@lumoai/cli 1.48.0 → 1.49.0

package/assets/skill/SKILL.md

@@ -32,6 +32,7 @@ The command catalog below is a **map**: it lists every command grouped by domain
 | `verify`, `task status` — machine verification loop, claim-done flow, self-check/resume | [references/verify.md](references/verify.md)                   |
 | `cost` — per-operation (per-tool) token cost read-out; `task lineage` Top-5             | [references/task-context.md](references/task-context.md)       |
 | `outcome show/record/rate` — post-hoc outcome well (falsifier oracle, rejection-only)   | [references/outcome.md](references/outcome.md)                 |
+| `fidelity show` — per-delivery grounding + independence change-pattern read-out         | [references/fidelity.md](references/fidelity.md)               |
 | `project list`, `milestone*`                                                            | [references/milestones.md](references/milestones.md)           |
 | `doc create/update/list/move/bind/share/import` (CRUD)                                  | [references/docs.md](references/docs.md)                       |
 | `doc show --raw/--section`, `doc patch/append/diff/rebuild-source` (editing live docs)  | [references/doc-editing.md](references/doc-editing.md)         |
@@ -101,7 +102,16 @@ The command catalog below is a **map**: it lists every command grouped by domain
 
 - `lumo outcome show <task>` — read the post-hoc outcome well: the **falsifier** verdict (`REJECTED` | `INCONCLUSIVE` — never a "pass") plus its backing rejection signals. `INCONCLUSIVE` = no rejection on record, **not** "satisfied".
 - `lumo outcome record <task> --note "<what reality did>" [--kind <kind>]` — record a human-observed post-hoc **rejection** of a delivery (revert / rollback / CI regression / downstream redirect / bypass). Append-only; **there is no "mark satisfied" counterpart** — the well only asserts rejection. `--note` is required (the observed referent).
-- `lumo outcome rate [--min N] [--json]` — workspace **trust × post-hoc-fate** join (LUM-603): per delivery-time forecast-confidence bracket (high/medium/low), the post-hoc REJECTED rate from the well. Honest by construction — thin brackets read `insufficient` (no fabricated rate), the high-vs-low comparison stays `inconclusive` until CIs separate, and the rate is a **lower bound** (no signal = INCONCLUSIVE, never satisfied). Under-sampled today by design — the skeleton produces real strata once the well fills.
+- `lumo outcome rate [--min N] [--json]` — workspace **trust × post-hoc-fate** join (LUM-603, LUM-606): per delivery-time **verification-friction** bucket (`no-verification` / `single-round` / `multi-round-or-sendback` — two raw counts frozen at delivery, replacing the saturating forecast-confidence axis), the post-hoc REJECTED rate from the well. Honest by construction — thin buckets read `insufficient` (no fabricated rate), the single-round-vs-multi comparison stays `inconclusive` until CIs separate, and the rate is a **lower bound** (no signal = INCONCLUSIVE, never satisfied). Bucket names are value-neutral — direction is decided by the correlation, never welded into the label. Under-sampled today by design — the skeleton produces real strata once the well fills.
+
+**Fidelity read-out (mechanical change-pattern)** — see [fidelity.md](references/fidelity.md)
+
+- `lumo fidelity show <task> [--json]` — per delivery snapshot (LUM-609), a **composition table, not a single score**: (1) the **grounding** of the frozen contract — grounded (`EXTERNAL_FACT`, a machine-checkable upper bound) / self-confirming (`AGENT_CONSTRUCTED_STATE` + `UNVERIFIED_ASSERTION`) / inconclusive (`PENDING_OUTCOME` + `UNCLASSIFIED`, surfaced not swallowed) + the full effective-kind tally; (2) the **independence** signal — criteria `ADDED`/`UPDATED` at round>0 (after work started) that the delivery rode on = backward-inference suspects. Purely mechanical (timing + op + grounding) — **no direction verdict**. A no-snapshot task is reported explicitly (not a pass). Zero new storage — reads the snapshot + `CRITERION_CHANGED` trail.
+
+```bash
+lumo fidelity show LUM-42
+lumo fidelity show LUM-42 --json
+```
 
 **Artifacts & Figma** — see [artifacts-figma.md](references/artifacts-figma.md)
 
@@ -169,7 +179,7 @@ lumo criteria audit
    - `EXTERNAL_FACT` — declared as externally observable (git SHA, CI status, DB row) and the checkpointer invokes real external tooling
    - `AGENT_CONSTRUCTED_STATE` — passes by checking output the agent itself produced
    - `PENDING_OUTCOME` — deferred to post-hoc falsifier
-   - `UNVERIFIED_ASSERTION` — declared `EXTERNAL_FACT` but the checkpointer does **not** actually invoke external tooling (git/CI/HTTP); downgraded by the audit
+   - `UNVERIFIED_ASSERTION` — declared `EXTERNAL_FACT` but the checkpointer does **not** actually invoke external tooling (git/CI/HTTP); auto-downgraded. As of LUM-605 this is an **enforced gate, not just a label**: `lumo task criteria set` warns on it, and `lumo verify` blocks a PASS on it with **422 (no round burned)** until it's re-grounded or honestly re-declared `AGENT_CONSTRUCTED_STATE` (see references/criteria.md "referentKind")
    - `UNCLASSIFIED` — legacy rows predating the `referentKind` field (null in DB)
 
 2. **Self-confirming-green headline ratio** — `(AGENT_CONSTRUCTED_STATE + UNVERIFIED_ASSERTION) / classified`. Criteria in these two buckets pass by confirming only the agent's own work, not an independent external state.

