dsh-vibe-math 2.4.1 → 2.5.0

package/tests/audit-v5-sensitivity.mjs

@@ -31,6 +31,31 @@ const original = readFileSync(SRC, 'utf8')
 const REPO = fileURLToPath(new URL('..', import.meta.url))
 const dir = mkdtempSync(join(tmpdir(), 'v5-sens-'))
 
+// `armNextVerify`'s two exclusion gates (a live MEETING and a live VERIFICATION), each written
+// at the function head AND as a re-check inside the `while` loop with no `await` in between.
+// `armGuards(true, true)` is the pristine source text; the probes switch ONE gate off in BOTH
+// copies, which is the minimal edit that actually breaks the guarantee. Keeping the block in
+// one place means the two mutations cannot drift apart from the source they mutate.
+const armGuards = (meetingOn, verifyOn) => [
+  ...(meetingOn ? ['      if (meeting) return'] : []),
+  '      // Only one begin may be in flight. Without this, two callers (a scheduling pass',
+  '      // and a fresh proposal) could both pass the `currentVerify()` check before either',
+  '      // has published its verdict record and would start the SAME object twice.',
+  '      if (beginLock) return',
+  ...(verifyOn ? ['      if (currentVerify()) return'] : []),
+  '      beginLock = true',
+  '      try {',
+  '        while (true) {',
+  '          // NEVER remove a proposal we are not about to run: the entry leaves the durable',
+  '          // queue only in the same step that starts it. The old code shifted it out and then',
+  '          // returned because a meeting was live, so the proposal existed in neither the queue',
+  '          // nor `verdicts` until some later pass happened to re-arm it (audit M2). Re-check',
+  '          // the exclusion guards here too: `await putQueue` can let a meeting open.',
+  '          const q = inst().queue.slice()',
+  '          if (!q.length) return',
+  '          if (' + (meetingOn && verifyOn ? 'meeting || currentVerify()' : meetingOn ? 'meeting' : 'currentVerify()') + ') return',
+].join('\n')
+
 // Each probe: { name, ref, guarantee, from, to }
 // `from` must occur exactly once, so a mutation can never quietly hit the wrong site.
 const probes = [
@@ -141,9 +166,19 @@ const probes = [
     name: 'begin-not-exclusive',
     ref: 'prompt-v5-integrity.test.mjs',
     guarantee: '⑱ a second proposal must QUEUE, never start a concurrent ballot',
-    from: "      if (beginLock) return\n      if (currentVerify()) return\n      beginLock = true",
-    to: "      beginLock = true",
-  },
+    from: armGuards(true, true),
+    to: armGuards(true, false),
+  },
+  // NOTE — the mutual-exclusion gates of `armNextVerify` are written TWICE: once at the
+  // function head and once as a re-check inside the `while (true)` loop, and there is NO
+  // `await` between them. The head copies are therefore redundant mirrors of the in-loop
+  // ones, and a probe that deletes only a head copy is SEMANTICALLY INERT — it can never go
+  // red, which would masquerade as a "blind spot" forever (this was the state of both of the
+  // ⑱/㉝ probes: the in-loop re-check kept the invariant alive and
+  // `prompt-v5-integrity.test.mjs` stayed green). The probes for ⑱ and ㉝ therefore remove
+  // BOTH copies of the ONE gate they test, which is the minimal edit that actually lets a
+  // second ballot start — and the suite's case 9b ("a second proposal QUEUES") and case 10b
+  // ("a verification proposed DURING a meeting must queue") do detect exactly that.
   // NOTE — a probe for `continueMeetingRound`'s `if (finalizeLock) { armHeartbeat(); return }`
   // re-arm was REMOVED, not because the re-arm is unnecessary but because the state it
   // guards is UNREACHABLE, so no black-box probe can detect its removal:
@@ -269,8 +304,10 @@ const probes = [
     name: 'verify-preempts-a-live-meeting',
     ref: 'prompt-v5-integrity.test.mjs',
     guarantee: '㉝ a verification proposed during a meeting must QUEUE, never start concurrently (the two are mutually exclusive)',
-    from: "      if (meeting) return\n      // Only one begin may be in flight.",
-    to: "      // Only one begin may be in flight.",
+    // Removes BOTH `meeting` gates (see the note above `meeting-never-finalized`): deleting
+    // only the head copy is inert because the in-loop re-check runs before any `await`.
+    from: armGuards(true, true),
+    to: armGuards(false, true),
   },
 
   // ── LEAN FORMAL VERIFICATION PROBES (docs/formal-verification.md) ─────────
@@ -362,7 +399,11 @@ for (const p of probes) {
     continue
   }
   const r = spawnSync(process.execPath, [testPath], {
-    env: Object.assign({}, process.env, { V5_PLUGIN: file }),
+    // V5_CORPUS_DIR: a MUTATED run must never rewrite the shipped `prompt-corpus-v5/`. The
+    // corpus is the mandatory human-review artifact (AUDIT-CHECKLIST §0.3/§2.4); letting a
+    // deliberately broken copy dump its prompts there would leave the working tree holding
+    // mutant text until someone re-ran the healthy suite.
