create-agdf 0.14.2 → 0.14.3

package/generated/submissions/openai/agdf/meta/contracts/control-scaffold.md

@@ -4,11 +4,24 @@
 
 Delivery Path Search is an optional read-only planning step for high-impact decisions with several materially different next actions.
 
-- It consumes current AGDF state and must reject gate-illegal candidates before model evaluation.
-- It returns one advisory recommendation or `no_safe_recommendation`.
+- It consumes the canonical selected-run `gate-check` evaluation for run, revision, current gate and
+  legal actions. Persisted presentation Markdown such as the Run Status Card is never policy input.
+- It binds the selected `scope_key`, `scope_revision` and objective to one control snapshot. A stale
+  or incomplete snapshot fails before candidate generation or evaluation.
+- It reports the phase that actually ran: `input | candidate | evaluation | search`. A phase that
+  did not run cannot produce a later-phase conclusion.
+- Terminal status is `input_unavailable | no_legal_candidates | evaluator_unavailable |
+  evaluator_error | recommendation | no_safe_recommendation`. Recommendation-facing statuses
+  require at least one contract-valid evaluation. `candidate_queue_exhausted` is a stopping reason,
+  not recommendation evidence.
+- It reports baseline/generated/legal/rejected candidate counts and attempted/valid/invalid
+  evaluation counts. Zero valid evaluations must never be presented or persisted as an evaluated
+  recommendation conclusion.
 - It must report budgets, stopping reason and `full | tool_enforced | instruction_only` enforcement.
 - Model scores are judgements, not measurements.
 - Search output is evidence only. Canonical `gate-check` independently decides what may proceed.
+- Search applies only to the selected run objective. An unrelated decision needs the correct
+  governed scope; Delivery Path Search is not a second task-target resolver.
 - The bounded first-release algorithm must not be labelled MCTS.
 - Surface adapters may translate transport and presentation, but must not fork scoring, search or gate semantics.
 - Optional AI-native candidate generation supplements the deterministic candidate baseline; it never replaces it.
@@ -19,6 +32,8 @@ Delivery Path Search is an optional read-only planning step for high-impact deci
 - Codex and Claude Code may provide tool-enforced generator transports. Copilot, OpenCode and generic surfaces remain instruction-only without conforming evidence.
 - OpenCode may provide a tool-enforced evaluator only for an invocation whose capability preflight proves `opencode run --pure --agent`, the owned evaluator agent and effective executable-tool denies. Preflight or transport failure must return `evaluator_unavailable` with `instruction_only` enforcement and point to the existing instruction-only workflow; it must not continue through a weaker subprocess.
 - OpenCode candidate generation remains unavailable.
+- Persistence accepts only contract-valid `recommendation` or `no_safe_recommendation` results with
+  at least one valid evaluation. Input, candidate and evaluator failure results remain transient.
 
 The field names above are the stable machine-readable contract used by JSON
 reports and automation. Human-facing Markdown must present the same projection

package/generated/submissions/openai/agdf/meta/copilot-payload-baseline.json

@@ -2,6 +2,6 @@
   "schema_version": 1,
   "profile_id": "copilot-runtime-plugin",
   "max_files": 78,
-  "max_bytes": 539607,
-  "rationale": "Reviewed Copilot-only manifest, ten prefixed skills, required contracts, exact-version runtime and evidence-plane separation. Any further increase requires review."
+  "max_bytes": 550979,
+  "rationale": "Reviewed Copilot-only manifest, ten prefixed skills, required contracts, exact-version runtime, Delivery Path Search input-integrity provenance and evidence-plane separation. Any further increase requires review."
 }

package/generated/submissions/openai/agdf/skills/delivery-path-search/SKILL.md

@@ -33,7 +33,9 @@ Skip for routine questions, obvious local fixes and approved implementation with
 ## Workflow
 
