imprint-mcp 0.6.2 → 0.6.4

package/src/imprint/compile-agent.ts

@@ -11,6 +11,7 @@ import { join as pathJoin } from 'node:path';
 import {
   type AgentProgress,
   type AgentResult,
+  type AgentTool,
   type OnDeadlineReached,
   doneTool,
   giveUpTool,
@@ -19,7 +20,12 @@ import {
 import { type SharedModuleManifestEntry, resolvePlanSliceFromFile } from './build-plan.ts';
 import { compileViaClaudeCli } from './claude-cli-compile.ts';
 import { compileViaCodexCli } from './codex-cli-compile.ts';
-import type { CompileAgentProgress, CompileAgentResult } from './compile-agent-types.ts';
+import {
+  type CompileAgentProgress,
+  type CompileAgentResult,
+  advanceIncompleteSemanticVerificationRuns,
+  advanceSemanticVerificationCycle,
+} from './compile-agent-types.ts';
 import { formatCandidateContext, formatToolPlan } from './compile-agent-types.ts';
 import {
   applyLiveVerification,
@@ -29,11 +35,13 @@ import {
 } from './compile-tools.ts';
 import { type Replacement, extractCredentials } from './credential-extract.ts';
 import {
+  isInfrastructureOnlyInconclusiveReport,
   mergeSemanticParamVerification,
   runLiveSemanticVerification,
   semanticVerificationFailures,
 } from './live-verifier.ts';
 import {
+  DEFAULT_VERIFICATION_PROVIDER,
   type LLMOptions,
   type ProviderName,
   type ToolUseProvider,
@@ -43,6 +51,11 @@ import {
 } from './llm.ts';
 import { loadJsonFile } from './load-json.ts';
 import { createLog } from './log.ts';
+import {
+  canAcceptInconclusiveDecision,
+  compileArtifactFingerprint,
+  inconclusiveDecisionAtSemanticCap,
+} from './mcp-compile-server.ts';
 import { localSiteDir } from './paths.ts';
 import { rebindExistingBackendsCacheToWorkflow } from './probe-backends.ts';
 import { detectPageMintedHeaders, redactSession } from './redact.ts';
@@ -57,6 +70,31 @@ const log = createLog('compile-agent');
 const REPO_ROOT = pathJoin(import.meta.dir, '..', '..');
 const PROMPTS_DIR = pathJoin(REPO_ROOT, 'prompts');
 
+function compileDoneTool(): AgentTool {
+  const tool = doneTool();
+  return {
+    ...tool,
+    description:
+      'Call this when compilation is complete. After an infrastructure-only inconclusive live review, call it again on unchanged artifacts with an explicit acceptance decision and reasoning.',
+    input_schema: {
+      ...tool.input_schema,
+      properties: {
+        ...tool.input_schema.properties,
+        accept_inconclusive: {
+          type: 'boolean',
+          description:
+            'Explicitly ship an unchanged deterministic artifact after an infrastructure-only inconclusive live review.',
+        },
+        inconclusive_reason: {
+          type: 'string',
+          description:
+            'Concrete compiler reasoning for accepting the unchanged artifact without a liveVerified stamp.',
+        },
+      },
+    },
+  };
+}
+
 let claudeCliCompiler = compileViaClaudeCli;
 let codexCliCompiler = compileViaCodexCli;
 
@@ -237,7 +275,7 @@ export async function compileAgent(opts: CompileAgentOptions): Promise<CompileAg
       sharedModules: opts.sharedModules,
       revisionMode: opts.revisionMode,
     }),
-    doneTool(),
+    compileDoneTool(),
     giveUpTool(),
   ];
 
@@ -327,12 +365,20 @@ Begin by calling read_session_summary to orient yourself, then proceed per the s
   let conversationLog: AgentResult['conversationLog'] = [];
 
   const MAX_VERIFICATION_CYCLES = 5;
-  let verificationCycle = 0;
+  const MAX_INCOMPLETE_VERIFIER_RUNS = 2;
+  let semanticVerificationCycles = 0;
+  let incompleteVerifierRuns = 0;
+  let pendingInconclusive:
+    | {
+        artifactFingerprint: string;
+        report: Awaited<ReturnType<typeof runLiveSemanticVerification>>;
+      }
+    | undefined;
   let result: AgentResult | null = null;
   let currentInitialMessage = initialUserMessage;
 
