loopforge 3.2.1 → 3.7.0

package/dist/verification-gate.js

@@ -11,23 +11,40 @@
  *                 this round is excluded from the success trend (NOT
  *                 modified). Flags become hard constraints — the agent
  *                 must respond in the next round.
+ *
+ * v3.7: every check belongs to one of four verification domains (CHECK_DOMAIN
+ * below): evaluation consistency / evidence integrity / plan & contract /
+ * progress & recovery. A domain describes a check's semantic job — it never
+ * changes run order or verdict aggregation. Round Contract checks are further
+ * framed as declaration / execution / closure stages in their doc comments.
  */
-import { getPolicy } from "./policy.js";
+import { getPolicy, isConfiguredCommand } from "./policy.js";
 import { makeVerificationFlag, makeVerificationResult } from "./protocol.js";
-import { jaccardSimilarity, tokenize, entryRound as sharedEntryRound, isRecord } from "./token-utils.js";
+import { jaccardSimilarity, tokenize, isRecord, entryRound, extractFilePathTokens } from "./token-utils.js";
 import { deriveSubGoalId } from "./loop-compiler.js";
+import { committedRoundsFromEntries, machineGitMotionSeries, entryViolations } from "./committed-round.js";
+import { contractRoundEvaluations, contractDoneWhenSatisfied, contractItemMatches, deriveActiveRoundContract, } from "./round-contract.js";
+import { stableStringify } from "./canonical-state.js";
 import { deriveClaimView, resolveRoundFiles } from "./evidence-claims.js";
-import { effectiveSuccess } from "./self-eval.js";
+import { effectiveSuccess, parseRoundContract } from "./self-eval.js";
 // ═══════════════════════════════════════════════════════════════════════════
 // v2.12: Check-name constants — single source of truth so the enforcement
 // gate and audit can reference checks without string-literal drift.
+//
+// v3.7: every check belongs to one of four verification domains (CHECK_DOMAIN
+// below). The flag set was converged from 27 to 24:
+// - progress_regression removed — self-report-only decoration; machine-side
+//   progress policing lives in the enforcement gate's progress stall row.
+// - empty_change_with_passing removed — success without machine backing is
+//   already covered by the success-evidence arms below.
+// - success_claim_conflict merged into outcome_success_contradiction.
 // ═══════════════════════════════════════════════════════════════════════════
-export const CHECK_PROGRESS_REGRESSION = "progress_regression";
-export const CHECK_EMPTY_CHANGE_WITH_PASSING = "empty_change_with_passing";
 export const CHECK_SUCCESS_WITH_REMAINING_CRITERIA = "success_with_remaining_criteria";
 export const CHECK_SUCCESS_WITHOUT_VERIFIED_EVIDENCE = "success_without_verified_evidence";
+// v3.7: single id for the outcome-vs-success axis — error when a declared
+// success contradicts success=false, warn when success=true but the outcome
+// declares a non-success (the former success_claim_conflict direction).
 export const CHECK_OUTCOME_SUCCESS_CONTRADICTION = "outcome_success_contradiction";
-export const CHECK_SUCCESS_CLAIM_CONFLICT = "success_claim_conflict";
 export const CHECK_BLOCKED_WITHOUT_BLOCKER = "blocked_without_blocker";
 export const CHECK_RETROACTIVE_CLAIM_BAD_ROUND = "retroactive_claim_bad_round";
 export const CHECK_RETROACTIVE_CLAIM_UNVERIFIED = "retroactive_claim_unverified";
@@ -37,38 +54,179 @@ export const CHECK_RETRACT_FRESH_CONSTRAINT = "retract_fresh_constraint";
 export const CHECK_EVIDENCE_INTEGRITY = "evidence_integrity";
 export const CHECK_REQUIRED_COMMAND_FAILED = "required_command_failed";
 export const CHECK_COMMAND_EVIDENCE_MISMATCH = "command_evidence_mismatch";
+/** v3.3: Verification domain integrity — a command entrypoint (run-tests.sh,
+ *  package.json, …) changed in the same round the command ran. The runtime
+ *  executed a script the agent just rewrote, so the observation has no
+ *  stable baseline: error. Test-file changes are normal dev activity (TDD):
+ *  warn-only, see CHECK_TEST_FILES_MODIFIED. */
+export const CHECK_VERIFICATION_ENTRYPOINT_MODIFIED = "verification_entrypoint_modified";
+/** v3.3: Test files changed in the same round a verification command passed.
