agent-bios 0.12.1 → 0.13.0

package/claude/guides/review-defect-criteria.md

@@ -161,10 +161,19 @@ Ranked by how much the channel refuses for you:
    Stated honestly: on a prose route this is steering, not control — the fold is
    performed by an agent following this guide, and nothing structural refuses a
    class-less row for it. That is the known weaker result of a request-only rule.
-3. A structural criterion slot in the review dispatch machinery is deliberately not
-   part of this guide: a criterion is per-review while dispatch config is per-launch,
-   and a slot with no schema-backed consumer would be an inert value. Until such a
-   channel exists, ranks 1–2 are the real ones.
+3. **The launcher's criterion discipline** (agent-launch): a preset declaring
+   `criterion = true` renders one core-owned discipline clause into every review
+   method row — the criterion's content never enters the per-launch config; it rides
+   the packet as a `ReviewCriterion/v1:` record line beside the prose above.
+   `--compile-criterion` refuses a document failing the schema's decidable subset and
+   emits the canonical findings schema; where the host CLI's structured-output flag
+   probes present (`--check-schema-flag`), the dispatch passes that schema, and
+   receipt emission under `REVIEW_CRITERION_SCHEMA` refuses a class-less or
+   out-of-enum result — no receipt, and an unproven dispatch is already in the stop
+   class. `--verify-receipts --packet` recompiles the packet's record and refuses a
+   receipt whose schema digest was compiled from any other criterion. A route whose
+   flag probes absent runs rank 2 and is disclosed as prose discipline — never
+   credited as schema-enforced.
 
 ## Golden lifecycle
 

package/codex/guides/review-defect-criteria.md

@@ -161,10 +161,19 @@ Ranked by how much the channel refuses for you:
    Stated honestly: on a prose route this is steering, not control — the fold is
    performed by an agent following this guide, and nothing structural refuses a
    class-less row for it. That is the known weaker result of a request-only rule.
-3. A structural criterion slot in the review dispatch machinery is deliberately not
-   part of this guide: a criterion is per-review while dispatch config is per-launch,
-   and a slot with no schema-backed consumer would be an inert value. Until such a
-   channel exists, ranks 1–2 are the real ones.
+3. **The launcher's criterion discipline** (agent-launch): a preset declaring
+   `criterion = true` renders one core-owned discipline clause into every review
+   method row — the criterion's content never enters the per-launch config; it rides
+   the packet as a `ReviewCriterion/v1:` record line beside the prose above.
+   `--compile-criterion` refuses a document failing the schema's decidable subset and
+   emits the canonical findings schema; where the host CLI's structured-output flag
+   probes present (`--check-schema-flag`), the dispatch passes that schema, and
+   receipt emission under `REVIEW_CRITERION_SCHEMA` refuses a class-less or
+   out-of-enum result — no receipt, and an unproven dispatch is already in the stop
+   class. `--verify-receipts --packet` recompiles the packet's record and refuses a
+   receipt whose schema digest was compiled from any other criterion. A route whose
+   flag probes absent runs rank 2 and is disclosed as prose discipline — never
+   credited as schema-enforced.
 
 ## Golden lifecycle
 

package/launch/agent-launch.py

@@ -937,6 +937,19 @@ SEVERITY_NAME_RULE = (
 # forbidding the labels that trigger it, which is why `<`, `-` and `=` stay registrable.
 SEVERITY_ARROW = " => "
 SEVERITY_CLAUSE_MARKER = "; severities "
+# The criterion discipline clause. A CONSTANT, not a slot: the criterion's content is
+# per-review and lives in the packet (which packet_sha256 binds), while the contract is
+# per-launch and golden-pinned — so what renders here is only the discipline, identical
+# for every method and every criterion. Placed BEFORE the severity clause in the row,
+# because the severity clause is parsed as everything after its marker.
+CRITERION_CLAUSE_MARKER = "; criterion "
+CRITERION_CLAUSE = (
+    f"{CRITERION_CLAUSE_MARKER}declared in the packet: compile it with "
+    f"--compile-criterion, prefer a dispatch whose host schema flag probed present "
+    f"(--check-schema-flag), emit receipts under REVIEW_CRITERION_SCHEMA so emission "
+    f"refuses unclassified findings, and fold returned rows against the declared enum "
+    f"without guessing a class"
+)
 # The panel that carries corpus/registration text, and the scrolling body that holds it.
 # Named once so the screen, its CSS, its key bindings and the check that drives them cannot
 # drift apart.
@@ -1127,6 +1140,17 @@ class ReviewMechanism:
 def parse_review_method(method_id: str, raw: Any, context: str) -> ReviewMethod:
     if not isinstance(raw, dict):
         raise LaunchError(f"{context} must be a table")
+    # The method ID is the one authored value core PREFIXES to the rendered row, so the
+    # formatted-body marker checks never see it — a registry key carrying a clause
+    # marker forged a second decodable clause beside core's (criterion round, #1; the
+    # same door round 20 #5 opened for the plan marker, closed there on the whole row).
+    for marker in (SEVERITY_CLAUSE_MARKER, CONTROLS_CLAUSE_MARKER, CRITERION_CLAUSE_MARKER):
+        if marker in method_id:
+            raise LaunchError(
+                f"{context}: the method id contains {marker!r}, which core owns for a "
+                f"rendered clause; an id carrying it would forge a second clause in "
+                f"every row it prefixes"
+            )
     unknown = sorted(set(raw) - METHOD_KEYS)
     if unknown:
         raise LaunchError(f"{context}: unknown method key(s): {', '.join(unknown)}")
@@ -1307,6 +1331,12 @@ def validate_instruction_slots(template: str, context: str) -> set:
             f"{context}: contains {CONTROLS_CLAUSE_MARKER!r}, which core appends from the "
             f"method's declared controls; a second clause would contradict it"
         )
+    if CRITERION_CLAUSE_MARKER in template:
+        raise LaunchError(
+            f"{context}: contains {CRITERION_CLAUSE_MARKER!r}, which core appends when the "
+            f"plan declares a criterion-disciplined review; a second clause would "
+            f"contradict the plan's toggle"
+        )
     refuse_plan_marker(template, context)
     return used
 
@@ -1513,9 +1543,16 @@ def derive_review_mechanism(
     )
 