package/assets/skill/references/criteria.md

@@ -60,6 +60,21 @@ The 3–7 range is calibrated for typical multi-file tasks. Criterion count must
 
 ### judgeSteps — agent-drafted judging steps for HUMAN criteria
 
+**`referentKind` — what the criterion anchors (required, and a real gate as of LUM-605):**
+
+Every criterion declares one `referentKind` — the only dimension that decides whether a PASS is independent or self-confirming. Required on every item (the API rejects a missing one with 400):
+
+- `EXTERNAL_FACT` — anchored on a fact the agent cannot author: a git SHA / diff, CI status, an HTTP probe, a DB row, `prisma migrate status`. **Only honest when the checkpointer actually invokes external tooling** (`git`/`gh`/`curl`/`psql`/…) AND its output or exit status reaches the verdict (piped into an assertion, captured in `$(…)`, or the terminal command whose exit IS the verdict). A no-op or output-discarded external command (`git --version && cat frozen.txt | grep`) does **not** count.
+- `AGENT_CONSTRUCTED_STATE` — passes by checking output the agent itself produced: **your own jest/vitest/tsc/node/tsx tests, build, type-check**. This is the honest kind for almost every code task's checks. Green here is self-confirming — that's fine, just label it truthfully.
+- `PENDING_OUTCOME` — truth lands post-delivery (a downstream regression, a revert). Has no check today: it **cannot** be MACHINE (the API rejects PENDING_OUTCOME + MACHINE). Draft it HUMAN or leave it out of the encoded contract.
+
+**The gate (LUM-605):** declaring `EXTERNAL_FACT` + MACHINE on a checkpointer that doesn't ground external (e.g. `npx jest …`) is the LUM-601 fakeGit shape — it would launder a self-confirming green into a "verified external fact". The system now downgrades it to `UNVERIFIED_ASSERTION` and:
+
+- at **`criteria set`** — stores it but returns a non-rejecting ⚠ warning naming the criterion (re-ground or re-declare);
+- at **`lumo verify`** — a PASS on it is **blocked with 422 (no round burned)**; the round does not land and the task does not move to IN_REVIEW until you either re-ground the checkpointer against a real external fact, or honestly re-declare it `AGENT_CONSTRUCTED_STATE`. Both fixes are free (no round consumed).
+
+Don't reach for `EXTERNAL_FACT` to look stronger — a jest test is `AGENT_CONSTRUCTED_STATE`, full stop. Reserve `EXTERNAL_FACT` for checks that truly read external state, or use a HUMAN criterion for "a person ran the real system and observed X" (HUMAN is never mechanically downgraded).
+
 A HUMAN criterion is judged by a person, not a checkpointer — so don't hand them a bare assertion ("the copy reads naturally") and make them reverse-engineer what to do. Attach **`judgeSteps`**: short, human-readable instructions the adjudication card renders verbatim (light markdown, URLs made clickable). Structured labour is yours; the human just follows the steps.
 
 **Shape — 1–3 steps, always in this order:**
@@ -78,6 +93,7 @@ A HUMAN criterion is judged by a person, not a checkpointer — so don't hand th
 {
   "statement": "The acceptance tab reads as plain operational instructions, not agent-voice assertions",
   "verifierType": "HUMAN",
+  "referentKind": "AGENT_CONSTRUCTED_STATE",
   "judgeSteps": "Open the task's Acceptance tab (the IN_REVIEW card). For each HUMAN criterion, read its 'How to judge' block. Pass if each one names where to look, what to do, and what counts as pass vs send-back; send back if any reads as a bare assertion with no steps."
 }
 ```
@@ -97,12 +113,14 @@ Two real-repo invariant examples — `prisma/migrations/` files never deleted (t
   {
     "statement": "No file under prisma/migrations/ is deleted by this change (vs origin/main)",
     "verifierType": "MACHINE",
-    "checkpointer": "bash -c \"test -z \\\"$(git diff --diff-filter=D --name-only origin/main -- prisma/migrations/)\\\"\""
+    "checkpointer": "bash -c \"test -z \\\"$(git diff --diff-filter=D --name-only origin/main -- prisma/migrations/)\\\"\"",
+    "referentKind": "EXTERNAL_FACT"
   },
   {
     "statement": "Live-doc keeps its table structure after the edit (no rows/headings dropped)",
     "verifierType": "MACHINE",
-    "checkpointer": "npx tsx scripts/verify-live-doc.ts <docId> docs/live-docs/<file>.md"
+    "checkpointer": "npx tsx scripts/verify-live-doc.ts <docId> docs/live-docs/<file>.md",
+    "referentKind": "AGENT_CONSTRUCTED_STATE"
   }
 ]
 ```
@@ -120,17 +138,20 @@ One invariant criterion is usually enough — it's the guardrail, not the whole
   {
     "statement": "PUT /api/tasks/[id]/criteria rejects a second AGENT_DRAFT submission with 409",
     "verifierType": "MACHINE",
-    "checkpointer": "npx jest __tests__/task-criteria.service.test.ts -t 'agent lock'"
+    "checkpointer": "npx jest __tests__/task-criteria.service.test.ts -t 'agent lock'",
+    "referentKind": "AGENT_CONSTRUCTED_STATE"
   },
   {
     "statement": "The criteria section reads naturally as part of the task statement",
     "verifierType": "HUMAN",
+    "referentKind": "AGENT_CONSTRUCTED_STATE",
     "judgeSteps": "Open the task's Acceptance tab. Read the contract top to bottom. Pass if it scans as one coherent definition of done; send back if a criterion reads as boilerplate or contradicts another."
   },
   {
     "statement": "Session-start injection shows the contract ahead of memory",
     "verifierType": "MACHINE",
     "checkpointer": "npx jest __tests__/cli/hook-runner-session-start-stdout.test.ts",
+    "referentKind": "AGENT_CONSTRUCTED_STATE",
     "evidenceRequired": true
   }
 ]
@@ -141,6 +162,7 @@ Fields:
 - `statement` — required, ≤2000 chars.
 - `verifierType` — `"MACHINE"` | `"HUMAN"`.
 - `checkpointer` — required for MACHINE.
+- `referentKind` — **required**, `"EXTERNAL_FACT"` | `"AGENT_CONSTRUCTED_STATE"` | `"PENDING_OUTCOME"` (see "referentKind" above). Your own tests/build/type-check are `AGENT_CONSTRUCTED_STATE`; `EXTERNAL_FACT` is gated (warned at set, 422 at verify) unless the checkpointer truly grounds external; `PENDING_OUTCOME` can't be MACHINE.
 - `evidenceRequired` — optional, default false.
 - `judgeSteps` — optional, ≤2000 chars; agent-drafted human-judging steps for a HUMAN criterion (see "judgeSteps" above).
 - `id` — only in `--human` revisions (see below).