+    env: Object.assign({}, process.env, { V5_PLUGIN: file, V5_CORPUS_DIR: join(dir, 'corpus') }),
     encoding: 'utf8',
     cwd: REPO,
   })

package/tests/e2e-v5-round2.test.mjs

@@ -347,6 +347,47 @@ console.log('\n[6] quorum recomputed when a voter is dismissed')
   assert(h.drains.length === 2, 'both dismissed researchers had their resident child released')
 }
 
+// ---------- 6b. a dismissed voter's old ballot votes in NEITHER direction ----------
+console.log('\n[6b] a dismissed voter\'s old ballot is dropped from the ledger AND the tally')
+{
+  // Round A H2 fixed "a dismissed member's old ballot still counts". The suite used to prove only
+  // that m/voterCount were recomputed and that the resident was released — never that the BALLOT
+  // stopped counting. This case votes, dismisses, then re-votes, which is the sequence the audit
+  // asked for: r-1 asserts TRUE, is dismissed, and the remaining voter's FALSE must now CONCLUDE
+  // (with r-1's ballot ignored). If a former member's vote still counted, 1 vs 0 would conflict
+  // and the object could never reach Verified/ — so the verdict itself is the discriminator.
+  const h = makeHost({ pluginModule })
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  await h.settleSpawns()
+  const stateFile = join(h.WS, 'VibeMath', 'Projects', 'default', 'Institutes', 'institute', 'State', 'institute.v5state.json')
+  const ballots = () => {
+    try {
+      const s = JSON.parse(readFileSync(stateFile, 'utf8'))
+      const v = s.institutes[Object.keys(s.institutes)[0]].verdicts['p-dismiss']
+      return v ? Object.keys(v.votes || {}) : null
+    } catch (e) { return null }
+  }
+  const s0 = await h.callTool('vibe_v5_status', {})
+  assert(s0.quorum.voterCount === 2 && s0.quorum.m === 2, 'baseline: acad + r-1 = 2 voters, m=2 (got P=' + s0.quorum.voterCount + ', m=' + s0.quorum.m + ')')
+  await h.callTool('vibe_v5_record_proposition', { id: 'p-dismiss', statement: '被解雇者的旧票不得计入', value: 0.5, motive: 'm', p: 0.5 })
+  await h.callTool('vibe_v5_propose_verify', { target: 'p-dismiss', kind: 'proposition', reason: 'r' }, h.childAgent(h.childOf('r-1')))
+  const s1 = await h.callTool('vibe_v5_status', {})
+  assert(!!s1.verify && s1.verify.target === 'p-dismiss', 'the ballot on p-dismiss is live')
+  const voted = await h.callTool('vibe_v5_verdict', { target: 'p-dismiss', verdict: 1, reason: 'r-1 断言为真' }, h.childAgent(h.childOf('r-1')))
+  assert(voted.ok === true && voted.allVoted === false, 'r-1 cast the ONLY boolean vote so far (the other voter has not answered)')
+  assert((ballots() || []).indexOf('r-1') !== -1, 'the durable open-verdict record carries r-1\'s ballot before the dismissal (' + JSON.stringify(ballots()) + ')')
+  const removed = await h.callTool('vibe_v5_remove_researcher', { id: 'r-1' })
+  assert(removed.ok === true, 'r-1 was dismissed with the ballot still open (' + JSON.stringify(removed).slice(0, 80) + ')')
+  const s2 = await h.callTool('vibe_v5_status', {})
+  assert(s2.quorum.voterCount === 1 && s2.quorum.m === 1, 'the live roster recomputes immediately: P=1, m=1 (got P=' + s2.quorum.voterCount + ', m=' + s2.quorum.m + ')')
+  assert((ballots() || []).indexOf('r-1') === -1, '★ the dismissed member\'s ballot is DELETED from the durable open verdict (votes=' + JSON.stringify(ballots()) + ')')
+  const finalVote = await h.callTool('vibe_v5_verdict', { target: 'p-dismiss', verdict: 0, reason: 'acad 断言为假' }, h.childAgent(h.childOf('acad')))
+  assert(finalVote.ok === true && finalVote.allVoted === true, 'the remaining voter completed the ballot (allVoted=true)')
+  const s3 = await h.callTool('vibe_v5_status', {})
+  assert(s3.verified.indexOf('p-dismiss') !== -1,
+    '★ the ballot CONCLUDED false — a former member\'s TRUE vote cannot block it (got verified=' + JSON.stringify(s3.verified) + ', undecided=' + JSON.stringify(s3.undecided) + ')')
+}
+
 // ---------- 7. vibe_v5_wait ----------
 console.log('\n[7] vibe_v5_wait')
 {
@@ -584,6 +625,319 @@ console.log('\n[15] the host live-child cap (ACTIVATION_LIMIT_REACHED) is named,
   assert(st2.members.filter(m => m.phase === 'active' && m.childId).length === CAP, 'the institute is back at the host ceiling (active=' + st2.members.filter(m => m.phase === 'active').map(m => m.id).join(',') + ')')
 }
 
+// ---------- 16. a state file that was never loaded must never be overwritten (audit H1) --------
+console.log('\n[16] a pre-seeded snapshot is ADOPTED, never overwritten with an empty institute')
+{
+  // Round A H1. Ported from the reproduction that lived outside the repository
+  // (`_oneoff/audit241-v5-overwrite.mjs`): a host with no `sandboxPolicy` service (the supported
+  // case the e2e harness itself models) used to latch the DEFAULT path on its first read, after
+  // which `configure {institute:'alpha'}` wrote an EMPTY institute over alpha's real file.