 
-def render_review_method(method: ReviewMethod, mechanism: ReviewMechanism) -> str:
+def render_review_method(
+    method: ReviewMethod, mechanism: ReviewMechanism, criterion: bool = False
+) -> str:
     """The generic renderer. Every method — shipped or third-party — reaches the
-    contract through this one function, with the exact seat already resolved."""
+    contract through this one function, with the exact seat already resolved.
+
+    `criterion` is the plan's toggle, threaded rather than read from anywhere global:
+    when the preset declares a criterion-disciplined review, core appends the one
+    discipline clause to every row, method-blind, the way the severity translation is
+    appended — an author never writes it and a slot never carries it."""
     binding = mechanism.binding
     slots = {
         "command": mechanism.command or "",
@@ -1561,7 +1598,8 @@ def render_review_method(method: ReviewMethod, mechanism: ReviewMechanism) -> st
     # them as literals, and a perspective label carrying `; controls trials=1` rendered a
     # second controls clause beside core's (round 19, #9). Every substitution passes here.
     for marker, owner in ((CONTROLS_CLAUSE_MARKER, "the method's declared controls"),
-                          (REVIEW_PLAN_MARKER, "the contract's canonical review record")):
+                          (REVIEW_PLAN_MARKER, "the contract's canonical review record"),
+                          (CRITERION_CLAUSE_MARKER, "the plan's criterion discipline")):
         if marker in body:
             raise LaunchError(
                 f"review method {method.method_id!r} renders {marker!r} in its body, which "
@@ -1570,7 +1608,7 @@ def render_review_method(method: ReviewMethod, mechanism: ReviewMechanism) -> st
     rendered = (
         f"{method.method_id}: {body} "
         f"[{mechanism.shape}; {binding.model}/{binding.effort}"
-        f"{controls_clause(method)}{severity_translation(method)}]"
+        f"{controls_clause(method)}{criterion_clause(criterion)}{severity_translation(method)}]"
     )
     # The assembled ROW, after the body. The body check above catches a SLOT value and says
     # so; what it cannot see is the part core itself prefixes — the METHOD ID, a user-chosen
@@ -1623,6 +1661,16 @@ def severity_vocabulary(method: ReviewMethod) -> str:
     return ", ".join(method.severity_emits)
 
 
+def criterion_clause(active: bool) -> str:
+    """The discipline clause, or "" when the plan declares no criterion.
+
+    Core-owned and constant for the reason severity_translation is core-appended: a
+    third-party method carries it without its author remembering to, and the gate can
+    subtract the exact substring. Inside the seat bracket, BEFORE the severity clause,
+    which is parsed as everything after its own marker."""
+    return CRITERION_CLAUSE if active else ""
+
+
 def severity_translation(method: ReviewMethod) -> str:
     """The clause telling the reader how to move this reviewer's severities onto the
     canonical ladder, or "" when it reports on the ladder already.
@@ -1743,7 +1791,8 @@ def independence_grade(reviewer: ReviewBinding, main: ReviewBinding) -> str:
 
 
 def _resolve_one(
-    method: ReviewMethod, binding: ReviewBinding, main: ReviewBinding, config: dict[str, Any]
+    method: ReviewMethod, binding: ReviewBinding, main: ReviewBinding,
+    config: dict[str, Any], criterion: bool = False,
 ) -> ReviewMethodReport:
     """One method against the main seat. An optional method is NEVER silently rebound
     to a different seat: if its mechanism cannot be derived it is dropped, and the
@@ -1823,7 +1872,7 @@ def _resolve_one(
     return ReviewMethodReport(
         method.method_id, status, grade, "; ".join(notes),
         binding.model, binding.effort, binding.provider, mechanism.adapter,
-        render_review_method(method, mechanism), method_controls(method),
+        render_review_method(method, mechanism, criterion), method_controls(method),
         tuple(mechanism.evidence),
     )
 
@@ -1844,7 +1893,7 @@ def best_review_grade(rows) -> str:
 
 def resolve_composable_review(
     review: ReviewPlan, main: ReviewBinding, config: dict[str, Any],
-    methods: dict[str, ReviewMethod],
+    methods: dict[str, ReviewMethod], criterion: bool = False,
 ) -> ReviewReport:
     """Base panel plus the method map, each graded against the main seat.
 
@@ -1858,7 +1907,7 @@ def resolve_composable_review(
     if panel is None:
         raise LaunchError(f"the {PANEL_METHOD} method is required and is not registered")
     base_binding = review.base_binding or main
-    base = _resolve_one(panel, base_binding, main, config)
+    base = _resolve_one(panel, base_binding, main, config, criterion)
     # Authored-but-unsatisfiable is a fallback too, not just an undeliverable mechanism.
     # Without this the §1 rule below was unreachable for the commonest case — a preset
     # naming a provider the profile has no host for never got here at all, because the
@@ -1866,7 +1915,7 @@ def resolve_composable_review(
     fell_back = review.base_unseated is not None
     if base.status == STATUS_DROPPED and review.base_binding is not None:
         # Try the same floor on the main's own seat before giving up on review.
-        base = _resolve_one(panel, main, main, config)
+        base = _resolve_one(panel, main, main, config, criterion)
         fell_back = True
     if fell_back and base.status != STATUS_DROPPED:
         detail = (
@@ -1905,7 +1954,7 @@ def resolve_composable_review(
                 if unseated
                 else "no binding: the method names no verifier seat"))
             continue
-        rows.append(_resolve_one(method, binding, main, config))
+        rows.append(_resolve_one(method, binding, main, config, criterion))
     return ReviewReport(base, tuple(rows), best_review_grade((base, *rows)))
 
 
@@ -2375,6 +2424,12 @@ RECEIPT_KEYS = frozenset({
     "provider", "model", "effort", "exit_status", "passes", "ordering_seed", "swap_group",
     # What the tool reported back, keyed by the field names its offer declared.
     "evidence",
+    # The digest of the compiled criterion schema the emission validated this result
+    # against — present ONLY on a schema-route dispatch (REVIEW_CRITERION_SCHEMA was
+    # set), read by --verify-receipts, which recompiles the packet's criterion and
+    # refuses a mismatch. Absent on a prose-route dispatch, which is disclosed, never
+    # refused: host schema capability is per-machine and not retroactively provable.
+    "criterion_schema_sha256",
 })
 # The BUNDLE's grammar, closed for the reason the receipt's is. The reader took its four
 # anchors and ignored everything else, so a key it does not know rode along unjudged and
@@ -2460,6 +2515,16 @@ def _receipt_structure_reason(receipt: Any) -> str:
             f"records exit_status as {type(status).__name__}, not an integer — a boolean is "
             f"not an exit status, and JSON false is not exit 0"
         )
+    # Form here, in the door the adjudicator AND the fold share, so a folded pair of
+    # matching non-hashes cannot agree its way past the per-receipt check.
+    if "criterion_schema_sha256" in receipt and not is_sha256_hex(
+        receipt["criterion_schema_sha256"]
+    ):
+        return (
+            f"records criterion_schema_sha256={receipt['criterion_schema_sha256']!r}, "
+            f"which is not a SHA-256 hash — nothing was hashed, so no schema validated "
+            f"this result"
+        )
     return ""
 
 
@@ -2496,7 +2561,7 @@ def _raw_receipt_reason(receipt: Any) -> str:
 
 def _receipt_reason(
     receipt: Any, row: "ReviewMethodReport | None", bundle: dict, seen: set,
-    controls: dict, required_evidence: tuple = (),
+    controls: dict, required_evidence: tuple = (), criterion_digest: "str | None" = None,
 ) -> str:
     """Why this receipt cannot be credited, or "" when it can.
 