package/assets/skill/references/fidelity.md

@@ -0,0 +1,32 @@
+# Fidelity read-outs (mechanical change-pattern)
+
+`lumo fidelity` is the fidelity-axis read surface — pure, read-only analytics over what the acceptance loop already records, in the same family as `lumo criteria audit` and `lumo outcome rate`. It adds **no storage and no write path**; it only reads the LUM-609 delivery snapshots and the `CRITERION_CHANGED` audit trail.
+
+## `lumo fidelity show <task>`
+
+```bash
+lumo fidelity show LUM-42
+lumo fidelity show LUM-42 --json
+```
+
+For **each delivery** of the task (one append-only `TaskCriteriaSnapshot` per fresh IN_REVIEW entry — a reopen→re-deliver appends another), it discloses two compositions and deliberately stops there. There is **no single fidelity score and no good/bad direction verdict** — the read-out is purely mechanical (timing + op + checkpointer grounding; it never reads statement or diff semantics).
+
+### 1. Grounding composition
+
+Runs the same `effectiveReferentKind` classifier the LUM-605 verify gate uses over the **frozen** contract (delivery-time truth, not the since-edited `latest`), rolled into three buckets plus the full per-kind tally:
+
+- **grounded** — `EXTERNAL_FACT` (anchored on a fact the agent cannot author: a git SHA/diff, CI status, a DB row). This count is a **machine-checkable _upper bound_** — the checkpointer heuristic can over-count external grounding, never under-count it.
+- **self-confirming** — `AGENT_CONSTRUCTED_STATE` + `UNVERIFIED_ASSERTION` (passes by checking the agent's own output, incl. a declared-EXTERNAL_FACT checkpointer that doesn't truly ground external).
+- **inconclusive** — `PENDING_OUTCOME` + `UNCLASSIFIED` (not mechanically resolvable here). **Surfaced, never silently swallowed.**
+
+### 2. Independence signal
+
+A criterion is a **backward-inference suspect** when it is both (a) in this delivery's frozen contract and (b) was `ADDED`/`UPDATED` at **round>0** (after work started) at or before the freeze — i.e. the contract the delivery rode on was bent after the work began rather than fixed up front. round-0 (initial-draft) criteria are clean; `DELETED` ops and edits recorded after the freeze (a later cycle) don't count. Each suspect shows its `op`, `round`, and `causeTag`. The read-out **counts and discloses — it does not judge** whether a given edit was legitimate sharpening or tampering (that direction call is left to a human / a later axis).
+
+### Caveat (printed on every report)
+
+The time anchor is the **work-start boundary** (`Task.workStartedAt`), so the independence signal detects a contract edited _after work started_ — not specifically _after output was produced_. A task with **no delivery snapshot** (never entered IN_REVIEW, or predates the LUM-609 freeze) is reported explicitly — "nothing to read yet", which is **not** a pass.
+
+`--json` emits the full report (`taskId`, `workStartedAt`, `hasSnapshots`, `deliveries[]` with `grounding`/`independence`, `caveat`) for scripting.
+
+**When to suggest**: when the user wants to see how externally-grounded a task's delivered acceptance contract actually was, or whether criteria were added/changed after work began (independence). It's a disclosure tool, not a gate — it never blocks DONE and emits no verdict.

package/assets/skill/references/outcome.md

@@ -40,7 +40,7 @@ lumo outcome record LUM-42 --note "downstream rewrote the API shape this task in
 
