arkaos 4.41.0 → 4.43.0

package/THE-ARKAOS-GUIDE.md

@@ -1,6 +1,6 @@
 # The ArkaOS Guide
 
-> v4.41.0 — 89 agents, 17 departments, 332 skills, 297 commands, 18 ADRs.
+> v4.43.0 — 89 agents, 17 departments, 332 skills, 297 commands, 18 ADRs.
 > One file, everything you need to start. Generated by `scripts/guide_gen.py` — never hand-edited.
 
 ## What it is

package/VERSION

@@ -1 +1 @@
-4.41.0
+4.43.0

package/arka/skills/checkpoint/SKILL.md

@@ -53,7 +53,12 @@ Any work item whose execution would block the user for **> 30 seconds**
 Per the brainstorm (Marta + Tomas):
 
 - **Technical conflicts** between reviewers (e.g. Eduardo + Francisca
-  disagree on a code-style call) → Marta resolves silently.
+  disagree on a code-style call) → Marta resolves ON THE RECORD:
+  evidence decides (reproduce the claim, cite the reproduction), and
+  the resolution lands in her verdict notes. A blocker backed by
+  evidence is fixed or REFUTED with a substantive reason — never
+  dropped silently (constitution `inter-agent-checkpoints` enforcement
+  + `evidence-flow`; the aggregate guard enforces the bar).
 - **Strategic / taste / business-knowledge conflicts** → Marta surfaces
   the disagreement at the next checkpoint: *"Eduardo + Francisca
   discordam em X, eu inclino para A — qual o teu input?"*. The user
@@ -74,8 +79,10 @@ Tens contexto a acrescentar antes de eu arrancar? (Silêncio = procedo.)
   follows by emitting checkpoint markers between agent calls.
 - Does not block the user. The user is free to stay silent (proceed)
   or to send any message (parsed by `parse_user_injection`).
-- Does not bypass the mandatory 13-phase flow. Checkpoints are
-  emitted **inside** the per-todo loop of Phase 11.
+- Does not bypass the mandatory 4-gate evidence flow (the 13-phase
+  flow it referenced was replaced in v4.1.0 — constitution
+  `evidence-flow`). Checkpoints are emitted **inside** Gate 3
+  execution, between sub-dispatches; Gate 4 still runs.
 
 ## Cross-references
 

package/arka/skills/flow/SKILL.md

@@ -142,6 +142,10 @@ resumes at the right gate.
   Time and token cost are not acceptable answers to any of the three.
 - Quality Gate REJECTED loops back at most twice; a third REJECTED
   escalates to the operator with the full verdict.
+- The gate-closing report reproduces each reviewer verdict VERBATIM
+  under `### <Reviewer> — verbatim`, with the ledger artifact path
+  (`~/.arkaos/quality-gate/<session>/`) beside it. Summarising a
+  reviewer in your own words is relay, not report.
 - Close with an honest summary: what changed, where, how it was
   verified (real commands + results), what remains open.
 

package/config/claude-agents/eduardo-copy.md

@@ -55,10 +55,21 @@ DOCUMENTATION-scope prose it is advisory.
 Return a `QGVerdict` JSON object (schema: `QG_VERDICT_JSON_SCHEMA` in
 `core.governance.qg_verdict`): `verdict`, `evidence_report` summary,
 `blockers` [{check, detail, file, verdict}] with exact location and
-correction — `verdict` is claim-level: CONFIRMED (you verified the
+correction — `check` names the evidence check or rubric area (the
+aggregate's coverage matching keys on it; never leave it empty),
+`verdict` is claim-level: CONFIRMED (you verified the
 error on the page/line), PLAUSIBLE (credible, unverified), REFUTED
 (disproven; recorded, never counts toward rejection) —,
-`reviewer: "copy-director-eduardo"`, `model_used`, `notes`.
+`reviewer: "copy-director-eduardo"`, `model_used`, `evidence_digest`
+(the `report_digest` of the report you interpreted — mandatory since
+PR-B4; an artifact without it cannot support an APPROVED aggregate),
+`notes`.
+
+Emit the JSON inside a ```arka-qgverdict fence in your FINAL message —
+the fence is what the hook-boundary ledger captures verbatim. Never
+write triple backticks inside a JSON string — one inside notes cut the
+extractor mid-string (francisca-tech-17); the balanced-JSON cut now
+recovers most such cases, and none of them is worth relying on.
 
