brainclaw 1.26.2 → 1.27.0

package/dist/core/loops/reconcile-turn.js

@@ -1,15 +1,22 @@
+import fs from 'node:fs';
 import path from 'node:path';
-import { getReservation, evidenceMatchesAttempt, currentNonce, deriveTurnId, launchGrant } from './attempt-reservation.js';
+import { getReservation, evidenceMatchesAttempt, currentNonce, launchGrant, resolveTurnId } from './attempt-reservation.js';
 import { getLoop } from './store.js';
-import { complete_turn, add_artifact, advance } from './verbs.js';
+import { completeTurnWithEvidence, addArtifactWithEvidence, complete_turn, advance } from './verbs.js';
 import { reducerForKind } from './result-reducers.js';
-import { loadAgentRun, transitionAgentRun } from '../agentruns.js';
+import { loadAgentRun, recordExecutionContractAnomaly, transitionAgentRun } from '../agentruns.js';
 import { loadAssignment, transitionAssignment } from '../assignments.js';
 import { loadClaim, releaseClaim, releaseClaimIfActive } from '../claims.js';
 import { createRuntimeEvent } from '../events.js';
-import { readCompletionSignals } from '../runtime-signals.js';
+import { readCompletionSignals, readContractAck } from '../runtime-signals.js';
 import { buildFixCycleTask } from '../review-loop-close.js';
 import { withLoopLock, LockTimeoutError, LockLostError } from './lock.js';
+import { validateWorkerContractAcceptance } from '../execution-contract.js';
+import { evidenceDigest } from './evidence.js';
+import { executionContractForGeneration, settleActiveAttemptGenerationV2 } from './attempt-authority.js';
+import { fenceForGeneration, resolveTurnGenerationChain } from './attempt-generations.js';
+import { readLocalAuthorityHome } from './attempt-rollout.js';
+import { LaneResultSchema } from '../schema.js';
 // The terminal loop statuses (LOOP_STATUSES = open|paused|completed|blocked|cancelled).
 // 'blocked' is LOAD-BEARING (pln#630 PR3b): the iteration cap closes a fix cycle to
 // `blocked`, and a blocked loop must be treated as terminal both by the idempotent
@@ -88,9 +95,35 @@ export function reconcileTurn(input) {
     if (!sameStore) {
         return { reconciled: false, reason: `containment: reservation store_root ${reservation.store_root} != operating store ${operatingRoot}` };
     }
+    const resolvedGeneration = resolveTurnGenerationChain(cwd ?? reservation.store_root, reservation.turn_id);
+    const activeGeneration = resolvedGeneration && (resolvedGeneration.status === 'active' || resolvedGeneration.status === 'settled')
+        ? resolvedGeneration.latest_generation
+        : undefined;
+    const activeRunId = activeGeneration?.run_id ?? reservation.child_ids.run_id;
+    const activeContractRef = activeGeneration
+        ? executionContractForGeneration(reservation, activeGeneration).ref
+        : reservation.execution_contract_ref;
+    const activeLaunchStatus = activeGeneration ? 'crossed' : reservation.launch?.status;
+    const owningRun = loadAgentRun(activeRunId, cwd);
+    if (owningRun?.execution_contract_anomaly) {
+        return {
+            reconciled: false,
+            contract_anomaly: true,
+            respawn: false,
+            reason: `persisted post-crossing execution-contract anomaly (${owningRun.execution_contract_anomaly.source}) — convergence withheld; respawn=false`,
+        };
+    }
     // ── §2 read-strict evidence gate: the LANE must be turn-keyed to THIS attempt's
     // current launch generation. A stale/mismatched result never converges the loop. ──
-    if (!evidenceMatchesAttempt(reservation, { turn_id: lane.turn_id, run_id: lane.run_id, nonce: lane.nonce })) {
+    if (!evidenceMatchesAttempt(reservation, {
+        assignment_id: lane.assignment_id,
