVE, never satisfied). Bucket names are value-neutral — direction is decided by the correlation, never welded into the label. Under-sampled today by design — the skeleton produces real strata once the well fills.
+
+**Fidelity read-out (mechanical change-pattern)** — see [fidelity.md](references/fidelity.md)
+
+- `lumo fidelity show <task> [--json]` — per delivery snapshot (LUM-609), a **composition table, not a single score**: (1) the **grounding** of the frozen contract — grounded (`EXTERNAL_FACT`, a machine-checkable upper bound) / self-confirming (`AGENT_CONSTRUCTED_STATE` + `UNVERIFIED_ASSERTION`) / inconclusive (`PENDING_OUTCOME` + `UNCLASSIFIED`, surfaced not swallowed) + the full effective-kind tally; (2) the **independence** signal — criteria `ADDED`/`UPDATED` at round>0 (after work started) that the delivery rode on = backward-inference suspects. Purely mechanical (timing + op + grounding) — **no direction verdict**. A no-snapshot task is reported explicitly (not a pass). Zero new storage — reads the snapshot + `CRITERION_CHANGED` trail.
+
+```bash
+lumo fidelity show LUM-42
+lumo fidelity show LUM-42 --json
+```
+
 **Artifacts & Figma** — see [artifacts-figma.md](references/artifacts-figma.md)
 
 - `lumo task artifact add/update/list/show/rm` — record spec/plan products on a task
@@ -146,6 +167,25 @@ The command catalog below is a **map**: it lists every command grouped by domain
 - `lumo worktree rm <LUM-N> --yes` — remove a worktree (keeps the branch unless `--delete-branch`)
 - `lumo worktree list` — list `.worktrees/` worktrees (task id, branch, dirty, node_modules link)
 
+## Criteria audit
+
+```bash
+lumo criteria audit
+```
+
+`lumo criteria audit` — workspace-level acceptance-criteria analytics. Calls `GET /api/criteria/audit` and prints two things:
+
+1. **Declared-kind distribution** — count of criteria by effective referent kind:
+   - `EXTERNAL_FACT` — declared as externally observable (git SHA, CI status, DB row) and the checkpointer invokes real external tooling
+   - `AGENT_CONSTRUCTED_STATE` — passes by checking output the agent itself produced
+   - `PENDING_OUTCOME` — deferred to post-hoc falsifier
+   - `UNVERIFIED_ASSERTION` — declared `EXTERNAL_FACT` but the checkpointer does **not** actually invoke external tooling (git/CI/HTTP); auto-downgraded. As of LUM-605 this is an **enforced gate, not just a label**: `lumo task criteria set` warns on it, and `lumo verify` blocks a PASS on it with **422 (no round burned)** until it's re-grounded or honestly re-declared `AGENT_CONSTRUCTED_STATE` (see references/criteria.md "referentKind")
+   - `UNCLASSIFIED` — legacy rows predating the `referentKind` field (null in DB)
+
+2. **Self-confirming-green headline ratio** — `(AGENT_CONSTRUCTED_STATE + UNVERIFIED_ASSERTION) / classified`. Criteria in these two buckets pass by confirming only the agent's own work, not an independent external state.
+
+**When to suggest**: when the user wants to audit how much of the workspace's "green" criteria are self-confirming vs externally anchored; when diagnosing whether acceptance criteria have real external hooks or are circular.
+
 ## Commands & flags that do NOT exist (common mistakes)
 
 Don't guess these:

package/assets/skill/references/criteria.md

@@ -60,6 +60,21 @@ The 3–7 range is calibrated for typical multi-file tasks. Criterion count must
 
 ### judgeSteps — agent-drafted judging steps for HUMAN criteria
 
+**`referentKind` — what the criterion anchors (required, and a real gate as of LUM-605):**
+
+Every criterion declares one `referentKind` — the only dimension that decides whether a PASS is independent or self-confirming. Required on every item (the API rejects a missing one with 400):
+
+- `EXTERNAL_FACT` — anchored on a fact the agent cannot author: a git SHA / diff, CI status, an HTTP probe, a DB row, `prisma migrate status`. **Only honest when the checkpointer actually invokes external tooling** (`git`/`gh`/`curl`/`psql`/…) AND its output or exit status reaches the verdict (piped into an assertion, captured in `$(…)`, or the terminal command whose exit IS the verdict). A no-op or output-discarded external command (`git --version && cat frozen.txt | grep`) does **not** count.
+- `AGENT_CONSTRUCTED_STATE` — passes by checking output the agent itself produced: **your own jest/vitest/tsc/node/tsx tests, build, type-check**. This is the honest kind for almost every code task's checks. Green here is self-confirming — that's fine, just label it truthfully.
+- `PENDING_OUTCOME` — truth lands post-delivery (a downstream regression, a revert). Has no check today: it **cannot** be MACHINE (the API rejects PENDING_OUTCOME + MACHINE). Draft it HUMAN or leave it out of the encoded contract.
+
+**The gate (LUM-605):** declaring `EXTERNAL_FACT` + MACHINE on a checkpointer that doesn't ground external (e.g. `npx jest …`) is the LUM-601 fakeGit shape — it would launder a self-confirming green into a "verified external fact". The system now downgrades it to `UNVERIFIED_ASSERTION` and:
+
+- at **`criteria set`** — stores it but returns a non-rejecting ⚠ warning naming the criterion (re-ground or re-declare);
+- at **`lumo verify`** — a PASS on it is **blocked with 422 (no round burned)**; the round does not land and the task does not move to IN_REVIEW until you either re-ground the checkpointer against a real external fact, or honestly re-declare it `AGENT_CONSTRUCTED_STATE`. Both fixes are free (no round consumed).
+
+Don't reach for `EXTERNAL_FACT` to look stronger — a jest test is `AGENT_CONSTRUCTED_STATE`, full stop. Reserve `EXTERNAL_FACT` for checks that truly read external state, or use a HUMAN criterion for "a person ran the real system and observed X" (HUMAN is never mechanically downgraded).
+
 A HUMAN criterion is judged by a person, not a checkpointer — so don't hand them a bare assertion ("the copy reads naturally") and make them reverse-engineer what to do. Attach **`judgeSteps`**: short, human-readable instructions the adjudication card renders verbatim (light markdown, URLs made clickable). Structured labour is yours; the human just follows the steps.
 