+ *  Warn-only — the command result stays usable. */
+export const CHECK_TEST_FILES_MODIFIED = "test_files_modified";
 export const CHECK_INTENT_DRIFT = "intent_drift";
 export const CHECK_SUBGOAL_DRIFT = "subgoal_drift";
 export const CHECK_BACKTRACK_WORKSPACE_NOT_RESTORED = "backtrack_workspace_not_restored";
 export const CHECK_CRITERIA_CLAIMS_UNVERIFIED = "criteria_claims_unverified";
-/** v3.2: success declared with no machine-verified observation this round
- *  (providerStatus ≠ verified). Warn-level: the round still commits, but its
- *  success never enters the trajectory and trust drops. */
-export const CHECK_SUCCESS_UNVERIFIED = "success_unverified";
+// v3.3 — Round Contract checks. v3.4: split by target. The submission's own
+// round_contract is a PROPOSAL for the NEXT round and is checked only
+// structurally at declaration (underspecified / unverifiable). Execution
+// conformance (scope drift / premature boundary) targets the ACTIVE
+// contract — the contract the round actually executed under, derived from
+// the committed evals of earlier rounds (round-contract.ts). All checks are
+// silent when their target is absent: contract-less rounds behave exactly
+// as before these checks existed, and round 1 (no committed rounds → no
+// active contract) never produces declaration off-by-one noise.
+// v3.7: the checks are framed as three contract stages — Declaration
+// (proposal quality: round_underspecified / round_unverifiable /
+// contract_premature), Execution (conformance under the ACTIVE contract:
+// round_scope_drift; premature_boundary's silently-dropped arm), Closure
+// (completion truth: contract_completion_unverified; premature_boundary's
+// claimed-met-unverified arm). The framing is documentation only — no phase
+// field exists on the contract.
+/** Contract proposed with an empty done_when — nothing is promised, so
+ *  nothing can be verified at the boundary. Warn: the contract can be fixed
+ *  by re-declaring next round. */
+export const CHECK_ROUND_UNDERSPECIFIED = "round_underspecified";
+/** done_when items exist but verification_plan is empty or names commands
+ *  that are not configured AND enabled in policy.evidence.commands — the
+ *  completion claims could never be machine-checked. Warn. */
+export const CHECK_ROUND_UNVERIFIABLE = "round_unverifiable";
+/** The round's actual git changes include files outside the ACTIVE
+ *  contract's declared scope. Warn + drift_clarification exemption
+ *  (R7-style). */
+export const CHECK_ROUND_SCOPE_DRIFT = "round_scope_drift";
+/** success claimed under the ACTIVE contract whose done_when items are
+ *  either claimed met without machine-verified evidence or silently dropped
+ *  (not in success_criteria_met NOR success_criteria_remaining). Error. */
+export const CHECK_PREMATURE_BOUNDARY = "premature_boundary";
+/** v3.5: Closing a Round Contract is a success-class claim and must be
+ *  machine-backed. The eval's met claims satisfy every done_when of the