+        turn_id: lane.turn_id,
+        run_id: lane.run_id,
+        nonce: lane.nonce,
+        attempt_epoch: lane.attempt_epoch,
+        contract_hash: lane.execution_contract_hash,
+        workspace_digest: lane.workspace_digest,
+    })) {
         const nonce = currentNonce(reservation);
         return {
             reconciled: false,
@@ -99,6 +132,65 @@ export function reconcileTurn(input) {
                 : `lane evidence (turn=${lane.turn_id} run=${lane.run_id} nonce=${lane.nonce}) does not match attempt ${turn_id}`,
         };
     }
+    if (activeContractRef) {
+        const completion = readCompletionSignals(cwd ?? process.cwd(), reservation.child_ids.assignment_id, activeGeneration?.run_id).completed;
+        const bootstrapAck = readContractAck(cwd ?? process.cwd(), reservation.child_ids.assignment_id, activeGeneration?.run_id);
+        const accepted = {
+            contract_hash: lane.execution_contract_hash ?? completion?.contract_hash ?? '',
+            capability_snapshot_hash: lane.capability_snapshot_hash ?? completion?.capability_snapshot_hash ?? '',
+        };
+        const bootstrapVerdict = bootstrapAck?.status === 'accepted'
+            && bootstrapAck.turn_id === reservation.turn_id
+            && bootstrapAck.run_id === activeRunId
+            && bootstrapAck.nonce === (activeGeneration?.launch_nonce ?? reservation.launch?.token)
+            && (!activeGeneration
+                || bootstrapAck.cwd === normalizedWorkspace(activeGeneration.workspace_path))
+            && (!activeGeneration || (bootstrapAck.attempt_epoch === activeGeneration.attempt_epoch
+                && bootstrapAck.workspace_digest === activeGeneration.workspace_digest))
+            ? validateWorkerContractAcceptance(activeContractRef, {
+                contract_hash: bootstrapAck.contract_hash,
+                capability_snapshot_hash: bootstrapAck.capability_snapshot_hash,
+            }, activeLaunchStatus)
+            : undefined;
+        const terminalVerdict = validateWorkerContractAcceptance(activeContractRef, accepted, activeLaunchStatus);
+        if (bootstrapVerdict?.kind !== 'accepted' || terminalVerdict.kind !== 'accepted') {
+            try {
+                recordExecutionContractAnomaly(activeRunId, {
+                    source: bootstrapVerdict?.kind !== 'accepted'
+                        ? 'bootstrap_ack'
+                        : lane.execution_contract_hash ? 'lane_result' : 'completion_signal',
+                    reason: bootstrapVerdict?.kind !== 'accepted'
+                        ? 'bootstrap did not accept the immutable execution contract'
+                        : 'terminal evidence did not match the immutable execution contract',
+                    accepted_contract_hash: bootstrapVerdict?.kind !== 'accepted'
+                        ? bootstrapAck?.contract_hash
+                        : accepted.contract_hash,
+                    accepted_capability_snapshot_hash: bootstrapVerdict?.kind !== 'accepted'
+                        ? bootstrapAck?.capability_snapshot_hash
+                        : accepted.capability_snapshot_hash,
+                }, cwd);
+            }
+            catch { /* ack/sentinel remains a durable fallback fence */ }
+            try {
+                createRuntimeEvent({
+                    agent: actor,
+                    event_type: 'run_blocked',
+                    text: `reconcileTurn: post-crossing execution-contract acceptance anomaly for ${turn_id}; convergence WITHHELD and respawn=false`,
+                    tags: ['loops', 'reconcile', 'contract-anomaly', 'turn-attempt'],
+                    assignment_id: reservation.child_ids.assignment_id,