+  const ws = mkdtempSync(join(tmpdir(), 'vibe-v5-seed-'))
+  const seedFile = join(ws, 'VibeMath', 'Projects', 'default', 'Institutes', 'alpha', 'State', 'alpha.v5state.json')
+  mkdirSync(dirname(seedFile), { recursive: true })
+  const seeded = {
+    v: 1,
+    institutes: {
+      'default::alpha': {
+        key: 'default::alpha', project: 'default', institute: 'alpha', createdAt: 1, phase: 'active',
+        problem: { id: 'p', statement: 'a real problem' }, params: {}, runId: 'run-x',
+        members: ['acad', 'r-1', 'r-2', 'r-3', 't-1'].map((id) => ({
+          id, kind: id === 'acad' ? 'academician' : id[0] === 'r' ? 'researcher' : 'temp',
+          childId: '', phase: 'active', direction: 'd', hiredBy: '', term: '', provider: 'spawn',
+          persona: 'CHARTER', error: '', createdAt: 1, dismissedAt: 0, dismissReason: '',
+        })),
+        tasks: [], messages: [], delivered: [], meetings: [], debates: [], verdicts: {}, formal: {},
+        todo: [], queue: [], counters: { academician: 1, researcher: 3, temp: 1, task: 0, meeting: 0, message: 0, verify: 0 },
+        lastProgressAt: 1, artifactCount: 7, diagnostics: [],
+      },
+    },
+    order: ['default::alpha'],
+  }
+  writeFileSync(seedFile, JSON.stringify(seeded, null, 2), 'utf8')
+  const h = makeHost({ pluginModule, ws })
+  const c = await h.callTool('vibe_v5_configure', { institute: 'alpha', problem: 'a real problem' })
+  assert(c.ok === true && c.institute === 'alpha', 'configure accepted the existing named institute (' + JSON.stringify(c).slice(0, 90) + ')')
+  const after = JSON.parse(readFileSync(seedFile, 'utf8')).institutes['default::alpha']
+  assert(after && after.members.length === 5, '★ the 5-member snapshot on disk survived configure (got ' + (after && after.members.length) + ')')
+  assert(after.artifactCount === 7 && after.runId === 'run-x', 'the rest of the snapshot survived too (artifactCount=' + after.artifactCount + ', runId=' + after.runId + ')')
+  const st = await h.callTool('vibe_v5_status', {})
+  assert(st.key === 'default::alpha' && st.members.length === 5, 'status reads the ADOPTED institute, not an empty one (key=' + st.key + ', members=' + st.members.length + ')')
+}
+
+// ---------- 17. the NAMED institute's own file is really read (audit H1, second half) ----------
+console.log('\n[17] a second host reads the NAMED institute from its own file')
+{
+  // Ported from `_oneoff/audit241-v5-key.mjs`. `configure` must read `Institutes/<name>/State/
+  // <name>.v5state.json` — the audit's bug was that it silently created a NEW empty institute
+  // under the requested name while the real file stayed untouched.
+  const h1 = makeHost({ pluginModule })
+  const c1 = await h1.callTool('vibe_v5_configure', { institute: 'alpha', problem: 'named institute' })
+  assert(c1.ok === true && c1.institute === 'alpha', 'host A configured the named institute')
+  const s1 = await h1.callTool('vibe_v5_status', {})
+  assert(s1.key === 'default::alpha', 'host A reports key=default::alpha (got ' + s1.key + ')')
+  await h1.callTool('vibe_v5_start', { researcherCount: 1 })
+  await h1.settleSpawns()
+  const namedFile = join(h1.WS, 'VibeMath', 'Projects', 'default', 'Institutes', 'alpha', 'State', 'alpha.v5state.json')
+  const onDisk = () => { try { return JSON.parse(readFileSync(namedFile, 'utf8')).institutes['default::alpha'] } catch (e) { return null } }
+  let snapshot = null
+  for (let i = 0; i < 80 && !(snapshot && snapshot.members.length >= 2); i++) { snapshot = onDisk(); if (!(snapshot && snapshot.members.length >= 2)) await sleep(25) }
+  assert(!!snapshot && snapshot.members.length >= 2, 'host A persisted the institute into the file NAMED AFTER IT (' + JSON.stringify(snapshot && snapshot.members.map(m => m.id)) + ')')
+  const ids = (snapshot || { members: [] }).members.map(m => m.id)
+  // A fresh host (fresh module instance) over the SAME workspace: this is what a user restarting
+  // DSH sees. It must adopt the institute, not found a second empty one.
+  const h2 = makeHost({ pluginModule, ws: h1.WS })
+  const c2 = await h2.callTool('vibe_v5_configure', { institute: 'alpha', problem: 'named institute' })
+  assert(c2.ok === true, 'host B configured the same named institute (' + JSON.stringify(c2).slice(0, 90) + ')')
+  const s2 = await h2.callTool('vibe_v5_status', {})
+  assert(s2.key === 'default::alpha' && s2.backend === 'file', 'host B reports the named institute over the file backend (key=' + s2.key + ', backend=' + s2.backend + ')')
+  assert(ids.length > 0 && ids.every(id => s2.members.some(m => m.id === id)),
+    '★ host B READ the existing members instead of starting empty (got ' + JSON.stringify(s2.members.map(m => m.id)) + ', expected to include ' + JSON.stringify(ids) + ')')
+  const resumed = await h2.callTool('vibe_v5_resume', {})
+  assert(resumed.ok === true, 'resume on the adopted institute succeeded (' + JSON.stringify(resumed).slice(0, 120) + ')')
+}
+
+// ---------- 18. a FAILED turn: stopReason=error, lastAssistantMessage OMITTED -------------------
+console.log('\n[18] a turn ending with stopReason=error is recorded, with or without output')
+{
+  // The real host emits `stopReason:'error'` for a failed turn and OMITS `lastAssistantMessage`
+  // when there is nothing to report (dsh-subagent index.js:268-278/317-324). Every other mock in
+  // the suite fires 'completed' WITH a message, so this branch — and the omission it must survive —
+  // was never executed in CI (audit A-7).