+ *  ACTIVE contract but its verification_plan commands did not pass this
+ *  round. Error; warn under evidence.machine_backed_success "warn"; never
+ *  downgraded by no_change_reason (all done_when met contradicts "no
+ *  change"). Fail-open: plan names no longer configured+enabled are not
+ *  required (cannot observe). */
+export const CHECK_CONTRACT_COMPLETION_UNVERIFIED = "contract_completion_unverified";
+/** v3.5: The ACTIVE contract is still open (not completed, not blocked)
+ *  while a different contract was proposed — the proposal is ignored until
+ *  the active one closes. Warn: the walker still ignores it; this only
+ *  surfaces the otherwise-silent state. */
+export const CHECK_CONTRACT_PREMATURE = "contract_premature";
+export const CHECK_DOMAIN = {
+    // ── evaluation_consistency ────────────────────────────────────────────────
+    [CHECK_SUCCESS_WITH_REMAINING_CRITERIA]: "evaluation_consistency",
+    [CHECK_OUTCOME_SUCCESS_CONTRADICTION]: "evaluation_consistency",
+    [CHECK_BLOCKED_WITHOUT_BLOCKER]: "evaluation_consistency",
+    [CHECK_RETROACTIVE_CLAIM_BAD_ROUND]: "evaluation_consistency",
+    [CHECK_RETROACTIVE_CLAIM_UNVERIFIED]: "evaluation_consistency",
+    [CHECK_DUPLICATE_CONSTRAINT_DISCOVERY]: "evaluation_consistency",
+    [CHECK_RECURRING_VIOLATION]: "evaluation_consistency",
+    [CHECK_RETRACT_FRESH_CONSTRAINT]: "evaluation_consistency",
+    // ── evidence_integrity ────────────────────────────────────────────────────
+    [CHECK_SUCCESS_WITHOUT_VERIFIED_EVIDENCE]: "evidence_integrity",
+    [CHECK_CRITERIA_CLAIMS_UNVERIFIED]: "evidence_integrity",
+    [CHECK_EVIDENCE_INTEGRITY]: "evidence_integrity",
+    [CHECK_REQUIRED_COMMAND_FAILED]: "evidence_integrity",
+    [CHECK_COMMAND_EVIDENCE_MISMATCH]: "evidence_integrity",
+    [CHECK_VERIFICATION_ENTRYPOINT_MODIFIED]: "evidence_integrity",
+    [CHECK_TEST_FILES_MODIFIED]: "evidence_integrity",
+    // ── plan_contract ─────────────────────────────────────────────────────────
+    [CHECK_INTENT_DRIFT]: "plan_contract",
+    [CHECK_SUBGOAL_DRIFT]: "plan_contract",
+    [CHECK_ROUND_UNDERSPECIFIED]: "plan_contract",
+    [CHECK_ROUND_UNVERIFIABLE]: "plan_contract",
+    [CHECK_ROUND_SCOPE_DRIFT]: "plan_contract",
+    [CHECK_PREMATURE_BOUNDARY]: "plan_contract",
+    [CHECK_CONTRACT_COMPLETION_UNVERIFIED]: "plan_contract",
+    [CHECK_CONTRACT_PREMATURE]: "plan_contract",
+    // ── progress_recovery ─────────────────────────────────────────────────────
+    [CHECK_BACKTRACK_WORKSPACE_NOT_RESTORED]: "progress_recovery",
+};
 // ═══════════════════════════════════════════════════════════════════════════
 // Helpers
 // ═══════════════════════════════════════════════════════════════════════════
-/** Extract the round number from a vault entry's loop_lineage.
- *  Returns 0 if the entry has no lineage or no round field.
- *  In practice, persistLoopLineage always writes round ≥ 1, so 0
- *  unambiguously means "not a valid round entry" in this context.