-  while (verificationCycle < MAX_VERIFICATION_CYCLES) {
-    verificationCycle++;
+  while (true) {
+    const currentSemanticCycle = Math.min(semanticVerificationCycles + 1, MAX_VERIFICATION_CYCLES);
 
     // Wrap the user's onProgress callback to inject verification cycle info
     const userOnProgress = opts.onProgress;
@@ -340,7 +386,7 @@ Begin by calling read_session_summary to orient yourself, then proceed per the s
       ? (p: AgentProgress) =>
           userOnProgress({
             ...p,
-            verificationCycle,
+            verificationCycle: currentSemanticCycle,
             maxVerificationCycles: MAX_VERIFICATION_CYCLES,
           })
       : undefined;
@@ -399,42 +445,48 @@ Begin by calling read_session_summary to orient yourself, then proceed per the s
       log(`verification warnings (non-blocking):\n${warnings.join('\n')}`);
     }
 
+    let semanticReviewCompleted = false;
+    let semanticReviewAttempted = false;
     if (failures.length === 0) {
-      const semanticVerificationStartedAt = Date.now();
-      const semantic = await runLiveSemanticVerification({
-        provider: provider.name,
-        toolDir: absoluteToolDir,
-        evidence: integrationEvidence,
-        // Live semantic verification is a distinct phase. Do not inherit a
-        // nearly exhausted compile-agent deadline.
-      });
-      deadlineMs += Date.now() - semanticVerificationStartedAt;
-      failures.push(...semanticVerificationFailures(semantic.report));
-      if (semantic.report.status === 'approved_with_gaps') {
-        warnings.push(
-          `independent semantic verification approved with gaps: ${semantic.report.gaps.join('; ')}`,
-        );
-      }
-      if (failures.length === 0) {
-        // Success (possibly with explicit semantic gaps). Persist per-parameter
-        // flags and mint liveVerified=true only after independent approval.
-        applyLiveVerification(absoluteToolDir, undefined);
+      const doneInput = result.doneInput ?? {};
+      const currentFingerprint = compileArtifactFingerprint(absoluteToolDir);
+      if (
+        pendingInconclusive &&
+        canAcceptInconclusiveDecision({
+          semanticVerificationCycles,
+          maxVerificationCycles: MAX_VERIFICATION_CYCLES,
+          completedReview: pendingInconclusive.report.completedReview,
+          infrastructureOnly: isInfrastructureOnlyInconclusiveReport(
+            pendingInconclusive.report.report,
+          ),
+          pendingFingerprint: pendingInconclusive.artifactFingerprint,
+          currentFingerprint,
+          acceptInconclusive: doneInput.accept_inconclusive === true,
+          inconclusiveReason:
+            typeof doneInput.inconclusive_reason === 'string'
+              ? doneInput.inconclusive_reason
+              : undefined,
+        })
+      ) {
+        const semantic = pendingInconclusive.report;
+        const inconclusiveReason = String(doneInput.inconclusive_reason).trim();
+        applyLiveVerification(absoluteToolDir, {
+          kind: 'waived-infra',
+          firstError: inconclusiveReason,
+          exhaustedBackends: [],
+        });
         const paramWarnings = applyParamVerification(
           absoluteToolDir,
           mergeSemanticParamVerification(paramVerification, semantic.report),
         );
-        // liveVerified/parameter annotations change the hash-strict cache key,
-        // but not transport capabilities. Rebind the backend already exercised
-        // by the verifier instead of triggering another probe.
         rebindExistingBackendsCacheToWorkflow(absoluteToolDir);
-        const allWarnings = [...warnings, ...paramWarnings];
-        if (paramWarnings.length > 0) {
-          log(`parameter verification:\n${paramWarnings.join('\n')}`);
-        }
+        warnings.push(
+          `independent semantic verification was inconclusive: ${semantic.report.summary}`,
+          `compiler accepted the unchanged artifact without live verification: ${inconclusiveReason}`,
+          ...paramWarnings,
+        );
         message = result.doneSummary ?? 'Task completed';