+  const h = makeHost({ pluginModule })
+  const chatText = () => {
+    const dir = join(h.WS, 'VibeMath', 'Projects', 'default', 'Institutes', 'institute', 'Shared', 'Chat')
+    return existsSync(dir) ? readdirSync(dir).filter(f => f.endsWith('.md')).map(f => readFileSync(join(dir, f), 'utf8')).join('\n') : ''
+  }
+  // The exact host event, with the field ABSENT (not an empty array).
+  const fireBare = (childId, stopReason) => { for (const fn of h.listeners['subagent/end'] || []) fn({ id: childId, runId: 'r', provider: 'spawn', local: true, stopReason }) }
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  await h.settleSpawns()
+  // Wake r-1 first: an end for a member with no in-flight token is ignored BY DESIGN (the
+  // idempotence guard), so without this the error branch would be unreachable.
+  await h.callTool('vibe_v5_say', { to: 'r-1', text: '请回报进展。' }, h.childAgent(h.childOf('acad')))
+  await sleep(40)
+  const st0 = await h.callTool('vibe_v5_status', {})
+  assert((st0.members.find(m => m.id === 'r-1') || {}).busy === true, 'precondition: r-1 has a turn in flight')
+  const before = chatText().length
+  fireBare(h.childOf('r-1'), 'error')
+  await sleep(80)
+  const written = chatText().slice(before)
+  const seg = written.indexOf('【异常】') === -1 ? '' : written.slice(written.indexOf('【异常】'), written.indexOf('【异常】') + 400)
+  const line = (seg.match(/【异常】[^\n]*/) || [''])[0]
+  assert(/【异常】r-1/.test(line) && /error/.test(line), '★ a failed turn is recorded in the group chat as 【异常】 for its OWNER: ' + JSON.stringify(line.slice(0, 120)))
+  assert(seg.indexOf('最后输出') === -1, 'an OMITTED lastAssistantMessage adds no phantom output text')
+  const st1 = await h.callTool('vibe_v5_status', {})
+  assert((st1.members.find(m => m.id === 'r-1') || {}).busy !== true, 'the failed member is not left marked busy')
+  assert(st1.running === true, 'the institute keeps running after a failed turn')
+  // And the SAME branch WITH output must carry it — otherwise the two assertions above could hold
+  // for a handler that only ever writes the member id.
+  await h.callTool('vibe_v5_say', { to: 'r-1', text: '再来一次。' }, h.childAgent(h.childOf('acad')))
+  await sleep(40)
+  const mark = chatText().length
+  h.fireEnd(h.childOf('r-1'), { progress: 'partial text before the failure' }, 'max-tokens')
+  await sleep(80)
+  const after = chatText().slice(mark)
+  const idx2 = after.indexOf('【异常】')
+  const seg2 = idx2 === -1 ? '' : after.slice(idx2, idx2 + 400)
+  const line2 = (seg2.match(/【异常】[^\n]*/) || [''])[0]
+  assert(/max-tokens/.test(line2) && /最后输出/.test(line2) && /partial text before the failure/.test(seg2),
+    '★ a non-completed turn WITH output carries that output and its stop reason: ' + JSON.stringify(seg2.slice(0, 140)))
+}
+
+// ---------- 19. two proposals in the SAME tick are never lost -------------------
+console.log('\n[19] concurrent propose_verify: the durable queue must not lose one')
+{
+  // The verify queue was mutated with a whole-array read-modify-write (`inst().queue.slice()`,
+  // push, `await putQueue(q)`). Two members proposing in the same tick both read the same array
+  // and each committed its own copy, so the last writer won and the first proposal vanished from
+  // the durable queue with BOTH calls reporting ok:true. The mutation now happens inside the
+  // event fold (`appendToQueue`), so no same-tick append can overwrite another.
+  const h = makeHost({ pluginModule })
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  await h.settleSpawns()
+  const who = h.childAgent(h.childOf('r-1'))
+  const [pa, pb] = await Promise.all([
+    h.callTool('vibe_v5_propose_verify', { target: 'p-race-a', kind: 'proposition', reason: 'race A' }, who),
+    h.callTool('vibe_v5_propose_verify', { target: 'p-race-b', kind: 'proposition', reason: 'race B' }, who),
+  ])
+  assert(pa.ok === true && pb.ok === true, 'both concurrent proposals report ok (the buggy code reported ok for the lost one too)')
+  const s = await h.callTool('vibe_v5_status', {})
+  const seen = (s.verify ? [s.verify.target] : []).concat(s.verifyQueue)
+  assert(seen.indexOf('p-race-a') !== -1 && seen.indexOf('p-race-b') !== -1,
+    '★ neither same-tick proposal is lost: each is in-flight or queued (verify=' + JSON.stringify(s.verify && s.verify.target) + ', queue=' + JSON.stringify(s.verifyQueue) + ')')
+  await sleep(30)
+  const st = JSON.parse(readFileSync(statePathOf(h.WS), 'utf8'))
+  const inst = st.institutes[Object.keys(st.institutes)[0]]
+  const durable = (inst.queue || []).map(q => q.target)
+  const open = Object.keys(inst.verdicts || {}).filter(k => !inst.verdicts[k].closed)
+  const bothDurable = (durable.indexOf('p-race-a') !== -1 || open.indexOf('p-race-a') !== -1) &&
+    (durable.indexOf('p-race-b') !== -1 || open.indexOf('p-race-b') !== -1)
+  assert(bothDurable, '★ the durable state file keeps both as well (queue=' + JSON.stringify(durable) + ', open verdicts=' + JSON.stringify(open) + ')')
+}
+
+// ---------- 20. invalid numeric params are clamped, not silently destructive ----------
+console.log('\n[20] invalid numeric params are clamped instead of silently destructive')
+{
+  // `compactThreshold <= 0` made EVERY round look over the threshold (a permanent compaction
+  // directive), `verdictMaxRounds < 1` collapsed every debate to one round, and `chatDigestMax < 1`
+  // emptied the digest bucket. `normalizeParams` now applies the same discipline the durations use.
