agent-horde 0.1.5 → 0.1.6

package/src/tool/actions.ts

@@ -2,12 +2,17 @@ import { postBoard } from "../ledger/board.js";
 import { assertClaim, confirmClaim, contestClaim, listClaims, retractClaim, supersedeClaim } from "../ledger/claims.js";
 import type { ClaimEntry } from "../ledger/claims.js";
 import { listConcerns } from "../ledger/concerns.js";
-import { addFact, listFacts } from "../ledger/facts.js";
-import { addFinding, findingSummaries, verifyFinding } from "../ledger/findings.js";
+import { addFact, factUnsettled, listFacts, unsettledFactCitations } from "../ledger/facts.js";
+import type { FactEntry } from "../ledger/facts.js";
+import * as path from "node:path";
+import { CLUSTER_THRESHOLD } from "../ledger/clusters.js";
+import { collaborationState } from "../ledger/collaboration.js";
+import { addFinding, amendFinding, answerCitations, findingReviewState, findingRevision, findingSummaries, listFindingsForRun, pendingReviewsForMember, staleAnswerCitations, verifyFinding } from "../ledger/findings.js";
+import { textOverlap } from "../ledger/text-match.js";
 import { addIdea, claimIdea, dropIdea, finishIdea, listIdeas, ruleOutIdea } from "../ledger/ideas.js";
 import type { Idea } from "../ledger/ideas.js";
 import { claimResource, listResources } from "../ledger/resources.js";
-import { cleanStopRequestedFor, confirmSolved, contestSolved, markSolved } from "../ledger/run-signals.js";
+import { cleanStopRequestedFor, confirmSolved, contestSolved, markSolved, readSolved } from "../ledger/run-signals.js";
 import { oneLine } from "../format.js";
 import { validateFindingResourceCitations } from "../citations.js";
 import { idleHint } from "./hints.js";
@@ -34,6 +39,10 @@ interface ActionResult {
   noop?: boolean;
   /** For confirm-solved: whether this confirmation validated the proposal or joined an earlier one. */
   confirmation?: "credited" | "additional";
+  /** For amend: the revisions the edit moved between, and whether the claim line changed; reattest reads them. */
+  previousRevision?: string;
+  revision?: string;
+  titleChanged?: boolean;
 }
 
 interface ActionContext {
@@ -43,6 +52,12 @@ interface ActionContext {
   runId: string | undefined;
   /** True when a clean stop is pending for this member. */
   cleanStop: boolean;
+  /** The member's role instruction, when one was assigned. */
+  role: string | undefined;
+}
+
+export function isVerifierRole(role: string | undefined): boolean {
+  return /verifier/i.test(role ?? "");
 }
 
 type ActionHandler = (ctx: ActionContext) => ActionResult | Promise<ActionResult>;
@@ -177,7 +192,23 @@ async function findingAction(ctx: ActionContext): Promise<ActionResult> {
     };
   }
   const advisory = concernAdvisory ? `\nNote: ${concernAdvisory}` : "";
-  return { text: `Recorded finding F${finding.id} [${concern}]: ${finding.title}${advisory}`, id: finding.id };
+  return { text: `Recorded finding F${finding.id} [${concern}]: ${finding.title}${advisory}${unregisteredHarness(ctx, text)}`, id: finding.id };
+}
+
+const HARNESS_PATH = /\bartifacts\/[\w./-]+\.(?:py|js|mjs|cjs|ts|sh|go|rs|rb|pl)\b/g;
+
+/**
+ * A driver or harness every member rewrote because nobody registered it: a runnable under
+ * artifacts/ that no resource note and no published artifact names is pointed at `resource`.
+ */
+function unregisteredHarness(ctx: ActionContext, text: string): string {
+  const paths = [...new Set(text.match(HARNESS_PATH) ?? [])];
+  if (!paths.length) return "";
+  const known = listResources(ctx.hordeDir).map((resource) => `${resource.name} ${resource.note ?? ""}`).join("\n");
+  const published = ctx.runId ? collaborationState(ctx.hordeDir, ctx.runId).artifacts.map((artifact) => artifact.path) : [];
+  const unregistered = paths.filter((file) => !known.includes(file) && !published.some((artifact) => file.endsWith(artifact)));
+  if (!unregistered.length) return "";
+  return `\nNote: ${unregistered.join(", ")} looks like a harness no R# covers. Claim it with 'horde resource' (name in text, path in note) so other members reuse it instead of writing their own.`;
 }
 
 function concernsAction({ hordeDir }: ActionContext): ActionResult {
@@ -209,6 +240,26 @@ async function verifyAction(ctx: ActionContext): Promise<ActionResult> {
   };
 }
 