-        if (allWarnings.length > 0) {
-          message += `\n\nWarnings:\n${allWarnings.join('\n')}`;
-        }
+        message += `\n\nWarnings:\n${warnings.join('\n')}`;
         if (!opts.keepTest) {
           for (const f of ['parser.test.ts', 'integration.test.ts']) {
             const testPath = pathJoin(absoluteToolDir, f);
@@ -443,22 +495,127 @@ Begin by calling read_session_summary to orient yourself, then proceed per the s
         }
         break;
       }
+
+      const capDecision = inconclusiveDecisionAtSemanticCap({
+        semanticVerificationCycles,
+        maxVerificationCycles: MAX_VERIFICATION_CYCLES,
+        pendingFingerprint: pendingInconclusive?.artifactFingerprint,
+        currentFingerprint,
+      });
+      if (capDecision === 'fail-artifact-changed') {
+        pendingInconclusive = undefined;
+        failures.push(
+          'compile artifacts changed after the final allowed inconclusive semantic review; refusing to run an additional review beyond the semantic cycle cap',
+        );
+      } else if (capDecision === 'await-compiler-decision') {
+        failures.push(
+          'semantic review limit reached with an unchanged infrastructure-only inconclusive result; explicitly accept the unverified artifact with reasoning or revise it',
+        );
+      } else {
+        if (pendingInconclusive && pendingInconclusive.artifactFingerprint !== currentFingerprint) {
+          pendingInconclusive = undefined;
+        }
+        const semanticVerificationStartedAt = Date.now();
+        semanticReviewAttempted = true;
+        const semantic = await runLiveSemanticVerification({
+          provider: DEFAULT_VERIFICATION_PROVIDER,
+          toolDir: absoluteToolDir,
+          evidence: integrationEvidence,
+          // Live semantic verification is a distinct phase. Do not inherit a
+          // nearly exhausted compile-agent deadline.
+        });
+        deadlineMs += Date.now() - semanticVerificationStartedAt;
+        semanticReviewCompleted = semantic.completedReview;
+        if (semantic.report.status === 'inconclusive') {
+          pendingInconclusive = {
+            artifactFingerprint: compileArtifactFingerprint(absoluteToolDir),
+            report: semantic,
+          };
+        } else {
+          pendingInconclusive = undefined;
+        }
+        failures.push(...semanticVerificationFailures(semantic.report));
+        if (semantic.report.status === 'approved_with_gaps') {
+          warnings.push(
+            `independent semantic verification approved with gaps: ${semantic.report.gaps.join('; ')}`,
+          );
+        }
+        if (failures.length === 0) {
+          // Success (possibly with explicit semantic gaps). Persist per-parameter
+          // flags and mint liveVerified=true only after independent approval.
+          applyLiveVerification(absoluteToolDir, undefined);
+          const paramWarnings = applyParamVerification(
+            absoluteToolDir,
+            mergeSemanticParamVerification(paramVerification, semantic.report),
+          );
+          // liveVerified/parameter annotations change the hash-strict cache key,
+          // but not transport capabilities. Rebind the backend already exercised
+          // by the verifier instead of triggering another probe.
+          rebindExistingBackendsCacheToWorkflow(absoluteToolDir);
+          const allWarnings = [...warnings, ...paramWarnings];
+          if (paramWarnings.length > 0) {
+            log(`parameter verification:\n${paramWarnings.join('\n')}`);
+          }
+          message = result.doneSummary ?? 'Task completed';
+          if (allWarnings.length > 0) {
+            message += `\n\nWarnings:\n${allWarnings.join('\n')}`;
+          }
+          if (!opts.keepTest) {
+            for (const f of ['parser.test.ts', 'integration.test.ts']) {
+              const testPath = pathJoin(absoluteToolDir, f);
+              if (existsSync(testPath)) unlinkSync(testPath);
+            }
+          }
+          break;
+        }
+      }
     }
 