 **Shape — 1–3 steps, always in this order:**
@@ -78,6 +93,7 @@ A HUMAN criterion is judged by a person, not a checkpointer — so don't hand th
 {
   "statement": "The acceptance tab reads as plain operational instructions, not agent-voice assertions",
   "verifierType": "HUMAN",
+  "referentKind": "AGENT_CONSTRUCTED_STATE",
   "judgeSteps": "Open the task's Acceptance tab (the IN_REVIEW card). For each HUMAN criterion, read its 'How to judge' block. Pass if each one names where to look, what to do, and what counts as pass vs send-back; send back if any reads as a bare assertion with no steps."
 }
 ```
@@ -97,12 +113,14 @@ Two real-repo invariant examples — `prisma/migrations/` files never deleted (t
   {
     "statement": "No file under prisma/migrations/ is deleted by this change (vs origin/main)",
     "verifierType": "MACHINE",
-    "checkpointer": "bash -c \"test -z \\\"$(git diff --diff-filter=D --name-only origin/main -- prisma/migrations/)\\\"\""
+    "checkpointer": "bash -c \"test -z \\\"$(git diff --diff-filter=D --name-only origin/main -- prisma/migrations/)\\\"\"",
+    "referentKind": "EXTERNAL_FACT"
   },
   {
     "statement": "Live-doc keeps its table structure after the edit (no rows/headings dropped)",
     "verifierType": "MACHINE",
-    "checkpointer": "npx tsx scripts/verify-live-doc.ts <docId> docs/live-docs/<file>.md"
+    "checkpointer": "npx tsx scripts/verify-live-doc.ts <docId> docs/live-docs/<file>.md",
+    "referentKind": "AGENT_CONSTRUCTED_STATE"
   }
 ]
 ```
@@ -120,17 +138,20 @@ One invariant criterion is usually enough — it's the guardrail, not the whole
   {
     "statement": "PUT /api/tasks/[id]/criteria rejects a second AGENT_DRAFT submission with 409",
     "verifierType": "MACHINE",
-    "checkpointer": "npx jest __tests__/task-criteria.service.test.ts -t 'agent lock'"
+    "checkpointer": "npx jest __tests__/task-criteria.service.test.ts -t 'agent lock'",
+    "referentKind": "AGENT_CONSTRUCTED_STATE"
   },
   {
     "statement": "The criteria section reads naturally as part of the task statement",
     "verifierType": "HUMAN",
+    "referentKind": "AGENT_CONSTRUCTED_STATE",
     "judgeSteps": "Open the task's Acceptance tab. Read the contract top to bottom. Pass if it scans as one coherent definition of done; send back if a criterion reads as boilerplate or contradicts another."
   },
   {
     "statement": "Session-start injection shows the contract ahead of memory",
     "verifierType": "MACHINE",
     "checkpointer": "npx jest __tests__/cli/hook-runner-session-start-stdout.test.ts",
+    "referentKind": "AGENT_CONSTRUCTED_STATE",
     "evidenceRequired": true
   }
 ]
@@ -141,6 +162,7 @@ Fields:
 - `statement` — required, ≤2000 chars.
 - `verifierType` — `"MACHINE"` | `"HUMAN"`.
 - `checkpointer` — required for MACHINE.
+- `referentKind` — **required**, `"EXTERNAL_FACT"` | `"AGENT_CONSTRUCTED_STATE"` | `"PENDING_OUTCOME"` (see "referentKind" above). Your own tests/build/type-check are `AGENT_CONSTRUCTED_STATE`; `EXTERNAL_FACT` is gated (warned at set, 422 at verify) unless the checkpointer truly grounds external; `PENDING_OUTCOME` can't be MACHINE.
 - `evidenceRequired` — optional, default false.
 - `judgeSteps` — optional, ≤2000 chars; agent-drafted human-judging steps for a HUMAN criterion (see "judgeSteps" above).
 - `id` — only in `--human` revisions (see below).

package/assets/skill/references/fidelity.md

@@ -0,0 +1,32 @@
+# Fidelity read-outs (mechanical change-pattern)
+
+`lumo fidelity` is the fidelity-axis read surface — pure, read-only analytics over what the acceptance loop already records, in the same family as `lumo criteria audit` and `lumo outcome rate`. It adds **no storage and no write path**; it only reads the LUM-609 delivery snapshots and the `CRITERION_CHANGED` audit trail.
+
+## `lumo fidelity show <task>`
+
+```bash
+lumo fidelity show LUM-42
+lumo fidelity show LUM-42 --json
+```
+
+For **each delivery** of the task (one append-only `TaskCriteriaSnapshot` per fresh IN_REVIEW entry — a reopen→re-deliver appends another), it discloses two compositions and deliberately stops there. There is **no single fidelity score and no good/bad direction verdict** — the read-out is purely mechanical (timing + op + checkpointer grounding; it never reads statement or diff semantics).
+
+### 1. Grounding composition
+
+Runs the same `effectiveReferentKind` classifier the LUM-605 verify gate uses over the **frozen** contract (delivery-time truth, not the since-edited `latest`), rolled into three buckets plus the full per-kind tally:
+
+- **grounded** — `EXTERNAL_FACT` (anchored on a fact the agent cannot author: a git SHA/diff, CI status, a DB row). This count is a **machine-checkable _upper bound_** — the checkpointer heuristic can over-count external grounding, never under-count it.
+- **self-confirming** — `AGENT_CONSTRUCTED_STATE` + `UNVERIFIED_ASSERTION` (passes by checking the agent's own output, incl. a declared-EXTERNAL_FACT checkpointer that doesn't truly ground external).
+- **inconclusive** — `PENDING_OUTCOME` + `UNCLASSIFIED` (not mechanically resolvable here). **Surfaced, never silently swallowed.**
+
+### 2. Independence signal
+
+A criterion is a **backward-inference suspect** when it is both (a) in this delivery's frozen contract and (b) was `ADDED`/`UPDATED` at **round>0** (after work started) at or before the freeze — i.e. the contract the delivery rode on was bent after the work began rather than fixed up front. round-0 (initial-draft) criteria are clean; `DELETED` ops and edits recorded after the freeze (a later cycle) don't count. Each suspect shows its `op`, `round`, and `causeTag`. The read-out **counts and discloses — it does not judge** whether a given edit was legitimate sharpening or tampering (that direction call is left to a human / a later axis).
+
+### Caveat (printed on every report)
+
+The time anchor is the **work-start boundary** (`Task.workStartedAt`), so the independence signal detects a contract edited _after work started_ — not specifically _after output was produced_. A task with **no delivery snapshot** (never entered IN_REVIEW, or predates the LUM-609 freeze) is reported explicitly — "nothing to read yet", which is **not** a pass.
+
+`--json` emits the full report (`taskId`, `workStartedAt`, `hasSnapshots`, `deliveries[]` with `grounding`/`independence`, `caveat`) for scripting.
+
+**When to suggest**: when the user wants to see how externally-grounded a task's delivered acceptance contract actually was, or whether criteria were added/changed after work began (independence). It's a disclosure tool, not a gate — it never blocks DONE and emits no verdict.