+async function amendAction(ctx: ActionContext): Promise<ActionResult> {
+  const { hordeDir, member, params, runId } = ctx;
+  validateFindingResourceCitations(hordeDir, runId, params.text ?? "");
+  const { finding, previous, titleChanged } = await amendFinding(hordeDir, requireRun(ctx), member, {
+    id: requireId(params),
+    text: params.text,
+    note: params.note,
+  });
+  return {
+    text:
+      `Amended F${finding.id}: ${finding.title}. Revision ${previous.slice(0, 12)} is superseded by the new text; ` +
+      "reviews stay pinned to the revision they checked. " +
+      (titleChanged ? "The claim line changed, so reviewers must review again." : "Ask reviewers to reattest if what they checked is unchanged, or to review again."),
+    id: finding.id,
+    previousRevision: previous,
+    revision: findingRevision(finding),
+    titleChanged,
+  };
+}
+
 async function factAction({ hordeDir, member, params }: ActionContext): Promise<ActionResult> {
   const { fact, duplicateOf, corroborationFull } = await addFact(
     hordeDir,
@@ -225,13 +276,26 @@ async function factAction({ hordeDir, member, params }: ActionContext): Promise<
       id: fact.id,
     };
   }
-  return { text: `Recorded fact T${fact.id}: ${fact.text}`, id: fact.id };
+  const provisional = fact.provisionalOn
+    ? `\nT${fact.id} is provisional: ${fact.provisionalOn} is still auditing its subject. The answer may not quote it as settled until ${fact.provisionalOn} is closed or resolved; cite that closure with it.`
+    : "";
+  return { text: `Recorded fact T${fact.id}: ${fact.text}${provisional}`, id: fact.id };
 }
 
 function factsAction({ hordeDir }: ActionContext): ActionResult {
   const facts = listFacts(hordeDir);
   if (facts.length === 0) return { text: "FACTS.md has no facts yet" };
-  return { text: facts.map((fact) => `T${fact.id} ${fact.text} @${fact.author}`).join("\n") };
+  const status = (fact: FactEntry): string => {
+    if (!fact.provisionalOn) return "";
+    return factUnsettled(hordeDir, fact) ? ` [provisional: ${fact.provisionalOn} open]` : ` [was provisional on ${fact.provisionalOn}, now closed]`;
+  };
+  return { text: facts.map((fact) => `T${fact.id} ${fact.text} @${fact.author}${status(fact)}`).join("\n") };
+}
+
+/** An answer that quotes a provisional fact as settled asserts what an open idea is still auditing. */
+function unsettledAnswerFacts(ctx: ActionContext, text: string): string | undefined {
+  const unsettled = unsettledFactCitations(ctx.hordeDir, text);
+  return unsettled.length ? `quotes provisional ${unsettled.join(", ")}` : undefined;
 }
 
 async function assertAction({ hordeDir, member, params }: ActionContext): Promise<ActionResult> {
@@ -288,13 +352,44 @@ async function ideaAction({ hordeDir, member, params }: ActionContext): Promise<
   return { text: `Added idea #${idea.id}: ${idea.text}`, id: idea.id };
 }
 