 ## `lumo outcome rate [--min N] [--json]`
 
-The workspace-level **trust × post-hoc-fate** join (LUM-603). For every delivery that has a frozen forecast snapshot, it buckets the delivery by its **delivery-time forecast-confidence** (high / medium / low — the only trust axis frozen at delivery, recomputed from the snapshot's `cohortSize` / `tokenCostBasis`) and reports each bracket's post-hoc **REJECTED** rate from the well. The question it answers once data is sufficient: _do high-trust deliveries get rejected by reality less often than low-trust ones?_
+The workspace-level **trust × post-hoc-fate** join (LUM-603, LUM-606). For every delivery that has a frozen forecast snapshot, it buckets the delivery by its **delivery-time verification friction** — two raw counts (`verificationRounds`, `sendBackCount`) frozen at delivery from the append-only `VerificationRun` log, cut at `capturedAt`, then bucketed value-neutrally into `no-verification` / `single-round` / `multi-round-or-sendback` — and reports each bucket's post-hoc **REJECTED** rate from the well. The friction axis replaced the original sample-size forecast-confidence axis (LUM-606), which saturated: every mature-project delivery landed in `high`, so `high`-vs-`low` could never compare. The question it answers once data is sufficient: _do deliveries that took more verification friction get rejected by reality more (fragility) or less (scrutiny) often?_ The bucket names carry **no** good/bad direction — the correlation, not the label, decides.
 
 ```bash
 lumo outcome rate
@@ -49,17 +49,17 @@ lumo outcome rate --min 20 --json
 
 This is the falsifier discipline applied at the **query layer** — it refuses to manufacture a finding off a thin sample:
 
-- A bracket with fewer than `--min` (default 10) deliveries reads **`insufficient`** with the rate withheld — the raw `rejected/delivered` counts are still shown, but never divided into a believable proportion.
-- The per-bracket rate is an explicit **lower bound** on true failure: the well only records rejections, so a zero-signal delivery is `INCONCLUSIVE` (counted in the denominator), never "satisfied".
-- The headline **high-vs-low** comparison asserts a direction **only** when both brackets are measured _and_ their 95% confidence intervals are disjoint; otherwise it stays **`inconclusive`**.
+- A bucket with fewer than `--min` (default 10) deliveries reads **`insufficient`** with the rate withheld — the raw `rejected/delivered` counts are still shown, but never divided into a believable proportion.
+- The per-bucket rate is an explicit **lower bound** on true failure: the well only records rejections, so a zero-signal delivery is `INCONCLUSIVE` (counted in the denominator), never "satisfied".
+- The **`single-round` vs `multi-round-or-sendback`** comparison asserts a direction **only** when both buckets are measured _and_ their 95% confidence intervals are disjoint; otherwise it stays **`inconclusive`**. `no-verification` is never a comparison arm (silence is not a friction level).
 
-**Expect `inconclusive` today.** The well is freshly wired and under-sampled — that is the designed state, not a bug. The same command produces real strata once enough post-hoc signals accumulate (the deferred outcome the skeleton exists to read).
+**Expect `inconclusive` today.** The well is freshly wired and the discriminating end of the friction axis is sparse (multi-round/send-back deliveries are rare) — that is the designed state, not a bug. The same command produces real strata once enough post-hoc signals accumulate against the populated friction buckets (the deferred outcome the skeleton exists to read).
 
-> Scope note (debt-a): the trust axis is **task-level** forecast confidence only. Fragment-level trust is not frozen at delivery and drifts, so it is deliberately **not** joined here — doing so would read a post-hoc value against a past delivery. Freezing fragment trust is a separate follow-up.
+> Scope note: friction is frozen **at delivery** and cut at `capturedAt`, so it is replayable and never reads a drifted current value. A delivery with no `VerificationRun` before capture is its own `no-verification` bucket — absence of verification is never folded into `single-round` (silence ≠ a clean pass).
 
 ## When to suggest
 
 - A teammate says a shipped task **was reverted / rolled back / broke prod / got redone / was bypassed** — record it with `lumo outcome record` so the well carries reality's verdict.
 - Auditing whether a "done" task actually held up — `lumo outcome show <task>` reads the well.
-- Asking whether **higher-confidence deliveries actually fail less** (does delivery-time trust predict post-hoc fate?) — `lumo outcome rate`. Expect `inconclusive` until the well fills; it will never print a correlation the sample can't support.
+- Asking whether **verification friction predicts post-hoc fate** (do harder-to-verify deliveries fail more, or less?) — `lumo outcome rate`. Expect `inconclusive` until the well fills; it will never print a correlation the sample can't support.
 - **Never** use it to mark something good: the well has no positive verdict by design. To assert a delivery met its contract, that is the acceptance loop (`lumo verify` / `lumo task status`), not the well.

package/assets/skill/references/verify.md

@@ -21,10 +21,10 @@ lumo verify --note "…" --timeout 900     # per-checkpointer timeout in seconds
 **`--note` is required (LUM-597)** whenever a round will actually be posted (the
 task has MACHINE criteria). It is your one-line self-report — what you did and
 why it is ready ("我改了 X,因为 Y 可验收"). When the round all-passes and the
-task flips to IN_REVIEW, the note is frozen as the task's **claim** (provenance
+task flips to IN*REVIEW, the note is frozen as the task's **claim** (provenance
 `AGENT` — the汇报者's own voice, not a summarizer paraphrase) and is checked
 against the diff for faithfulness. Capturing the claim is deterministic ("不填不
-让 post"); whether it is _truthful_ is the faithfulness audit's job — so don't
+让 post"); whether it is \_truthful* is the faithfulness audit's job — so don't