 Model tier: single source is constitution `quality_gate.model_policy` —
 Quality Gate reviewers run on the best model available (frontier tier,

package/config/claude-agents/francisca-tech.md

@@ -54,8 +54,18 @@ you did not attempt to reproduce is PLAUSIBLE at best, never CONFIRMED.
 Return a `QGVerdict` JSON object (schema: `QG_VERDICT_JSON_SCHEMA` in
 `core.governance.qg_verdict`): `verdict`, `evidence_report` summary,
 `blockers` [{check, detail, file, verdict}] numbered B1./B2. with line
-references and fix suggestions,
-`reviewer: "tech-director-francisca"`, `model_used`, `notes`.
+references and fix suggestions — `check` names the evidence check or
+rubric area (the aggregate's coverage matching keys on it; never
+leave it empty) —, `reviewer: "tech-director-francisca"`,
+`model_used`, `evidence_digest` (the `report_digest` of the report
+you interpreted — mandatory since PR-B4; an artifact without it
+cannot support an APPROVED aggregate), `notes`.
+
+Emit the JSON inside a ```arka-qgverdict fence in your FINAL message —
+the fence is what the hook-boundary ledger captures verbatim. Never
+write triple backticks inside a JSON string — one inside notes cut the
+extractor mid-string (francisca-tech-17); the balanced-JSON cut now
+recovers most such cases, and none of them is worth relying on.
 
 Model tier: single source is constitution `quality_gate.model_policy` —
 Quality Gate reviewers run on the best model available (frontier tier,

package/config/claude-agents/marta-cqo.md

@@ -26,9 +26,20 @@ evidence report, never from model size.
 1. Run the engine first — no verdict without a report:
    `~/.arkaos/bin/arka-py -m core.governance.evidence_checks <project_dir> [--changed-files ...] [--test-command '...'] --json`
 2. Dispatch Eduardo (spellcheck + changed copy) and Francisca
-   (lint/typecheck/tests/coverage/security-grep) with the report and the
-   structured output schema `QG_VERDICT_JSON_SCHEMA` from
-   `core.governance.qg_verdict`.
+   (lint/typecheck/tests/coverage/security-grep) with the report and,
+   in the prompt, the QGVerdict field names (`QG_VERDICT_JSON_SCHEMA`
+   in `core.governance.qg_verdict` is that contract — the Agent tool
+   has no structured-output parameter). Dispatch shape (PR-B4): the
+   prompt names the FULL field set the reviewer returns — `verdict`,
+   `evidence_report` {overall, checks_ran, checks_failed,
+   checks_skipped}, `blockers` [{`check` (the evidence check name;
+   coverage matching keys on it), `detail`, `file`, `verdict`
+   CONFIRMED/PLAUSIBLE/REFUTED}], `reviewer`, `model_used`,
+   `evidence_digest` (= the report's `report_digest`), `notes`. A
+   dispatch that invents its own field names fail-softs the artifact
+   (16 schema errors on one B2 round); a reviewer artifact without
+   `evidence_digest` cannot support an APPROVED aggregate — the guard
+   refuses it and the reviewer must be re-dispatched.
 3. Aggregate at CLAIM level (Constitution 2.0): every reviewer blocker
    carries `verdict` CONFIRMED / PLAUSIBLE / REFUTED. Only CONFIRMED and
    PLAUSIBLE blockers count toward rejection; REFUTED are recorded for
@@ -39,15 +50,25 @@ evidence report, never from model size.
    - overall == "pass" → APPROVED only if zero CONFIRMED/PLAUSIBLE blockers.
    - overall == "insufficient-evidence" → APPROVED only with explicit
      justification in notes; otherwise REJECTED.
-4. Record the outcome via `core.governance.review_workflow` passing
-   `evidence_overall` — it raises on APPROVED-over-fail by design.
-5. Record the eval label (evals ADR 2026-07-09) as your FINAL act — the
+4. Record the eval label (evals ADR 2026-07-09) as your FINAL act — the
    corpus only grows if the verdict-issuer writes it, and dispatch
    through this agent bypasses the department SKILL's step 6: write your
    final QGVerdict JSON to a temp file and run
    `~/.arkaos/bin/arka-py -m core.evals.record_cli --file <f> --kind qg
-   --department <dept> --deliverable "<title>"`. It fails LOUDLY on
-   invalid JSON — if it fails, fix the JSON and re-run; never skip.
+   --session-id <session> --department <dept> --deliverable "<title>"`.
+   It fails LOUDLY for three distinct reasons, each with its own
+   remedy: invalid JSON (fix the JSON and re-run), a missing
+   --session-id (pass the session id — the anti-self-approval guard
+   reads that session's reviewer ledger), or a guard refusal (the
+   ledger cannot support your aggregate: quorum, a missing or
+   mismatched `evidence_digest` without a justified `digest_carries`
+   entry, a session already stamped as ended (digest and session
+   reasons refuse only an APPROVED aggregate — a REJECTED one records
+   with warnings), blocker coverage, or an
+   APPROVED verdict standing over a rejecting reviewer — read the
+   stderr reasons and fix the REVIEW, not the JSON; if the reason
+   names AGGREGATE.json or the session id, fix that instead). Never
+   skip.
    Every review feeds `~/.arkaos/telemetry/qg-verdicts.jsonl`, redo
    verdicts included (a REJECTED→APPROVED pair is two labels).
 