-async function claimAction({ hordeDir, member, params }: ActionContext): Promise<ActionResult> {
+/**
+ * The verifier reviews before it investigates: a verifier that claimed ideas and filed the
+ * run's main findings left its first session with zero scoped reviews while its summary
+ * reported verification complete. Any verdict counts; a finding it cannot reproduce gets a
+ * refuting or inconclusive review, not silence.
+ */
+function checkVerifierClaim(ctx: ActionContext): void {
+  if (!ctx.runId || !isVerifierRole(ctx.role)) return;
+  const pending = pendingReviewsForMember(ctx.hordeDir, ctx.runId, ctx.member);
+  if (!pending.length) return;
+  throw new Error(
+    `horde: you are the verifier and ${pending.length} finding(s) by other members await your review: ` +
+      `${pending.map((f) => `F${f.id}`).join(", ")}. Review each (any verdict, with its unchecked scope) before claiming an idea`,
+  );
+}
+
+/** Findings of this run that already have an independent corroborator or a full review and overlap the idea. */
+function reproducedOverlap(ctx: ActionContext, idea: Idea): string {
+  if (!ctx.runId) return "";
+  const state = collaborationState(ctx.hordeDir, ctx.runId);
+  const settled = listFindingsForRun(ctx.hordeDir, ctx.runId).filter((f) =>
+    f.supersededBy === undefined && (f.corroborators.length > 0 || findingReviewState(f, state.reviews, state.messages).status === "full"));
+  const match = textOverlap(settled.map((f) => f.title), idea.text);
+  if (!match || Math.max(match.jaccard, match.overlap) < CLUSTER_THRESHOLD) return "";
+  const finding = settled[match.index];
+  if (!finding) return "";
+  return `\nNote: F${finding.id} ("${finding.title}") is already independently reproduced; a further reproduction adds nothing. Attach a new vector or distinct evidence with deltaOf: ${finding.id}, or take a different slice.`;
+}
+
+async function claimAction(ctx: ActionContext): Promise<ActionResult> {
+  const { hordeDir, member, params } = ctx;
+  checkVerifierClaim(ctx);
   const { idea, overlap } = await claimIdea(hordeDir, member, requireId(params));
   const warning = overlap
     ? `\nWarning: #${overlap.id} held by ${overlap.owner} covers a similar slice ("${overlap.text}"). ` +
       `Coordinate: take a distinct angle, or attach evidence to #${overlap.id} with a finding or contest.`
     : "";
-  return { text: `Claimed #${idea.id}: ${idea.text}${warning}`, id: idea.id };
+  return { text: `Claimed #${idea.id}: ${idea.text}${warning}${reproducedOverlap(ctx, idea)}`, id: idea.id };
 }
 
 async function resourceAction(ctx: ActionContext): Promise<ActionResult> {
@@ -341,12 +436,31 @@ function resourcesAction({ hordeDir }: ActionContext): ActionResult {
   };
 }
 
+/**
+ * An answer that cites a superseded finding, or one amended since the proposal pinned it, ships a
+ * stale reading as the run's result. The proposer cites the current text instead; a validator is
+ * refused until the proposer re-proposes.
+ */
+function staleAnswer(ctx: ActionContext, text: string, cites?: Record<string, string>): string | undefined {
+  const runId = requireRun(ctx);
+  const stale = staleAnswerCitations(listFindingsForRun(ctx.hordeDir, runId), text, cites);
+  if (!stale.length) return undefined;
+  return `cites ${stale.join(", ")}`;
+}
+
 async function solvedAction(ctx: ActionContext): Promise<ActionResult> {
+  const runId = requireRun(ctx);
+  const text = ctx.params.text ?? "";
+  const stale = staleAnswer(ctx, text);
+  if (stale) throw new Error(`horde: the answer ${stale}; cite the current findings and propose again`);
+  const unsettled = unsettledAnswerFacts(ctx, text);
+  if (unsettled) throw new Error(`horde: the answer ${unsettled}; close the idea or resolve the claim first, or leave the fact out`);
   const { signal, alreadySolved } = await markSolved(
     ctx.hordeDir,
-    requireRun(ctx),
+    runId,
     ctx.member,
     ctx.params.text,
+    answerCitations(listFindingsForRun(ctx.hordeDir, runId), text),
   );
   return {
     text: alreadySolved
@@ -356,7 +470,13 @@ async function solvedAction(ctx: ActionContext): Promise<ActionResult> {
 }
 
 async function confirmSolvedAction(ctx: ActionContext): Promise<ActionResult> {
-  const answer = await confirmSolved(ctx.hordeDir, requireRun(ctx), ctx.member, ctx.params.text, ctx.params.revision);
+  const runId = requireRun(ctx);
+  const proposal = readSolved(path.join(ctx.hordeDir, "runs", runId));
+  const stale = proposal ? staleAnswer(ctx, proposal.text, proposal.cites) : undefined;
+  if (stale) throw new Error(`horde: the pending answer ${stale}; it cannot be validated until ${proposal?.member} re-proposes against the current findings`);
+  const unsettled = proposal ? unsettledAnswerFacts(ctx, proposal.text) : undefined;
+  if (unsettled) throw new Error(`horde: the pending answer ${unsettled}; close the idea or resolve the claim before validating it`);
+  const answer = await confirmSolved(ctx.hordeDir, runId, ctx.member, ctx.params.text, ctx.params.revision);
   if (!answer.ok) throw new Error(`horde: ${answer.reason}`);
   if (answer.reason !== "validated") {
     return {
@@ -378,9 +498,23 @@ async function contestSolvedAction(ctx: ActionContext): Promise<ActionResult> {
   };
 }
 