 under- or over-state it. A missing/blank note is refused **before** the round is
 posted, so no round is burned; just re-run with one. (An old CLI that omits it
 still verifies — the claim degrades to the synthesized run-summary fallback.)
@@ -61,15 +61,16 @@ errors.
 
 ## Edge cases
 
-| Case                                            | Behavior                                                                                                                                                                                                                                                                                                             |
-| ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **No contract yet**                             | Error pointing at `lumo task criteria set`; draft the contract first (criteria.md golden rule).                                                                                                                                                                                                                      |
-| **HUMAN-only contract** (zero MACHINE criteria) | Nothing to run; CLI says so and suggests `lumo task update <id> --status in_review` for human review. No server write happens.                                                                                                                                                                                       |
-| **Partial round**                               | A round must cover every MACHINE criterion; the CLI always runs all of them and the server rejects partial rounds.                                                                                                                                                                                                   |
-| **`REVIEW_ADDED` criteria**                     | Criteria added during review appear in the contract and are picked up automatically by the next round.                                                                                                                                                                                                               |
-| **Session bound to a different task**           | Server returns 409, surfaced as an error. No advisory printed; the verify round is rejected outright.                                                                                                                                                                                                                |
-| **Provably-unbound session**                    | Response carries `bindingAdvisory: 'unbound'`; prints `⚠ Working unbound — this verify ran from a Claude Code session not attached to the task.` Recorded as a `SESSION_BINDING_MISSING` boundary crossing (visible in `lumo task status` open crossings). Run `lumo session attach <LUM-N>` before the next verify. |
-| **Unconfirmed session binding**                 | `bindingAdvisory: 'unconfirmed'` → softer advisory `⚠ Could not confirm this session is attached to the task.` Same remediation: `lumo session attach <LUM-N>`.                                                                                                                                                      |
+| Case                                            | Behavior                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **No contract yet**                             | Error pointing at `lumo task criteria set`; draft the contract first (criteria.md golden rule).                                                                                                                                                                                                                                                                                                                                          |
+| **HUMAN-only contract** (zero MACHINE criteria) | Nothing to run; CLI says so and suggests `lumo task update <id> --status in_review` for human review. No server write happens.                                                                                                                                                                                                                                                                                                           |
+| **Partial round**                               | A round must cover every MACHINE criterion; the CLI always runs all of them and the server rejects partial rounds.                                                                                                                                                                                                                                                                                                                       |
+| **`REVIEW_ADDED` criteria**                     | Criteria added during review appear in the contract and are picked up automatically by the next round.                                                                                                                                                                                                                                                                                                                                   |
+| **Session bound to a different task**           | Server returns 409, surfaced as an error. No advisory printed; the verify round is rejected outright.                                                                                                                                                                                                                                                                                                                                    |
+| **Ungrounded EXTERNAL_FACT PASS** (LUM-605)     | A reported PASS on a criterion declared `EXTERNAL_FACT` whose checkpointer doesn't invoke external tooling (e.g. `npx jest …`) is blocked with **422 — no round burned**; the task does **not** move to IN_REVIEW. Fix it for free: re-ground the checkpointer against a real external fact, or honestly re-declare `referentKind` as `AGENT_CONSTRUCTED_STATE` (`lumo task criteria set`), then re-run. See criteria.md "referentKind". |