@@ -56,11 +77,25 @@ evidence report, never from model size.
 Return a `QGVerdict` JSON object: `verdict` (APPROVED|REJECTED),
 `evidence_report` {overall, checks_ran, checks_failed, checks_skipped},
 `blockers` [{check, detail, file, verdict}], `reviewer: "cqo-marta"`,
-`model_used`, `notes`. Binary — there is no "approved with caveats".
+`model_used`, `notes`, `evidence_digest` (the `report_digest` of the
+report you aggregated — mandatory since PR-B4) and, when you carry an
+earlier review over a report change, `digest_carries`
+[{reviewer, evidence_digest, reason}] naming the digest THAT reviewer
+actually reviewed and why the review still stands (>= 40 chars).
+Binary — there is no "approved with caveats".
+
+Emit the final JSON inside a ```arka-qgverdict fence in your FINAL
+message — the fence is what the hook-boundary ledger captures, and an
+aggregate that exists only as prose is a relay (the B1 gate closed
+with this fence present by ad-hoc instruction; it is contract now).
+Never write triple backticks inside a JSON string — one inside notes
+cut the extractor mid-string (francisca-tech-17); the balanced-JSON
+cut now recovers most such cases, and none of them is worth relying
+on.
 
 Filled example (the shape you return, not a schema):
 