package/assets/skill/references/outcome.md

@@ -0,0 +1,65 @@
+# Outcome well (post-hoc oracle) — `lumo outcome`
+
+The **post-hoc outcome well** (LUM-598) is the single external oracle for correctness + fidelity. It records the real-world fate a delivery met **after** it shipped — facts the agent cannot construct and that occur post-delivery (a revert, a rollback, CI turning red, a reopen, a downstream redirect of the design).
+
+## The one invariant: falsifier, not verifier
+
+The well **only** ever produces a rejection. Its verdict space is exactly:
+
+- `REJECTED` — the well holds ≥1 rejection signal (reality revoked / redid / bypassed the delivery).
+- `INCONCLUSIVE` — no rejection on record.
+
+There is **no `SATISFIED` / `PASS`**. "N sprints and nobody touched it" is the _absence_ of a rejection — satisfied, merely-tolerated, and never-noticed are externally indistinguishable — so it reads `INCONCLUSIVE`, never a pass. Treat `INCONCLUSIVE` as "could not confirm a rejection", not as approval.
+
+## Collection (where signals come from)
+
+- **Automatic** — a DONE task reopened (the lineage `REWORKED` transition) is folded into the well as a `REOPENED` signal. No action needed; it happens server-side.
+- **Manual** — a human who observed reality reject a delivery records it with `lumo outcome record`. The `--note` is mandatory: it is the observed referent, frozen as evidence.
+
+## `lumo outcome show <task>`
+
+Read the well for a task — the verdict plus its backing signals.
+
+```bash
+lumo outcome show LUM-42
+```
+
+An empty well prints `INCONCLUSIVE` with the reminder that silence is not a pass. A non-empty well prints `REJECTED` and lists each signal (date, kind, source, note).
+
+## `lumo outcome record <task> --note "<what reality did>" [--kind <kind>]`
+
+Record one human-observed post-hoc rejection. Append-only — every call inserts a new signal; nothing is ever mutated or cleared.
+
+```bash
+lumo outcome record LUM-42 --note "reverted in #812 after a prod incident" --kind reverted
+lumo outcome record LUM-42 --note "downstream rewrote the API shape this task introduced" --kind downstream_redirect
+```
+
+- `--kind` (case-insensitive, default `manual`): `reverted | rolled_back | ci_regression | downstream_redirect | bypassed | manual`. `reopened` is **not** a manual kind — it is owned by the automatic lineage fold.
+- `--occurred-at <iso>` — when the event actually happened (defaults to now).
+
+## `lumo outcome rate [--min N] [--json]`
+
+The workspace-level **trust × post-hoc-fate** join (LUM-603, LUM-606). For every delivery that has a frozen forecast snapshot, it buckets the delivery by its **delivery-time verification friction** — two raw counts (`verificationRounds`, `sendBackCount`) frozen at delivery from the append-only `VerificationRun` log, cut at `capturedAt`, then bucketed value-neutrally into `no-verification` / `single-round` / `multi-round-or-sendback` — and reports each bucket's post-hoc **REJECTED** rate from the well. The friction axis replaced the original sample-size forecast-confidence axis (LUM-606), which saturated: every mature-project delivery landed in `high`, so `high`-vs-`low` could never compare. The question it answers once data is sufficient: _do deliveries that took more verification friction get rejected by reality more (fragility) or less (scrutiny) often?_ The bucket names carry **no** good/bad direction — the correlation, not the label, decides.
+
+```bash
+lumo outcome rate
+lumo outcome rate --min 20 --json
+```
+
+This is the falsifier discipline applied at the **query layer** — it refuses to manufacture a finding off a thin sample:
+
+- A bucket with fewer than `--min` (default 10) deliveries reads **`insufficient`** with the rate withheld — the raw `rejected/delivered` counts are still shown, but never divided into a believable proportion.
+- The per-bucket rate is an explicit **lower bound** on true failure: the well only records rejections, so a zero-signal delivery is `INCONCLUSIVE` (counted in the denominator), never "satisfied".
+- The **`single-round` vs `multi-round-or-sendback`** comparison asserts a direction **only** when both buckets are measured _and_ their 95% confidence intervals are disjoint; otherwise it stays **`inconclusive`**. `no-verification` is never a comparison arm (silence is not a friction level).
+
+**Expect `inconclusive` today.** The well is freshly wired and the discriminating end of the friction axis is sparse (multi-round/send-back deliveries are rare) — that is the designed state, not a bug. The same command produces real strata once enough post-hoc signals accumulate against the populated friction buckets (the deferred outcome the skeleton exists to read).
+
+> Scope note: friction is frozen **at delivery** and cut at `capturedAt`, so it is replayable and never reads a drifted current value. A delivery with no `VerificationRun` before capture is its own `no-verification` bucket — absence of verification is never folded into `single-round` (silence ≠ a clean pass).
+
+## When to suggest
+
+- A teammate says a shipped task **was reverted / rolled back / broke prod / got redone / was bypassed** — record it with `lumo outcome record` so the well carries reality's verdict.
+- Auditing whether a "done" task actually held up — `lumo outcome show <task>` reads the well.
+- Asking whether **verification friction predicts post-hoc fate** (do harder-to-verify deliveries fail more, or less?) — `lumo outcome rate`. Expect `inconclusive` until the well fills; it will never print a correlation the sample can't support.
+- **Never** use it to mark something good: the well has no positive verdict by design. To assert a delivery met its contract, that is the acceptance loop (`lumo verify` / `lumo task status`), not the well.

package/assets/skill/references/verify.md

@@ -21,10 +21,10 @@ lumo verify --note "…" --timeout 900     # per-checkpointer timeout in seconds
 **`--note` is required (LUM-597)** whenever a round will actually be posted (the
 task has MACHINE criteria). It is your one-line self-report — what you did and
 why it is ready ("我改了 X,因为 Y 可验收"). When the round all-passes and the
-task flips to IN_REVIEW, the note is frozen as the task's **claim** (provenance
+task flips to IN*REVIEW, the note is frozen as the task's **claim** (provenance
 `AGENT` — the汇报者's own voice, not a summarizer paraphrase) and is checked
 against the diff for faithfulness. Capturing the claim is deterministic ("不填不
-让 post"); whether it is _truthful_ is the faithfulness audit's job — so don't
+让 post"); whether it is \_truthful* is the faithfulness audit's job — so don't
 under- or over-state it. A missing/blank note is refused **before** the round is
 posted, so no round is burned; just re-run with one. (An old CLI that omits it
 still verifies — the claim degrades to the synthesized run-summary fallback.)
@@ -61,15 +61,16 @@ errors.
 
 ## Edge cases
 
-| Case                                            | Behavior                                                                                                                                                                                                                                                                                                             |
-| ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **No contract yet**                             | Error pointing at `lumo task criteria set`; draft the contract first (criteria.md golden rule).                                                                                                                                                                                                                      |
-| **HUMAN-only contract** (zero MACHINE criteria) | Nothing to run; CLI says so and suggests `lumo task update <id> --status in_review` for human review. No server write happens.                                                                                                                                                                                       |
-| **Partial round**                               | A round must cover every MACHINE criterion; the CLI always runs all of them and the server rejects partial rounds.                                                                                                                                                                                                   |
-| **`REVIEW_ADDED` criteria**                     | Criteria added during review appear in the contract and are picked up automatically by the next round.                                                                                                                                                                                                               |
-| **Session bound to a different task**           | Server returns 409, surfaced as an error. No advisory printed; the verify round is rejected outright.                                                                                                                                                                                                                |
-| **Provably-unbound session**                    | Response carries `bindingAdvisory: 'unbound'`; prints `⚠ Working unbound — this verify ran from a Claude Code session not attached to the task.` Recorded as a `SESSION_BINDING_MISSING` boundary crossing (visible in `lumo task status` open crossings). Run `lumo session attach <LUM-N>` before the next verify. |
-| **Unconfirmed session binding**                 | `bindingAdvisory: 'unconfirmed'` → softer advisory `⚠ Could not confirm this session is attached to the task.` Same remediation: `lumo session attach <LUM-N>`.                                                                                                                                                      |
+| Case                                            | Behavior                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **No contract yet**                             | Error pointing at `lumo task criteria set`; draft the contract first (criteria.md golden rule).                                                                                                                                                                                                                                                                                                                                          |
+| **HUMAN-only contract** (zero MACHINE criteria) | Nothing to run; CLI says so and suggests `lumo task update <id> --status in_review` for human review. No server write happens.                                                                                                                                                                                                                                                                                                           |
+| **Partial round**                               | A round must cover every MACHINE criterion; the CLI always runs all of them and the server rejects partial rounds.                                                                                                                                                                                                                                                                                                                       |
+| **`REVIEW_ADDED` criteria**                     | Criteria added during review appear in the contract and are picked up automatically by the next round.                                                                                                                                                                                                                                                                                                                                   |
+| **Session bound to a different task**           | Server returns 409, surfaced as an error. No advisory printed; the verify round is rejected outright.                                                                                                                                                                                                                                                                                                                                    |
+| **Ungrounded EXTERNAL_FACT PASS** (LUM-605)     | A reported PASS on a criterion declared `EXTERNAL_FACT` whose checkpointer doesn't invoke external tooling (e.g. `npx jest …`) is blocked with **422 — no round burned**; the task does **not** move to IN_REVIEW. Fix it for free: re-ground the checkpointer against a real external fact, or honestly re-declare `referentKind` as `AGENT_CONSTRUCTED_STATE` (`lumo task criteria set`), then re-run. See criteria.md "referentKind". |
+| **Provably-unbound session**                    | Response carries `bindingAdvisory: 'unbound'`; prints `⚠ Working unbound — this verify ran from a Claude Code session not attached to the task.` Recorded as a `SESSION_BINDING_MISSING` boundary crossing (visible in `lumo task status` open crossings). Run `lumo session attach <LUM-N>` before the next verify.                                                                                                                     |
+| **Unconfirmed session binding**                 | `bindingAdvisory: 'unconfirmed'` → softer advisory `⚠ Could not confirm this session is attached to the task.` Same remediation: `lumo session attach <LUM-N>`.                                                                                                                                                                                                                                                                          |
 