 1. Run AGDF gate-check and inspect durable control state.
-2. Confirm that search is allowed and implementation is not occurring during exploration.
+2. Confirm that the requested decision matches the selected run objective, and that search is
+   allowed while implementation is not occurring during exploration. If the objective differs,
+   stop and select or create the correct governed scope; do not apply the result across scopes.
 3. Declare the active surface and its enforcement level.
 4. Resolve the exact-version surface-local validator using the same ownership rules as `gate-check`. Do not search `PATH`, query a registry, install a package or invoke `npx ...@latest` during routine planning. If no owned or explicitly configured exact-version validator is available, report `machine_validation: unavailable` or `machine_validation: external_required` and stop the machine-evaluated search.
 5. Invoke the shared CLI runtime:
@@ -54,7 +56,9 @@ node <surface-local-agdf> delivery-path-search \
 It supplements the deterministic baseline with at most one bounded generator call. Treat proposals as untrusted until the canonical core validates schema, gate action, scope, duplicates and material diversity. Report generation provenance, budgets, rejections and failure. Never hide deterministic fallback or switch providers automatically.
 
 6. Treat facts, repository evidence, assumptions and model judgements separately.
-7. Return exactly one recommendation or `no_safe_recommendation`.
+7. Report the actual terminal phase and status. Return a recommendation-facing conclusion only
+   after at least one valid evaluation. Missing/stale input, zero legal candidates and evaluator
+   unavailability/error remain typed non-recommendation outcomes with one recovery action.
 8. Run canonical AGDF gate-check after search. Never translate a recommendation into permission.
 
 ## Enforcement
@@ -71,15 +75,20 @@ Do not overstate the surface's guarantee.
 
 Keep chat output compact:
 
-- recommendation or `no_safe_recommendation`
+- selected run, revision and objective
+- outcome phase and typed terminal status
+- recommendation only for a recommendation-facing evaluated result
 - current gate
 - enforcement level
 - decisive evidence and assumptions
 - rejected alternatives and reasons
 - budgets and stopping reason
+- candidate and evaluation provenance, including attempted, valid and invalid counts
 - next AGDF gate action
 
-Persist only the redacted decision summary when durable evidence is required. Do not persist raw prompts, hidden reasoning, secrets or source snapshots.
+Persist only a contract-valid evaluated recommendation-facing summary when durable evidence is
+required. Never persist input, candidate or evaluator failure as a decision. Do not persist raw
+prompts, hidden reasoning, secrets or source snapshots.
 
 ## Boundaries
 
@@ -87,6 +96,9 @@ Persist only the redacted decision summary when durable evidence is required. Do
 - Do not modify repository files during search.
 - Do not execute evaluator-returned commands.
 - Do not invent default scores for invalid evaluator output.
+- Do not parse Run Status Card or other presentation Markdown as gate-policy input.
+- Do not describe zero valid evaluations as `no_safe_recommendation`.
+- Do not apply one selected run's result to an unrelated question.
 - Do not implement, approve or release based on search output.
 - Do not create agent-specific scoring, gate logic or skill copies.
 - Do not replace deterministic candidates with generated proposals.

package/generated/submissions/openai/agdf/submission/openai/availability.md

@@ -1,6 +1,6 @@
 # Availability Decision Record
 
-- release: `0.14.2`
+- release: `0.14.3`
 - decision_state: `pending`
 - decision_owner: verified publisher
 - countries: not selected

package/generated/submissions/openai/agdf/submission/openai/capability-matrix.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.14.2",
+  "releaseVersion": "0.14.3",
   "evidenceStates": [
     "common",
     "codex-specific",