     // Verification failed — re-enter the loop with a continuation message
-    if (verificationCycle >= MAX_VERIFICATION_CYCLES) {
+    semanticVerificationCycles = advanceSemanticVerificationCycle(
+      semanticVerificationCycles,
+      semanticReviewCompleted,
+    );
+    incompleteVerifierRuns = advanceIncompleteSemanticVerificationRuns(
+      incompleteVerifierRuns,
+      semanticReviewAttempted,
+      semanticReviewCompleted,
+    );
+    if (incompleteVerifierRuns >= MAX_INCOMPLETE_VERIFIER_RUNS) {
       outcome = 'error';
-      message = `Verification failed after ${MAX_VERIFICATION_CYCLES} cycles. Final failures:\n${failures.join('\n')}`;
+      message = `Independent semantic verifier failed to complete after ${MAX_INCOMPLETE_VERIFIER_RUNS} bounded runs. Final failures:\n${failures.join('\n')}`;
+      break;
+    }
+    const awaitingFinalInconclusiveDecision =
+      semanticVerificationCycles >= MAX_VERIFICATION_CYCLES && pendingInconclusive !== undefined;
+    if (
+      semanticVerificationCycles >= MAX_VERIFICATION_CYCLES &&
+      !awaitingFinalInconclusiveDecision
+    ) {
+      outcome = 'error';
+      message = `Semantic verification failed after ${MAX_VERIFICATION_CYCLES} cycles. Final failures:\n${failures.join('\n')}`;
       break;
     }
 
-    log(`verification failed (cycle ${verificationCycle}), resuming agent loop...`);
-    currentInitialMessage = `You called done but verification failed:
+    const failurePhase = semanticReviewCompleted
+      ? `semantic verification failed (cycle ${semanticVerificationCycles}/${MAX_VERIFICATION_CYCLES})`
+      : semanticReviewAttempted
+        ? 'semantic verifier did not complete a review (semantic cycle limit unchanged)'
+        : 'deterministic verification failed (semantic cycle limit unchanged)';
+    log(`${failurePhase}, resuming agent loop...`);
+    currentInitialMessage = `You called done but ${failurePhase}:
 
 ${failures.map((f) => `- ${f}`).join('\n')}
 
 Resume your work. Read the files you wrote (workflow.json, parser.ts, parser.test.ts), fix the issues, re-run tests, and call done again when fixed.`;
-    currentInitialMessage += `\n\nUse the verifier's semantic evidence, not a requirement for 100% of the original candidate inputs. If the core intent works but a secondary parameter cannot be supported from the recording and live evidence without guessing, remove that parameter and add workflow.limitations with omittedParameters and a specific reason. Do not use a limitation to hide a broken core tool, and do not keep a known broken or ignored public input.`;
+    currentInitialMessage += `\n\nUse the verifier's semantic evidence, not a requirement for 100% of the original candidate inputs. If the core intent works but a secondary parameter cannot be supported from the recording and live evidence without guessing, remove that parameter and add workflow.limitations with omittedParameters and a specific reason. Treat emitsTokens as downstream compatibility targets, not automatic definitions of producer success: when useful core records lack an optional consumer token, preserve the records and supported input classes, document the missing output and affected consumers, and leave those consumers limited/unverified. Narrow an input class only when its core results are unusable or misleading. Do not use a limitation to hide a broken core tool, and do not keep a known broken or ignored public input.`;
+    if (pendingInconclusive) {
+      currentInitialMessage +=
+        semanticVerificationCycles >= MAX_VERIFICATION_CYCLES &&
+        pendingInconclusive.report.completedReview
+          ? '\n\nThe final allowed live semantic review was infrastructure-only inconclusive. Review its evidence and log. If no tool defect is exposed and the unchanged deterministic artifact should ship explicitly unverified, call done again with accept_inconclusive=true and a concrete inconclusive_reason. This does not mint liveVerified.'
+          : '\n\nThe live verifier was infrastructure-only inconclusive. Review its evidence and log. Fix any exposed tool defect, or call done normally to request another independent review. Explicit unverified acceptance is available only after the semantic review limit is reached.';
+    }
   }
 