+/** A result line that reports a confirmed negative: the lead is dead, not merely finished. */
+const NEGATIVE_RESULT =
+  /\b(?:not (?:exploitable|vulnerable|reachable|reproducible|affected)|does not reproduce|could not reproduce|cannot be reproduced|confirmed negative|negative result|dead end|ruled? out|no (?:vulnerability|exploit|issue|bug|weakness) (?:found|present|exists))\b/i;
+
 async function doneAction(ctx: ActionContext): Promise<ActionResult> {
   const { hordeDir, member, params } = ctx;
-  const idea = await finishIdea(hordeDir, member, requireId(params), closeNote(params));
+  const note = closeNote(params) ?? "";
+  // Four confirmed negatives were recorded only as done notes and prose, so the next run on the
+  // same target re-walked them. A negative closes with rule-out, which later runs can read.
+  const negative = NEGATIVE_RESULT.exec(note);
+  if (negative) {
+    throw new Error(
+      `horde: "${negative[0]}" reads as a confirmed negative; close #${requireId(params)} with 'horde rule-out' and the same note so later runs do not retry it. ` +
+        "Use done only for work that produced a result.",
+    );
+  }
+  const idea = await finishIdea(hordeDir, member, requireId(params), note || undefined);
   return closedIdea(ctx, idea, `Done #${idea.id}: ${idea.text}`);
 }
 
@@ -422,6 +556,7 @@ const HANDLERS: Partial<Record<HordeToolParams["action"], ActionHandler>> = {
   "contest-solved": contestSolvedAction,
   concerns: concernsAction,
   verify: verifyAction,
+  amend: amendAction,
 };
 
 export async function runHordeAction(
@@ -429,9 +564,10 @@ export async function runHordeAction(
   member: string,
   params: HordeToolParams,
   runId: string | undefined = process.env.PI_HORDE_RUN,
-  tracking: { attempt?: string; requestId?: string } = {},
+  tracking: { attempt?: string; requestId?: string; role?: string | undefined } = {},
 ): Promise<ActionResult> {
   const cleanStop = Boolean(runId && cleanStopRequestedFor(hordeDir, runId, member));
+  const role = tracking.role;
   const ctx: EventContext = { hordeDir, runId: runId ?? "", actor: member, ...tracking, requestId: params.requestId ?? tracking.requestId };
   if (COLLABORATION_ACTIONS.has(params.action)) {
     if (!runId) throw new Error("horde: collaboration needs an active run");
@@ -444,7 +580,7 @@ export async function runHordeAction(
   const intent = audit ? await recordEvent({ ...ctx, requestId: ctx.requestId ? `${ctx.requestId}:intent` : undefined }, params.action, { outcome: "intent", payload: { input: params } }) : undefined;
   try {
     const refused = cleanStop && NEW_WORK_ACTIONS.has(params.action);
-    const result = refused ? { text: CLEAN_STOP_NOTICE } : await handler({ hordeDir, member, params, runId, cleanStop });
+    const result = refused ? { text: CLEAN_STOP_NOTICE } : await handler({ hordeDir, member, params, runId, cleanStop, role });
     // A refusal and a no-op both record `noop`; the no-op keeps `result.noop` so the graph and the
     // report can tell an absorbed duplicate from refused work.
     if (audit) await recordEvent(ctx, params.action, { outcome: refused || result.noop ? "noop" : "applied", payload: { input: params, result }, parents: intent ? [intent.eventId] : [] });

package/src/tool/collaboration-actions.ts

@@ -3,15 +3,15 @@ import * as path from "node:path";
 import { listFindingsForRun } from "../ledger/findings.js";
 import { requireParam, requireText } from "../ledger/files.js";
 import { collaborationState, openMessages, projectCollaboration } from "../ledger/collaboration.js";
-import type { CollaborationState, PeerMessage } from "../ledger/collaboration.js";
-import { transactEvent } from "../ledger/events.js";
+import type { ArtifactRecord, CollaborationState, PeerMessage } from "../ledger/collaboration.js";
+import { readEvents, transactEvent } from "../ledger/events.js";
 import type { EventContext, EventDraft } from "../ledger/events.js";
 import { currentTarget, targetInfo, retainArtifact, hashText } from "./collaboration-target.js";
 import { collaborationView, inspectRecord } from "./collaboration-view.js";
 import { resourceTransition } from "./resource-contract.js";
 import type { HordeToolParams } from "./params.js";
 