- *  Exported for reuse by enforcement-gate.ts. */
-export function entryRound(entry) {
-    return sharedEntryRound(entry);
-}
-/** Read constraint_violations from a vault entry (entry-level, stored from
- *  the previous round's last_round_result at persist time). */
-function entryViolations(entry) {
-    const viols = entry.constraint_violations;
-    if (Array.isArray(viols))
-        return viols.filter((v) => typeof v === "string");
-    return [];
+// ── v3.3: Round Contract scope matching ─────────────────────────────────────
+/** Normalize a contract scope entry: backslashes → forward slashes, strip
+ *  leading "./", trim, strip trailing slashes. "." / "./" / "" normalize to
+ *  "" = the repository root (everything is in scope). */
+export function normalizeScopeEntry(path) {
+    let s = path.replace(/\\/g, "/").trim();
+    while (s.startsWith("./"))
+        s = s.slice(2);
+    if (s === "." || s === "")
+        return "";
+    while (s.endsWith("/"))
+        s = s.slice(0, -1);
+    return s;
+}
+/** Whether a git-diff file path falls inside any declared scope entry:
+ *  exact file match, or the file lives under a declared directory. The ""
+ *  entry (repo root) matches everything. Git paths are always workspace-
+ *  relative with forward slashes. */
+export function isFileInScope(file, scope) {
+    const normalizedFile = normalizeScopeEntry(file);
+    for (const entry of scope) {
+        const normalized = normalizeScopeEntry(entry);
+        if (normalized === "" || normalizedFile === normalized ||
+            normalizedFile.startsWith(normalized + "/")) {
+            return true;
+        }
+    }
+    return false;
+}
+/** Git-diff files outside the declared scope (the round_scope_drift signal). */
+export function collectOutOfScopeFiles(files, scope) {
+    return files.filter((file) => !isFileInScope(file, scope));
+}
+/** v3.3: Detect verification-domain tampering for a command snapshot.
+ *  entrypointModified — a workspace file the command depends on
+ *  (snapshot.data.entrypointFiles) changed this round: the runtime executed
+ *  a script the agent just rewrote, so the "machine observation" has no
+ *  stable baseline. testFilesModified — the round changed test files
+ *  (isTestFile): normal in TDD, so warn-only; the command result stays
+ *  usable. Pure snapshot derivation — no fs access (this module is pure). */
+function commandTampered(snapshot, gitSnapshot) {
+    if (!gitSnapshot)
+        return { entrypointModified: false, testFilesModified: false };
+    const gitFiles = new Set(gitSnapshot.files);
+    const entrypoints = isRecord(snapshot.data) &&
+        Array.isArray(snapshot.data.entrypointFiles)
+        ? snapshot.data.entrypointFiles.filter((f) => typeof f === "string")
+        : [];
+    const entrypointModified = entrypoints.some((file) => gitFiles.has(file));
+    const testFilesModified = [...gitFiles].some((file) => isTestFile(file));
+    return { entrypointModified, testFilesModified };
 }
 function passedAfterCommand(snapshots) {
+    const git = snapshots.find((snapshot) => snapshot.provider === "git") ?? null;
     return snapshots.find((snapshot) => isRecord(snapshot.data) &&
         snapshot.data.kind === "command" &&
         snapshot.data.phase === "after" &&
-        snapshot.data.status === "passed") ?? null;
+        snapshot.data.status === "passed" &&
+        // v3.3: a command whose entrypoint changed this round is not machine
+        // evidence — exclude it so providerStatus degrades to unavailable.
+        !commandTampered(snapshot, git).entrypointModified) ?? null;
+}
+/** v3.5: Names of commands observed passing in the after-phase this round.
+ *  Tampered commands (entrypoint changed this round) are not machine
+ *  evidence and are excluded — the same rule passedAfterCommand applies. */
+function passedPlanCommandNames(snapshots) {
+    const git = snapshots.find((snapshot) => snapshot.provider === "git") ?? null;
+    const names = new Set();
+    for (const snapshot of snapshots) {
+        if (!isRecord(snapshot.data))
+            continue;
+        if (snapshot.data.kind !== "command")
+            continue;
+        if (snapshot.data.phase !== "after" || snapshot.data.status !== "passed")
+            continue;
+        if (commandTampered(snapshot, git).entrypointModified)
+            continue;
+        const name = snapshot.data.commandName;
+        if (typeof name === "string" && name.length > 0)
+            names.add(name);
+    }
+    return names;
 }
 /** v3.2: Derive the machine-verification status of a round. The verification
  *  capability is modeled explicitly (verified / unavailable / absent) instead
@@ -99,9 +257,17 @@ export function deriveEvidenceStatus(selfEval, evidenceSnapshots) {
         reportedFilesMatch = reportedSet.length === actualSet.length &&
             reportedSet.every((file, index) => file === actualSet[index]);
     }
+    // v3.3: git observation alone is no longer "verified" — the machine seeing
+    // file changes is not the machine verifying success. Only a passed
+    // after-phase command (observed by the runtime itself) upgrades a round.