+| **Provably-unbound session**                    | Response carries `bindingAdvisory: 'unbound'`; prints `⚠ Working unbound — this verify ran from a Claude Code session not attached to the task.` Recorded as a `SESSION_BINDING_MISSING` boundary crossing (visible in `lumo task status` open crossings). Run `lumo session attach <LUM-N>` before the next verify.                                                                                                                     |
+| **Unconfirmed session binding**                 | `bindingAdvisory: 'unconfirmed'` → softer advisory `⚠ Could not confirm this session is attached to the task.` Same remediation: `lumo session attach <LUM-N>`.                                                                                                                                                                                                                                                                          |
 
 ## Round discipline
 

package/dist/cli/src/commands/fidelity.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fidelityShow = fidelityShow;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/**
+ * `lumo fidelity show <task>` — the LUM-610 mechanical change-pattern read-out
+ * (fidelity axis, second block, on the LUM-609 delivery-snapshot foundation).
+ *
+ * Per delivery snapshot it discloses two compositions and NOTHING else — no
+ * single score, no good/bad verdict (approach (a): purely mechanical):
+ *   • grounding — how much of the FROZEN contract is externally grounded
+ *     (EXTERNAL_FACT) vs self-confirming (agent-authored) vs inconclusive.
+ *     `grounded` is a machine-checkable UPPER BOUND.
+ *   • independence — criteria ADDED/UPDATED after work started (round>0) that
+ *     the delivery rode on: backward-inference suspects. Direction left blank.
+ */
+const EFFECTIVE_KINDS = [
+    'EXTERNAL_FACT',
+    'AGENT_CONSTRUCTED_STATE',
+    'UNVERIFIED_ASSERTION',
+    'PENDING_OUTCOME',
+    'UNCLASSIFIED',
+];
+function authBase() {
+    const creds = (0, config_1.readCredentials)();
+    if (!creds)
+        return { error: 'not logged in. Run `lumo auth login` first.' };
+    const base = (0, api_1.trimTrailingSlash)((0, api_1.resolveAuthedApiUrl)(creds.apiUrl));
+    const headers = {
+        Authorization: `Bearer ${creds.token}`,
+    };
+    const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
+    if (sessionId)
+        headers['X-Lumo-Session-Id'] = sessionId;
+    return { base, headers };
+}
+function formatReport(report, taskId) {
+    const lines = [];
+    lines.push(`Fidelity change-pattern — ${(0, sanitize_1.sanitizeField)(taskId)}`);
+    if (!report.hasSnapshots) {
+        lines.push('  No delivery snapshot on record (task never entered IN_REVIEW, or ' +
+            'predates the LUM-609 freeze). Nothing to read yet — not a pass.');
+        lines.push('');
+        lines.push(`  ${report.caveat}`);
+        return lines.join('\n') + '\n';
+    }
+    report.deliveries.forEach((d, i) => {
+        const when = d.frozenAt.slice(0, 19).replace('T', ' ');
+        lines.push('');
+        lines.push(`  Delivery ${i + 1}/${report.deliveries.length} · frozen ${when}Z · ${(0, sanitize_1.sanitizeField)(d.trigger)} · ${d.total} criteria`);
+        const g = d.grounding;
+        lines.push(`    grounding:    grounded ${g.grounded}  ·  self-confirming ${g.selfConfirming}  ·  inconclusive ${g.inconclusive}   (grounded = machine-checkable upper bound)`);
+        const kinds = EFFECTIVE_KINDS.filter(k => g.byEffectiveKind[k] > 0)
+            .map(k => `${k} ${g.byEffectiveKind[k]}`)
+            .join(', ');
+        lines.push(`      effective kinds: ${kinds || '(none)'}`);
+        const ind = d.independence;
+        lines.push(`    independence: ${ind.postStartChanges}/${ind.total} criteria ADDED/UPDATED after work started (backward-inference suspects; direction not judged)`);
+        for (const s of ind.suspects) {
+            const cause = s.causeTag ? ` · ${(0, sanitize_1.sanitizeField)(s.causeTag)}` : '';
+            lines.push(`      ↳ ${(0, sanitize_1.sanitizeField)(s.criterionId)}  ${s.op}@round${s.round}${cause}  (${s.at.slice(0, 10)})`);
+        }
+    });
+    lines.push('');
+    lines.push(`  ${report.caveat}`);
+    return lines.join('\n') + '\n';
+}
+async function fidelityShow(taskId, options = {}) {
+    if (!taskId || taskId.trim() === '') {
+        console.error('Error: a task is required: lumo fidelity show <task>');
+        return 1;
+    }
+    const auth = authBase();
+    if ('error' in auth) {
+        console.error(`Error: ${auth.error}`);
+        return 1;
+    }
+    let res;
+    try {
+        res = await fetch(`${auth.base}/api/tasks/${encodeURIComponent(taskId)}/fidelity`, { headers: auth.headers });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: task ${(0, sanitize_1.sanitizeField)(taskId)} not found.`);
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: could not read the fidelity change-pattern (HTTP ${res.status}).`);
+        return 1;
+    }
+    const report = (await res.json());
+    if (options.json) {
+        process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+        return;
+    }
+    process.stdout.write(formatReport(report, taskId));
+    return;
+}

package/dist/cli/src/commands/outcome.js

@@ -141,10 +141,12 @@ async function outcomeShow(taskId) {
     }
     return;
 }
+/** Width of the widest bucket label, for aligned columns. */
+const BUCKET_LABEL_WIDTH = 'multi-round-or-sendback'.length;
 /** Render the report client-side (same pattern as `lumo cost` / `outcome show`). */
 function formatRate(report) {
     const lines = [];
-    lines.push('Trust × post-hoc fate — delivery-time forecast confidence vs the outcome well');
+    lines.push('Trust × post-hoc fate — delivery-time verification friction vs the outcome well');
     lines.push('  (rejection rate is a LOWER BOUND: the well only records rejections; ' +