-export const COLLABORATION_ACTIONS = new Set(["inbox", "message", "ack", "respond", "resolve", "defer", "attach", "review", "artifact", "resource-state", "collaboration", "inspect"]);
+export const COLLABORATION_ACTIONS = new Set(["inbox", "message", "ack", "respond", "resolve", "defer", "attach", "review", "reattest", "artifact", "resource-state", "collaboration", "inspect"]);
 interface CollaborationCommand {
   ctx: EventContext;
   state: CollaborationState;
@@ -144,9 +144,13 @@ function attachEvidence(c: CollaborationCommand): EventDraft {
   if (p.revision && p.revision !== info.revision) throw new Error("horde: target revision changed");
   const file = p.artifactPath ? retainArtifact(ctx, p.artifactPath) : {};
   const text = requireText(p.text, "attach");
+  // Contradicting evidence on an idea is how a lead dies; the record that outlives the run is a rule-out.
+  const ruleOutHint = p.relation === "contradicts" && /^I\d+$/.test(target)
+    ? { note: `${target} has contradicting evidence: a rule-out candidate. If this closes the lead, its owner (${info.owner}) should 'horde rule-out' it with this evidence as the reason so later runs do not retry it.` }
+    : {};
   return { payload: { evidenceRecord: { id: `E${seq}`, actor: ctx.actor, target, revision: info.revision,
     relation: p.relation ?? "extends", text, ...file },
-    ...(p.relation === "contradicts" ? automaticChallenge(c, target, info, text, [`E${seq}`]) : {}) } };
+    ...(p.relation === "contradicts" ? automaticChallenge(c, target, info, text, [`E${seq}`]) : {}), ...ruleOutHint } };
 }
 
 function publishArtifact(c: CollaborationCommand): EventDraft {
@@ -167,8 +171,15 @@ function publishArtifact(c: CollaborationCommand): EventDraft {
   if (existing && existing.hash === retained.hash && (existing.criteria !== criteria || JSON.stringify(existing.dependencies) !== JSON.stringify(dependencies))) {
     throw new Error("horde: changing criteria or dependencies requires a new file revision so prior reviews cannot transfer to a different contract");
   }
+  // A revision other artifacts pin is a frozen contract: re-hashing it goes stale for every
+  // dependent, so the change is announced, and reviewers can reattest when behaviour is unchanged.
+  const dependents = existing ? state.artifacts.filter((a) => a.id !== existing.id && a.dependencies.some((d) => d.target === existing.id)).map((a) => a.id) : [];
+  if (existing && existing.hash !== retained.hash && dependents.length && !p.text?.trim()) {
+    throw new Error(`horde: ${existing.id}@${existing.hash.slice(0, 12)} is pinned by ${dependents.join(", ")}; prefer a follow-up finding or artifact, or republish with text= naming the change and whether behaviour is unchanged so dependents can reattest`);
+  }
+  const changeNote = existing && existing.hash !== retained.hash && p.text?.trim() ? { changeNote: p.text.trim() } : {};
   return { payload: { artifact: { id: existing?.id ?? `A${seq}`, kind, owner: ctx.actor, ...retained,
-    criteria, dependencies } }, parents: evidenceRefs(state, p.refs) };
+    criteria, dependencies, ...changeNote }, ...(dependents.length ? { dependents } : {}) }, parents: evidenceRefs(state, p.refs) };
 }
 
 function recordReview(c: CollaborationCommand): EventDraft {
@@ -192,33 +203,71 @@ function recordReview(c: CollaborationCommand): EventDraft {
     text: requireParam(p.evidenceText, "evidenceText", p.action), ...(p.artifactPath ? retainArtifact(ctx, p.artifactPath) : {}),
   };
   if (evidenceRecord) refs.push(evidenceRecord.id);
+  const limits = p.limits?.trim();
+  // A partial verdict refutes nothing: its unchecked scope is coverage debt that the acceptance
+  // names and a full review settles. Only a refutation is an objection the owner must answer.
   return { payload: { ...(evidenceRecord ? { evidenceRecord } : {}), review: { id: `V${seq}`, actor: ctx.actor, target, revision: info.revision,
-    verdict: p.verdict, support: p.support, checked, unchecked: p.unchecked,
+    verdict: p.verdict, support: p.support, checked, unchecked: p.unchecked, ...(limits ? { limits } : {}),
     text, evidence: refs },
     ...completeAssignedReview(c, target, `V${seq}`, text, refs),
-    ...(["refutes", "partially-supports"].includes(p.verdict) ? automaticChallenge(c, target, info, text, refs) : {}),
-    ...(p.verdict === "supports" && !p.unchecked.trim() ? coverageClearance(c, target, info, `V${seq}`, refs) : {}) }, parents: refs.filter((id) => id !== evidenceRecord?.id) };
-}
-
-/** The challenge a partially-supports review raised in its own event, as opposed to an objection a member wrote. */
-function coverageChallenge(state: CollaborationState, message: PeerMessage): boolean {
-  return state.reviews.some((r) => r.id === `V${message.id.slice(1)}` && r.actor === message.sender && r.verdict === "partially-supports");
+    ...(p.verdict === "refutes" ? automaticChallenge(c, target, info, text, refs) : {}) }, parents: refs.filter((id) => id !== evidenceRecord?.id) };
 }
 