+  const h = makeHost({ pluginModule })
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  await h.settleSpawns()
+  const r = await h.callTool('vibe_v5_set', { verdictMaxRounds: 0, chatDigestMax: -3, compactThreshold: 0 })
+  assert(r.ok === true && r.params.verdictMaxRounds === 1, 'verdictMaxRounds=0 floors at 1 (got ' + r.params.verdictMaxRounds + ')')
+  assert(r.params.chatDigestMax === 1, 'chatDigestMax=-3 floors at 1 (got ' + r.params.chatDigestMax + ')')
+  assert(r.params.compactThreshold === 66, 'compactThreshold=0 falls back to the default 66 (got ' + r.params.compactThreshold + ')')
+}
+
+// ---------- 21. an office-only tool never impersonates the office for an unknown caller ----
+console.log('\n[21] office-only tools refuse a caller that is neither a member nor the session root')
+{
+  // `memberIdOfAgent` answers 'office' for the root AND '' for an unrelated descendant, and
+  // `isOffice('')` used to be true — so the old handlers fell back to the office and let any
+  // unresolvable caller convene meetings / hire / fire / ASSIGN / NUDGE / create tasks as the
+  // office (audit L6 and its follow-up). `officeCaller` now refuses, every writing tool resolves
+  // through it, and `isOffice` itself only accepts the literal 'office'.
+  const h = makeHost({ pluginModule })
+  await h.callTool('vibe_v5_start', { problem: PROBLEM, researcherCount: 1 })
+  await h.settleSpawns()
+  const ghost = h.childAgent('c-nobody')
+  const mtg = await h.callTool('vibe_v5_meeting', { agenda: '冒充所办', kind: 'sync' }, ghost)
+  assert(mtg.ok === false && mtg.code === 'V5_MEMBER_NOT_FOUND',
+    'meeting is refused for a caller that is not a member or the session root (' + JSON.stringify(mtg).slice(0, 90) + ')')
+  const res = await h.callTool('vibe_v5_add_researcher', { direction: 'x' }, ghost)
+  assert(res.ok === false && res.code === 'V5_MEMBER_NOT_FOUND',
+    'add_researcher is refused for the same caller (' + JSON.stringify(res).slice(0, 90) + ')')
+  // The whole family of writing tools must refuse that caller, not just the office-only ones:
+  // each of these used to receive '' from memberIdOfAgent and treat it as the office. A REAL task
+  // is opened first so the ghost's task_update / prioritize have live state to damage.
+  const t1 = await h.callTool('vibe_v5_task_create', { subject: '真实任务' })
+  assert(t1.ok === true, 'a real caller can still open a task (' + JSON.stringify(t1).slice(0, 90) + ')')
+  const boardBefore = (await h.callTool('vibe_v5_task_list', {})).tasks.length
+  const ghostWrites = [
+    ['vibe_v5_assign', { subject: '冒充分派', to: 'r-1', why: 'w', acceptance: 'a' }],
+    ['vibe_v5_nudge', { to: 'r-1', why: 'w' }],
+    ['vibe_v5_task_create', { subject: '冒充所办建的任务' }],
+    ['vibe_v5_task_update', { task_id: t1.task.id, expected_revision: 1, action: 'delete' }],
+    ['vibe_v5_prioritize', { order: [{ task_id: t1.task.id, priority: 9 }], why: 'w' }],
+    ['vibe_v5_propose_verify', { target: 'p-ghost', kind: 'proposition', reason: 'r' }],
+    ['vibe_v5_lean_run', { file: 'Formal/ghost.lean' }],
+  ]
+  for (const [name, args] of ghostWrites) {
+    const r = await h.callTool(name, args, ghost)
+    assert(r.ok === false && r.code === 'V5_MEMBER_NOT_FOUND',
+      name + ' is refused for the unidentifiable caller (' + JSON.stringify(r).slice(0, 90) + ')')
+  }
+  const boardAfter = await h.callTool('vibe_v5_task_list', {})
+  const t1After = boardAfter.tasks.find((t) => t.id === t1.task.id)
+  assert(boardAfter.tasks.length === boardBefore,
+    'no refused write reached the board (before=' + boardBefore + ', after=' + boardAfter.tasks.length + ')')
+  assert(t1After && t1After.status !== 'deleted', 'the refused task_update did not delete a real task')
+  assert(t1After && t1After.priority === 0, 'the refused prioritize did not reorder a real task (priority=' + (t1After && t1After.priority) + ')')
+  // ...and the real identities still work: the office signs as the office, a member acts as itself.
+  const asgOffice = await h.callTool('vibe_v5_assign', { subject: '所办分派', to: 'r-1', why: 'w', acceptance: 'a' })
+  assert(asgOffice.ok === true && asgOffice.task && asgOffice.task.assignedBy === 'office',
+    'the office still assigns and is signed as office (' + JSON.stringify(asgOffice).slice(0, 110) + ')')
+  const tcOffice = await h.callTool('vibe_v5_task_create', { subject: '所办任务' })
+  assert(tcOffice.ok === true && tcOffice.task.createdBy === 'office', 'the office task_create still records createdBy=office')
+  const nudgeAcad = await h.callTool('vibe_v5_nudge', { to: 'r-1', why: '院士督办' }, h.childAgent(h.childOf('acad')))
+  assert(nudgeAcad.ok === true, 'the academician still nudges (' + JSON.stringify(nudgeAcad).slice(0, 90) + ')')
+  const office = await h.callTool('vibe_v5_meeting', { agenda: '所办直接开会', kind: 'sync' })
+  assert(office.ok === true, 'the real office (session root) still convenes a meeting (' + JSON.stringify(office).slice(0, 90) + ')')
+  // Two office-impersonation holes the independent verifier found AFTER Round D — same L6 class,
+  // and neither was covered by the assertions above: `vibe_v5_message` signed EVERY caller's text
+  // as the office (no caller resolution at all), and `vibe_v5_remove_researcher` ("Office only")
+  // accepted any caller. Both now resolve through `officeCaller` and refuse.