   // 10. Final flush of the complete conversation log

package/src/imprint/compile-tools.ts

@@ -57,6 +57,7 @@ import {
 } from './types.ts';
 
 const REPO_ROOT = pathJoin(import.meta.dir, '..', '..');
+const MAX_SHARED_MODULE_SOURCE_CHARS = 50_000;
 
 // Env var read by the agent-written parser.test.ts to locate the redacted
 // session. The test loads it, finds the load-bearing request seq, and feeds
@@ -160,11 +161,11 @@ function buildReadBuildPlanTool(
       ];
       if (emitsTokens.length > 0) {
         tokenNotes.push(
-          `PRODUCER CONTRACT: your parser MUST emit ${emitsTokens
+          `PRODUCER COMPATIBILITY TARGET: emit ${emitsTokens
             .map((e) => `\`${e.field}\``)
             .join(
               ', ',
-            )} in each result item, in the exact shape described (the FULL value a sibling consumer needs — never a bare fragment). Sibling tools mint their input from these fields; the verifier fails this tool if a declared field is missing from the parser output.`,
+            )} in the exact shape described whenever a live result supplies or proves the full value a sibling consumer needs. Never fabricate a missing token. Useful core records may retain a null/absent token when workflow.limitations names the missing output and affected consumers; preserve their supported input classes. A missing downstream token alone is not a reason to discard valid producer records.`,
         );
       }
       for (const tp of tokenParams) {
@@ -175,7 +176,7 @@ function buildReadBuildPlanTool(
           ? ` The producer declares shape: ${producerShape}. If that shape contains requiredKeys=[...], request-transform.ts must decode/unpack the fresh value and reference each required key in the outgoing request.`
           : '';
         tokenNotes.push(
-          `CONSUMER CONTRACT: param \`${tp.param}\` is an opaque token minted by the \`${tp.sourceTool}\` tool's \`${tp.sourceField}\` output.${shapeNote} Write a CHAINED \`param:${tp.param}\` integration test that calls \`runCapturedIntegrationCase\` on \`../${tp.sourceTool}/workflow.json\` directly inside the \`param:${tp.param}\` test block, reads \`${tp.sourceField}\` from the producer's ACTUAL output shape (top-level field, or an item in any returned collection such as flights/items/results), and passes THAT fresh value (not the recorded constant) into this tool — then asserts the response is non-empty. When several params come from the same producer, mint once and choose one producer item containing all sibling fields so the values stay from the same result. On producer bot/infra error, rethrow so the suite waives; if the producer ran but the field is absent, fix the producer parser/output contract instead of waiving. Do not fabricate a fallback value or mutate producer.result.data to make the test pass.`,
+          `CONSUMER CONTRACT: param \`${tp.param}\` is an opaque token minted by the \`${tp.sourceTool}\` tool's \`${tp.sourceField}\` output.${shapeNote} Write a CHAINED \`param:${tp.param}\` integration test that calls \`runCapturedIntegrationCase\` on \`../${tp.sourceTool}/workflow.json\` directly inside the \`param:${tp.param}\` test block, reads \`${tp.sourceField}\` from the producer's ACTUAL output shape (top-level field, or an item in any returned collection such as flights/items/results), and passes THAT fresh value (not the recorded constant) into this tool — then asserts the response is non-empty. When several params come from the same producer, mint once and choose one producer item containing all sibling fields so the values stay from the same result. On producer bot/infra error, rethrow so the suite waives. If useful producer records legitimately lack the field, do not fabricate or mutate output: keep this consumer verified:false, waived-chain, or inconclusive with diagnostics, and require an honest producer limitation.`,
         );
       }
       // Per-source wiring guidance for the general dependency contract. These are
@@ -212,6 +213,7 @@ function buildReadBuildPlanTool(
               kind: m.kind,
               purpose: m.purpose,
               exportSignatures: m.exportSignatures,
+              ...readAssignedSharedModuleSource(buildPlanPath, m.path),
             })),
             parserGuidance: slice.tool.parserGuidance,
             paramChecklist: slice.tool.paramChecklist,
@@ -238,6 +240,30 @@ function buildReadBuildPlanTool(
   };
 }
 