 /**
- * A partial review opens a blocking challenge that only its sender may resolve. When that review
- * contradicted nothing and another member later supports the whole revision, the unchecked scope
- * is covered: the full review clears the challenge, and the resolution names both reviews.
+ * A behaviour-neutral re-hash (a republish against a corrected dependency, an amended finding
+ * body, a spec clarification) would otherwise drop every review of the earlier revision. The
+ * reviewer carries its own latest review forward with evidence that what it checked is unchanged.
+ */
+/**
+ * What changed between the reviewed revision and the current one, as the ledger recorded it. A
+ * review carries forward only across prose: a new acceptance contract or a new claim line is a
+ * different subject and needs a fresh review.
  */
-function coverageClearance(c: CollaborationCommand, target: string, info: { revision: string }, reviewId: string, refs: string[]): Record<string, unknown> {
-  const cleared = c.state.messages.filter((m) =>
-    m.target === target && m.revision === info.revision && m.blocking && m.state !== "resolved" && m.sender !== c.ctx.actor && coverageChallenge(c.state, m));
-  if (!cleared.length) return {};
-  return { clearances: cleared.map((m) => ({
-    id: m.id,
-    text: `cleared by ${reviewId}: ${c.ctx.actor}'s full-scope supporting review of ${target}@${info.revision.slice(0, 12)} covers the scope V${m.id.slice(1)} left unchecked`,
-    refs,
-  })) };
+function reattestBlocker(ctx: EventContext, state: CollaborationState, target: string, previousRevision: string): string | undefined {
+  const events = readEvents(ctx.hordeDir, ctx.runId).filter((e) => e.outcome === "applied");
+  if (target.startsWith("A")) {
+    const current = state.artifacts.find((a) => a.id === target);
+    const earlier = events.map((e) => e.payload.artifact as ArtifactRecord | undefined).find((a) => a?.id === target && a.hash === previousRevision);
+    if (!current || !earlier) return `the reviewed revision ${previousRevision.slice(0, 12)} of ${target} is not on record`;
+    if (earlier.criteria !== current.criteria) return `${target}'s criteria changed since the reviewed revision; review the new contract`;
+    if ((earlier.kind ?? "runnable") !== (current.kind ?? "runnable")) return `${target}'s kind changed since the reviewed revision`;
+    return undefined;
+  }
+  const amends = events.filter((e) => e.action === "amend").map((e) => e.payload.result as { id?: number; previousRevision?: string; titleChanged?: boolean } | undefined);
+  const start = amends.findIndex((a) => a?.id === Number(target.slice(1)) && a.previousRevision === previousRevision);
+  if (start === -1) return `the reviewed revision ${previousRevision.slice(0, 12)} of ${target} is not the revision an amend started from; review the current text`;
+  if (amends.slice(start).some((a) => a?.id === Number(target.slice(1)) && a.titleChanged)) return `${target}'s claim line changed since the reviewed revision; review the new claim`;
+  return undefined;
+}
+
+function reattestReview(c: CollaborationCommand): EventDraft {
+  const { ctx, state, params: p, seq } = c;
+  const target = requireParam(p.target, "target", p.action);
+  if (!/^[FA]\d+$/.test(target)) throw new Error("horde: reattest targets an F# or A#");
+  const info = targetInfo(ctx, state, target);
+  if (info.owner === ctx.actor) throw new Error("horde: an independent review needs another member");
+  if (p.revision !== info.revision) throw new Error("horde: reattest must name the current revision from inspect");
+  const previous = state.reviews.findLast((r) => r.target === target && r.actor === ctx.actor && r.revision !== info.revision);
+  if (!previous) throw new Error(`horde: no earlier review of ${target} by ${ctx.actor} to carry forward; record a review instead`);
+  const blocker = reattestBlocker(ctx, state, target, previous.revision);
+  if (blocker) throw new Error(`horde: cannot reattest: ${blocker}`);
+  if (state.reviews.some((r) => r.target === target && r.actor === ctx.actor && r.revision === info.revision)) {
+    throw new Error(`horde: ${ctx.actor} already reviewed ${target}@${info.revision.slice(0, 12)}`);
+  }
+  const refs = [...evidenceRefs(state, p.refs)];
+  if (!refs.length && !p.evidenceText) throw new Error("horde: reattest needs evidence that the checked behaviour is unchanged: refs or evidenceText");
+  const stale = staleEvidence(state, refs, target, info.revision);
+  if (stale) throw new Error(`horde: reattest evidence must address the current revision: ${stale}`);
+  const text = requireText(p.text, "reattest");
+  const evidenceRecord = p.evidenceText === undefined ? undefined : {
+    id: `E${seq}`, actor: ctx.actor, target, revision: info.revision, relation: "extends" as const,
+    text: p.evidenceText, ...(p.artifactPath ? retainArtifact(ctx, p.artifactPath) : {}),
+  };
+  if (evidenceRecord) refs.push(evidenceRecord.id);
+  const review = { ...previous, id: `V${seq}`, revision: info.revision, text, evidence: refs, reattests: previous.id };
+  return { payload: { ...(evidenceRecord ? { evidenceRecord } : {}), review,
+    ...completeAssignedReview(c, target, `V${seq}`, text, refs),
+    ...(review.verdict === "refutes" ? automaticChallenge(c, target, info, text, refs) : {}) }, parents: [previous.id, ...refs.filter((id) => id !== evidenceRecord?.id)] };
 }
 