+                    run_id: activeRunId,
+                    status_reason: 'execution_contract_acceptance_mismatch',
+                }, cwd);
+            }
+            catch { /* anomaly journal best-effort */ }
+            return {
+                reconciled: false,
+                contract_anomaly: true,
+                respawn: false,
+                reason: 'post-crossing execution-contract acceptance mismatch or missing hash — convergence withheld; respawn=false',
+            };
+        }
+    }
     // ── §13 R4 contradiction: a turn-keyed FAILED sentinel present alongside a
     // completed result (the lane or a completed sentinel) → WITHHOLD convergence,
     // journal a conflict (never silently accept). Compared against the LANE's
@@ -106,9 +198,15 @@ export function reconcileTurn(input) {
     // LANE-RESULT then exited non-zero (turn-keyed failed sentinel) is a conflict,
     // not a clean close. ──
     try {
-        const bodies = readCompletionSignals(cwd ?? process.cwd(), reservation.child_ids.assignment_id);
-        const matchedCompleted = bodies.completed?.status === 'completed' && evidenceMatchesAttempt(reservation, bodies.completed);
-        const matchedFailed = bodies.failed?.status === 'failed' && evidenceMatchesAttempt(reservation, bodies.failed);
+        const bodies = readCompletionSignals(cwd ?? process.cwd(), reservation.child_ids.assignment_id, activeGeneration?.run_id);
+        const matchedCompleted = bodies.completed?.status === 'completed' && evidenceMatchesAttempt(reservation, {
+            assignment_id: reservation.child_ids.assignment_id,
+            ...bodies.completed,
+        });
+        const matchedFailed = bodies.failed?.status === 'failed' && evidenceMatchesAttempt(reservation, {
+            assignment_id: reservation.child_ids.assignment_id,
+            ...bodies.failed,
+        });
         if (matchedFailed && (matchedCompleted || lane.status === 'completed')) {
             try {
                 createRuntimeEvent({
@@ -117,7 +215,7 @@ export function reconcileTurn(input) {
                     text: `reconcileTurn: turn ${turn_id} has a completed(lane/sentinel)+failed(sentinel) contradiction — auto-stop WITHHELD (§13 R4), escalating to human`,
                     tags: ['loops', 'reconcile', 'conflict', 'turn-attempt'],
                     assignment_id: reservation.child_ids.assignment_id,
-                    run_id: reservation.child_ids.run_id,
+                    run_id: activeRunId,
                     status_reason: 'turn_evidence_contradiction',
                 }, cwd);
             }
@@ -156,7 +254,8 @@ export function reconcileTurn(input) {
  * version (plus the terminal-early-return claim release, review Finding 2).
  */
 function convergeLockedTurn(reservation, input, actor, cwd) {
-    const { turn_id, lane } = input;
+    const { turn_id } = input;
+    let lane = input.lane;
     const loop = getLoop(reservation.loop_id, cwd);
     if (!loop)
         return { reconciled: false, reason: `loop ${reservation.loop_id} not found` };
@@ -175,6 +274,57 @@ function convergeLockedTurn(reservation, input, actor, cwd) {
     if (slot.current_turn_id !== undefined && slot.current_turn_id !== turn_id) {
         return { reconciled: false, reason: `turn ${turn_id} superseded by current turn ${slot.current_turn_id} on slot ${slot.slot_id}` };
     }
+    // AttemptAuthority v2 TOCTOU closure: repeat the FULL evidence/fence check
+    // while holding the loop lock, then let settlement and takeover contend on
+    // the same immutable close(epoch) cell. If takeover won after the optimistic
+    // pre-check, settlement observes it here and performs no loop mutation.