 ## Round discipline
 

package/dist/cli/src/commands/criteria-audit.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatAuditReport = formatAuditReport;
+exports.criteriaAudit = criteriaAudit;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const KIND_ORDER = [
+    'EXTERNAL_FACT',
+    'AGENT_CONSTRUCTED_STATE',
+    'PENDING_OUTCOME',
+    'UNVERIFIED_ASSERTION',
+    'UNCLASSIFIED',
+];
+function formatAuditReport(r) {
+    const lines = ['Criteria referent-kind audit (workspace)', ''];
+    for (const k of KIND_ORDER) {
+        const n = r.byEffectiveKind[k] ?? 0;
+        const pct = r.total === 0 ? 0 : Math.round((n / r.total) * 100);
+        lines.push(`  ${k.padEnd(24)} ${String(n).padStart(4)}  (${pct}%)`);
+    }
+    lines.push('');
+    const pct = Math.round(r.selfConfirmingGreenRatio * 100);
+    lines.push(`  self-confirming green: ${pct}% of ${r.classified} classified criteria`);
+    lines.push(`  (AGENT_CONSTRUCTED_STATE + UNVERIFIED_ASSERTION — green that confirms only the agent's own work)`);
+    return lines.join('\n') + '\n';
+}
+/** `lumo criteria audit` — workspace-level referent-kind distribution. */
+async function criteriaAudit() {
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const base = (0, api_1.trimTrailingSlash)((0, api_1.resolveAuthedApiUrl)(creds.apiUrl));
+    let res;
+    try {
+        res = await fetch(`${base}/api/criteria/audit`, {
+            headers: { Authorization: `Bearer ${creds.token}` },
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API (${msg})`);
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: criteria audit failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const report = (await res.json());
+    process.stdout.write(formatAuditReport(report));
+}

package/dist/cli/src/commands/fidelity.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fidelityShow = fidelityShow;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/**
+ * `lumo fidelity show <task>` — the LUM-610 mechanical change-pattern read-out
+ * (fidelity axis, second block, on the LUM-609 delivery-snapshot foundation).
+ *
+ * Per delivery snapshot it discloses two compositions and NOTHING else — no
+ * single score, no good/bad verdict (approach (a): purely mechanical):
+ *   • grounding — how much of the FROZEN contract is externally grounded
+ *     (EXTERNAL_FACT) vs self-confirming (agent-authored) vs inconclusive.
+ *     `grounded` is a machine-checkable UPPER BOUND.
+ *   • independence — criteria ADDED/UPDATED after work started (round>0) that
+ *     the delivery rode on: backward-inference suspects. Direction left blank.
+ */
+const EFFECTIVE_KINDS = [
+    'EXTERNAL_FACT',
+    'AGENT_CONSTRUCTED_STATE',
+    'UNVERIFIED_ASSERTION',
+    'PENDING_OUTCOME',
+    'UNCLASSIFIED',
+];
+function authBase() {
+    const creds = (0, config_1.readCredentials)();
+    if (!creds)
+        return { error: 'not logged in. Run `lumo auth login` first.' };
+    const base = (0, api_1.trimTrailingSlash)((0, api_1.resolveAuthedApiUrl)(creds.apiUrl));
+    const headers = {
+        Authorization: `Bearer ${creds.token}`,
+    };
+    const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
+    if (sessionId)
+        headers['X-Lumo-Session-Id'] = sessionId;
+    return { base, headers };
+}
+function formatReport(report, taskId) {
+    const lines = [];
+    lines.push(`Fidelity change-pattern — ${(0, sanitize_1.sanitizeField)(taskId)}`);
+    if (!report.hasSnapshots) {
+        lines.push('  No delivery snapshot on record (task never entered IN_REVIEW, or ' +
+            'predates the LUM-609 freeze). Nothing to read yet — not a pass.');
+        lines.push('');
+        lines.push(`  ${report.caveat}`);
+        return lines.join('\n') + '\n';
+    }
+    report.deliveries.forEach((d, i) => {
+        const when = d.frozenAt.slice(0, 19).replace('T', ' ');
+        lines.push('');
+        lines.push(`  Delivery ${i + 1}/${report.deliveries.length} · frozen ${when}Z · ${(0, sanitize_1.sanitizeField)(d.trigger)} · ${d.total} criteria`);
+        const g = d.grounding;
+        lines.push(`    grounding:    grounded ${g.grounded}  ·  self-confirming ${g.selfConfirming}  ·  inconclusive ${g.inconclusive}   (grounded = machine-checkable upper bound)`);
+        const kinds = EFFECTIVE_KINDS.filter(k => g.byEffectiveKind[k] > 0)
+            .map(k => `${k} ${g.byEffectiveKind[k]}`)
+            .join(', ');
+        lines.push(`      effective kinds: ${kinds || '(none)'}`);
+        const ind = d.independence;
+        lines.push(`    independence: ${ind.postStartChanges}/${ind.total} criteria ADDED/UPDATED after work started (backward-inference suspects; direction not judged)`);
+        for (const s of ind.suspects) {
+            const cause = s.causeTag ? ` · ${(0, sanitize_1.sanitizeField)(s.causeTag)}` : '';
+            lines.push(`      ↳ ${(0, sanitize_1.sanitizeField)(s.criterionId)}  ${s.op}@round${s.round}${cause}  (${s.at.slice(0, 10)})`);
+        }
+    });
+    lines.push('');
+    lines.push(`  ${report.caveat}`);
+    return lines.join('\n') + '\n';
+}
+async function fidelityShow(taskId, options = {}) {
+    if (!taskId || taskId.trim() === '') {
+        console.error('Error: a task is required: lumo fidelity show <task>');
+        return 1;
+    }
+    const auth = authBase();
+    if ('error' in auth) {
+        console.error(`Error: ${auth.error}`);
+        return 1;
+    }
+    let res;
+    try {
+        res = await fetch(`${auth.base}/api/tasks/${encodeURIComponent(taskId)}/fidelity`, { headers: auth.headers });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: task ${(0, sanitize_1.sanitizeField)(taskId)} not found.`);
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: could not read the fidelity change-pattern (HTTP ${res.status}).`);
+        return 1;
+    }
+    const report = (await res.json());
+    if (options.json) {
+        process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+        return;
+    }
+    process.stdout.write(formatReport(report, taskId));
+    return;
+}