 /** The parent's assignment closes with the review id and its evidence, so the thread shows what decided it. */
@@ -239,6 +288,7 @@ function decide(c: CollaborationCommand): EventDraft {
     case "message": return newMessage(c);
     case "attach": return attachEvidence(c);
     case "review": return recordReview(c);
+    case "reattest": return reattestReview(c);
     case "artifact": return publishArtifact(c);
     case "resource-state": return resourceTransition(c);
     default: return transition(c);

package/src/tool/params.ts

@@ -28,19 +28,20 @@ export const HordeParams = Type.Object({
       "confirm-solved",
       "contest-solved",
       "concerns",
-      "verify", "inbox", "message", "ack", "respond", "resolve", "defer",
-      "attach", "review", "artifact", "resource-state", "collaboration", "inspect",
+      "verify", "amend", "inbox", "message", "ack", "respond", "resolve", "defer",
+      "attach", "review", "reattest", "artifact", "resource-state", "collaboration", "inspect",
     ] as const,
     {
       description:
         "list/findings/facts/claims/resources/concerns: read shared state; post: BOARD.md; " +
         "idea/claim/done/drop/rule-out: checklist (rule-out is a terminal negative); " +
         "finding: FINDINGS.md with a claimed idea, a concern slug, and optional importance/" +
-        "confidence/support; " +
+        "confidence/support; amend: rewrite the body prose of your own F#id at its current revision; " +
         "verify: record your independent reproduction of finding F#id with the support level you reached; " +
         "fact: FACTS.md; assert/confirm/contest/retract/supersede: change claim C#id state; " +
         "resource: claim a shared dataset, harness, corpus, or sandbox (with cleanup) before building it; " +
-        "solved: propose the goal answered; confirm-solved/contest-solved: validate or refute it",
+        "solved: propose the goal answered; confirm-solved/contest-solved: validate or refute it; " +
+        "reattest: carry your earlier review of F#/A# forward to its current revision with evidence that the checked behaviour is unchanged",
     },
   ),
   detail: Type.Optional(StringEnum(["summary", "full"] as const, { description: "Collaboration reads default to summaries; full returns complete page bodies, inspected subjects or write receipts. inspect E#/V#/Q# always returns the full record." })),
@@ -57,7 +58,8 @@ export const HordeParams = Type.Object({
   relation: Type.Optional(StringEnum(["supports", "contradicts", "extends"] as const)),
   verdict: Type.Optional(StringEnum(["supports", "partially-supports", "refutes", "inconclusive"] as const)),
   checked: Type.Optional(Type.String({ description: "Exact assertions checked and method; required for review." })),
-  unchecked: Type.Optional(Type.String({ description: "Assertions left unchecked or limitations; empty only for full coverage." })),
+  unchecked: Type.Optional(Type.String({ description: "Assertions inside the target's stated claim or criteria that you did not check; empty only for full coverage of that scope. Disclosures outside the criteria go in limits." })),
+  limits: Type.Optional(Type.String({ description: "For review: limits outside the target's declared claim or criteria (one engine, no hardened deployment). Recorded on the acceptance as limits, never as blockers." })),
   artifactKind: Type.Optional(StringEnum(["runnable", "document"] as const, { description: "Artifact classification, immutable after publication. Default runnable requires tested/reproduced review. document permits full-scope sourced/derived review of its stated criteria, not runtime acceptance." })),
   artifactPath: Type.Optional(Type.String({ description: "File path relative to this run, under artifacts/, retained by content hash." })),
   criteria: Type.Optional(Type.String({ description: "Artifact acceptance criteria, including positive/negative tests." })),
@@ -168,8 +170,8 @@ export type HordeToolParams = {
     | "confirm-solved"
     | "contest-solved"
     | "concerns"
-    | "verify" | "inbox" | "message" | "ack" | "respond" | "resolve" | "defer"
-    | "attach" | "review" | "artifact" | "resource-state" | "collaboration" | "inspect";
+    | "verify" | "amend" | "inbox" | "message" | "ack" | "respond" | "resolve" | "defer"
+    | "attach" | "review" | "reattest" | "artifact" | "resource-state" | "collaboration" | "inspect";
   detail?: "summary" | "full";
   offset?: number;
   limit?: number;
@@ -185,6 +187,7 @@ export type HordeToolParams = {
   verdict?: "supports" | "partially-supports" | "refutes" | "inconclusive";
   checked?: string;
   unchecked?: string;
+  limits?: string;
   artifactPath?: string;
   artifactKind?: "runnable" | "document";
   criteria?: string;