+function readAssignedSharedModuleSource(
+  buildPlanPath: string,
+  modulePath: string,
+): { source?: string; sourceTruncated?: boolean; sourceUnavailable?: string } {
+  const siteDir = realpathSync(dirname(buildPlanPath));
+  const candidate = pathJoin(siteDir, modulePath);
+  if (!existsSync(candidate)) {
+    return { sourceUnavailable: 'The verified shared module file is missing.' };
+  }
+
+  const resolved = realpathSync(candidate);
+  const relative = pathRelative(siteDir, resolved);
+  if (relative.startsWith('..') || relative === '') {
+    return { sourceUnavailable: 'The shared module resolved outside the site directory.' };
+  }
+
+  const source = readFileSync(resolved, 'utf8');
+  if (source.length <= MAX_SHARED_MODULE_SOURCE_CHARS) return { source };
+  return {
+    source: source.slice(0, MAX_SHARED_MODULE_SOURCE_CHARS),
+    sourceTruncated: true,
+  };
+}
+
 // ─── Tool: read_session_summary ──────────────────────────────────────────────
 
 export function buildReadSessionSummaryTool(
@@ -1887,24 +1913,121 @@ interface TestBlock {
   body: string;
 }
 
+function matchingClosingBrace(source: string, openIndex: number): number | null {
+  let depth = 0;
+  let quote: "'" | '"' | '`' | null = null;
+  let escaped = false;
+  let lineComment = false;
+  let blockComment = false;
+  for (let index = openIndex; index < source.length; index++) {
+    const char = source[index] ?? '';
+    const next = source[index + 1] ?? '';
+    if (lineComment) {
+      if (char === '\n') lineComment = false;
+      continue;
+    }
+    if (blockComment) {
+      if (char === '*' && next === '/') {
+        blockComment = false;
+        index++;
+      }
+      continue;
+    }
+    if (quote) {
+      if (escaped) {
+        escaped = false;
+      } else if (char === '\\') {
+        escaped = true;
+      } else if (char === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (char === '/' && next === '/') {
+      lineComment = true;
+      index++;
+      continue;
+    }
+    if (char === '/' && next === '*') {
+      blockComment = true;
+      index++;
+      continue;
+    }
+    if (char === "'" || char === '"' || char === '`') {
+      quote = char;
+      continue;
+    }
+    if (char === '{') depth++;
+    if (char === '}' && --depth === 0) return index;
+  }
+  return null;
+}
+
 function hasCapturedLiveWorkflowCall(source: string): boolean {
   return /\b(?:runWorkflowWithLadder|runCapturedIntegrationCase)\s*\(/.test(source);
 }
 