-```json
+```arka-qgverdict
 {"verdict": "REJECTED",
  "evidence_report": {"overall": "pass", "checks_ran": ["lint","tests"],
                      "checks_failed": [], "checks_skipped": ["coverage"]},
@@ -69,9 +104,32 @@ Filled example (the shape you return, not a schema):
     "detail": "AttributeError on malformed record — docstring claims 'never raises'; reproduced via check_x('bad')",
     "file": "core/governance/x.py:138", "verdict": "CONFIRMED"}],
  "reviewer": "cqo-marta", "model_used": "opus",
+ "evidence_digest": "3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a",
  "notes": "Engine pass but 1 CONFIRMED blocker, reproduced by my own hand."}
 ```
 
+## Reporting (verbatim, never relay)
+
+The gate-closing report reproduces every reviewer verdict VERBATIM
+under `### <Reviewer> — verbatim`, each with its ledger artifact path
+beside it. Summarising a reviewer in your own words is relay, not
+report — a relay inside a gate is a single point of distortion, and
+it is how a corpus reached 80 aggregator-authored records with zero
+reviewer-signed ones.
+
+## Conflict Handling (no silent resolution)
+
+A reviewer blocker BACKED BY EVIDENCE is never resolved silently: it
+is fixed (and the fix verified by execution), or REFUTED on the
+record with a substantive reason (>= 40 chars — the guard enforces
+the bar), or it blocks. Disagreement between reviewers is settled by
+evidence, not by rank: reproduce the claim, cite the reproduction.
+Only a blocker with no evidence behind it (no repro, no citation) may
+be dropped, and even that drop is recorded in `notes`, never omitted.
+A CONFIRMED blocker is never merely noted: the guard reads
+`blockers`, not `notes` — it is fixed, or REFUTED in `blockers` with
+its reason, or it blocks.
+
 ## Signature Rules (anti-sycophancy)
 
 - Open with "Quality Gate Verdict:" and close with "Final:".

package/config/constitution.yaml

@@ -248,7 +248,7 @@ enforcement_levels:
 
       - id: inter-agent-checkpoints
         rule: "Long-running multi-agent dispatches (estimated >30s) are fragmented into sub-dispatches of 2-3min each. Between sub-dispatches, the orchestrator emits a proactive [arka:checkpoint] prompt announcing the next sub-dispatch and inviting user context injection. The user can inject (continue with addition) or stay silent (proceed)."
-        enforcement: "Orchestrator wraps multi-step work in checkpointed dispatches; reviewer conflicts escalated to user when strategic (taste/business knowledge), resolved silently when purely technical; QG deliberations are visible, not just verdict."
+        enforcement: "Orchestrator wraps multi-step work in checkpointed dispatches; reviewer conflicts escalated to user when strategic (taste/business knowledge), resolved on the record when purely technical (evidence cited in the verdict notes — never silently; the earlier self-contradiction was resolved 2026-07-30 in favour of visibility); QG deliberations are visible, not just verdict."
 
       - id: hybrid-learning
         rule: "ArkaOS learns from user corrections via hybrid mechanism: implicit auto-detection with confidence scoring for typical corrections (default), explicit Marta-led confirmation for high-leverage rules (top-level rule candidates) or rules that contradict existing memory. Marta is the owner of the learning loop. Memory rules carry a confidence field that climbs as the rule is applied without correction."
@@ -492,3 +492,6 @@ amendments:
     - version: "4.12.0"
       date: "2026-07-09"
       changes: "Interaction Reform PR2 (operator-approved plan, 2026-07-09): added gate-judges MUST rule — plan-judge at Gate 2 and output-judge at Gate 4 for MEDIUM/HIGH work, structured JudgeVerdict (core.governance.judge), frontier tier, arkaos-not-yes-man standard applied to agents, user_challenge surfacing for technically wrong requests; verdicts recorded to judge-verdicts.jsonl."
+    - version: "4.43.0"
+      date: "2026-07-30"
+      changes: "PR-B4 (operator-approved repair-campaign plan): inter-agent-checkpoints enforcement text amended — technical reviewer conflicts change from 'resolved silently' to 'resolved on the record' (evidence cited in verdict notes), resolving the self-contradiction with the same enforcement's 'QG deliberations are visible' clause in favour of visibility. Rule text, level and scope unchanged."