package/dist/cli/src/commands/outcome.js

@@ -0,0 +1,225 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.outcomeRecord = outcomeRecord;
+exports.outcomeShow = outcomeShow;
+exports.outcomeRate = outcomeRate;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/**
+ * `lumo outcome` — the post-hoc outcome well (LUM-598).
+ *
+ * The well is the single external oracle for correctness + fidelity: it records
+ * the real-world fate a delivery met AFTER it shipped. It is a FALSIFIER, not a
+ * verifier — it only ever reads REJECTED (reality revoked/redid/bypassed the
+ * work) or INCONCLUSIVE (no rejection on record). There is deliberately no
+ * "mark satisfied": the absence of a rejection is not a pass.
+ */
+const MANUAL_KINDS = [
+    'REVERTED',
+    'ROLLED_BACK',
+    'CI_REGRESSION',
+    'DOWNSTREAM_REDIRECT',
+    'BYPASSED',
+    'MANUAL',
+];
+function authBase() {
+    const creds = (0, config_1.readCredentials)();
+    if (!creds)
+        return { error: 'not logged in. Run `lumo auth login` first.' };
+    const base = (0, api_1.trimTrailingSlash)((0, api_1.resolveAuthedApiUrl)(creds.apiUrl));
+    const headers = {
+        Authorization: `Bearer ${creds.token}`,
+    };
+    const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
+    if (sessionId)
+        headers['X-Lumo-Session-Id'] = sessionId;
+    return { base, headers };
+}
+/**
+ * `lumo outcome record <task> --note "<what reality did>" [--kind <kind>]` —
+ * record a human-observed post-hoc REJECTION of a delivery. Append-only. The
+ * note is mandatory (the observed referent); the default kind is MANUAL.
+ */
+async function outcomeRecord(taskId, options = {}) {
+    if (!taskId || taskId.trim() === '') {
+        console.error('Error: a task is required: lumo outcome record <task> --note "…"');
+        return 1;
+    }
+    const note = options.note?.trim();
+    if (!note) {
+        console.error('Error: --note "<what reality did>" is required (the observed rejection, e.g. "reverted in #812 after prod incident").');
+        return 1;
+    }
+    const kind = (options.kind?.trim().toUpperCase() ||
+        'MANUAL');
+    if (!MANUAL_KINDS.includes(kind)) {
+        console.error(`Error: --kind must be one of: ${MANUAL_KINDS.map(k => k.toLowerCase()).join(', ')}`);
+        return 1;
+    }
+    const auth = authBase();
+    if ('error' in auth) {
+        console.error(`Error: ${auth.error}`);
+        return 1;
+    }
+    const payload = { kind, note };
+    if (options.occurredAt?.trim())
+        payload.occurredAt = options.occurredAt.trim();
+    let res;
+    try {
+        res = await fetch(`${auth.base}/api/tasks/${encodeURIComponent(taskId)}/outcome-signals`, {
+            method: 'POST',
+            headers: { ...auth.headers, 'Content-Type': 'application/json' },
+            body: JSON.stringify(payload),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (!res.ok) {
+        const errBody = (await res.json().catch(() => null));
+        const detail = errBody && typeof errBody.error === 'string'
+            ? (0, sanitize_1.sanitizeField)(errBody.error)
+            : '';
+        console.error(`Error: outcome not recorded (HTTP ${res.status})${detail ? ` — ${detail}` : ''}`);
+        return 1;
+    }
+    process.stdout.write(`✓ Recorded a ${(0, sanitize_1.sanitizeField)(kind.toLowerCase())} rejection on ${(0, sanitize_1.sanitizeField)(taskId)}.\n` +
+        '  The well is a falsifier — this marks the delivery REJECTED by reality; ' +
+        'it is append-only and there is no "satisfied" counterpart.\n');
+    return;
+}
+/**
+ * `lumo outcome show <task>` — read the well for a task: the falsifier verdict
+ * plus its backing rejection signals.
+ */
+async function outcomeShow(taskId) {
+    if (!taskId || taskId.trim() === '') {
+        console.error('Error: a task is required: lumo outcome show <task>');
+        return 1;
+    }
+    const auth = authBase();
+    if ('error' in auth) {
+        console.error(`Error: ${auth.error}`);
+        return 1;
+    }
+    let res;
+    try {
+        res = await fetch(`${auth.base}/api/tasks/${encodeURIComponent(taskId)}/outcome-signals`, { headers: auth.headers });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: could not read the well (HTTP ${res.status}).`);
+        return 1;
+    }
+    const well = (await res.json());
+    const mark = well.verdict === 'REJECTED' ? '✗' : '·';
+    process.stdout.write(`${mark} Outcome well — ${(0, sanitize_1.sanitizeField)(taskId)}: ${well.verdict}\n`);
+    if (well.verdict === 'INCONCLUSIVE') {
+        process.stdout.write('  No rejection on record. INCONCLUSIVE ≠ satisfied — the well only ' +
+            'asserts rejection; silence is not a pass.\n');
+        return;
+    }
+    for (const s of well.signals) {
+        const when = (s.occurredAt ?? s.detectedAt).slice(0, 10);
+        const note = s.evidence?.note ? ` — ${(0, sanitize_1.sanitizeField)(s.evidence.note)}` : '';
+        process.stdout.write(`  ${when}  ${(0, sanitize_1.sanitizeField)(s.kind)} (${(0, sanitize_1.sanitizeField)(s.source)})${note}\n`);
+    }
+    return;
+}
+/** Width of the widest bucket label, for aligned columns. */
+const BUCKET_LABEL_WIDTH = 'multi-round-or-sendback'.length;
+/** Render the report client-side (same pattern as `lumo cost` / `outcome show`). */
+function formatRate(report) {
+    const lines = [];
+    lines.push('Trust × post-hoc fate — delivery-time verification friction vs the outcome well');
+    lines.push('  (rejection rate is a LOWER BOUND: the well only records rejections; ' +
+        'no signal = INCONCLUSIVE, never "satisfied")');
+    lines.push(`  ${report.totalDeliveries} snapshotted deliveries · min ${report.minSamples} per bracket`);
+    if (report.totalDeliveries === 0) {
+        lines.push('  (no delivery has a forecast snapshot yet — nothing to join)');
+        return lines.join('\n') + '\n';
+    }
+    for (const b of report.brackets) {
+        if (b.status === 'measured') {
+            const pct = ((b.rejectionRate ?? 0) * 100).toFixed(1);
+            const lo = ((b.interval?.lower ?? 0) * 100).toFixed(1);
+            const hi = ((b.interval?.upper ?? 0) * 100).toFixed(1);
+            lines.push(`  ${b.bracket.padEnd(BUCKET_LABEL_WIDTH)} ≥${pct}% rejected (${b.rejected}/${b.delivered}, 95% CI ${lo}–${hi}%)`);
+        }
+        else {
+            lines.push(`  ${b.bracket.padEnd(BUCKET_LABEL_WIDTH)} insufficient (${b.rejected}/${b.delivered} deliveries < ${report.minSamples} — rate withheld)`);
+        }
+    }
+    const verdict = report.comparison.status === 'measured'
+        ? `→ ${(0, sanitize_1.sanitizeField)(report.comparison.reason)}`
+        : `→ inconclusive: ${(0, sanitize_1.sanitizeField)(report.comparison.reason)}`;
+    lines.push(`  ${verdict}`);
+    return lines.join('\n') + '\n';
+}
+/**
+ * `lumo outcome rate [--min N] [--json]` — read the workspace trust × post-hoc-
+ * fate join: per delivery-time verification-friction bucket (LUM-606:
+ * no-verification / single-round / multi-round-or-sendback, frozen at delivery),
+ * the post-hoc REJECTED rate from the outcome well. Honest by construction — thin
+ * buckets read `insufficient` (no fabricated rate) and the single-round
+ * vs multi-round-or-sendback comparison stays `inconclusive` until the well has
+ * enough signal to tell the buckets apart.
+ */
+async function outcomeRate(options = {}) {
+    const auth = authBase();
+    if ('error' in auth) {
+        console.error(`Error: ${auth.error}`);
+        return 1;
+    }
+    let min;
+    if (options.min !== undefined && options.min.trim() !== '') {
+        const n = Number(options.min);
+        if (!Number.isInteger(n) || n < 1) {
+            console.error('Error: --min must be a positive integer');
+            return 1;
+        }
+        min = n;
+    }
+    const qs = min !== undefined ? `?min=${min}` : '';
+    let res;
+    try {
+        res = await fetch(`${auth.base}/api/outcome/rate${qs}`, {
+            headers: auth.headers,
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: could not read the outcome rate (HTTP ${res.status}).`);
+        return 1;
+    }
+    const report = (await res.json());
+    if (options.json) {
+        process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+        return;
+    }
+    process.stdout.write(formatRate(report));
+    return;
+}