package/generated/submissions/openai/agdf/submission/openai/inventory.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.14.2",
-  "digest": "0c78d217817ca7cec6cd2e8638e3a4fa678a7dc4c954119606f5f954bd1a2ca2",
+  "releaseVersion": "0.14.3",
+  "digest": "88a2d665f6b0a11cc7de1d0200979d58bc601164f0418faa66e200f7d8a6635c",
   "files": [
     {
       "path": ".codex-plugin/plugin.json",
-      "sha256": "0eccc7ed08162a4f4437c7ccfbdd9145a9034b4ab6de44f5565ca608989d5c4a"
+      "sha256": "1723041a1f54829e14dd90d95017fe403e72074e569ae64fca4fc62f9d74b318"
     },
     {
       "path": "assets/agdf-icon.svg",
@@ -29,7 +29,7 @@
     },
     {
       "path": "meta/agdf-plugin.definition.json",
-      "sha256": "ba636c3e224125df8f2dedde215b00473174b1a02fdeecbf91da1a262dcde778"
+      "sha256": "16b69b796510bf4f6907fd986ad64dcf8e5ac4f3860d12e0e62381ea2582b012"
     },
     {
       "path": "meta/agdf-runtime-contract.md",
@@ -53,7 +53,7 @@
     },
     {
       "path": "meta/contracts/control-scaffold.md",
-      "sha256": "bf5773ec22013d3332cf4900d59880ebdfbaab7dee227c66b1721d0fd05aeac2"
+      "sha256": "82d298d5399c56ecbaeef78ac367556b675200c09ea96e160534ec03adb07f42"
     },
     {
       "path": "meta/contracts/gate-transition.md",
@@ -77,7 +77,7 @@
     },
     {
       "path": "meta/copilot-payload-baseline.json",
-      "sha256": "ab87e177288c36a056cccc583c78fd57b50fd82517a56276a009345e065ec1d6"
+      "sha256": "7f9d12592af01da501c2e5e2c4fc79cff86e7677384db3b2c72c6f8ec589aa4c"
     },
     {
       "path": "skills/brownfield-analysis/SKILL.md",
@@ -113,7 +113,7 @@
     },
     {
       "path": "skills/delivery-path-search/SKILL.md",
-      "sha256": "8c4a94c8ad86a51380f2f636d8b2fedd5a3554adf3edb19d350eb6a7c8254914"
+      "sha256": "688a0e04f6a1a39be17ded0047f88187b109f25bd9f22927a3d4261cbfdc0bd5"
     },
     {
       "path": "skills/delivery-path-search/help.md",
@@ -161,23 +161,23 @@
     },
     {
       "path": "submission/openai/availability.md",
-      "sha256": "57e428da0faf2a48f459796781b4f5b472dc10e1cea957f6078404bf6e7a184b"
+      "sha256": "6e2a4d12acfd22a728841169ae5d68b57d303ec3632aba09b5aa6c64d033253b"
     },
     {
       "path": "submission/openai/capability-matrix.json",
-      "sha256": "203b63da20727ac116fe816893c669725d46ff67388a934fa17cda68ea97f09a"
+      "sha256": "81425b79a427492d3e46e6f665ebc65e5a6ad47b8e897044180a8946e91c94b9"
     },
     {
       "path": "submission/openai/listing.json",
-      "sha256": "29c2a8865f69e227d746548b487422135b7165c4c5aa4f92ed414b220dd21151"
+      "sha256": "8302d3c25e7385767456b9ffa8a8939f9476cc28ce5a2357eb8b08cceb58fbb0"
     },
     {
       "path": "submission/openai/release-notes.md",
-      "sha256": "fcacfc5c8382ae589871359a3467dafac700822928999e680a106c484cc7044e"
+      "sha256": "ece61208d4538e5fd9a239d3c6bca98e1e0a34a5204fae1d4666b0bbaabf54f4"
     },
     {
       "path": "submission/openai/reviewer-cases.json",
-      "sha256": "e1ffc93e955edfab9a95cfaf0437badbf5f4741763cb0161f3de6b0e23c8bb27"
+      "sha256": "83b192f19d11e28ed16b33a81cadbcef8d6dd4b46bd2022841dc317ba6612b7a"
     }
   ]
 }

package/generated/submissions/openai/agdf/submission/openai/listing.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.14.2",
+  "releaseVersion": "0.14.3",
   "submissionType": "skills",
   "identity": {
     "technicalId": "agdf",

package/generated/submissions/openai/agdf/submission/openai/readiness.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.14.2",
+  "releaseVersion": "0.14.3",
   "candidateState": "repository_ready",
   "submissionReady": false,
   "submissionBlockers": [
@@ -16,7 +16,7 @@
     },
     "bundle": {
       "state": "pass",
-      "detail": "44 inventoried files; inventory digest 0c78d217817ca7cec6cd2e8638e3a4fa678a7dc4c954119606f5f954bd1a2ca2"
+      "detail": "44 inventoried files; inventory digest 88a2d665f6b0a11cc7de1d0200979d58bc601164f0418faa66e200f7d8a6635c"
     },
     "installed_host": {
       "state": "unverified",

package/generated/submissions/openai/agdf/submission/openai/readiness.md

@@ -1,6 +1,6 @@
 # AGDF Public Plugin Readiness
 
-- release: `0.14.2`
+- release: `0.14.3`
 - candidate_state: `repository_ready`
 - submission_ready: `false`
 