         'no signal = INCONCLUSIVE, never "satisfied")');
     lines.push(`  ${report.totalDeliveries} snapshotted deliveries · min ${report.minSamples} per bracket`);
@@ -157,10 +159,10 @@ function formatRate(report) {
             const pct = ((b.rejectionRate ?? 0) * 100).toFixed(1);
             const lo = ((b.interval?.lower ?? 0) * 100).toFixed(1);
             const hi = ((b.interval?.upper ?? 0) * 100).toFixed(1);
-            lines.push(`  ${b.bracket.padEnd(6)} ≥${pct}% rejected (${b.rejected}/${b.delivered}, 95% CI ${lo}–${hi}%)`);
+            lines.push(`  ${b.bracket.padEnd(BUCKET_LABEL_WIDTH)} ≥${pct}% rejected (${b.rejected}/${b.delivered}, 95% CI ${lo}–${hi}%)`);
         }
         else {
-            lines.push(`  ${b.bracket.padEnd(6)} insufficient (${b.rejected}/${b.delivered} deliveries < ${report.minSamples} — rate withheld)`);
+            lines.push(`  ${b.bracket.padEnd(BUCKET_LABEL_WIDTH)} insufficient (${b.rejected}/${b.delivered} deliveries < ${report.minSamples} — rate withheld)`);
         }
     }
     const verdict = report.comparison.status === 'measured'
@@ -171,10 +173,12 @@ function formatRate(report) {
 }
 /**
  * `lumo outcome rate [--min N] [--json]` — read the workspace trust × post-hoc-
- * fate join: per delivery-time forecast-confidence bracket, the post-hoc
- * REJECTED rate from the outcome well. Honest by construction — thin brackets
- * read `insufficient` (no fabricated rate) and the high-vs-low comparison stays
- * `inconclusive` until the well has enough signal to tell the brackets apart.
+ * fate join: per delivery-time verification-friction bucket (LUM-606:
+ * no-verification / single-round / multi-round-or-sendback, frozen at delivery),
+ * the post-hoc REJECTED rate from the outcome well. Honest by construction — thin
+ * buckets read `insufficient` (no fabricated rate) and the single-round
+ * vs multi-round-or-sendback comparison stays `inconclusive` until the well has
+ * enough signal to tell the buckets apart.
  */
 async function outcomeRate(options = {}) {
     const auth = authBase();

package/dist/cli/src/commands/task-criteria-set.js

@@ -197,6 +197,11 @@ async function taskCriteriaSet(identifier, options) {
     if (data.judgeStepsWarning) {
         process.stdout.write(`⚠ ${(0, sanitize_1.sanitizeField)(data.judgeStepsWarning)}\n`);
     }
+    // LUM-605: EXTERNAL_FACT criteria whose checkpointer doesn't ground external
+    // — stored, but the verify loop will refuse a PASS on them until re-grounded.
+    if (data.referentWarning) {
+        process.stdout.write(`⚠ ${(0, sanitize_1.sanitizeField)(data.referentWarning)}\n`);
+    }
     const readbackIssues = verifyReadback(criteriaItems, data.criteria);
     if (readbackIssues.length > 0) {
         for (const issue of readbackIssues) {

package/dist/cli/src/index.js

@@ -48,6 +48,7 @@ const session_status_1 = require("./commands/session-status");
 const next_1 = require("./commands/next");
 const cost_1 = require("./commands/cost");
 const criteria_audit_1 = require("./commands/criteria-audit");
+const fidelity_1 = require("./commands/fidelity");
 const verify_1 = require("./commands/verify");
 const verdict_1 = require("./commands/verdict");
 const crossing_explain_1 = require("./commands/crossing-explain");
@@ -285,6 +286,14 @@ criteria
     .command('audit')
     .description('Show the workspace referent-kind distribution + self-confirming-green ratio (GET /api/criteria/audit)')
     .action(wrap(() => (0, criteria_audit_1.criteriaAudit)()));
+const fidelity = program
+    .command('fidelity')
+    .description('Mechanical fidelity read-outs (LUM-610)');
+fidelity
+    .command('show <task>')
+    .description('Per delivery snapshot (LUM-609): the grounding composition of the frozen contract (grounded / self-confirming / inconclusive) and the independence signal (criteria ADDED/UPDATED after work started = backward-inference suspects). A composition table, not a single score — direction is never judged. inconclusive is surfaced, never swallowed.')
+    .option('--json', 'Emit the report as JSON')
+    .action(wrap((task, options) => (0, fidelity_1.fidelityShow)(task, options)));
 const session = program
     .command('session')
     .description('Manage per-terminal coding-session context');

package/dist/shared/src/referent-kind.js

@@ -47,6 +47,20 @@ function wordMatches(word, tools) {
     // exact tool, or a tool-prefixed filename like jest-t.ts / vitest.config
     return tools.some(t => word === t || word.startsWith(`${t}-`) || word.startsWith(`${t}.`));
 }
+/**
+ * No-op external invocations (LUM-605): forms whose exit code and output are
+ * constant w.r.t. external state (`git --version`, `gh --help`, …). An external
+ * tool invoked this way establishes no external fact, so it must never ground
+ * EXTERNAL — this is half of the C-hole fix (the other half is the consumption
+ * requirement below). Kept deliberately small/conservative: a smaller set means
+ * fewer real external checks get mistaken for no-ops (we'd rather under-flag a
+ * decoy than false-downgrade a genuine check, which enforcement now penalizes).
+ */
+const NOOP_FLAG_TOKENS = new Set(['--version', '--help']);
+/** No-op SUBCOMMAND forms — only when they are the first word after the tool
+ *  (`git version`, `gh help`). Not matched as a bare flag-anywhere, so we don't
+ *  trip on an unrelated positional like a psql `-h <host>` (host, not help). */
+const NOOP_SUBCOMMANDS = new Set(['version', 'help']);
 /**
  * Given a raw command word (possibly `npx jest`, `npm run build`, etc.),
  * normalize to the effective tool name. Returns null for pure wrapper tokens
@@ -138,6 +152,143 @@ function collectCommandWords(script) {
     }
     return result;
 }
+function isExternalTool(word) {
+    return wordMatches(word, EXTERNAL_TOOLS);
+}
+/**
+ * Parse one shell command segment (already split off sequencing/pipe operators)
+ * into its effective tool + whether it is a no-op invocation. Mirrors the
+ * wrapper-skipping of {@link collectCommandWords} (npx / sudo / command / npm
+ * run), then reads the post-tool tokens to flag no-op forms (LUM-605).
+ */