+    // Any other snapshot presence is "unavailable": the machine saw activity
+    // (or nothing at all this round) but could not verify the success claim,
+    // so R8 warns and trust drops (v3.6: merged success_unverified semantics).
     const providerStatus = evidenceSnapshots.length === 0
         ? "absent"
-        : gitObserved || commandVerified ? "verified" : "unavailable";
+        : commandVerified
+            ? "verified"
+            : "unavailable";
     return {
         providerStatus,
         gitObserved,
@@ -110,85 +276,13 @@ export function deriveEvidenceStatus(selfEval, evidenceSnapshots) {
         reportedFilesMatch,
     };
 }
-/** v3.2: Per-round machine progress — whether git observed file changes in
- *  each of the last `lookback` committed rounds, rebuilt from the feedback
- *  entries' roundEvidence snapshots (already persisted at commit). Returns
- *  null when fewer than `lookback` rounds carry git snapshots — the machine
- *  signal is unavailable and callers (R4/R5 on the heuristic path) keep
- *  their legacy skip. The snapshot shape is parsed defensively here because
- *  this module must not import round-transaction (import cycle). */
+/** Per-round machine progress over decoded committed history. */
 export function machineProgressSeries(vaultEntries, currentRound, lookback) {
-    const byRound = new Map();
-    for (const entry of vaultEntries) {
-        const tid = String(entry.task_id ?? "");
-        if (!tid.endsWith(":feedback"))
-            continue;
-        const rnd = entryRound(entry);
-        if (rnd <= 0 || rnd >= currentRound)
-            continue;
-        const rt = isRecord(entry.loop_lineage)
-            ? entry.loop_lineage.round_transaction
-            : null;
-        const snapshot = isRecord(rt) ? rt.snapshot : null;
-        const roundEvidence = isRecord(snapshot) ? snapshot.roundEvidence : null;
-        if (!Array.isArray(roundEvidence))
-            continue;
-        const git = roundEvidence.find((value) => isRecord(value) && value.provider === "git");
-        if (!git)
-            continue;
-        const gitFiles = git.files;
-        byRound.set(rnd, Array.isArray(gitFiles) && gitFiles.length > 0);
-    }
-    if (byRound.size < lookback)
-        return null;
-    const sorted = [...byRound.keys()].sort((a, b) => a - b);
-    const recent = sorted.slice(-lookback);
-    // Continuity: the recent rounds must be the actual last `lookback` rounds.