+  const ghostMsg = await h.callTool('vibe_v5_message', { to: 'all', content: '冒充所办通知' }, ghost)
+  assert(ghostMsg.ok === false && ghostMsg.code === 'V5_MEMBER_NOT_FOUND',
+    'vibe_v5_message is refused for the unidentifiable caller (' + JSON.stringify(ghostMsg).slice(0, 90) + ')')
+  const memberMsg = await h.callTool('vibe_v5_message', { to: 'all', content: '成员冒充所办通知' }, h.childAgent(h.childOf('r-1')))
+  assert(memberMsg.ok === false && memberMsg.code === 'V5_NOT_OFFICE',
+    'vibe_v5_message is refused for a MEMBER too — the relay is signed as the office, members use vibe_v5_say (' + JSON.stringify(memberMsg).slice(0, 90) + ')')
+  const ghostRm = await h.callTool('vibe_v5_remove_researcher', { id: 'r-1' }, ghost)
+  assert(ghostRm.ok === false && ghostRm.code === 'V5_MEMBER_NOT_FOUND',
+    'vibe_v5_remove_researcher is refused for the unidentifiable caller (' + JSON.stringify(ghostRm).slice(0, 90) + ')')
+  const memberRm = await h.callTool('vibe_v5_remove_researcher', { id: 'r-1' }, h.childAgent(h.childOf('r-1')))
+  assert(memberRm.ok === false && memberRm.code === 'V5_NOT_OFFICE',
+    '...and refused for a member (the tool says Office only), not just for ghosts (' + JSON.stringify(memberRm).slice(0, 90) + ')')
+  const r1Still = (await h.callTool('vibe_v5_members', {})).members.find((m) => m.id === 'r-1')
+  assert(r1Still && r1Still.phase === 'active', 'neither refused call dismissed r-1 (phase=' + JSON.stringify(r1Still && r1Still.phase) + ')')
+  const officeMsg = await h.callTool('vibe_v5_message', { to: 'all', content: '所办通知' })
+  assert(officeMsg.ok === true, 'the office still relays a message (' + JSON.stringify(officeMsg).slice(0, 90) + ')')
+  // The `/v5` SLASH-COMMAND line is the third surface of the same class: it hardcoded 'office' for
+  // every subcommand (`remove`/`fire`/`hire`/`set`/`stop`/`message`…), and a member child maps to
+  // the same institute session — so a member (or an unidentifiable descendant) could drive it. It
+  // now resolves the caller too.
+  const cmdV5 = h.commandRegs.find((c) => c.name === 'v5')
+  const cmdGhost = JSON.parse((await cmdV5.handler({ agent: ghost, rawInput: 'remove r-1' })).text)
+  assert(cmdGhost.ok === false && cmdGhost.code === 'V5_NOT_OFFICE',
+    '/v5 remove is refused for the unidentifiable caller (' + JSON.stringify(cmdGhost).slice(0, 90) + ')')
+  const cmdMember = JSON.parse((await cmdV5.handler({ agent: h.childAgent(h.childOf('r-1')), rawInput: 'remove r-1' })).text)
+  assert(cmdMember.ok === false && cmdMember.code === 'V5_NOT_OFFICE',
+    '/v5 remove is refused for a member child too (' + JSON.stringify(cmdMember).slice(0, 90) + ')')
+  const r1AfterCmd = (await h.callTool('vibe_v5_members', {})).members.find((m) => m.id === 'r-1')
+  assert(r1AfterCmd && r1AfterCmd.phase === 'active', 'the refused /v5 remove did not dismiss r-1 (phase=' + JSON.stringify(r1AfterCmd && r1AfterCmd.phase) + ')')
+  const cmdOffice = JSON.parse((await cmdV5.handler({ agent: h.ROOT, rawInput: 'status' })).text)
+  assert(cmdOffice.ok === true, 'the office still drives the /v5 line (' + JSON.stringify(cmdOffice).slice(0, 90) + ')')
+  const officeRm = await h.callTool('vibe_v5_remove_researcher', { id: 'r-1' })
+  assert(officeRm.ok === true, 'the office can still dismiss a permanent researcher (' + JSON.stringify(officeRm).slice(0, 90) + ')')
+}
+
+// ---------- 22. the office-only LIFECYCLE controls resolve their caller too ----------
+console.log('\n[22] configure/start/resume/pause/stop/set belong to the PROVABLE session root')
+{
+  // A member child and the office share ONE institute session, so `getSession()` alone let a member
+  // (or an unidentifiable descendant of the root) drive these handlers as the office: stop the
+  // institute, or rewrite quorum/params. Absence of a caller is NOT the office either.
+  const h = makeHost({ pluginModule })
+  // (a) the root/UI path keeps working end-to-end: these are exactly the handlers `/v5` drives.