+function parseInvocation(segment) {
+    const cleaned = segment
+        .replace(/['"]/g, ' ')
+        .replace(/\[|\]/g, ' ')
+        .replace(/\$\{?[^}]*}?/g, ' ')
+        .trim();
+    if (!cleaned)
+        return null;
+    const tokens = cleaned.split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < tokens.length) {
+        const lower = tokens[i].toLowerCase();
+        if (lower === 'npx' || lower === 'sudo' || lower === 'command') {
+            i++;
+            continue;
+        }
+        if (lower === 'npm' && tokens[i + 1]?.toLowerCase() === 'run') {
+            i += 2;
+            continue;
+        }
+        break;
+    }
+    if (i >= tokens.length)
+        return null;
+    const tool = normalizeCommandWord(tokens[i].toLowerCase());
+    const rest = tokens.slice(i + 1).map(t => t.toLowerCase());
+    const isNoop = rest.some(t => NOOP_FLAG_TOKENS.has(t)) ||
+        (rest.length > 0 && NOOP_SUBCOMMANDS.has(rest[0]));
+    return { tool, isNoop };
+}
+/**
+ * Does this script contain a CONSUMED, non-no-op external command (LUM-605)?
+ * "Consumed" — the discriminator that closes the C hole — means the external
+ * command's output or exit actually reaches the check's verdict:
+ *   - captured in a `$(...)` / backtick substitution (output → data → assertion);
+ *   - piped into a downstream stage (`ext | …`);
+ *   - the terminal command of the whole script (its exit status IS the verdict).
+ * A non-terminal external word whose output is discarded (the decoy
+ * `git --version && cat frozen.txt | grep`), or any no-op invocation, does NOT
+ * ground EXTERNAL.
+ */
+function groundsExternal(script) {
+    const noComments = script.replace(/(^|\s)#[^\n]*/gm, ' ');
+    return scanScript(noComments);
+}
+/** Pull out substitutions / `bash -c` payloads (recursing into them) then walk
+ *  statements → `&&`/`||` segments → pipeline stages to test each consumed slot. */
+function scanScript(text) {
+    let remaining = text;
+    let foundInNested = false;
+    remaining = remaining.replace(/\$\(([^)]*)\)/g, (_m, inner) => {
+        if (scanConsumed(inner))
+            foundInNested = true;
+        return ' ';
+    });
+    remaining = remaining.replace(/`([^`]*)`/g, (_m, inner) => {
+        if (scanConsumed(inner))
+            foundInNested = true;
+        return ' ';
+    });
+    remaining = remaining.replace(/\b(?:bash|sh)\b[^'"]*-c\s+'([^']*)'/g, (_m, payload) => {
+        if (scanScript(payload))
+            foundInNested = true;
+        return ' ';
+    });
+    remaining = remaining.replace(/\b(?:bash|sh)\b[^'"]*-c\s+"([^"]*)"/g, (_m, payload) => {
+        if (scanScript(payload))
+            foundInNested = true;
+        return ' ';
+    });
+    if (foundInNested)
+        return true;
+    const statements = remaining
+        .split(/;|\n/)
+        .map(s => s.trim())
+        .filter(Boolean);
+    for (let si = 0; si < statements.length; si++) {
+        const terminalStatement = si === statements.length - 1;
+        const segments = statements[si].split(/&&|\|\|/)
+            .map(s => s.trim())
+            .filter(Boolean);
+        for (let gi = 0; gi < segments.length; gi++) {
+            const terminalSegment = gi === segments.length - 1;
+            const stages = segments[gi].split(/\|/)
+                .map(s => s.trim())
+                .filter(Boolean);
+            for (let pi = 0; pi < stages.length; pi++) {
+                const finalStage = pi === stages.length - 1;
+                const inv = parseInvocation(stages[pi]);
+                if (!inv || !isExternalTool(inv.tool) || inv.isNoop)
+                    continue;
+                const pipedIntoConsumer = !finalStage;
+                const exitIsVerdict = finalStage && terminalSegment && terminalStatement;
+                if (pipedIntoConsumer || exitIsVerdict)
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+/** Substitution context: the captured output is data fed to the surrounding
+ *  assertion, so a non-no-op external command word in ANY position is consumed. */
+function scanConsumed(inner) {
+    let remaining = inner;
+    let found = false;
+    remaining = remaining.replace(/\$\(([^)]*)\)/g, (_m, x) => {
+        if (scanConsumed(x))
+            found = true;
+        return ' ';
+    });
+    remaining = remaining.replace(/`([^`]*)`/g, (_m, x) => {
+        if (scanConsumed(x))
+            found = true;
+        return ' ';
+    });
+    if (found)
+        return true;
+    const segments = remaining
+        .split(/&&|\|\||;|\||\n/)
+        .map(s => s.trim())
+        .filter(Boolean);
+    for (const seg of segments) {
+        const inv = parseInvocation(seg);
+        if (inv && isExternalTool(inv.tool) && !inv.isNoop)
+            return true;
+    }
+    return false;
+}
 function classifyCheckpointerGrounding(checkpointer) {
     if (!checkpointer || checkpointer.trim() === '')
         return 'NONE';
@@ -145,11 +296,13 @@ function classifyCheckpointerGrounding(checkpointer) {
     // Fast path for known two-word external phrases (e.g. prisma migrate status)
     if (EXTERNAL_PHRASES.some(p => lower.includes(p)))
         return 'EXTERNAL';
-    const words = collectCommandWords(checkpointer.toLowerCase());
+    const words = collectCommandWords(lower);
     if (words.length === 0)
         return 'NONE';
-    // Strongest signal wins: EXTERNAL > AGENT_HARNESS > ASSERTION_ONLY
-    if (words.some(w => wordMatches(w, EXTERNAL_TOOLS)))
+    // Strongest signal wins: EXTERNAL > AGENT_HARNESS > ASSERTION_ONLY. EXTERNAL
+    // is gated on a CONSUMED, non-no-op external command (LUM-605) — a no-op or
+    // output-discarded external word falls through to harness/assertion.
+    if (groundsExternal(lower))
         return 'EXTERNAL';
     if (words.some(w => wordMatches(w, HARNESS_TOOLS)))
         return 'AGENT_HARNESS';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumoai/cli",
-  "version": "1.48.0",
+  "version": "1.49.0",
   "description": "Lumo CLI — manage tasks and sessions from the terminal",
   "license": "MIT",
   "author": "cli@uselumo.ai",