+    const generationState = resolveTurnGenerationChain(cwd ?? reservation.store_root, reservation.turn_id);
+    if (generationState) {
+        if (!evidenceMatchesAttempt(reservation, {
+            assignment_id: lane.assignment_id,
+            turn_id: lane.turn_id,
+            run_id: lane.run_id,
+            nonce: lane.nonce,
+            attempt_epoch: lane.attempt_epoch,
+            contract_hash: lane.execution_contract_hash,
+            workspace_digest: lane.workspace_digest,
+        })) {
+            return { reconciled: false, reason: 'attempt generation changed before commit — stale evidence fenced' };
+        }
+        const generation = generationState.latest_generation;
+        const localAuthorityHome = readLocalAuthorityHome(cwd ?? reservation.store_root);
+        if (!localAuthorityHome) {
+            return { reconciled: false, reason: 'AttemptAuthority v2 settlement requires the activated local authority_home' };
+        }
+        const settlement = settleActiveAttemptGenerationV2(turn_id, fenceForGeneration(generation), lane, localAuthorityHome, actor, loop.created_by, cwd ?? reservation.store_root);
+        if (!settlement || settlement.cell.decision !== 'settled') {
+            return {
+                reconciled: false,
+                reason: `settlement lost close(${generation.attempt_epoch}) to ${settlement?.cell.decision ?? 'unknown'} — evidence is audit-only`,
+            };
+        }
+        lane = LaneResultSchema.parse(settlement.evidence.result);
+    }
+    const acceptedGeneration = generationState?.latest_generation;
+    const acceptedRunId = acceptedGeneration?.run_id ?? reservation.child_ids.run_id;
+    const acceptedNonce = acceptedGeneration?.launch_nonce ?? reservation.launch?.token;
+    const acceptedEpoch = acceptedGeneration?.attempt_epoch ?? reservation.epoch;
+    const acceptedContractHash = acceptedGeneration?.contract_hash
+        ?? reservation.execution_contract_ref?.hash
+        ?? evidenceDigest({
+            version: 'legacy-uncontracted-reservation-v1',
+            turn_id: reservation.turn_id,
+            run_id: reservation.child_ids.run_id,
+            epoch: reservation.epoch,
+            phase: reservation.phase,
+            iteration: reservation.iteration,
+            cwd: reservation.cwd,
+        });
+    const acceptedWorkspaceDigest = acceptedGeneration?.workspace_digest ?? evidenceDigest({
+        workspace_policy: reservation.execution_contract?.workspace_policy,
+        cwd: reservation.cwd,
+        store_root: reservation.store_root,
+    });
     // A terminal loop already converged → idempotent no-op (any trigger may fire us). Still
     // release the claim (review Finding 2): a cap-blocked loop that crashed AFTER the block
     // transition but BEFORE its own deferred release would otherwise leak the retained claim
@@ -210,17 +360,66 @@ function convergeLockedTurn(reservation, input, actor, cwd) {
             const [primary, ...extras] = reduced.artifacts;
             for (const a of extras) {
                 try {
-                    add_artifact({ id: loop.id, actor, artifact: { phase: a.phase, type: a.type, body: a.body, produced_by: a.produced_by } }, cwd);
+                    addArtifactWithEvidence({
+                        id: loop.id,
+                        actor,
+                        evidence_context: {
+                            channel: 'reconcile_turn',
+                            producer_kind: 'slot',
+                            producer_id: reservation.agent,
+                            agent_id: reservation.agent_id,
+                            slot_id: slot.slot_id,
+                            slot_role: slot.role,
+                            turn_id,
+                            assignment_id: reservation.child_ids.assignment_id,
+                            claim_id: reservation.claim_id,
+                            run_id: acceptedRunId,
+                            nonce: acceptedNonce,
+                            attempt_epoch: acceptedEpoch,
+                            execution_contract_hash: acceptedContractHash,
+                            workspace_digest: acceptedWorkspaceDigest,
+                        },
+                        artifact: {
+                            phase: a.phase,
+                            type: a.type,
+                            body: a.body,
+                            produced_by: a.produced_by,
+                            addresses_critique: a.addresses_critique,
+                        },
+                    }, cwd);
                 }
                 catch { /* an extra artifact failing must not abort convergence */ }
             }
-            complete_turn({
+            completeTurnWithEvidence({
                 id: loop.id,
                 slot_id: slot.slot_id,
                 actor,
+                evidence_context: {
+                    channel: 'reconcile_turn',
+                    producer_kind: 'slot',
+                    producer_id: reservation.agent,
+                    agent_id: reservation.agent_id,
+                    slot_id: slot.slot_id,
+                    slot_role: slot.role,
+                    turn_id,