-/** Split a test file into `test(...)` / `it(...)` blocks (title + source from
- *  that test's start to the next test's start). Good enough to check whether a
- *  named per-parameter test's body actually calls the workflow. */
+/** Resolve small local function wrappers around a captured workflow call. The
+ * generated suites commonly factor one invocation helper above their tests;
+ * keeping the resolution local prevents a call in an unrelated param test from
+ * laundering a synthetic baseline elsewhere in the file. */
+function capturedWorkflowHelperNames(source: string): Set<string> {
+  const functionRe = /\b(?:async\s+)?function\s+([A-Za-z_$][\w$]*)\s*\([^)]*\)\s*\{/g;
+  const functions = [...source.matchAll(functionRe)].map((match) => ({
+    name: match[1] ?? '',
+    index: match.index ?? 0,
+  }));
+  const testStarts = [...source.matchAll(/\b(?:test|it)\s*\(/g)].map((match) => match.index ?? 0);
+  const boundaries = [...functions.map((entry) => entry.index), ...testStarts, source.length].sort(
+    (a, b) => a - b,
+  );
+  const bodies = new Map<string, string>();
+  for (const entry of functions) {
+    const end = boundaries.find((boundary) => boundary > entry.index) ?? source.length;
+    bodies.set(entry.name, source.slice(entry.index, end));
+  }
+  const captured = new Set<string>();
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const [name, body] of bodies) {
+      if (captured.has(name)) continue;
+      const callsCapturedHelper = [...captured].some((helper) =>
+        new RegExp(`\\b${helper.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*\\(`).test(body),
+      );
+      if (hasCapturedLiveWorkflowCall(body) || callsCapturedHelper) {
+        captured.add(name);
+        changed = true;
+      }
+    }
+  }
+  return captured;
+}
+
+/** Split a test file into `test(...)` / `it(...)` blocks (title + callback
+ *  source). Good enough to check whether a named per-parameter test's body
+ *  actually calls the workflow. */
 export function extractTestBlocks(src: string): TestBlock[] {
   const re = /\b(?:test|it)\s*\(\s*(['"`])((?:\\.|(?!\1).)*)\1/g;
-  const starts: Array<{ index: number; title: string }> = [];
+  const starts: Array<{ index: number; title: string; afterTitle: number }> = [];
   for (const m of src.matchAll(re)) {
-    starts.push({ index: m.index ?? 0, title: m[2] ?? '' });
+    starts.push({
+      index: m.index ?? 0,
+      title: m[2] ?? '',
+      afterTitle: (m.index ?? 0) + m[0].length,
+    });
   }
   const blocks: TestBlock[] = [];
   for (let i = 0; i < starts.length; i++) {
     const start = starts[i];
     if (!start) continue;
-    const end = i + 1 < starts.length ? (starts[i + 1]?.index ?? src.length) : src.length;
+    const fallbackEnd = i + 1 < starts.length ? (starts[i + 1]?.index ?? src.length) : src.length;
+    const callbackOpen = src.indexOf('{', start.afterTitle);
+    const callbackClose =
+      callbackOpen >= 0 && callbackOpen < fallbackEnd
+        ? matchingClosingBrace(src, callbackOpen)
+        : null;
+    const end = callbackClose === null ? fallbackEnd : callbackClose + 1;
     blocks.push({ title: start.title, body: src.slice(start.index, end) });
   }
   return blocks;
@@ -2287,6 +2410,7 @@ export function classifyIntegrationOutcome(input: {
  *  - chained pass → `{ verified: true, sourcedFrom }`
  *  - passed but not chained (the recorded-value tautology) → `unchained` (blocking)
  *  - suite waived (producer anti-bot) → `{ verified: false, reason: 'waived-chain' }`
+ *  - explicitly annotated unavailable producer output → `{ verified: false, reason: 'waived-chain' }`
  *  - else → `unchained` (blocking)
  */
 export function classifyParamCoverage(opts: {
@@ -2321,6 +2445,10 @@ export function classifyParamCoverage(opts: {
     const token = `param:${lp.name}`;
     const passedLive = [...opts.passedTests].some((n) => n.includes(token));
     const block = blocks.find((b) => b.title.includes(token));
+    const annotationRe = new RegExp(
+      `//\\s*exposed-but-not-verified[^\\n]*\\b${lp.name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`,
+    );
+    const isAnnotated = annotationRe.test(opts.integrationSrc);
 
     // Producer-sourced token param: requires a chained test that mints a fresh
     // value from the producer's sibling workflow.
@@ -2344,17 +2472,24 @@ export function classifyParamCoverage(opts: {
           reason: 'waived-chain',
           sourcedFrom,
         });
+      } else if (isAnnotated) {
+        // The compile agent may explicitly preserve a limited consumer when
+        // its producer returns useful core records but cannot mint this token.
+        // The durable verified:false+sourcedFrom stamp keeps orchestration
+        // honest; opaque defaults and passing recorded-token tests remain
+        // blocked by the independent guards above and below.
+        paramVerification.push({
+          name: lp.name,
+          verified: false,
+          reason: 'waived-chain',
+          sourcedFrom,
+        });
       } else {
         unchained.push(lp.name);
       }
       continue;
     }
 