@@ -2545,6 +2610,22 @@ def _receipt_reason(
         )
     if packet != bundle.get("packet_sha256"):
         return "hashes a different packet than the one the plan declared"
+    # Only when the packet's criterion is in hand: the digest is recompiled from the
+    # packet's own record, so a mismatch means the schema the host was handed was
+    # compiled from some OTHER criterion — a stricter or looser enum than the one this
+    # packet declares. With no packet supplied there is nothing to recompile, and the
+    # rendering says the claim is unbound rather than treating it as proven.
+    if (
+        criterion_digest is not None
+        and "criterion_schema_sha256" in receipt
+        and receipt["criterion_schema_sha256"] != criterion_digest
+    ):
+        return (
+            f"was validated against a schema hashing "
+            f"{receipt['criterion_schema_sha256']}, and recompiling this packet's "
+            f"declared criterion yields {criterion_digest} — the schema enforced was "
+            f"not compiled from the criterion this packet declares"
+        )
     for field in ("provider", "model", "effort"):
         if receipt.get(field) != getattr(row, field):
             return (
@@ -2639,7 +2720,7 @@ def _receipt_reason(
 
 def verify_review_receipts(
     report: ReviewReport, bundle: Any, required_controls: dict[str, dict],
-    required_evidence: dict[str, tuple],
+    required_evidence: dict[str, tuple], criterion_digest: "str | None" = None,
 ) -> tuple[ReviewReport, tuple[ReceiptVerdict, ...]]:
     """Adjudicate a review against its receipts.
 
@@ -2860,6 +2941,7 @@ def verify_review_receipts(
             # The row's own snapshot, never the caller's recomputation — see the drift
             # refusal above.
             row.evidence if row else (),
+            criterion_digest,
         )
         if not reason and isinstance(receipt.get("dispatch_id"), str):
             seen.add(receipt["dispatch_id"])
@@ -2908,7 +2990,8 @@ def verify_review_receipts(
 
 
 def render_receipt_verdicts(
-    report: ReviewReport, verdicts: tuple[ReceiptVerdict, ...], packet_bound: bool = False
+    report: ReviewReport, verdicts: tuple[ReceiptVerdict, ...],
+    packet_bound: bool = False, criterion_note: str = "",
 ) -> str:
     # Coverage is printed as a count, not only as a word: `partial` tells a reader the set
     # was incomplete and `1/3` tells them how incomplete, which is the difference between
@@ -2952,6 +3035,10 @@ def render_receipt_verdicts(
         "  grade_derivation=claimed — the plan does not serialize the main seat, so a row's "
         "independence grade is the launch's own claim and is not recomputed here"
     )
+    if criterion_note:
+        # Empty on every non-criterion adjudication, so the rendering is byte-identical
+        # to today's whenever the plan declared no discipline.
+        lines.append(criterion_note)
     for verdict in verdicts:
         state = "ACHIEVED" if verdict.accepted else "PROPOSED"
         lines.append(
@@ -2962,6 +3049,426 @@ def render_receipt_verdicts(
     return "\n".join(lines)
 