+                    assignment_id: reservation.child_ids.assignment_id,
+                    claim_id: reservation.claim_id,
+                    run_id: acceptedRunId,
+                    nonce: acceptedNonce,
+                    attempt_epoch: acceptedEpoch,
+                    execution_contract_hash: acceptedContractHash,
+                    workspace_digest: acceptedWorkspaceDigest,
+                },
                 outcome: reduced.slot_outcome,
                 failure_reason: reduced.failure_reason,
-                ...(primary ? { artifact: { phase: primary.phase, type: primary.type, body: primary.body } } : {}),
+                ...(primary ? {
+                    artifact: {
+                        phase: primary.phase,
+                        type: primary.type,
+                        body: primary.body,
+                        addresses_critique: primary.addresses_critique,
+                    },
+                } : {}),
             }, cwd);
         }
         catch (err) {
@@ -235,7 +434,9 @@ function convergeLockedTurn(reservation, input, actor, cwd) {
                 text: `reconcileTurn: harvested turn ${turn_id} on slot ${slot.slot_id} → loop ${loop.id} (${slot_outcome}, ${artifacts_added} artifact(s), phase ${reservation.phase})`,
                 tags: ['loops', 'reconcile', 'harvest', 'turn-attempt'],
                 assignment_id: reservation.child_ids.assignment_id,
-                run_id: reservation.child_ids.run_id,
+                run_id: acceptedRunId,
+                attempt_epoch: acceptedGeneration?.attempt_epoch,
+                workspace_digest: acceptedGeneration?.workspace_digest,
                 status_reason: `harvested_${slot_outcome}`,
             }, cwd);
         }
@@ -248,7 +449,7 @@ function convergeLockedTurn(reservation, input, actor, cwd) {
     // can RETAIN the claim/worktree. Run + assignment settle unconditionally on both paths
     // (a crash that recorded the turn but not the settle still converges on replay; the
     // fix-cycle re-dispatch mints a fresh run/assignment, so completing the old is correct). ──
-    settleRunCompleted(reservation.child_ids.run_id, actor, cwd);
+    settleRunCompleted(acceptedRunId, actor, cwd);
     settleAssignment(reservation.child_ids.assignment_id, actor, cwd);
     // ── Advance / stop decision. On a `done` outcome we either drive a deterministic stop
     // (reviewer_green / gate → close), continue a symmetric fix cycle (bump the round + retain
@@ -276,7 +477,7 @@ function convergeLockedTurn(reservation, input, actor, cwd) {
             loop.protocol?.review_mode === 'symmetric';
         if (symmetricRC) {
             // EXACTLY-ONCE bump (the one non-negotiable safety guard): each bump changes
-            // deriveTurnId(loop, slot, iteration), so a DOUBLE bump would mint two turn_ids and
+            // resolveTurnId(loop, slot, phase, iteration), so a DOUBLE bump would mint two turn_ids and
             // the launch fence would spawn BOTH rounds. Bump only when this turn's round is still
             // current; a re-reconcile after the bump takes the else-branch (no re-bump, no re-emit).
             if (loop.iteration_count === reservation.iteration) {
@@ -308,7 +509,14 @@ function convergeLockedTurn(reservation, input, actor, cwd) {
                     // (reserved_never_launched — crash between arm and consume + the expiry sweep) or an
                     // absent reservation is a STRAND (dec#149 R1): re-emit to self-heal. The re-dispatch's
                     // prepare re-arms a revoked grant at a higher epoch, so this round can actually relaunch.
-                    const bumpedTurnId = deriveTurnId(loop.id, slot.slot_id, cur.iteration_count);
+                    const currentSlot = cur.slots.find((candidate) => candidate.slot_id === slot.slot_id);
+                    const bumpedTurnId = resolveTurnId({
+                        loop_id: loop.id,
+                        slot_id: slot.slot_id,
+                        phase: cur.current_phase,
+                        iteration: cur.iteration_count,
+                        current_turn_id: currentSlot?.current_turn_id,
+                    }, cwd);
                     const bumpedGrant = launchGrant(bumpedTurnId, cwd);
                     const bumpedLive = getReservation(bumpedTurnId, cwd) !== undefined &&
                         (bumpedGrant?.status === 'armed' || bumpedGrant?.status === 'crossed');
@@ -321,7 +529,7 @@ function convergeLockedTurn(reservation, input, actor, cwd) {
                                 text: `reconcileTurn: fix-cycle round ${cur.iteration_count} of loop ${loop.id} was bumped but never dispatched (turn ${turn_id} strand) — re-emitting next_turn to self-heal`,
                                 tags: ['loops', 'reconcile', 'turn-owned', 'strand-recovery'],
                                 assignment_id: reservation.child_ids.assignment_id,
-                                run_id: reservation.child_ids.run_id,
+                                run_id: acceptedRunId,
                                 status_reason: 'fix_cycle_strand_reemit',
                             }, cwd);
                         }