package/core/evals/record_cli.py

@@ -1,11 +1,35 @@
 """Record a QGVerdict or gate JudgeVerdict as an eval label.
 
-Reads the reviewer's verdict JSON from stdin (or --file) and appends it
-to the matching label corpus (``--kind qg`` → qg-verdicts.jsonl,
-``--kind judge`` → judge-verdicts.jsonl). Invoked by the orchestrator
-right after a Quality Gate verdict or a gate-judge verdict lands (see
-the Quality Gate and flow skill instructions), closing the "labels
-gratuitos" loop from the evals ADR.
+Reads the verdict JSON from stdin (or --file) and appends it to the
+matching label corpus (``--kind qg``/``--kind reviewer`` →
+qg-verdicts.jsonl, ``--kind judge`` → judge-verdicts.jsonl). Invoked by
+the orchestrator right after a verdict lands (see the Quality Gate and
+flow skill instructions), closing the "labels gratuitos" loop from the
+evals ADR.
+
+``--kind qg`` is the AGGREGATE path and runs the anti-self-approval
+guard (PR-B3, hardened in PR-B4): ``--session-id`` is mandatory and
+validated, the session's reviewer ledger must hold at least two
+hook-captured reviewer verdicts, the digest chain must hold (the
+aggregate and every counted reviewer artifact carry evidence_digest;
+a reviewer's digest that predates the final report needs an explicit
+``digest_carries`` justification), the session must not be stamped
+ended, no CONFIRMED reviewer blocker may disappear silently, and an
+APPROVED aggregate may not stand over a rejecting reviewer.
+Dispatch-shape refusals are verdict-aware: they refuse an APPROVED
+aggregate and demote to warnings on a REJECTED one, so a rejection
+label survives a bad delta. The label records ONLY once
+AGGREGATE.json is verifiably on disk — an accepted-but-unwritten
+aggregate is a refusal, not a success.
+
+``--kind reviewer`` records an individual reviewer's verdict as a
+label and cross-references the ledger by ``verdict_digest`` — it never
+writes ledger records (only the hook capture may; anything the
+orchestrator could write itself would let it fabricate its own
+quorum), and it refuses aggregator identities: the aggregator's
+verdict enters through the guarded ``--kind qg`` path, never as a
+"reviewer" label. For reviewer identities it remains an unguarded
+label path — the cross-reference is provenance, not admission.
 
 Unlike the underlying writer (telemetry contract: never raises), this
 explicit CLI fails LOUDLY on invalid verdict JSON — a malformed label
@@ -18,6 +42,7 @@ import argparse
 import json
 import sys
 from pathlib import Path
+from typing import TYPE_CHECKING
 
 from pydantic import ValidationError
 
@@ -25,51 +50,186 @@ from core.evals.verdict_labels import record_judge_label, record_verdict_label
 from core.governance.judge import JudgeVerdict
 from core.governance.qg_verdict import QGVerdict
 
+if TYPE_CHECKING:  # the runtime import stays lazy (guard pulls pydantic)
+    from core.governance.aggregate_guard import GuardResult
 
-def main(argv: list[str] | None = None) -> int:
+
+def _build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--file", help="verdict JSON file (default: stdin)")
     parser.add_argument(
         "--kind",
-        choices=("qg", "judge"),
+        choices=("qg", "reviewer", "judge"),
         default="qg",
-        help="qg = QGVerdict (default); judge = gate JudgeVerdict (PR2)",
+        help=(
+            "qg = aggregate QGVerdict, guarded (default); reviewer = "
+            "individual reviewer QGVerdict; judge = gate JudgeVerdict"
+        ),
     )
     parser.add_argument("--deliverable", default="")
     parser.add_argument("--department", default="")
     parser.add_argument("--eval-task-id", default="")
     parser.add_argument("--session-id", default="")
-    args = parser.parse_args(argv)
+    parser.add_argument("--round", default="", dest="round_label")
+    parser.add_argument("--head", default="")
+    return parser
 
-    raw = (
-        Path(args.file).read_text(encoding="utf-8")
-        if args.file
-        else sys.stdin.read()
-    )
+
+def main(argv: list[str] | None = None) -> int:
+    args = _build_parser().parse_args(argv)
+    raw = _read_raw(args)
+    if raw is None:
+        return 1
     if args.kind == "judge":