 
+# ── criterion discipline (defect-criterion stage 6) ─────────────────────────
+# The criterion is PER-REVIEW: its content rides the packet, never the contract or the
+# config. What core owns is the deterministic subset — the document grammar, the
+# compiled findings schema, the packet record line, and the findings check that receipt
+# emission runs. Whether a golden is persuasive or a stop condition genuinely reachable
+# stays semantic and is never adjudicated here.
+CRITERION_RECORD_SCHEMA = "ReviewCriterion/v1"
+CRITERION_RECORD_MARKER = f"{CRITERION_RECORD_SCHEMA}: "
+# The guide's eight fields plus the two the machine subset needs named apart: the enum
+# and its one stop-relevant member. Closed, and every key required — the guide's own
+# rule is that an empty cell makes a hunch, not a criterion.
+CRITERION_KEYS = frozenset({
+    "name", "observer", "defect", "classes", "stop_class", "evidence",
+    "non_defects", "stop_condition", "misclassification_cost", "goldens",
+})
+CRITERION_GOLDEN_KEYS = frozenset({"kind", "case", "why", "date", "provenance"})
+CRITERION_GOLDEN_KINDS = ("positive", "negative", "boundary")
+# The guide's admission bar: ≥2 positive, ≥2 negative, ≥1 boundary.
+CRITERION_GOLDEN_MINIMUMS = {"positive": 2, "negative": 2, "boundary": 1}
+CRITERION_PROVENANCE = frozenset({"measured", "constructed"})
+
+
+def _utf8_encodable(value: str) -> bool:
+    """False for a string no UTF-8 artifact can carry — a JSON escape can smuggle a
+    lone surrogate through json.loads, and every encode after it crashes."""
+    try:
+        value.encode("utf-8")
+    except UnicodeEncodeError:
+        return False
+    return True
+
+
+def validate_criterion(document: Any, context: str) -> None:
+    """Refuse a criterion document that fails the DECIDABLE subset of the guide schema,
+    by field name. Nothing downstream receives a half-criterion: there is no fallback
+    to "no criterion" and no default for any cell."""
+    if not isinstance(document, dict):
+        raise LaunchError(f"{context} must be a JSON object")
+    # The whole document must be UTF-8-encodable BEFORE any field check: JSON escapes
+    # admit lone surrogates that json.loads accepts and every later encode —
+    # the canonical record line, the compiled schema bytes — crashes on with a
+    # traceback instead of a named refusal (criterion round 2, #0).
+    try:
+        json.dumps(document, ensure_ascii=False).encode("utf-8")
+    except UnicodeEncodeError as exc:
+        raise LaunchError(
+            f"{context} is not UTF-8-encodable ({exc}); a lone surrogate cannot ride "
+            f"the record line or the compiled schema"
+        ) from exc
+    missing = sorted(CRITERION_KEYS - set(document))
+    if missing:
+        raise LaunchError(
+            f"{context} is missing {', '.join(missing)}; an empty cell makes a hunch, "
+            f"not a criterion"
+        )
+    unknown = sorted(set(document) - CRITERION_KEYS)
+    if unknown:
+        raise LaunchError(f"{context} carries unknown key(s): {', '.join(unknown)}")
+    for field in ("name", "observer", "defect", "evidence", "stop_condition",
+                  "misclassification_cost"):
+        value = document[field]
+        if not isinstance(value, str) or not value.strip():
+            raise LaunchError(f"{context}.{field} must be a non-empty string")
+    classes = document["classes"]
+    if (
+        not isinstance(classes, list) or len(classes) < 2
+        or not all(isinstance(value, str) and value for value in classes)
+    ):
+        raise LaunchError(
+            f"{context}.classes must list at least two non-empty class names — the "
+            f"stop-relevant class and the relief valves that keep it honest"
+        )
+    if len(set(classes)) != len(classes):
+        raise LaunchError(f"{context}.classes repeats a value")
+    for value in classes:
+        if value != value.strip():
+            raise LaunchError(
+                f"{context}.classes[{value!r}] may not carry leading or trailing "
+                f"whitespace, which no reader can see"
+            )
+    stop = document["stop_class"]
+    if not isinstance(stop, str) or stop not in classes:
+        raise LaunchError(
+            f"{context}.stop_class must name exactly one member of classes; "
+            f"got {stop!r}"
+        )
+    non_defects = document["non_defects"]
+    if (
+        not isinstance(non_defects, list) or not non_defects
+        or not all(isinstance(value, str) and value.strip() for value in non_defects)
+    ):
+        raise LaunchError(
+            f"{context}.non_defects must be a non-empty list of the defect-lookalikes "
+            f"this criterion excludes"
+        )
+    goldens = document["goldens"]
+    if not isinstance(goldens, list):
+        raise LaunchError(f"{context}.goldens must be a list")
+    counts = {kind: 0 for kind in CRITERION_GOLDEN_KINDS}
+    for index, golden in enumerate(goldens):
+        slot = f"{context}.goldens[{index}]"
+        if not isinstance(golden, dict):
+            raise LaunchError(f"{slot} must be an object")
+        missing = sorted(CRITERION_GOLDEN_KEYS - set(golden))
+        if missing:
+            raise LaunchError(f"{slot} is missing {', '.join(missing)}")
+        unknown = sorted(set(golden) - CRITERION_GOLDEN_KEYS)
+        if unknown:
+            raise LaunchError(f"{slot} carries unknown key(s): {', '.join(unknown)}")
+        kind = golden["kind"]
+        if kind not in CRITERION_GOLDEN_KINDS:
+            raise LaunchError(
+                f"{slot}.kind must be one of {', '.join(CRITERION_GOLDEN_KINDS)}; "
+                f"got {kind!r}"
+            )
+        for field in ("case", "why"):
+            if not isinstance(golden[field], str) or not golden[field].strip():
+                raise LaunchError(f"{slot}.{field} must be a non-empty string")
+        date = golden["date"]
+        if not isinstance(date, str):
+            raise LaunchError(f"{slot}.date must be a string")
+        try:
+            datetime.date.fromisoformat(date)
+        except ValueError as exc:
+            raise LaunchError(f"{slot}.date must be an ISO date: {exc}") from exc
+        if golden["provenance"] not in CRITERION_PROVENANCE:
+            raise LaunchError(
+                f"{slot}.provenance must be measured or constructed; "
+                f"got {golden['provenance']!r}"
+            )
+        counts[kind] += 1
+    short = [
+        f"{kind} {counts[kind]}/{minimum}"
+        for kind, minimum in CRITERION_GOLDEN_MINIMUMS.items()
+        if counts[kind] < minimum
+    ]
+    if short:
+        raise LaunchError(
+            f"{context}.goldens falls short of the admission bar ({', '.join(short)}); "
+            f"the bar is never weakened to admit an entry"
+        )
+
+
+def criterion_schema(classes: list) -> dict:
+    """The compiled findings schema — a pure function of the enum, which is what makes
+    `--verify-receipts` able to recompile it from the packet's record and compare
+    digests. Both object levels reject unknown fields; `findings` may be empty."""
+    return {
+        "type": "object",
+        "additionalProperties": False,
+        "required": ["findings"],
+        "properties": {
+            "findings": {
+                "type": "array",
+                "items": {
+                    "type": "object",
+                    "additionalProperties": False,
+                    "required": ["class", "finding"],
+                    "properties": {
+                        "class": {"enum": list(classes)},
+                        "finding": {"type": "string", "minLength": 1},
+                    },
+                },
+            },
+        },
+    }
+
+
+def criterion_schema_bytes(document: dict) -> bytes:
+    """Canonical bytes for the compiled schema: sorted keys, no whitespace, one
+    trailing newline. Byte-identical on every compile of the same document — proven by
+    the double-compile control — because the receipt digest is compared against a
+    recompilation."""
+    schema = criterion_schema(document["classes"])
+    return (
+        json.dumps(schema, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
+        + "\n"
+    ).encode("utf-8")
+
+
+def criterion_record_line(document: dict) -> str:
+    """The one line the packet carries: the canonical serialization of the document
+    behind the record marker, the same shape the ReviewPlan/v1 record rides in."""
+    return CRITERION_RECORD_MARKER + json.dumps(
+        document, ensure_ascii=False, sort_keys=True, separators=(",", ":")
+    )
+
+
+def extract_criterion(text: str, context: str) -> dict:
+    """The criterion the packet declares, from its record line — exactly one.