@@ -9,7 +9,7 @@
 | Class | State | Detail |
 |---|---|---|
 | repository | pass | canonical contract and deterministic source checks |
-| bundle | pass | 44 inventoried files; inventory digest 0c78d217817ca7cec6cd2e8638e3a4fa678a7dc4c954119606f5f954bd1a2ca2 |
+| bundle | pass | 44 inventoried files; inventory digest 88a2d665f6b0a11cc7de1d0200979d58bc601164f0418faa66e200f7d8a6635c |
 | installed_host | unverified | PPD-L02 and PPD-L03 not performed |
 | portal | unverified | unverified |
 | post_publication | unverified | not published |

package/generated/submissions/openai/agdf/submission/openai/release-notes.md

@@ -1,4 +1,4 @@
-# AGDF 0.14.2 — Initial OpenAI Public Plugin Candidate
+# AGDF 0.14.3 — Initial OpenAI Public Plugin Candidate
 
 This candidate packages the canonical AGDF workflow skills for public discovery in ChatGPT and
 Codex. It helps users assess delivery fit, preserve explicit human approvals, inspect existing-system
@@ -19,6 +19,12 @@ runtime or hooks, so automatic runtime checks remain unavailable in this profile
 installers also show the target and verified installed AGDF version, distinguish previous intent from
 effective host permission, explain manual mode and recover visibly from an invalid key.
 
+Delivery Path Search now consumes canonical selected-run gate actions instead of persisted
+presentation Markdown. Its additive version-1 result fields expose run revision, objective, outcome
+phase and candidate/evaluation provenance. Missing input, zero legal candidates and evaluator
+failures no longer appear as `no_safe_recommendation`; recommendation-facing results require at
+least one valid evaluation and are the only persistable outcomes.
+
 AGDF is an independent open-source project by Arndt Gold. It is not affiliated with, endorsed by or
 sponsored by OpenAI and is not a security sandbox, legal assessment, compliance certification or
 autonomous shipping system.

package/generated/submissions/openai/agdf/submission/openai/reviewer-cases.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.14.2",
+  "releaseVersion": "0.14.3",
   "cases": [
     {
       "id": "positive-proportional-fit",

package/lib/cli/delivery-path-search-command.js

@@ -12,21 +12,25 @@ import { enforcementForSurface } from '../delivery-path-search/surfaces/capabili
 import { persistSearchResult } from '../delivery-path-search/persistence.js';
 
 function unavailableOpenCodeResult({ options, preflight, input = null, error = null }) {
+  const surface = options.surface ?? "opencode";
   const mutation = error?.code === "OPENCODE_EVALUATOR_MUTATION_DETECTED";
-  const attempted = Boolean(input);
+  const attempted = Boolean(input && error);
   const nextAction = mutation
     ? "Investigate and revert the detected repository mutation before any evaluator fallback or retry."
     : "Repair the reported OpenCode capability and retry, or use the existing instruction-only Delivery Path Search workflow.";
   return {
     contract_version: "1",
-    surface: "opencode",
+    surface,
     scope_key: input?.scope_key ?? options.runId ?? null,
+    scope_revision: input?.scope_revision ?? "unversioned",
+    objective: input?.objective ?? "Delivery Path Search evaluator capability",
     current_gate: input?.current_gate ?? null,
+    outcome_phase: "evaluation",
     status: mutation ? "evaluator_error" : "evaluator_unavailable",
     recommendation: null,
-    enforcement: enforcementForSurface("opencode"),
+    enforcement: enforcementForSurface(surface),
     evaluator: {
-      name: "opencode",
+      name: surface,
       preflight: preflight?.code ?? "not_run",
       failure_code: error?.code ?? preflight?.code,
       detail: error?.message ?? preflight?.detail,
@@ -38,6 +42,16 @@ function unavailableOpenCodeResult({ options, preflight, input = null, error = n
       failure_code: error?.code ?? preflight?.code,
       evidence: preflight?.evidence ?? [],
     },
+    provenance: {
+      baseline_candidates: Math.min(input?.allowed_actions?.length ?? 0, input?.budgets?.max_candidates ?? 0),
+      generated_candidates: 0,
+      legal_candidates: attempted ? 1 : 0,
+      rejected_candidates: 0,
+      evaluation_attempts: attempted ? 1 : 0,
+      valid_evaluations: 0,
+      invalid_evaluations: attempted ? 1 : 0,
+    },
+    failure_code: error?.code ?? preflight?.code,
     stopping_reason: mutation ? "opencode_mutation_detected" : attempted ? "opencode_evaluator_failed" : "opencode_preflight_failed",
     next_action: nextAction,
     next_gate_action: nextAction,
@@ -46,11 +60,26 @@ function unavailableOpenCodeResult({ options, preflight, input = null, error = n
 