@@ -366,6 +574,15 @@ function convergeLockedTurn(reservation, input, actor, cwd) {
         ...(next_turn ? { next_turn } : {}),
     };
 }
+function normalizedWorkspace(value) {
+    try {
+        const resolved = fs.realpathSync.native(value);
+        return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Converge a TURN-OWNED lane whose worker died at the TRANSPORT level (no lane
  * result will ever arrive). dec#151, operator-decided option (b): the lane's

package/dist/core/loops/result-reducers.js

@@ -26,6 +26,22 @@ export const reviewReducer = (input, attempt) => {
     if (lane.status !== 'completed') {
         return { artifacts: [], slot_outcome: 'failed', failure_reason: `review lane status is ${lane.status}, not completed` };
     }
+    if (phase === 'author_response') {
+        if (lane.artifact_type !== 'author_response') {
+            return { artifacts: [], slot_outcome: 'failed', failure_reason: "review author_response requires artifact_type 'author_response'" };
+        }
+        const response = (lane.body ?? '').trim();
+        if (!response) {
+            return { artifacts: [], slot_outcome: 'failed', failure_reason: 'review author_response produced no body' };
+        }
+        return {
+            artifacts: [{ phase, type: 'author_response', body: capBody(response), produced_by: attempt.agent }],
+            slot_outcome: 'done',
+        };
+    }
+    if (phase !== 'findings' && phase !== 'followup_review') {
+        return { artifacts: [], slot_outcome: 'failed', failure_reason: `review phase '${phase}' has no worker-result contract` };
+    }
     if (!lane.review_verdict) {
         return { artifacts: [], slot_outcome: 'failed', failure_reason: 'review lane completed without a review_verdict — cannot converge the loop' };
     }
@@ -39,7 +55,7 @@ export const reviewReducer = (input, attempt) => {
     };
 };
 /**
- * ideation reducer (§6). A `critique_batch` → N `critique` artifacts (so
+ * ideation reducer (§6). An explicitly typed critique → `critique` artifacts (so
  * `min_artifacts_by_type` can open the next phase). A bare summary with no
  * critique body → slot `failed`, gate stays shut (correct: no fake progress from
  * a lane that produced no critiques).
@@ -49,8 +65,38 @@ export const ideationReducer = (input, attempt) => {
     if (lane.status !== 'completed') {
         return { artifacts: [], slot_outcome: 'failed', failure_reason: `ideation lane status is ${lane.status}, not completed` };
     }
+    if (phase !== 'critique') {
+        const artifactType = phase === 'proposal' ? 'proposal' : phase === 'revision' ? 'revision' : phase === 'synthesis' ? 'plan_draft' : undefined;
+        if (!artifactType) {
+            return { artifacts: [], slot_outcome: 'failed', failure_reason: `ideation phase '${phase}' has no result contract` };
+        }
+        if (lane.artifact_type !== artifactType) {
+            return { artifacts: [], slot_outcome: 'failed', failure_reason: `ideation phase '${phase}' expected artifact_type '${artifactType}', got '${lane.artifact_type}'` };
+        }
+        const body = (lane.body ?? lane.summary).trim();
+        if (!body)
+            return { artifacts: [], slot_outcome: 'failed', failure_reason: `ideation ${phase} produced no body` };
+        if (artifactType === 'plan_draft') {
+            const addresses = [
+                ...(lane.artifacts ?? []).filter((id) => /^art_[0-9a-z]+$/.test(id)),
+                ...(critiques ?? []).flatMap((c) => c.addresses_critique ?? []),
+            ];
+            const uniqueAddresses = [...new Set(addresses)];
+            if (uniqueAddresses.length === 0) {
+                return { artifacts: [], slot_outcome: 'failed', failure_reason: 'ideation synthesis must cite critique artifact ids in lane.artifacts' };
+            }
+            return {
+                artifacts: [{ phase, type: artifactType, body: capBody(body), produced_by: attempt.agent, addresses_critique: uniqueAddresses }],
+                slot_outcome: 'done',
+            };
+        }
+        return { artifacts: [{ phase, type: artifactType, body: capBody(body), produced_by: attempt.agent }], slot_outcome: 'done' };
+    }
+    if (lane.artifact_type !== 'critique') {
+        return { artifacts: [], slot_outcome: 'failed', failure_reason: "ideation critique requires artifact_type 'critique'" };
+    }
     if (!critiques || critiques.length === 0) {
-        return { artifacts: [], slot_outcome: 'failed', failure_reason: 'ideation lane produced no critiques (bare summary) — gate stays shut' };
+        return { artifacts: [], slot_outcome: 'failed', failure_reason: 'ideation critique lane produced no critiques (bare summary) — gate stays shut' };
     }
     return {
         artifacts: critiques.map((c) => ({
@@ -61,11 +107,9 @@ export const ideationReducer = (input, attempt) => {
     };
 };
 /**
- * Default reducer for loop kinds without a specialized one (implementation /
- * research / debug / bootstrap): a completed lane → one generic `lane_result`
- * artifact carrying the summary; a non-completed lane → slot failed. Keeps
- * convergence sensible without fabricating structured artifacts a kind never
- * declared.