+
+    Zero records is a refusal rather than None on purpose: this is only called when
+    the plan's rows carry the discipline clause, and a launch that declared the
+    discipline cannot verify without the criterion."""
+    # LINE-anchored, because the packet is free text: an unanchored find took a prose
+    # mention — "for example, ReviewCriterion/v1: {...}" mid-sentence — as the declared
+    # record (criterion round, #5). The record is a line the compiler printed: marker at
+    # line start, one JSON value, nothing else before the newline.
+    starts = []
+    index = text.find(CRITERION_RECORD_MARKER)
+    while index >= 0:
+        if index == 0 or text[index - 1] == "\n":
+            starts.append(index)
+        index = text.find(CRITERION_RECORD_MARKER, index + 1)
+    if not starts:
+        raise LaunchError(
+            f"{context} carries no {CRITERION_RECORD_SCHEMA} record line, so the "
+            f"criterion the plan's discipline clause declares is nowhere in the bytes "
+            f"the reviewers consumed"
+        )
+    if len(starts) > 1:
+        raise LaunchError(
+            f"{context} carries more than one {CRITERION_RECORD_SCHEMA} record; a mixed "
+            f"packet is split into one packet per criterion, so exactly one is the claim "
+            f"this can adjudicate"
+        )
+    start = starts[0] + len(CRITERION_RECORD_MARKER)
+    try:
+        document, consumed = json.JSONDecoder().raw_decode(text[start:])
+    except json.JSONDecodeError as exc:
+        raise LaunchError(
+            f"{context} carries a {CRITERION_RECORD_SCHEMA} record that does not parse: "
+            f"{exc}"
+        ) from exc
+    trailing = text[start + consumed:].split("\n", 1)[0]
+    if trailing.strip():
+        raise LaunchError(
+            f"{context} carries a {CRITERION_RECORD_SCHEMA} record line with trailing "
+            f"content ({trailing.strip()[:40]!r}); the record is the whole line, so "
+            f"extra text on it is a different claim than the compiler printed"
+        )
+    validate_criterion(document, f"{context}'s {CRITERION_RECORD_SCHEMA} record")
+    return document
+
+
+def criterion_classes_of_schema(schema: Any, context: str) -> list:
+    """The enum a compiled schema file carries — accepted only when the whole schema
+    equals what compiling that enum produces, so a hand-edited or foreign schema is
+    refused rather than partially read."""
+    try:
+        classes = schema["properties"]["findings"]["items"]["properties"]["class"]["enum"]
+    except (TypeError, KeyError):
+        raise LaunchError(
+            f"{context} is not a compiled criterion schema; compile one with "
+            f"--compile-criterion"
+        ) from None
+    # Self-consistency alone lets the schema supply its own authority: an exact
+    # criterion_schema(['anything']) equals recompiling its own enum although the
+    # compiler can never produce it — validate_criterion refuses every one-class
+    # document (criterion round, #2). The enum must also be one the compiler admits.
+    if (
+        not isinstance(classes, list) or len(classes) < 2
+        or len(set(classes)) != len(classes)
+        or not all(
+            isinstance(value, str) and value and value == value.strip()
+            and _utf8_encodable(value)
+            for value in classes
+        )
+    ):
+        raise LaunchError(
+            f"{context} carries an enum --compile-criterion can never produce (fewer "
+            f"than two classes, or a duplicate, empty, whitespace-padded, or "
+            f"non-UTF-8-encodable name); it was not written by the compiler — "
+            f"recompile rather than editing the artifact"
+        )
+    if schema != criterion_schema(classes):
+        raise LaunchError(
+            f"{context} differs from what compiling its own enum produces, so it was "
+            f"not written by --compile-criterion; recompile rather than editing the "
+            f"artifact"
+        )
+    return list(classes)
+
+
+def findings_violations(result: Any, classes: list) -> list:
+    """Why this result is not a findings record under the declared enum — every
+    violation named, empty when it conforms. Deterministic and total: no salvage, no
+    guessed class, no partial admission."""
+    violations = []
+    if not isinstance(result, dict):
+        return [f"the result is {type(result).__name__}, not an object"]
+    unknown = sorted(set(result) - {"findings"})
+    if unknown:
+        violations.append(f"unknown result key(s): {', '.join(unknown)}")
+    findings = result.get("findings")
+    if not isinstance(findings, list):
+        violations.append("the result carries no findings array")
+        return violations
+    for index, finding in enumerate(findings):
+        slot = f"findings[{index}]"
+        if not isinstance(finding, dict):
+            violations.append(f"{slot} is {type(finding).__name__}, not an object")
+            continue
+        unknown = sorted(set(finding) - {"class", "finding"})
+        if unknown:
+            violations.append(f"{slot} carries unknown key(s): {', '.join(unknown)}")
+        if "class" not in finding:
+            violations.append(f"{slot} carries no class; a row is never admitted unclassified")
+        elif finding["class"] not in classes:
+            violations.append(
+                f"{slot} carries class {finding['class']!r}, which is not in the "
+                f"declared enum ({', '.join(classes)})"
+            )
+        prose = finding.get("finding")
+        if not isinstance(prose, str) or not prose.strip():
+            violations.append(f"{slot}.finding must be a non-empty string")
+    return violations
+
+
+def compile_criterion_command(criterion_file: str, schema_out: str) -> int:
+    """Validate a criterion document and publish its compiled findings schema.
+
+    Prints the packet record line the dispatching agent pastes verbatim, and the
+    digest receipt emission will stamp — so the three artifacts (packet record,
+    schema file, receipt digest) cannot drift from one authoring."""
+    path = pathlib.Path(criterion_file).expanduser()
+    try:
+        document = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise LaunchError(f"cannot read criterion document {path}: {exc}") from exc
+    validate_criterion(document, str(path))
+    payload = criterion_schema_bytes(document)
+    target = pathlib.Path(schema_out).expanduser()
+    try:
+        target.parent.mkdir(parents=True, exist_ok=True)
+        publish_atomically(target, payload)
+    except OSError as exc:
+        raise LaunchError(f"cannot write compiled schema into {target}: {exc}") from exc
+    print(criterion_record_line(document))
+    print(f"criterion_schema_sha256={hashlib.sha256(payload).hexdigest()} {target}")
+    return 0
+
+
+def check_findings_command(result_file: str, schema_file: str) -> int:
+    """The structural accepting channel, standalone: refuse a findings result that
+    fails the compiled schema, each violation by name. The same check runs inside
+    --emit-receipt when REVIEW_CRITERION_SCHEMA is set, so bypassing this one only
+    forfeits the receipt."""
+    schema_path = pathlib.Path(schema_file).expanduser()
+    try:
+        schema = json.loads(schema_path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise LaunchError(f"cannot read compiled schema {schema_path}: {exc}") from exc
+    classes = criterion_classes_of_schema(schema, str(schema_path))
+    result_path = pathlib.Path(result_file).expanduser()
+    try:
+        result = json.loads(result_path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError) as exc:
+        raise LaunchError(f"cannot read result {result_path}: {exc}") from exc
+    except json.JSONDecodeError as exc:
+        print(f"REFUSED: {result_path} is not JSON, so no finding in it carries a class: {exc}")
+        return 1
+    violations = findings_violations(result, classes)
+    if violations:
+        for violation in violations:
+            print(f"REFUSED: {violation}")
+        return 1
+    count = len(result["findings"])
+    print(f"OK: {count} finding{'s' if count != 1 else ''} conform to the declared enum")
+    return 0
+
+
+# The host CLIs' structured-output flags, and how each registers them. A TABLE plus a
+# PROBE rather than an offer key: a declared capability is documentation, and the rule
+# is probe-over-docs — the flag either appears in the installed binary's registered
+# options or the route renders prose discipline.
+HOST_SCHEMA_FLAGS = {
+    "codex": (("exec", "--help"), "--output-schema"),
+    "claude": (("--help",), "--json-schema"),
+}
+SCHEMA_FLAG_ABSENT_EXIT = 4