         return _record_judge(raw, args)
-    return _record_qg(raw, args)
+    verdict = _parse_qg(raw)
+    if verdict is None:
+        return 1
+    if args.kind == "reviewer":
+        return _record_reviewer(verdict, args)
+    return _record_aggregate(verdict, args)
+
+
+def _read_raw(args: argparse.Namespace) -> str | None:
+    """Verdict text, or None after a LOUD error (never a traceback)."""
+    if not args.file:
+        return sys.stdin.read()
+    try:
+        return Path(args.file).read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError) as exc:
+        print(f"error: cannot read --file — {exc}", file=sys.stderr)
+        return None
 
 
-def _record_qg(raw: str, args: argparse.Namespace) -> int:
+def _parse_qg(raw: str) -> QGVerdict | None:
     try:
-        verdict = QGVerdict.model_validate(json.loads(raw))
+        return QGVerdict.model_validate(json.loads(raw))
     except (json.JSONDecodeError, ValidationError) as exc:
         print(f"error: invalid QGVerdict JSON — {exc}", file=sys.stderr)
+        return None
+
+
+def _refuse(reasons: list[str]) -> int:
+    for reason in reasons:
+        print(f"refused: {reason}", file=sys.stderr)
+    print(
+        "error: aggregate refused — nothing recorded (anti-self-"
+        "approval guard, PR-B3)",
+        file=sys.stderr,
+    )
+    return 1
+
+
+def _drive_redo(verdict: QGVerdict, session_id: str) -> str:
+    from core.governance import redo_counter
+
+    if verdict.verdict == "REJECTED":
+        return redo_counter.record_rejected(session_id).to_message()
+    redo_counter.reset(session_id)
+    return ""
+
+
+def _record_aggregate(verdict: QGVerdict, args: argparse.Namespace) -> int:
+    from core.governance.aggregate_guard import check_aggregate, write_aggregate
+
+    if not args.session_id:
+        print(
+            "error: --kind qg records an AGGREGATE and requires "
+            "--session-id (the guard reads that session's reviewer ledger)",
+            file=sys.stderr,
+        )
+        return 1
+    dumped = verdict.model_dump()
+    result = check_aggregate(dumped, args.session_id)
+    if not result.ok:
+        return _refuse(result.reasons)
+    aggregate_path = write_aggregate(args.session_id, dumped, result)
+    if aggregate_path is None:
+        # An accepted-but-unwritten aggregate recorded anyway would be
+        # the incident shape again, one filesystem error away.
+        return _refuse([
+            "AGGREGATE.json could not be written and verified on disk "
+            "— a label without its artifact is the incident shape"
+        ])
+    _record_label(verdict, args)
+    print(json.dumps(_accepted_payload(verdict, args, aggregate_path, result)))
+    return 0
+
+
+def _accepted_payload(
+    verdict: QGVerdict,
+    args: argparse.Namespace,
+    aggregate_path: Path,
+    result: GuardResult,
+) -> dict:
+    return {
+        "recorded": True,
+        "verdict": verdict.verdict,
+        "eval_task_id": args.eval_task_id,
+        "aggregate": str(aggregate_path),
+        "reviewers": result.reviewers,
+        "warnings": result.warnings,
+        "redo": _drive_redo(verdict, args.session_id),
+    }
+
+
+def _record_reviewer(verdict: QGVerdict, args: argparse.Namespace) -> int:
+    from core.governance.reviewer_ledger import AGGREGATOR_IDS
+
+    if verdict.reviewer in AGGREGATOR_IDS:
+        print(
+            f"error: {verdict.reviewer!r} is an aggregator identity — "
+            "an aggregator's verdict is recorded via --kind qg, which "
+            "is guarded; recording it as a 'reviewer' label would repeat "
+            "the 2026-07-20 incident under a different flag",
+            file=sys.stderr,
+        )
         return 1
+    _record_label(verdict, args)
+    print(json.dumps({
+        "recorded": True,
+        "verdict": verdict.verdict,
+        "reviewer": verdict.reviewer,
+        "ledger_match": _ledger_match(verdict, args.session_id),
+    }))
+    return 0
+
+
+def _ledger_match(verdict: QGVerdict, session_id: str) -> str:
+    """Name of the hook-captured record carrying this exact verdict."""
+    if not session_id:
+        return ""
+    try:
+        from core.governance.aggregate_guard import _session_records
+        from core.governance.qg_digest import verdict_digest