-    const annotationRe = new RegExp(
-      `//\\s*exposed-but-not-verified[^\\n]*\\b${lp.name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`,
-    );
-    const isAnnotated = annotationRe.test(opts.integrationSrc);
-
     if (passedLive) {
       // Anti-tautology: a passing per-param test must actually exercise the live
       // workflow, not assert a constant.
@@ -2388,13 +2523,20 @@ export function hasLiveBaselineWorkflowTest(integrationSrc: string): boolean {
   const throwsOnFailure = /if\s*\(\s*!result\.ok\s*\)\s*\{[\s\S]{0,500}\bthrow\b/;
   const returnsOnFailedResult =
     /if\s*\([^)]*![^)]*\.result\.ok[\s\S]{0,200}\)\s*(?:\{[\s\S]{0,300}\breturn\b|return\b)/;
-  return extractTestBlocks(integrationSrc).some(
-    (block) =>
+  const capturedHelpers = capturedWorkflowHelperNames(integrationSrc);
+  return extractTestBlocks(integrationSrc).some((block) => {
+    const invokesCapturedWorkflow =
+      hasCapturedLiveWorkflowCall(block.body) ||
+      [...capturedHelpers].some((helper) =>
+        new RegExp(`\\b${helper.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*\\(`).test(block.body),
+      );
+    return (
       !block.title.includes('param:') &&
-      hasCapturedLiveWorkflowCall(block.body) &&
+      invokesCapturedWorkflow &&
       !returnsOnFailedResult.test(block.body) &&
-      (requiresOk.test(block.body) || throwsOnFailure.test(block.body)),
-  );
+      (requiresOk.test(block.body) || throwsOnFailure.test(block.body))
+    );
+  });
 }
 
 /**
@@ -4149,7 +4291,7 @@ export async function externalVerification(
         })
         .join(', ');
       failures.push(
-        `${coverage.unchained.length} producer-sourced token param(s) lack a CHAINED \`param:<name>\` test that mints a FRESH value from the producer tool: ${details}. Each test must call runWorkflowWithLadder on the named producer's \`workflow.json\`, read the named field from its result, and pass THAT value (not the recorded constant) into this tool — then assert the response is non-empty. If the producer only emits a bare fragment, fix the PRODUCER to emit the full value this tool consumes. See prompts/compile-agent.md "Producer-sourced token parameters".`,
+        `${coverage.unchained.length} producer-sourced token param(s) lack a CHAINED \`param:<name>\` test that mints a FRESH value from the producer tool: ${details}. Each test must call runWorkflowWithLadder on the named producer's \`workflow.json\`, read the named field from its result, and pass THAT value (not the recorded constant) into this tool — then assert the response is non-empty. If live producer results legitimately cannot supply the token, keep the consumer explicitly unverified with an \`// exposed-but-not-verified: <param> ...\` annotation and document the producer/consumer limitation instead of fabricating it. See prompts/compile-agent.md "Producer-sourced token parameters".`,
       );
     }
   }
@@ -4175,9 +4317,9 @@ export async function externalVerification(
           missing.length === 1 ? 'it' : 'them'
         } as an input token, but parser.ts does not emit ${
           missing.length === 1 ? 'that field' : 'those fields'
-        }. Emit ${
+        }. Reference ${
           missing.length === 1 ? 'it' : 'each'
-        } in every result item under the EXACT field name (the full value a consumer needs, never a bare fragment) — see read_build_plan "emitsTokens".`,
+        } under the EXACT field name and emit the full value whenever live evidence supplies it; null/absent values are allowed only for useful records whose missing output and affected consumers are documented in workflow.limitations — see read_build_plan "emitsTokens".`,
       );
     }