+
+
+def check_schema_flag_command(host: str, config_path: pathlib.Path) -> int:
+    """Probe the resolved backend binary for its structured-output flag.
+
+    Exit 0 when the flag is registered, SCHEMA_FLAG_ABSENT_EXIT when the binary runs
+    and does not register it — absence is a finding, not an error — and a LaunchError
+    when nothing could be probed at all."""
+    if host not in HOST_SCHEMA_FLAGS:
+        raise LaunchError(
+            f"no schema flag is known for host {host!r}; known hosts: "
+            f"{', '.join(sorted(HOST_SCHEMA_FLAGS))}"
+        )
+    config = load_config(config_path)
+    command = config.get("backends", {}).get(host, {}).get("command")
+    if not isinstance(command, str) or not command:
+        raise LaunchError(f"config names no backend command for host {host!r}")
+    help_args, flag = HOST_SCHEMA_FLAGS[host]
+    try:
+        probe = subprocess.run(
+            [command, *help_args], capture_output=True, text=True, timeout=60,
+        )
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        raise LaunchError(f"cannot probe {command!r} for {flag}: {exc}") from exc
+    # A failed help run proves nothing about the flag — and its ERROR text can carry
+    # the very token being searched for ("error: unknown option --output-schema"), so
+    # scanning it reported present on the known-opposite input (criterion round, #7).
+    if probe.returncode != 0:
+        detail = (probe.stderr or probe.stdout).strip()[:160]
+        raise LaunchError(
+            f"cannot probe {command!r} for {flag}: help exited {probe.returncode}"
+            + (f" ({detail})" if detail else "")
+            + " — presence cannot be read from a failed probe"
+        )
+    text = (probe.stdout + probe.stderr).replace(",", " ")
+    registered = any(
+        token == flag or token.startswith(f"{flag}=")
+        for token in text.split()
+    )
+    if registered:
+        print(f"schema flag {flag} for host {host}: present ({command})")
+        return 0
+    print(
+        f"schema flag {flag} for host {host}: absent ({command} registers no such "
+        f"option; dispatch this route as prose discipline)"
+    )
+    return SCHEMA_FLAG_ABSENT_EXIT
+
+
 # ── receipt production (the adapter side of the same contract) ──────────────
 # Everything above adjudicates receipts; nothing produced one. That gap is the whole
 # defect: the only party able to write a receipt was whoever ran the review, so the
@@ -2983,6 +3490,12 @@ RECEIPT_METHOD_ENV = "REVIEW_METHOD_ID"
 # multi-pass method, and a third-party one gets them right by not participating.
 RECEIPT_SEED_ENV = "REVIEW_ORDERING_SEED"
 RECEIPT_SWAP_ENV = "REVIEW_SWAP_GROUP"
+# The compiled criterion schema for THIS dispatch, set by the dispatch wrapper only
+# when it passed the schema to the host. Set, emission validates the result against it
+# and refuses to write a receipt for a class-less or out-of-enum finding — so the only
+# path to a receipt IS the structural accepting channel, and a bypassed check is an
+# unproven dispatch. Unset — every prose route — emission behaves exactly as today.
+RECEIPT_CRITERION_ENV = "REVIEW_CRITERION_SCHEMA"
 # The probe adjudicates a one-row plan, and every plan's one required row is the base
 # panel wearing its reserved id (`_review_identity_reason`). It had a name of its own —
 # `adapter-conformance-probe` — which made the probe the only plan in the system whose
@@ -3083,18 +3596,79 @@ def emit_receipt_command(
         if not key or not separator:
             raise LaunchError(f"--evidence takes key=value, got {item!r}")
         fields[key] = value
+    # Present-but-empty is a configuration error, never a silent prose downgrade: an
+    # exported empty value made the whole validation vacuous while the caller believed
+    # it armed (criterion round, #3 — the empty-variable class the corpus already
+    # names for shell checks).
+    criterion_env = os.environ.get(RECEIPT_CRITERION_ENV)
+    if criterion_env is not None and not criterion_env.strip():
+        raise LaunchError(
+            f"{RECEIPT_CRITERION_ENV} is set but empty; unset it for a prose-route "
+            f"dispatch or point it at a compiled schema"
+        )
+    # Only a SUCCESSFUL dispatch is validated and stamped: a failed dispatch's receipt
+    # records the failure and is already refused credit for exit != 0, and refusing to
+    # write it would erase the failure record — while stamping it would claim a
+    # validation that never ran.
+    criterion_schema_path = criterion_env if status == 0 else None
+    # ONE byte snapshot each for the schema and the result: validating one read and
+    # hashing a second let the digest bind bytes the validation never saw — the same
+    # false PASS whether the swap is a race or an adversary (criterion round, #4).
+    criterion_digest = None
+    result_bytes = None
+    if criterion_schema_path:
+        schema_file = pathlib.Path(criterion_schema_path).expanduser()
+        try:
+            schema_bytes = schema_file.read_bytes()
+        except OSError as exc:
+            raise LaunchError(
+                f"{RECEIPT_CRITERION_ENV} names {schema_file}, which is not a readable "
+                f"compiled schema: {exc}"
+            ) from exc
+        try:
+            schema = json.loads(schema_bytes)
+        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+            raise LaunchError(
+                f"{RECEIPT_CRITERION_ENV} names {schema_file}, which is not a readable "
+                f"compiled schema: {exc}"
+            ) from exc
+        classes = criterion_classes_of_schema(schema, str(schema_file))
+        try:
+            result_bytes = pathlib.Path(result_file).expanduser().read_bytes()
+        except OSError as exc:
+            raise LaunchError(f"cannot read result {result_file}: {exc}") from exc
+        try:
+            result = json.loads(result_bytes)
+        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+            raise LaunchError(
+                f"no receipt: the result is not JSON, so no finding in it carries a "
+                f"class from the declared enum ({exc})"
+            ) from exc
+        violations = findings_violations(result, classes)
+        if violations:
+            raise LaunchError(
+                "no receipt: " + "; ".join(violations) + " — a result the schema "
+                "refuses is not published, and runtime never guesses a class"
+            )
+        criterion_digest = hashlib.sha256(schema_bytes).hexdigest()
     dispatch_id = uuid.uuid4().hex
     receipt = {
         "schema": RECEIPT_SCHEMA,
         "method_id": method_id,
         "dispatch_id": dispatch_id,
         "packet_sha256": _sha256_file(packet_file),
-        "result_sha256": _sha256_file(result_file),
+        # The bytes the validation saw, when it ran; the file, when it did not.
+        "result_sha256": (
+            hashlib.sha256(result_bytes).hexdigest()
+            if result_bytes is not None else _sha256_file(result_file)
+        ),
         "provider": provider,
         "model": model,
         "effort": effort,
         "exit_status": status,
     }
+    if criterion_digest:
+        receipt["criterion_schema_sha256"] = criterion_digest
     if fields:
         receipt["evidence"] = fields
     for key, name in (("ordering_seed", RECEIPT_SEED_ENV), ("swap_group", RECEIPT_SWAP_ENV)):
@@ -3222,7 +3796,12 @@ def _merge_method_passes(method_id: str, group: list[dict], main_dispatch_id: st
     # `passes`, and for a lone receipt it is naturally the one-element set. Round 4 made
     # the multi-pass record faithful and this is the same sentence applied to the twin
     # F1 already names: asked of EACH receipt, singleton included.
-    for field_name in ("provider", "model", "effort", "packet_sha256"):
+    for field_name in (
+        "provider", "model", "effort", "packet_sha256", "criterion_schema_sha256",
+    ):
+        # criterion_schema_sha256 included with PRESENCE counted as a value: passes
+        # validated against different schemas — or one validated and one not — ran
+        # under different criteria and cannot be one method's passes.
         values = {json.dumps(receipt.get(field_name), sort_keys=True) for receipt in group}
         if len(values) > 1:
             raise LaunchError(
@@ -3586,7 +4165,8 @@ def routed_preset_names(presets: dict[str, Any]) -> set[str]:
     """
     return {
         name for name, preset in presets.items()
-        if isinstance(preset, dict) and ("mission" in preset or "trigger" in preset)
+        if isinstance(preset, dict)
+        and ("mission" in preset or "trigger" in preset or "criterion" in preset)
     }
 