package/dist/cli/src/commands/task-criteria-list.js

@@ -5,6 +5,7 @@ exports.taskCriteriaList = taskCriteriaList;
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const sanitize_1 = require("../lib/sanitize");
+const referent_kind_1 = require("../../../shared/src/referent-kind");
 /**
  * Render criteria rows for stdout. One line per criterion —
  * `<id>  [TYPE]  SOURCE@rN  statement` — plus an indented checkpointer line
@@ -16,7 +17,13 @@ function formatCriteriaRows(criteria) {
     for (const c of criteria) {
         const provenance = `${c.source}@r${c.addedAtRound}`;
         const evidence = c.evidenceRequired ? '  [evidence]' : '';
-        lines.push(`${c.id}  [${c.verifierType}]  ${provenance}${evidence}  ${(0, sanitize_1.sanitizeField)(c.statement)}`);
+        const eff = (0, referent_kind_1.effectiveReferentKind)({
+            declared: c.referentKind ?? null,
+            verifierType: c.verifierType,
+            checkpointer: c.checkpointer,
+        });
+        const kindTag = ` ⟨${eff}⟩`;
+        lines.push(`${c.id}  [${c.verifierType}]  ${provenance}${evidence}${kindTag}  ${(0, sanitize_1.sanitizeField)(c.statement)}`);
         if (c.checkpointer) {
             lines.push(`  ↳ check: ${(0, sanitize_1.sanitizeField)(c.checkpointer)}`);
         }

package/dist/cli/src/commands/task-criteria-set.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyReadback = verifyReadback;
 exports.taskCriteriaSet = taskCriteriaSet;
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
@@ -7,6 +8,31 @@ const doc_input_1 = require("../lib/doc-input");
 const path_guard_1 = require("../lib/path-guard");
 const sanitize_1 = require("../lib/sanitize");
 const task_criteria_list_1 = require("./task-criteria-list");
+/**
+ * Landing-integrity read-back (LUM-602): a 200 OK proves absence of error,
+ * not presence of correct content. Compare what the server stored (echoed in
+ * the PUT response) field-by-field against what we submitted; any divergence
+ * means the value was corrupted in transport/landing.
+ */
+function verifyReadback(submitted, stored) {
+    const issues = [];
+    const storedByStatement = new Map(stored.map(c => [c.statement, c]));
+    for (const s of submitted) {
+        const got = storedByStatement.get(s.statement);
+        if (!got) {
+            issues.push(`criterion not found after write: "${s.statement.slice(0, 60)}"`);
+            continue;
+        }
+        const wantCk = s.checkpointer ?? null;
+        if ((got.checkpointer ?? null) !== wantCk) {
+            issues.push(`checkpointer corrupted in landing for "${s.statement.slice(0, 40)}": sent ${JSON.stringify(wantCk)}, stored ${JSON.stringify(got.checkpointer ?? null)}`);
+        }
+        if (s.referentKind != null && got.referentKind !== s.referentKind) {
+            issues.push(`referentKind corrupted in landing for "${s.statement.slice(0, 40)}": sent ${s.referentKind}, stored ${got.referentKind}`);
+        }
+    }
+    return issues;
+}
 const CAUSE_TAGS = [
     'NEW_INFO',
     'SCOPE_CHANGE',
@@ -28,7 +54,7 @@ function parseCriteriaJson(raw) {
     if (!Array.isArray(parsed) || parsed.length === 0) {
         return {
             ok: false,
-            error: 'expected a non-empty JSON array of criteria, e.g. [{"statement":"…","verifierType":"MACHINE","checkpointer":"npx jest …"}]',
+            error: 'expected a non-empty JSON array of criteria, e.g. [{"statement":"…","verifierType":"MACHINE","checkpointer":"npx jest …","referentKind":"AGENT_CONSTRUCTED_STATE"}]',
         };
     }
     return { ok: true, items: parsed };
@@ -171,4 +197,17 @@ async function taskCriteriaSet(identifier, options) {
     if (data.judgeStepsWarning) {
         process.stdout.write(`⚠ ${(0, sanitize_1.sanitizeField)(data.judgeStepsWarning)}\n`);
     }
+    // LUM-605: EXTERNAL_FACT criteria whose checkpointer doesn't ground external
+    // — stored, but the verify loop will refuse a PASS on them until re-grounded.
+    if (data.referentWarning) {
+        process.stdout.write(`⚠ ${(0, sanitize_1.sanitizeField)(data.referentWarning)}\n`);
+    }
+    const readbackIssues = verifyReadback(criteriaItems, data.criteria);
+    if (readbackIssues.length > 0) {
+        for (const issue of readbackIssues) {
+            console.error(`⚠ landing-integrity: ${(0, sanitize_1.sanitizeField)(issue)}`);
+        }
+        console.error('Error: stored contract does not match what was submitted — do not trust the success receipt. Re-run and verify.');
+        return 1;
+    }
 }

package/dist/cli/src/index.js

@@ -47,9 +47,12 @@ const session_attach_1 = require("./commands/session-attach");
 const session_status_1 = require("./commands/session-status");
 const next_1 = require("./commands/next");
 const cost_1 = require("./commands/cost");
+const criteria_audit_1 = require("./commands/criteria-audit");
+const fidelity_1 = require("./commands/fidelity");
 const verify_1 = require("./commands/verify");
 const verdict_1 = require("./commands/verdict");
 const crossing_explain_1 = require("./commands/crossing-explain");
+const outcome_1 = require("./commands/outcome");
 const task_context_1 = require("./commands/task-context");
 const task_create_1 = require("./commands/task-create");
 const task_update_1 = require("./commands/task-update");
@@ -242,6 +245,26 @@ crossing
     .description('Append an agent self-explanation ("申辩") to a boundary crossing (LUM-542). Append-only and for the human reviewer — it never clears the crossing or unblocks Done (a human dispositions that). Targets a crossing on the session-bound task.')
     .requiredOption('--note <text>', 'The explanation to record (the rationale for the action / why it may be a false positive)')
     .action(wrap((id, options) => (0, crossing_explain_1.crossingExplain)(id, options)));
+const outcome = program
+    .command('outcome')
+    .description('Read / record the post-hoc outcome well (LUM-598)');
+outcome
+    .command('show <task>')
+    .description('Read the post-hoc outcome well for a task: the falsifier verdict (REJECTED | INCONCLUSIVE — never a "pass") plus its backing rejection signals. INCONCLUSIVE means no rejection on record, NOT satisfied.')
+    .action(wrap((task) => (0, outcome_1.outcomeShow)(task)));
+outcome
+    .command('record <task>')
+    .description('Record a human-observed post-hoc REJECTION of a delivery (revert / rollback / CI regression / downstream redirect / bypass). Append-only; there is no "mark satisfied" counterpart — the well only asserts rejection.')
+    .requiredOption('--note <text>', 'What reality did (the observed referent), e.g. "reverted in #812 after a prod incident"')
+    .option('--kind <kind>', 'reverted | rolled_back | ci_regression | downstream_redirect | bypassed | manual (case-insensitive; default: manual)')
+    .option('--occurred-at <iso>', 'When the event happened (ISO 8601; defaults to now)')
+    .action(wrap((task, options) => (0, outcome_1.outcomeRecord)(task, options)));
+outcome
+    .command('rate')
+    .description('Trust × post-hoc fate: per delivery-time forecast-confidence bracket, the post-hoc REJECTED rate from the outcome well. Honest by construction — thin brackets read "insufficient" and the high-vs-low comparison stays "inconclusive" until the well has enough signal. The rate is a LOWER BOUND (no signal = INCONCLUSIVE, never satisfied).')
+    .option('--min <N>', 'Per-bracket sample floor below which a rate is withheld (default 10)')
+    .option('--json', 'Emit the report as JSON')
+    .action(wrap(options => (0, outcome_1.outcomeRate)(options)));
 program
     .command('next')
     .description('Recommend the next task(s) to work on, ranked by priority, active sprint, and due date. Prints top N (default 3); pick one and run `session attach` + `task context`.')
@@ -256,6 +279,21 @@ program
     .option('--by <dim>', 'Headline grouping: tool | model | member | session (case-insensitive; default tool)')
     .option('--json', 'Emit the versioned payload as JSON')
     .action(wrap(options => (0, cost_1.cost)(options)));
+const criteria = program
+    .command('criteria')
+    .description('Workspace-level acceptance-criteria analytics');
+criteria
+    .command('audit')
+    .description('Show the workspace referent-kind distribution + self-confirming-green ratio (GET /api/criteria/audit)')
+    .action(wrap(() => (0, criteria_audit_1.criteriaAudit)()));
+const fidelity = program
+    .command('fidelity')
+    .description('Mechanical fidelity read-outs (LUM-610)');
+fidelity
+    .command('show <task>')
+    .description('Per delivery snapshot (LUM-609): the grounding composition of the frozen contract (grounded / self-confirming / inconclusive) and the independence signal (criteria ADDED/UPDATED after work started = backward-inference suspects). A composition table, not a single score — direction is never judged. inconclusive is surfaced, never swallowed.')
+    .option('--json', 'Emit the report as JSON')
+    .action(wrap((task, options) => (0, fidelity_1.fidelityShow)(task, options)));
 const session = program
     .command('session')
     .description('Manage per-terminal coding-session context');