+  const cfg = await h.callTool('vibe_v5_configure', { institute: 'life', problem: PROBLEM })
+  assert(cfg.ok === true, 'the office configures the institute (' + JSON.stringify(cfg).slice(0, 90) + ')')
+  const started = await h.callTool('vibe_v5_start', { researcherCount: 1 })
+  assert(started.ok === true, 'the office founds it (' + JSON.stringify(started).slice(0, 90) + ')')
+  await h.settleSpawns()
+  const setOk = await h.callTool('vibe_v5_set', { maxParallel: 2 })
+  assert(setOk.ok === true && setOk.params.maxParallel === 2, 'the office tunes parameters (' + JSON.stringify(setOk).slice(0, 90) + ')')
+  const pauseOk = await h.callTool('vibe_v5_pause', {})
+  assert(pauseOk.ok === true, 'the office pauses (' + JSON.stringify(pauseOk).slice(0, 90) + ')')
+  const resumeOk = await h.callTool('vibe_v5_resume', {})
+  assert(resumeOk.ok === true, 'the office resumes (' + JSON.stringify(resumeOk).slice(0, 90) + ')')
+  // (b) a MEMBER child and an unidentifiable descendant of the office root are both refused.
+  const member = h.childAgent(h.childOf('r-1'))
+  const ghost = h.childAgent('c-nobody')
+  const officeOnly = [
+    ['vibe_v5_configure', { institute: 'stolen', problem: 'x' }],
+    ['vibe_v5_start', { researcherCount: 3 }],
+    ['vibe_v5_resume', {}],
+    ['vibe_v5_pause', {}],
+    ['vibe_v5_stop', {}],
+    ['vibe_v5_set', { maxParallel: 9 }],
+  ]
+  for (const [name, args] of officeOnly) {
+    const asMember = await h.callTool(name, args, member)
+    assert(asMember.ok === false && asMember.code === 'V5_NOT_OFFICE',
+      name + ' is refused for a MEMBER child (' + JSON.stringify(asMember).slice(0, 80) + ')')
+    const asGhost = await h.callTool(name, args, ghost)
+    assert(asGhost.ok === false && asGhost.code === 'V5_NOT_OFFICE',
+      name + ' is refused for the unidentifiable caller (' + JSON.stringify(asGhost).slice(0, 80) + ')')
+  }
+  // (c) NO caller at all is not the office either — driven through the real registered wrapper (the
+  // harness' callTool defaults to ROOT, so `agent: undefined` is passed explicitly here). The wrapper
+  // refuses it as 'no session' BEFORE the gate, i.e. absence never reaches the office path.
+  const stopSpec = h.toolRegs.find((t) => t.name === 'vibe_v5_stop')
+  const noCaller = JSON.parse(await stopSpec.execute({}, { agent: undefined }))
+  assert(noCaller.ok === false,
+    'an agent-less call never reaches the lifecycle handler as the office (' + JSON.stringify(noCaller).slice(0, 80) + ')')
+  // (d) nothing the refusals asked for took effect.
+  const after = await h.callTool('vibe_v5_status', {})
+  assert(after && after.ok !== false && after.params && after.params.maxParallel === 2,
+    'no refused lifecycle call took effect (maxParallel=' + (after.params && after.params.maxParallel) + ')')
+  assert(after.members && after.members.some((m) => m.phase !== 'dismissed'),
+    'the refused stop did not dissolve the roster (' + (after.members || []).map((m) => m.id + ':' + m.phase).join(',') + ')')
+  const finalStop = await h.callTool('vibe_v5_stop', {})
+  assert(finalStop.ok === true, 'the office can still stop it (' + JSON.stringify(finalStop).slice(0, 90) + ')')
+}
+
 console.log('')
 console.log('passed=' + passed + ' failed=' + failed)
 if (failed) { console.error('FAILURES:'); for (const f of failures) console.error('  - ' + f); process.exit(1) }

package/tests/formal-verify-v2.test.mjs

@@ -184,7 +184,11 @@ function makeHost(WS, opts = {}) {
 }
 
 function makeRoot(id, WS) {
-  return { id, options: { provider: 'mock', model: 'mock' }, session: { id, header: { cwd: WS, parentSession: undefined } }, followup() {} }
+  // `pushed` records the framework's OWN messages to the main agent (`rootAgent.followup`), i.e. the
+  // reportMode=push progress report. It used to be a no-op, which is why that channel had no corpus
+  // entry at all (AUDIT §2.4 "框架→人 的反馈与推送类提示").
+  const pushed = []
+  return { id, options: { provider: 'mock', model: 'mock' }, session: { id, header: { cwd: WS, parentSession: undefined } }, pushed, followup(m) { const c = (m && m.content) || []; pushed.push(c.map((b) => (b && b.text) || '').join('')) } }
 }
 
 const hosts = []
@@ -1240,6 +1244,44 @@ section("15b a \`used\` reply must NOT downgrade an already-passed object")
   }
 }
 
+// ---------- 15c. the framework's OWN feedback channels (push report + gate notice) ----------
+// Every corpus entry so far was a child prompt (spawn/wake). The framework also speaks to the main
+// agent/human on two other channels — the `reportMode=push` progress report and the activity log's
+// formal-gate notice — and neither had any reviewable artefact (AUDIT §2.4 "框架→人 的反馈与推送类
+// 提示"). Both are captured DETERMINISTICALLY (no wall-clock, no timing-dependent counts):
+//   · push   = the forced push of the strict-termination branch on an EMPTY project (fixed counters);
+//   · feedback = the FIRST formal-gate activity line of one controlled require-mode deferral.