package/src/tool/register.ts

@@ -3,7 +3,7 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { cleanStopRequestedFor, writeHeartbeat } from "../ledger/run-signals.js";
 import { envNumber } from "../format.js";
 import { ReminderGate, goalReminder } from "../reminder.js";
-import { runHordeAction } from "./actions.js";
+import { isVerifierRole, runHordeAction } from "./actions.js";
 import { pendingVerificationHint, solvedHint } from "./hints.js";
 import { HordeParams } from "./params.js";
 import { compactReceipt } from "./collaboration-view.js";
@@ -18,9 +18,12 @@ const REMIND_MS = envNumber("PI_HORDE_REMIND_MS", 600_000);
 const MUTATING_ACTIONS = new Set([
   "post", "idea", "claim", "done", "drop", "rule-out", "finding", "fact", "assert", "confirm",
   "contest", "retract", "supersede", "resource", "solved", "confirm-solved", "contest-solved",
-  "verify", "message", "ack", "respond", "resolve", "defer", "attach", "review", "artifact", "resource-state",
+  "verify", "amend", "message", "ack", "respond", "resolve", "defer", "attach", "review", "reattest", "artifact", "resource-state",
 ]);
 
+/** After these, a verifier is shown what it still has to review. */
+const VERIFIER_QUEUE_ACTIONS = new Set(["verify", "review", "reattest", "post", "findings"]);
+
 export function registerMemberTool(pi: ExtensionAPI): void {
   const hordeDir = process.env.PI_HORDE_DIR;
   const member = process.env.PI_HORDE_NAME;
@@ -60,13 +63,15 @@ export function registerMemberTool(pi: ExtensionAPI): void {
     parameters: HordeParams,
     async execute(toolCallId, params) {
       const runId = process.env.PI_HORDE_RUN;
-      const result = await runHordeAction(hordeDir, member, params, runId, { attempt, requestId: toolCallId });
+      const role = process.env.PI_HORDE_ROLE;
+      const result = await runHordeAction(hordeDir, member, params, runId, { attempt, requestId: toolCallId, role });
       const runDir = runId ? path.join(hordeDir, "runs", runId) : undefined;
       if (runDir && MUTATING_ACTIONS.has(params.action)) touchHeartbeat(runDir, member);
       let text = compactReceipt(result.text, params) + solvedHint(hordeDir, runId, member, params.action);
-      // A verifier's coverage claim is only a snapshot. Append the live pending queue
-      // after every verify so a finding filed later cannot read as already checked.
-      if (runId && params.action === "verify" && /verifier/i.test(process.env.PI_HORDE_ROLE ?? "")) {
+      // A verifier's coverage claim is only a snapshot. Append the live pending queue after every
+      // review and every board update, so the unreviewed F# are named before wind-down and a
+      // finding filed later cannot read as already checked.
+      if (runId && VERIFIER_QUEUE_ACTIONS.has(params.action) && isVerifierRole(role)) {
         text += pendingVerificationHint(hordeDir, runId, member);
       }
       const winding = Boolean(runId && cleanStopRequestedFor(hordeDir, runId, member));