package/dist/shared/src/referent-kind.js

@@ -0,0 +1,321 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFERENT_KIND_DECLARABLE = void 0;
+exports.classifyCheckpointerGrounding = classifyCheckpointerGrounding;
+exports.effectiveReferentKind = effectiveReferentKind;
+/**
+ * referentKind (LUM-602): what a criterion anchors — the only dimension that
+ * determines independence. Dependency-light (no @prisma/client) so both the
+ * Next.js server and the CLI can import it; the Prisma `ReferentKind` enum
+ * mirrors REFERENT_KIND_DECLARABLE exactly.
+ */
+exports.REFERENT_KIND_DECLARABLE = [
+    'EXTERNAL_FACT',
+    'AGENT_CONSTRUCTED_STATE',
+    'PENDING_OUTCOME',
+];
+/** Tools whose output the agent cannot author — external facts. */
+const EXTERNAL_TOOLS = [
+    'git',
+    'gh',
+    'curl',
+    'wget',
+    'http',
+    'https',
+    'psql',
+    'dig',
+    'nc',
+];
+/** Agent's own test/type/build harness — green here is self-confirming. */
+const HARNESS_TOOLS = [
+    'jest',
+    'vitest',
+    'mocha',
+    'pytest',
+    'tsc',
+    'node',
+    'ts-node',
+    'tsx',
+];
+/**
+ * `prisma migrate status` is EXTERNAL (queries DB/migration history); a bare
+ * `prisma generate` is harness. Matched as a two-word phrase before the
+ * single-word scan.
+ */
+const EXTERNAL_PHRASES = ['prisma migrate status'];
+function wordMatches(word, tools) {
+    // exact tool, or a tool-prefixed filename like jest-t.ts / vitest.config
+    return tools.some(t => word === t || word.startsWith(`${t}-`) || word.startsWith(`${t}.`));
+}
+/**
+ * No-op external invocations (LUM-605): forms whose exit code and output are
+ * constant w.r.t. external state (`git --version`, `gh --help`, …). An external
+ * tool invoked this way establishes no external fact, so it must never ground
+ * EXTERNAL — this is half of the C-hole fix (the other half is the consumption
+ * requirement below). Kept deliberately small/conservative: a smaller set means
+ * fewer real external checks get mistaken for no-ops (we'd rather under-flag a
+ * decoy than false-downgrade a genuine check, which enforcement now penalizes).
+ */
+const NOOP_FLAG_TOKENS = new Set(['--version', '--help']);
+/** No-op SUBCOMMAND forms — only when they are the first word after the tool
+ *  (`git version`, `gh help`). Not matched as a bare flag-anywhere, so we don't
+ *  trip on an unrelated positional like a psql `-h <host>` (host, not help). */
+const NOOP_SUBCOMMANDS = new Set(['version', 'help']);
+/**
+ * Given a raw command word (possibly `npx jest`, `npm run build`, etc.),
+ * normalize to the effective tool name. Returns null for pure wrapper tokens
+ * (npx, sudo, command) that should cause us to advance to the next word.
+ */
+function normalizeCommandWord(word) {
+    // strip a leading path: scripts/jest-t.ts → jest-t.ts (keep basename)
+    const slash = word.lastIndexOf('/');
+    return slash >= 0 ? word.slice(slash + 1) : word;
+}
+/**
+ * Extract command-position words from a shell script string.
+ *
+ * Algorithm:
+ * 1. Strip `#` comments (everything from # to end of line).
+ * 2. Extract `$(...)` and backtick substitutions — they are command
+ *    lists; recurse into them and add their command-position words.
+ * 3. For `bash -c '...'` / `sh -c '...'` tokens, extract the quoted
+ *    payload and recurse into it as a command list.
+ * 4. Split the remaining text on command separators (|, &&, ||, ;, \n)
+ *    to get individual command segments.
+ * 5. From each segment, take the first meaningful word as the command.
+ *    Skip wrapper words (npx, sudo, command) and "npm run" pairs.
+ */
+function collectCommandWords(script) {
+    const result = [];
+    // Step 1: strip # comments (not inside quotes — simple heuristic: strip
+    // from # that is preceded by whitespace or start-of-line to end of line)
+    const noComments = script.replace(/(^|\s)#[^\n]*/gm, ' ');
+    // Step 2: recurse into $(...) substitutions
+    // We use a simple balanced-paren extractor.
+    let remaining = noComments;
+    remaining = remaining.replace(/\$\(([^)]*)\)/g, (_match, inner) => {
+        result.push(...collectCommandWords(inner));
+        return ' ';
+    });
+    // Recurse into backtick substitutions
+    remaining = remaining.replace(/`([^`]*)`/g, (_match, inner) => {
+        result.push(...collectCommandWords(inner));
+        return ' ';
+    });
+    // Step 3: handle bash -c / sh -c with a single-quoted payload.
+    // Pattern: (bash|sh) ... -c '...' or (bash|sh) ... -c "..."
+    // We do this BEFORE splitting on separators so the payload content
+    // doesn't pollute the segment split.
+    remaining = remaining.replace(/\b(?:bash|sh)\b[^'"]*-c\s+'([^']*)'/g, (_match, payload) => {
+        result.push(...collectCommandWords(payload));
+        return ' ';
+    });
+    remaining = remaining.replace(/\b(?:bash|sh)\b[^'"]*-c\s+"([^"]*)"/g, (_match, payload) => {
+        result.push(...collectCommandWords(payload));
+        return ' ';
+    });
+    // Step 4: split on command separators to get segments.
+    // Split on |, &&, ||, ;, newlines. Note: || must be checked before |.
+    const segments = remaining.split(/\|\||&&|[|;\n]/);
+    // Step 5: from each segment extract the command word.
+    for (const seg of segments) {
+        // Strip leading/trailing whitespace and any residual shell chars
+        // (quotes, $, brackets not already consumed).
+        const cleaned = seg
+            .replace(/['"]/g, ' ') // remove remaining quotes (string args)
+            .replace(/\[|\]/g, ' ') // remove [ ] test brackets
+            .replace(/\$\{?[^}]*}?/g, ' ') // remove remaining $VAR references
+            .trim();
+        if (!cleaned)
+            continue;
+        const tokens = cleaned.split(/\s+/).filter(Boolean);
+        // Walk tokens to find the effective command, skipping wrappers.
+        let i = 0;
+        while (i < tokens.length) {
+            const tok = tokens[i];
+            const lower = tok.toLowerCase();
+            if (lower === 'npx' || lower === 'sudo' || lower === 'command') {
+                i++;
+                continue;
+            }
+            if (lower === 'npm' && tokens[i + 1]?.toLowerCase() === 'run') {
+                // "npm run <script>" — script name is the command
+                i += 2;
+                continue;
+            }
+            // This is the effective command
+            const word = normalizeCommandWord(lower);
+            if (word)
+                result.push(word);
+            break;
+        }
+    }
+    return result;
+}
+function isExternalTool(word) {
+    return wordMatches(word, EXTERNAL_TOOLS);