 export async function executeDeliveryPathSearch(options, io = console, dependencies = {}) {
   const fixture = options.fixture ? JSON.parse(readFileSync(options.fixture, "utf8")) : null;
+  const fixtureGeneration = fixture?.generator_response;
+  const generationEnabled = Boolean(fixtureGeneration || options.generateCandidates);
+  const initialEnforcement = fixture?.input?.enforcement ?? enforcementForSurface(options.surface);
+  const initialInput = fixture?.input ?? (dependencies.searchInputFromControl ?? searchInputFromControl)(options.dir, {
+    scopeKey: options.runId,
+    enforcement: initialEnforcement,
+    generation: generationEnabled ? {
+      enabled: true,
+      maxProposals: options.maxGeneratedCandidates,
+      maxDurationMs: options.generationTimeoutMs,
+      maxCostUnits: options.generationCostUnits,
+    } : undefined,
+  });
   const preflight = !fixture && options.surface === "opencode"
     ? (dependencies.preflightOpenCodeEvaluator ?? preflightOpenCodeEvaluator)({ cwd: options.dir })
     : null;
   if (preflight?.status === "failed") {
-    const result = unavailableOpenCodeResult({ options, preflight });
+    const result = initialInput.input_failure_code
+      ? await runDeliveryPathSearch(initialInput, { name: "not-invoked", async evaluate() { throw new Error("input failure must stop before evaluation"); } })
+      : unavailableOpenCodeResult({ options, preflight, input: initialInput });
     printDeliveryPathSearchResult(result, options, io);
     return result;
   }
@@ -58,18 +87,7 @@ export async function executeDeliveryPathSearch(options, io = console, dependenc
     ?? (preflight
       ? enforcementForSurface("opencode", preflight.evidence, { preflight })
       : enforcementForSurface(options.surface));
-  const fixtureGeneration = fixture?.generator_response;
-  const generationEnabled = Boolean(fixtureGeneration || options.generateCandidates);
-  const baseInput = fixture?.input ?? (dependencies.searchInputFromControl ?? searchInputFromControl)(options.dir, {
-    scopeKey: options.runId,
-    enforcement,
-    generation: generationEnabled ? {
-      enabled: true,
-      maxProposals: options.maxGeneratedCandidates,
-      maxDurationMs: options.generationTimeoutMs,
-      maxCostUnits: options.generationCostUnits,
-    } : undefined,
-  });
+  const baseInput = fixture ? initialInput : { ...initialInput, enforcement };
   const input = generationEnabled && !baseInput.generation ? {
     ...baseInput,
     generation: {
@@ -90,7 +108,13 @@ export async function executeDeliveryPathSearch(options, io = console, dependenc
           ? (dependencies.openCodeEvaluator ?? openCodeEvaluator)({ cwd: options.dir, model: options.model, preflight })
           : null;
   if (!evaluator) {
-    throw new Error(`${options.surface} has no executable evaluator in this release. Codex, Claude and preflight-qualified OpenCode are the executable adapters; --fixture is available for deterministic contract testing.`);
+    const detail = `${options.surface} has no executable evaluator in this release. Codex, Claude and preflight-qualified OpenCode are the executable adapters; --fixture is available for deterministic contract testing.`;
+    const result = {
+      ...unavailableOpenCodeResult({ options, preflight: { code: "surface_evaluator_unavailable", detail, evidence: [] }, input }),
+      surface: options.surface,
+    };
+    printDeliveryPathSearchResult(result, options, io);
+    return result;
   }
   const generator = fixtureGeneration
     ? fixtureGenerator(fixtureGeneration)
@@ -125,15 +149,23 @@ function printDeliveryPathSearchResult(result, options, io) {
     return;
   }
   io.log(`AGDF Delivery Path Search: ${result.status}`);
+  io.log(`Scope: ${result.scope_key ?? "unknown"} @ ${result.scope_revision ?? "unversioned"}`);
+  if (result.objective) io.log(`Objective: ${result.objective}`);
   io.log(`Current gate: ${result.current_gate ?? "unknown"}`);
+  io.log(`Outcome phase: ${result.outcome_phase ?? "unknown"}`);
   io.log(`Enforcement: ${result.enforcement.level}`);
   io.log(`Recommendation: ${result.recommendation?.action ?? "none"}`);
   if (result.budgets) io.log(`Evaluations: ${result.budgets.evaluations}`);
+  if (result.provenance) {
+    io.log(`Candidates: ${result.provenance.legal_candidates} legal, ${result.provenance.rejected_candidates} rejected`);
+    io.log(`Evaluation provenance: ${result.provenance.valid_evaluations}/${result.provenance.evaluation_attempts} valid, ${result.provenance.invalid_evaluations} invalid`);
+  }
   if (result.generation) {
     io.log(`Generation: ${result.generation.status} (${result.generation.accepted}/${result.generation.returned} accepted)`);
     io.log(`Generation budget: ${result.generation.cost_units} cost units, ${result.generation.duration_ms} ms`);
     if (result.generation.failure_code) io.log(`Generation failure: ${result.generation.failure_code}`);
   }
   io.log(`Stopping reason: ${result.stopping_reason}`);
-  io.log(result.next_gate_action);
+  if (result.failure_code) io.log(`Failure: ${result.failure_code}`);
+  io.log(result.next_action ?? result.next_gate_action);
 }