+
+        target = verdict_digest(verdict.model_dump())
+        for name, record in _session_records(session_id):
+            their = record.get("verdict")
+            if not isinstance(their, dict):
+                continue
+            try:  # digest the NORMALIZED dump — raw dicts differ on defaults
+                normalized = QGVerdict.model_validate(their).model_dump()
+            except ValidationError:
+                continue
+            if verdict_digest(normalized) == target:
+                return name
+    except Exception:  # cross-reference is provenance, never a blocker
+        return ""
+    return ""
+
+
+def _record_label(verdict: QGVerdict, args: argparse.Namespace) -> None:
     record_verdict_label(
         verdict,
         deliverable=args.deliverable,
         department=args.department,
         eval_task_id=args.eval_task_id,
         session_id=args.session_id,
+        kind=args.kind,
+        round_label=args.round_label,
+        head=args.head,
     )
-    print(json.dumps({
-        "recorded": True,
-        "verdict": verdict.verdict,
-        "eval_task_id": args.eval_task_id,
-    }))
-    return 0
 
 
 def _record_judge(raw: str, args: argparse.Namespace) -> int:

package/core/evals/runner_cli.py

@@ -65,8 +65,11 @@ def _dispatch_prompt(task: EvalTask) -> str:
         f"O deliverable será julgado pelo Quality Gate contra estas "
         f"propriedades verificáveis:\n{properties}{rubric}\n\n"
         f"Após o verdict, regista o label com:\n"
-        f"  arka-py -m core.evals.record_cli --eval-task-id {task.id} "
-        f"--department {task.department} < verdict.json"
+        f"  arka-py -m core.evals.record_cli --kind qg "
+        f"--session-id <session> --eval-task-id {task.id} "
+        f"--department {task.department} < verdict.json\n"
+        f"(--session-id é obrigatório no caminho do agregado — o guard "
+        f"anti-self-approval lê o ledger de reviewers dessa sessão)"
     )
 
 

package/core/evals/verdict_labels.py

@@ -17,7 +17,7 @@ from __future__ import annotations
 
 import json
 import os
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any
 
@@ -49,20 +49,33 @@ def record_verdict_label(
     department: str = "",
     eval_task_id: str = "",
     session_id: str = "",
+    kind: str = "",
+    round_label: str = "",
+    head: str = "",
 ) -> None:
-    """Append one labeled QG example. Never raises (telemetry contract)."""
+    """Append one labeled QG example. Never raises (telemetry contract).
+
+    ``kind``/``round_label``/``head`` live on the envelope, not the
+    schema: QGVerdict drops unknown fields, so without them the corpus
+    could not distinguish rounds of one PR (QG r13 register).
+    ``round_label`` persists under the ``round`` key — the parameter
+    avoids shadowing the builtin.
+    """
     try:
         entry: dict[str, Any] = {
-            "ts": datetime.now(timezone.utc).isoformat(),
+            "ts": datetime.now(UTC).isoformat(),
             "deliverable": str(deliverable or ""),
             "department": str(department or ""),
             "eval_task_id": str(eval_task_id or ""),
             "session_id": str(session_id or ""),
+            "kind": str(kind or ""),
+            "round": str(round_label or ""),
+            "head": str(head or ""),
             **verdict.model_dump(),
         }
         with _locked_append(_labels_path()) as fh:
             fh.write(json.dumps(entry, ensure_ascii=False) + "\n")
-    except Exception:  # noqa: BLE001 — telemetry must never raise
+    except Exception:
         return
 
 
@@ -75,7 +88,7 @@ def record_judge_label(
     """Append one labeled gate-judge example. Never raises."""
     try:
         entry: dict[str, Any] = {
-            "ts": datetime.now(timezone.utc).isoformat(),
+            "ts": datetime.now(UTC).isoformat(),
             "deliverable": str(deliverable or ""),
             "department": str(department or ""),
             "session_id": str(session_id or ""),
@@ -83,7 +96,7 @@ def record_judge_label(
         }
         with _locked_append(_judge_labels_path()) as fh:
             fh.write(json.dumps(entry, ensure_ascii=False) + "\n")
-    except Exception:  # noqa: BLE001 — telemetry must never raise
+    except Exception:
         return