+section('15c the framework push report and the gate notice are captured')
+{
+  const h = await makeCase('push-report')
+  await h.call('vibe_math_set_params', { reportMode: 'push', tickIntervalMs: 200 })
+  await h.call('vibe_math_start', {})
+  const pushed = await waitFor(() => (h.root.pushed && h.root.pushed.length > 0 ? h.root.pushed : undefined), 80, 100)
+  assert(!!pushed, 'push-report: the scheduler pushed a progress report to the main agent')
+  assert(!!pushed && /\[Vibe Math V2\] 进度更新/.test(pushed[0]), '★★ the push text is the real framework→main-agent prompt (reportMode=push)')
+  assert(!!pushed && /vibe_math_report/.test(pushed[0]), 'and it names the FULL tool the main agent must call')
+  await h.call('vibe_math_pause', {})
+
+  const g = await makeCase('gate-feedback')
+  await g.call('vibe_math_set_params', { formalVerify: 'require', maxParallelThreshold: 8 })
+  await g.call('vibe_math_add_proposition', { id: 'pFeed', 概述: '门禁反馈语料', 布尔估计: 0.5, 优先级: 1, '价值/关键性': 0.5, 细类型: { 数论: {} } })
+  await startScheduler(g)
+  const gvs = await waitFor(() => { const x = verifiersOf(g, 'r-pFeed'); return x.length >= 2 ? x : undefined }, 60, 250)
+  assert(!!gvs, 'gate-feedback: verifiers were spawned for the proposition')
+  if (gvs) for (let i = 0; i < gvs.length && i < 2; i++) replyFrom(g, gvs[i].childId, { Result: 1, Reason: '门禁反馈用例' })
+  let gline
+  for (let i = 0; i < 60 && !gline; i++) {
+    const acts = (await g.call('vibe_math_status', {})).recentActivity || []
+    const hit = acts.find((a) => /formal-gate/.test(String(a.event)))
+    if (hit) gline = String(hit.event) + ': ' + String(hit.detail)
+    else await sleep(150)
+  }
+  assert(!!gline && /require 模式搁置/.test(gline), '★★ the require-gate withholding reaches the human-readable channel (captured verbatim)')
+  assert(!!gline && /Formal\/TODO\.md/.test(gline), 'and the notice says where the withholding was recorded')
+  g.feedbackLine = gline || ''
+  await g.call('vibe_math_pause', {})
+}
+
 section('16 the captured prompt corpus is written for human review')
 {
   // Freeze the scheduler in every case FIRST: a still-running tick loop could emit one more
@@ -1261,6 +1303,13 @@ section('16 the captured prompt corpus is written for human review')
       const owner = h.spawns.find((s) => s.childId === f.childId)
       entries.push({ kind: 'wake', case: h.label, label: owner ? owner.label : f.childId, prompt: scrub(h, f.prompt) })
     }
+    // The framework's own messages to the main agent (reportMode=push). Only the FIRST push per case is
+    // kept: whether a second identical push follows depends on tick/reportDirty timing, and the corpus
+    // must stay byte-identical across runs.
+    if (h.root && Array.isArray(h.root.pushed) && h.root.pushed.length > 0) entries.push({ kind: 'push', case: h.label, label: 'main-agent', prompt: scrub(h, h.root.pushed[0]) })
+    // The framework's human-readable feedback channel: the activity-log line that carries the require
+    // gate's withholding notice. It is captured once, in case 15c, for determinism.
+    if (typeof h.feedbackLine === 'string' && h.feedbackLine) entries.push({ kind: 'feedback', case: h.label, label: 'activity-log', prompt: scrub(h, h.feedbackLine) })
   }
   mkdirSync(CORPUS_DIR, { recursive: true })
   writeFileSync(join(CORPUS_DIR, 'formal-verify-v2.json'), JSON.stringify({ entries: entries }, null, 2), 'utf8')
@@ -1268,7 +1317,8 @@ section('16 the captured prompt corpus is written for human review')
     '> 由 `formal-verify-v2.test.mjs` 落盘：框架**真正发出**的每一条提示词原文。',
     '> 工作区路径归一化为 `<WS>`、VibeMath 根归一化为 `<VIBEMATH>`，因此可 diff、不泄露本机路径。',
     '> 覆盖：off 档（无任何 Lean 文字）、encourage 与 require 的表决初评/辩论、passed 后的忠实性分支、',
-    '> 以及平时工作轮的「顺手形式化」段落与 formal 回执契约。', '']
+    '> 平时工作轮的「顺手形式化」段落与 formal 回执契约，以及框架自己的两条反馈通道：',
+    '> `reportMode=push` 的推送汇报（kind=push）与 require 门禁搁置的活动日志公告（kind=feedback）。', '']
   for (let i = 0; i < entries.length; i++) {
     const e = entries[i]
     md.push('## [' + i + '] ' + e.kind + ' · ' + e.label + ' · case=' + e.case)
@@ -1288,6 +1338,8 @@ section('16 the captured prompt corpus is written for human review')
   assert(entries.some((e) => /【顺手形式化/.test(e.prompt) && /"formal":\{"target":"<对象id>","decision":"used\|blocked\|defect"/.test(e.prompt)), 'the corpus contains the formal reply contract line')
   assert(entries.some((e) => !/Lean|形式化/.test(e.prompt)), 'the corpus contains off-mode prompts with no Lean text at all')
   assert(entries.some((e) => e.kind === 'wake'), 'the corpus also keeps the continuation prompts (debate rounds)')
+  assert(entries.some((e) => e.kind === 'push' && /\[Vibe Math V2\] 进度更新/.test(e.prompt)), '★ the corpus carries the framework\'s PUSH report (reportMode=push)')
+  assert(entries.some((e) => e.kind === 'feedback' && /require 模式搁置/.test(e.prompt)), '★ and the require-gate withholding notice (the framework→human feedback channel)')
   // Generic sweeps over EVERY captured prompt, not spot checks (AUDIT §2.1).
   const joined = entries.map((e) => e.prompt).join('\n')
   const bare = entries.filter((e) => /(^|[^a-z_])lean_(run|archive|lib)/.test(e.prompt))