package/lib/delivery-path-search/contracts.js

@@ -68,6 +68,10 @@ export function validateSearchInput(value) {
   }
   requireString(input.objective, "objective");
   requireString(input.current_gate, "current_gate");
+  optionalBoundedString(input.scope_revision, "scope_revision", 200);
+  optionalBoundedString(input.input_failure_code, "input_failure_code", 200);
+  optionalBoundedString(input.input_failure_detail, "input_failure_detail", 1000);
+  optionalBoundedString(input.input_recovery_action, "input_recovery_action", 1000);
   stringArray(input.allowed_actions, "allowed_actions");
   stringArray(input.forbidden_actions, "forbidden_actions");
   stringArray(input.evidence_refs ?? [], "evidence_refs");
@@ -81,6 +85,39 @@ export function validateSearchInput(value) {
   return structuredClone(input);
 }
 
+const RESULT_PHASE_BY_STATUS = new Map([
+  ["input_unavailable", "input"],
+  ["no_legal_candidates", "candidate"],
+  ["evaluator_unavailable", "evaluation"],
+  ["evaluator_error", "evaluation"],
+  ["recommendation", "search"],
+  ["no_safe_recommendation", "search"],
+]);
+
+export function validateSearchResult(value) {
+  const result = requireObject(value, "search result");
+  if (result.contract_version !== CONTRACT_VERSION) throw new Error(`unsupported search result contract_version: ${result.contract_version}`);
+  const status = requireString(result.status, "result.status");
+  const expectedPhase = RESULT_PHASE_BY_STATUS.get(status);
+  if (!expectedPhase) throw new Error(`unsupported search result status: ${status}`);
+  if (result.outcome_phase !== expectedPhase) throw new Error(`${status} requires outcome_phase ${expectedPhase}`);
+  requireString(result.scope_key, "result.scope_key");
+  optionalBoundedString(result.scope_revision, "result.scope_revision", 200);
+  const provenance = requireObject(result.provenance, "result.provenance");
+  for (const key of ["baseline_candidates", "generated_candidates", "legal_candidates", "rejected_candidates", "evaluation_attempts", "valid_evaluations", "invalid_evaluations"]) {
+    if (!Number.isInteger(provenance[key]) || provenance[key] < 0) throw new Error(`result.provenance.${key} must be a non-negative integer`);
+  }
+  if (provenance.evaluation_attempts !== provenance.valid_evaluations + provenance.invalid_evaluations) throw new Error("result evaluation provenance counts are inconsistent");
+  const recommendationFacing = status === "recommendation" || status === "no_safe_recommendation";
+  if (recommendationFacing && provenance.valid_evaluations < 1) throw new Error(`${status} requires at least one valid evaluation`);
+  if (status === "recommendation" && !result.recommendation) throw new Error("recommendation status requires recommendation content");
+  if (status !== "recommendation" && result.recommendation != null) throw new Error(`${status} must not contain recommendation content`);