 
@@ -4527,7 +5107,7 @@ def host_models(config: dict[str, Any], host: str, tiers: dict[str, Any]) -> lis
 
 def resolve_review_for_plan(
     review: ReviewPlan, config: dict[str, Any], host: str, main_model: str,
-    main_effort: str, context: str,
+    main_effort: str, context: str, criterion: bool = False,
 ) -> tuple[dict, "ReviewReport | None"]:
     """(method registry, resolved report) for a review against the main seat.
 
@@ -4535,6 +5115,16 @@ def resolve_review_for_plan(
     what a fresh launch would; two copies of this would let the Custom hub show a report
     the next launch disagrees with."""
     if review.source != "composable":
+        if criterion:
+            # The clause renders only through composable review rows, so on a legacy
+            # plan the toggle is accepted and then does nothing — a false success the
+            # operator reads as discipline in force (criterion round, #0).
+            raise LaunchError(
+                f"{context} declares criterion = true, but its review uses the legacy "
+                f"schema; the discipline clause renders only through composable review "
+                f"rows, so the toggle would be silently inert — author a composable "
+                f"[review] block or drop the toggle"
+            )
         return {}, None
     provider = config["hosts"][host].get("provider")
     if not isinstance(provider, str) or not provider:
@@ -4544,7 +5134,7 @@ def resolve_review_for_plan(
         )
     methods = load_review_methods(config)
     main_seat = ReviewBinding(provider, host, main_model, main_effort)
-    return methods, resolve_composable_review(review, main_seat, config, methods)
+    return methods, resolve_composable_review(review, main_seat, config, methods, criterion)
 
 
 def effective_review_family(
@@ -4586,6 +5176,7 @@ def apply_review_plan(plan: dict[str, Any], config: dict[str, Any], review: Revi
     methods, report = resolve_review_for_plan(
         review, config, plan["host"], plan["tiers"][plan["main_tier"]]["model"],
         tier_effort(plan, plan["main_tier"]), f"custom.{plan['preset']}",
+        plan.get("criterion", False),
     )
     plan["review_plan"] = review
     # Editing on one host replaces that host's arm and leaves the others exactly as
@@ -4800,8 +5391,18 @@ def build_plan(config: dict[str, Any], host: str, preset_name: str) -> dict[str,
     # isolated mechanism is an invalid launch, and that has to fail while the plan is
     # being built rather than halfway through printing a contract.
     main_effort = frontier_effort if main_tier == "frontier" else tiers[main_tier]["effort"]
+    # The criterion-discipline toggle. A BOOLEAN, deliberately: the criterion itself is
+    # per-review and rides the packet, which packet_sha256 binds — a preset carrying its
+    # content would put per-review text into the per-launch contract the golden pins.
+    criterion = preset.get("criterion", False)
+    if not isinstance(criterion, bool):
+        raise LaunchError(
+            f"presets.{preset_name}.criterion must be a boolean toggle; the criterion "
+            f"itself is declared in the review packet, never in the preset"
+        )
     review_methods, review_report = resolve_review_for_plan(
-        review, config, host, tiers[main_tier]["model"], main_effort, f"presets.{preset_name}"
+        review, config, host, tiers[main_tier]["model"], main_effort,
+        f"presets.{preset_name}", criterion,
     )
     codex_policy = preset.get("codex_execution_policy")
     claude_policy = preset.get("claude_permission_mode")
@@ -4894,6 +5495,7 @@ def build_plan(config: dict[str, Any], host: str, preset_name: str) -> dict[str,
         },
         "mission": mission,
         "trigger": trigger,
+        "criterion": criterion,
     }
 