+ * Explicit legacy helper retained for callers/tests that intentionally want a
+ * generic lane_result. The exhaustive LoopKind registry below never falls back
+ * to it: every shipped kind has a phase-aware reducer.
  */
 export const defaultReducer = (input, attempt) => {
     const { lane, phase } = input;
@@ -77,12 +121,57 @@ export const defaultReducer = (input, attempt) => {
         slot_outcome: 'done',
     };
 };
-const RESULT_REDUCERS = {
+function typedPhaseReducer(kind, artifactByPhase) {
+    return (input, attempt) => {
+        const { lane, phase } = input;
+        if (lane.status !== 'completed') {
+            return { artifacts: [], slot_outcome: 'failed', failure_reason: `${kind} lane status is ${lane.status}, not completed` };
+        }
+        const expectedType = artifactByPhase[phase];
+        if (!expectedType) {
+            return { artifacts: [], slot_outcome: 'failed', failure_reason: `${kind} phase '${phase}' has no worker-result contract` };
+        }
+        if (lane.artifact_type !== expectedType) {
+            return {
+                artifacts: [],
+                slot_outcome: 'failed',
+                failure_reason: `${kind} phase '${phase}' expected artifact_type '${expectedType}', got '${lane.artifact_type}'`,
+            };
+        }
+        // Every worker artifact is explicitly attested. In particular a narrative
+        // summary can never masquerade as a gate-driving repro or verify report.
+        const body = (lane.body ?? lane.summary).trim();
+        if (!body) {
+            return { artifacts: [], slot_outcome: 'failed', failure_reason: `${kind} phase '${phase}' produced no artifact body` };
+        }
+        return {
+            artifacts: [{ phase, type: expectedType, body: capBody(body), produced_by: attempt.agent }],
+            slot_outcome: 'done',
+        };
+    };
+}
+export const implementationReducer = typedPhaseReducer('implementation', {
+    execute: 'execute_report',
+});
+export const researchReducer = typedPhaseReducer('research', {
+    investigate: 'finding',
+    synthesize: 'synthesis',
+});
+export const debugReducer = typedPhaseReducer('debug', {
+    reproduce: 'repro',
+    hypothesize: 'hypothesis',
+    isolate: 'isolation_report',
+    fix: 'verify_report',
+});
+export const RESULT_REDUCERS = {
     review: reviewReducer,
     ideation: ideationReducer,
+    implementation: implementationReducer,
+    research: researchReducer,
+    debug: debugReducer,
 };
-/** The reducer for a loop kind — a specialized one when registered, else the default. */
+/** The reducer for a loop kind. Exhaustive by construction: no silent fallback. */
 export function reducerForKind(kind) {
-    return RESULT_REDUCERS[kind] ?? defaultReducer;
+    return RESULT_REDUCERS[kind];
 }
 //# sourceMappingURL=result-reducers.js.map

package/dist/core/loops/store.js

@@ -10,6 +10,7 @@ import { gcWorktreeIfHarvested } from '../worktree.js';
 import { writeProjectMdSafe } from './hooks/bootstrap-write.js';
 import { notifyOperatorOnInputRequested } from './hooks/notify-operator.js';
 import { reconstructConsistentThread } from './commit-intent.js';
+import { evidencePolicyForNewLoop, evidenceWriterEnabled, sealArtifactEvidence, validateThreadEvidence } from './evidence.js';
 import { DEFAULT_PROTOCOLS, LoopArtifactSchema, LoopEventSchema, LoopThreadSchema, } from './types.js';
 function loopsDir(cwd) {
     return path.join(memoryDir(cwd ?? process.cwd()), 'loops');
@@ -166,6 +167,7 @@ export function openLoop(input, cwd) {