+  if (status === "no_legal_candidates" && (provenance.legal_candidates !== 0 || provenance.evaluation_attempts !== 0)) throw new Error("no_legal_candidates requires zero legal candidates and evaluation attempts");
+  if (status === "input_unavailable" && provenance.evaluation_attempts !== 0) throw new Error("input_unavailable requires zero evaluation attempts");
+  if ((status === "evaluator_unavailable" || status === "evaluator_error") && provenance.valid_evaluations !== 0) throw new Error(`${status} requires zero valid evaluations`);
+  return structuredClone(result);
+}
+
 export function validateCandidate(value) {
   const candidate = requireObject(value, "candidate");
   requireString(candidate.id, "candidate.id");

package/lib/delivery-path-search/persistence.js

@@ -1,5 +1,6 @@
 import { mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { validateSearchResult } from "./contracts.js";
 
 function safeResult(result) {
   return JSON.parse(JSON.stringify(result, (key, value) => {
@@ -9,22 +10,33 @@ function safeResult(result) {
 }
 
 export function persistSearchResult(targetDir, result) {
-  const root = join(targetDir, ".agdf", "control", "artefacts", result.scope_key);
+  const validated = validateSearchResult(result);
+  if (!["recommendation", "no_safe_recommendation"].includes(validated.status)) {
+    throw new Error(`search result status ${validated.status} is not persistable`);
+  }
+  if (validated.provenance.valid_evaluations < 1) {
+    throw new Error("search result requires at least one valid evaluation before persistence");
+  }
+  const root = join(targetDir, ".agdf", "control", "artefacts", validated.scope_key);
   const jsonPath = join(root, "DELIVERY_PATH_SEARCH.json");
   const markdownPath = join(root, "DELIVERY_PATH_SEARCH.md");
   mkdirSync(dirname(jsonPath), { recursive: true });
-  const safe = safeResult(result);
+  const safe = safeResult(validated);
   writeFileSync(jsonPath, `${JSON.stringify(safe, null, 2)}\n`, "utf8");
   const recommendation = safe.recommendation?.action ?? "No safe recommendation";
   writeFileSync(markdownPath, [
     "# Delivery Path Search Decision",
     "",
     `- status: ${safe.status}`,
+    `- outcome_phase: ${safe.outcome_phase}`,
+    `- scope_revision: ${safe.scope_revision}`,
     `- current_gate: ${safe.current_gate}`,
     `- enforcement: ${safe.enforcement.level}`,
     `- recommendation: ${recommendation}`,
     `- stopping_reason: ${safe.stopping_reason}`,
     `- evaluations: ${safe.budgets.evaluations}`,
+    `- evaluation_attempts: ${safe.provenance.evaluation_attempts}`,
+    `- invalid_evaluations: ${safe.provenance.invalid_evaluations}`,
     `- generation_status: ${safe.generation?.status ?? "legacy_deterministic"}`,
     `- generated_candidates: ${safe.generation ? `${safe.generation.accepted}/${safe.generation.returned}` : "0/0"}`,
     `- generation_cost_units: ${safe.generation?.cost_units ?? 0}`,