+}
+/**
+ * Parse one shell command segment (already split off sequencing/pipe operators)
+ * into its effective tool + whether it is a no-op invocation. Mirrors the
+ * wrapper-skipping of {@link collectCommandWords} (npx / sudo / command / npm
+ * run), then reads the post-tool tokens to flag no-op forms (LUM-605).
+ */
+function parseInvocation(segment) {
+    const cleaned = segment
+        .replace(/['"]/g, ' ')
+        .replace(/\[|\]/g, ' ')
+        .replace(/\$\{?[^}]*}?/g, ' ')
+        .trim();
+    if (!cleaned)
+        return null;
+    const tokens = cleaned.split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < tokens.length) {
+        const lower = tokens[i].toLowerCase();
+        if (lower === 'npx' || lower === 'sudo' || lower === 'command') {
+            i++;
+            continue;
+        }
+        if (lower === 'npm' && tokens[i + 1]?.toLowerCase() === 'run') {
+            i += 2;
+            continue;
+        }
+        break;
+    }
+    if (i >= tokens.length)
+        return null;
+    const tool = normalizeCommandWord(tokens[i].toLowerCase());
+    const rest = tokens.slice(i + 1).map(t => t.toLowerCase());
+    const isNoop = rest.some(t => NOOP_FLAG_TOKENS.has(t)) ||
+        (rest.length > 0 && NOOP_SUBCOMMANDS.has(rest[0]));
+    return { tool, isNoop };
+}
+/**
+ * Does this script contain a CONSUMED, non-no-op external command (LUM-605)?
+ * "Consumed" — the discriminator that closes the C hole — means the external
+ * command's output or exit actually reaches the check's verdict:
+ *   - captured in a `$(...)` / backtick substitution (output → data → assertion);
+ *   - piped into a downstream stage (`ext | …`);
+ *   - the terminal command of the whole script (its exit status IS the verdict).
+ * A non-terminal external word whose output is discarded (the decoy
+ * `git --version && cat frozen.txt | grep`), or any no-op invocation, does NOT
+ * ground EXTERNAL.
+ */
+function groundsExternal(script) {
+    const noComments = script.replace(/(^|\s)#[^\n]*/gm, ' ');
+    return scanScript(noComments);
+}
+/** Pull out substitutions / `bash -c` payloads (recursing into them) then walk
+ *  statements → `&&`/`||` segments → pipeline stages to test each consumed slot. */
+function scanScript(text) {
+    let remaining = text;
+    let foundInNested = false;
+    remaining = remaining.replace(/\$\(([^)]*)\)/g, (_m, inner) => {
+        if (scanConsumed(inner))
+            foundInNested = true;
+        return ' ';
+    });
+    remaining = remaining.replace(/`([^`]*)`/g, (_m, inner) => {
+        if (scanConsumed(inner))
+            foundInNested = true;
+        return ' ';
+    });
+    remaining = remaining.replace(/\b(?:bash|sh)\b[^'"]*-c\s+'([^']*)'/g, (_m, payload) => {
+        if (scanScript(payload))
+            foundInNested = true;
+        return ' ';
+    });
+    remaining = remaining.replace(/\b(?:bash|sh)\b[^'"]*-c\s+"([^"]*)"/g, (_m, payload) => {
+        if (scanScript(payload))
+            foundInNested = true;
+        return ' ';
+    });
+    if (foundInNested)
+        return true;
+    const statements = remaining
+        .split(/;|\n/)
+        .map(s => s.trim())
+        .filter(Boolean);
+    for (let si = 0; si < statements.length; si++) {
+        const terminalStatement = si === statements.length - 1;
+        const segments = statements[si].split(/&&|\|\|/)
+            .map(s => s.trim())
+            .filter(Boolean);
+        for (let gi = 0; gi < segments.length; gi++) {
+            const terminalSegment = gi === segments.length - 1;
+            const stages = segments[gi].split(/\|/)
+                .map(s => s.trim())
+                .filter(Boolean);
+            for (let pi = 0; pi < stages.length; pi++) {
+                const finalStage = pi === stages.length - 1;
+                const inv = parseInvocation(stages[pi]);
+                if (!inv || !isExternalTool(inv.tool) || inv.isNoop)
+                    continue;
+                const pipedIntoConsumer = !finalStage;
+                const exitIsVerdict = finalStage && terminalSegment && terminalStatement;
+                if (pipedIntoConsumer || exitIsVerdict)
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+/** Substitution context: the captured output is data fed to the surrounding
+ *  assertion, so a non-no-op external command word in ANY position is consumed. */
+function scanConsumed(inner) {
+    let remaining = inner;
+    let found = false;
+    remaining = remaining.replace(/\$\(([^)]*)\)/g, (_m, x) => {
+        if (scanConsumed(x))
+            found = true;
+        return ' ';
+    });
+    remaining = remaining.replace(/`([^`]*)`/g, (_m, x) => {
+        if (scanConsumed(x))
+            found = true;
+        return ' ';
+    });
+    if (found)
+        return true;
+    const segments = remaining
+        .split(/&&|\|\||;|\||\n/)
+        .map(s => s.trim())
+        .filter(Boolean);
+    for (const seg of segments) {
+        const inv = parseInvocation(seg);
+        if (inv && isExternalTool(inv.tool) && !inv.isNoop)
+            return true;
+    }
+    return false;
+}
+function classifyCheckpointerGrounding(checkpointer) {
+    if (!checkpointer || checkpointer.trim() === '')
+        return 'NONE';
+    const lower = checkpointer.toLowerCase();
+    // Fast path for known two-word external phrases (e.g. prisma migrate status)
+    if (EXTERNAL_PHRASES.some(p => lower.includes(p)))
+        return 'EXTERNAL';
+    const words = collectCommandWords(lower);
+    if (words.length === 0)
+        return 'NONE';
+    // Strongest signal wins: EXTERNAL > AGENT_HARNESS > ASSERTION_ONLY. EXTERNAL
+    // is gated on a CONSUMED, non-no-op external command (LUM-605) — a no-op or
+    // output-discarded external word falls through to harness/assertion.
+    if (groundsExternal(lower))
+        return 'EXTERNAL';
+    if (words.some(w => wordMatches(w, HARNESS_TOOLS)))
+        return 'AGENT_HARNESS';
+    return 'ASSERTION_ONLY';
+}
+function effectiveReferentKind(args) {
+    const { declared, verifierType, checkpointer } = args;
+    if (declared === null)
+        return 'UNCLASSIFIED';
+    if (declared === 'EXTERNAL_FACT' && verifierType === 'MACHINE') {
+        if (classifyCheckpointerGrounding(checkpointer) !== 'EXTERNAL') {
+            return 'UNVERIFIED_ASSERTION';
+        }
+    }
+    return declared;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumoai/cli",
-  "version": "1.47.0",
+  "version": "1.49.0",
   "description": "Lumo CLI — manage tasks and sessions from the terminal",
   "license": "MIT",
   "author": "cli@uselumo.ai",