         open_questions: [],
         linked: input.linked,
         stop_condition: input.stop_condition ?? protocolDefaults.stop_condition,
+        evidence_policy: evidencePolicyForNewLoop(),
         created_at: now,
         updated_at: now,
         created_by: input.created_by,
@@ -193,7 +195,13 @@ export function getLoop(id, cwd) {
     // the on-disk thread, return the reconstructed consistent view. The mutation
     // is durable in the intent; persistence catches up at the next lock-entry
     // recovery (never a write on this read path — cf. trp_fdf3e590 / dec#137).
-    return reconstructConsistentThread(id, onDisk, cwd);
+    const thread = reconstructConsistentThread(id, onDisk, cwd);
+    if (thread) {
+        const diagnostics = validateThreadEvidence(thread);
+        if (diagnostics.length > 0)
+            logger.warn(`loop ${id}: rejected evidence envelopes ${JSON.stringify(diagnostics)}`);
+    }
+    return thread;
 }
 export function listLoops(filters = {}, cwd) {
     const dir = threadsDir(cwd);
@@ -206,6 +214,9 @@ export function listLoops(filters = {}, cwd) {
         try {
             const raw = fs.readFileSync(path.join(dir, file), 'utf8');
             const loop = LoopThreadSchema.parse(JSON.parse(raw));
+            const diagnostics = validateThreadEvidence(loop);
+            if (diagnostics.length > 0)
+                logger.warn(`loop ${loop.id}: rejected evidence envelopes ${JSON.stringify(diagnostics)}`);
             if (filters.kind && loop.kind !== filters.kind)
                 continue;
             if (filters.status && loop.status !== filters.status)
@@ -361,6 +372,22 @@ export function closeLoop(input, cwd) {
                 project_md_final_id,
                 now: pauseNow,
             });
+            const persistedDiffArtifact = (current.evidence_policy !== undefined || evidenceWriterEnabled())
+                ? LoopArtifactSchema.parse(sealArtifactEvidence(current, writeResult.diff_artifact, {
+                    channel: 'system_hook',
+                    producer_kind: 'engine',
+                    producer_id: 'brainclaw:bootstrap-write',
+                }))
+                : writeResult.diff_artifact;
+            const persistedQuestionArtifact = (current.evidence_policy !== undefined || evidenceWriterEnabled())
+                ? LoopArtifactSchema.parse(sealArtifactEvidence(current, questionArtifact, {
+                    channel: 'system_hook',
+                    producer_kind: 'engine',
+                    producer_id: 'brainclaw:bootstrap-write',
+                    slot_id: slot.slot_id,
+                    slot_role: slot.role,
+                }))
+                : questionArtifact;
             const pausedThread = {
                 ...current,
                 version: pauseVersion,
@@ -370,9 +397,9 @@ export function closeLoop(input, cwd) {
                 pending_file_apply: {
                     artifact_id: project_md_final_id,
                     target_path: writeResult.target_path,
-                    diff_artifact_id: writeResult.diff_artifact.artifact_id,
+                    diff_artifact_id: persistedDiffArtifact.artifact_id,
                 },
-                artifacts: [...current.artifacts, writeResult.diff_artifact, questionArtifact],
+                artifacts: [...current.artifacts, persistedDiffArtifact, persistedQuestionArtifact],
                 open_questions: [...current.open_questions, question_id],
                 updated_at: pauseNow,
             };