 
@@ -6061,6 +6663,13 @@ def preset_from_plan(
         "codex_execution_policy": plan["codex_execution_policy"],
         "claude_permission_mode": plan["claude_permission_mode"],
     }
+    if plan.get("criterion"):
+        # Save As from a criterion-toggled plan silently dropped the discipline: the
+        # routed-name guard covers same-name shadowing, not a fresh name, and the
+        # reload defaulted the absent field to false while Save reported success
+        # (criterion round, #8). Written only when true, so every existing saved
+        # preset stays byte-identical.
+        fields["criterion"] = True
     if review_block is None:
         # Carrying both schemas on one preset is a validation error, so the legacy
         # names appear only when there is no authored block to write.
@@ -8941,6 +9550,28 @@ def parse_args(argv: list[str]) -> argparse.Namespace:
         "--fold-receipts", nargs=3, metavar=("DIR", "PACKET_FILE", "MAIN_DISPATCH_ID"),
         help=f"fold a directory of receipts into one {RECEIPT_BUNDLE_SCHEMA} bundle on stdout",
     )
+    # The criterion side of the same per-review file surface. Compile turns a criterion
+    # document into the canonical findings schema and prints the packet record line;
+    # check-findings is the structural accepting channel standalone; check-schema-flag
+    # probes the installed backend for its structured-output flag, because a declared
+    # capability is docs and the rule is probe-over-docs.
+    parser.add_argument(
+        "--compile-criterion", nargs=2, metavar=("CRITERION_FILE", "SCHEMA_OUT"),
+        help=f"validate a criterion document, write its compiled findings schema, and "
+             f"print the {CRITERION_RECORD_SCHEMA} record line the packet carries",
+    )
+    parser.add_argument(
+        "--check-findings", nargs=2, metavar=("RESULT_FILE", "SCHEMA_FILE"),
+        help="refuse a findings result that fails the compiled criterion schema, each "
+             "violation by name; the same check runs inside --emit-receipt when "
+             f"${RECEIPT_CRITERION_ENV} is set",
+    )
+    parser.add_argument(
+        "--check-schema-flag", metavar="PROBE_HOST",
+        help="probe the resolved backend binary for its structured-output flag; exit 0 "
+             f"when registered, {SCHEMA_FLAG_ABSENT_EXIT} when the binary runs and does "
+             f"not register it",
+    )
     # REMAINDER and not "+": the adapter's own command line carries flags, and "+" stops
     # at the first token starting with a dash — which handed `--model` to the host
     # positional and rejected the run before the adapter was ever dispatched.
@@ -8956,7 +9587,8 @@ def parse_args(argv: list[str]) -> argparse.Namespace:
     args = parser.parse_args(argv)
     hostless = (
         args.verify_receipts or args.emit_receipt or args.fold_receipts
-        or args.check_adapter
+        or args.check_adapter or args.compile_criterion or args.check_findings
+        or args.check_schema_flag
     )
     if args.host is None and not hostless:
         parser.error("the following arguments are required: host")
@@ -9031,9 +9663,25 @@ def verify_receipts_command(
     # under audit. Both halves, because either alone is satisfiable by the wrong thing —
     # a digest agreeing with the anchor says these bytes were hashed, and the plan the
     # bytes carry says WHICH review they were hashed for.
+    # Whether the plan declared the criterion discipline: read from the rows' rendered
+    # instructions, where the launch snapshotted it — a ReviewPlan/v1 field would be a
+    # schema change restating what the instruction already carries.
+    criterion_active = any(
+        CRITERION_CLAUSE_MARKER in row.instruction
+        for row in (report.base, *report.methods)
+        if row.status != STATUS_DROPPED
+    )
+    criterion_digest: "str | None" = None
     if packet_path is not None:
         packet_file = pathlib.Path(packet_path).expanduser()
-        digest = _sha256_file(str(packet_file))
+        # ONE byte snapshot: hashing the path and then reopening it as text let the
+        # equality speak for one file state and the plan/criterion extraction for
+        # another (criterion round, #6 — the emit-side twin is #4).
+        try:
+            packet_bytes = packet_file.read_bytes()
+        except OSError as exc:
+            raise LaunchError(f"cannot read the packet {packet_file}: {exc}") from exc
+        digest = hashlib.sha256(packet_bytes).hexdigest()
         anchor = bundle.get("packet_sha256") if isinstance(bundle, dict) else None
         if digest != anchor:
             raise LaunchError(
@@ -9042,8 +9690,8 @@ def verify_receipts_command(
                 f"these bytes"
             )
         try:
-            packet_text = packet_file.read_text(encoding="utf-8")
-        except (OSError, UnicodeDecodeError) as exc:
+            packet_text = packet_bytes.decode("utf-8")
+        except UnicodeDecodeError as exc:
             raise LaunchError(f"cannot read the packet {packet_file}: {exc}") from exc
         carried = extract_review_plan_v1(packet_text)
         if carried is None:
@@ -9056,6 +9704,16 @@ def verify_receipts_command(
                 f"the supplied packet carries a different {REVIEW_PLAN_SCHEMA} record than "
                 f"{plan_path}; these receipts evidence a review of another plan"
             )
+        if criterion_active:
+            # A plan whose rows carry the discipline clause declared a criterion, and a
+            # packet that omits the record cannot verify: extract_criterion refuses the
+            # absence, the malformed record and the second record each by name. The
+            # digest is a RECOMPILATION from the packet's own bytes — never read off
+            # the receipts, which are the artifacts under audit.
+            document = extract_criterion(packet_text, "the supplied packet")
+            criterion_digest = hashlib.sha256(
+                criterion_schema_bytes(document)
+            ).hexdigest()
     # The offer that SERVES THE ROW'S HOST, selected by `select_capability_offer` — the
     # same function `derive_review_mechanism` seats a method with, rather than a second
     # loop written to the same description. The first offer for the operation was taken
@@ -9110,9 +9768,26 @@ def verify_receipts_command(
             method, capability, row_host
         )["evidence"]
     verified, verdicts = verify_review_receipts(
-        report, bundle, required_controls, required_evidence
+        report, bundle, required_controls, required_evidence, criterion_digest
     )
-    print(render_receipt_verdicts(verified, verdicts, packet_bound=packet_path is not None))
+    if not criterion_active:
+        criterion_note = ""
+    elif criterion_digest is not None:
+        criterion_note = (
+            "  criterion=declared and bound: receipts carrying criterion_schema_sha256 "
+            "were held to the schema recompiled from the packet's record; a receipt "
+            "without it ran prose discipline — steering, not structural enforcement"
+        )
+    else:
+        criterion_note = (
+            "  criterion=declared but UNBOUND: no packet was supplied, so the declared "
+            "criterion was recompiled against nothing and no schema digest above was "
+            "adjudicated"
+        )
+    print(render_receipt_verdicts(
+        verified, verdicts, packet_bound=packet_path is not None,
+        criterion_note=criterion_note,
+    ))
     return 0 if verified.achievement == ACHIEVEMENT_COMPLETE else 1
 
 
@@ -9162,6 +9837,14 @@ def main(argv: list[str]) -> int:
         return emit_receipt_command(*args.emit_receipt, evidence=args.evidence)
     if args.fold_receipts:
         return fold_receipts_command(*args.fold_receipts)
+    if args.compile_criterion:
+        return compile_criterion_command(*args.compile_criterion)
+    if args.check_findings:
+        return check_findings_command(*args.check_findings)
+    if args.check_schema_flag:
+        return check_schema_flag_command(
+            args.check_schema_flag, args.config.expanduser()
+        )
     if args.check_adapter:
         if len(args.check_adapter) < 2:
             raise LaunchError("--check-adapter takes a seat and then the adapter command")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-bios",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "releaseDate": "2026-08-19",
   "description": "A thin, low-level instruction layer for LLM CLI agents: one set of principles and behavior whichever model you run. Deploys into $HOME by copy via an explicit `agent-bios install`.",
   "bin": {

package/provenance.json

@@ -1 +1 @@
-{"commit":"471ff43022a60490b5e0e788f5ba6dec3a89e992","committedAt":"2026-08-19T07:44:53+09:00","dirty":false}
+{"commit":"7d37b87e38e892108e7cd7bd0a397fd30316065c","committedAt":"2026-08-19T11:53:21+09:00","dirty":false}