-    if (recent[0] < currentRound - lookback)
-        return null;
-    return recent.map((round) => byRound.get(round));
+    return machineGitMotionSeries(committedRoundsFromEntries(vaultEntries, currentRound), currentRound, lookback);
 }
 // ═══════════════════════════════════════════════════════════════════════════
 // Individual checks — each returns a VerificationFlag or null
 // ═══════════════════════════════════════════════════════════════════════════
-function checkProgressRegression(selfEval, prevSelfEval) {
-    if (!prevSelfEval?.execution_evidence)
-        return null;
-    if (!selfEval.execution_evidence)
-        return null;
-    const prevProgress = prevSelfEval.execution_evidence.progress_estimate;
-    const currProgress = selfEval.execution_evidence.progress_estimate;
-    if (typeof prevProgress !== "number" || typeof currProgress !== "number")
-        return null;
-    // Use delta with epsilon to avoid IEEE 754 rounding issues (0.8 - 0.2 > 0.6 in float)
-    if (prevProgress - currProgress <= 0.2 + 1e-10)
-        return null;
-    return makeVerificationFlag({
-        severity: "warn",
-        field: "progress_estimate",
-        check: CHECK_PROGRESS_REGRESSION,
-        detail: `Progress dropped from ${prevProgress.toFixed(2)} to ` +
-            `${currProgress.toFixed(2)} (delta: ${(currProgress - prevProgress).toFixed(2)})`,
-    });
-}
-function checkEmptyChangeWithPassing(selfEval) {
-    const ev = selfEval.execution_evidence;
-    if (!ev)
-        return null;
-    const filesEmpty = ev.files_changed.length === 0;
-    const testsAllPass = ev.test_results !== null &&
-        ev.test_results.failed === 0 &&
-        ev.test_results.passed > 0;
-    if (!filesEmpty || !testsAllPass || !effectiveSuccess(selfEval))
-        return null;
-    return makeVerificationFlag({
-        severity: "warn",
-        field: "execution_evidence",
-        check: CHECK_EMPTY_CHANGE_WITH_PASSING,
-        detail: "Agent claims success with no files changed and all tests passing — " +
-            "verify that work was actually performed",
-    });
-}
 function checkSuccessWithRemainingCriteria(selfEval) {
     if (!effectiveSuccess(selfEval))
         return null;
@@ -222,10 +316,12 @@ function checkUnverifiedCriteriaClaims(selfEval, claimView) {
             "(no passing test evidence or command snapshot)",
     });
 }
-/** v2.12: Declared outcome vs legacy boolean consistency. A declared success
- *  with success=false is a self-contradiction (error); a declared non-success
- *  with success=true is a compat conflict (warn). Also: outcome==="blocked"
- *  without a blocker description gets a warn so the next prompt asks for it. */
+/** Declared outcome vs the core success flag — one check id for the whole
+ *  axis (v3.7: the former success_claim_conflict warn direction merged here).
+ *  A declared success with success=false is a self-contradiction (error);
+ *  success=true with a non-success outcome is an inconsistent claim (warn).
+ *  Also: outcome==="blocked" without a blocker description gets a warn so the
+ *  next prompt asks for it. */
 function checkOutcomeConsistency(selfEval) {
     const outcome = selfEval.outcome;
     if (outcome === "success" && selfEval.success === false) {
@@ -240,7 +336,7 @@ function checkOutcomeConsistency(selfEval) {
         return makeVerificationFlag({
             severity: "warn",
             field: "success",
-            check: CHECK_SUCCESS_CLAIM_CONFLICT,
+            check: CHECK_OUTCOME_SUCCESS_CONTRADICTION,
             detail: `outcome=${outcome} but success=true — the declared outcome wins`,
         });
     }
@@ -288,7 +384,7 @@ function checkRetroactiveClaims(selfEval, vaultEntries, currentRound) {
             }));
             continue;
         }
-        const paths = extractFilePaths(claim.claim);
+        const paths = extractFilePathTokens(claim.claim);
         const unverified = paths.filter((path) => !observed.some((file) => file === path || file.endsWith(path) || path.endsWith(file)));
         if (paths.length > 0 && unverified.length > 0) {
             flags.push(makeVerificationFlag({
@@ -300,50 +396,67 @@ function checkRetroactiveClaims(selfEval, vaultEntries, currentRound) {
             }));
         }
     }
-    return flags.length > 0 ? flags[0] : null;
+    // v3.3.1: return every offending claim's flag — a single truncated flag
+    // hid all but the first problem until the next round.
+    return flags.length > 0 ? flags : null;
 }
-/** v2.12: success with zero machine-verifiable evidence. The agent claims
- *  completion but nothing the runtime observed backs it — no verified claims
- *  (test evidence), no test results, no required commands. A declared
- *  no_change_reason is the honest escape hatch: it downgrades to info. */
-function checkSuccessWithoutVerifiedEvidence(selfEval, claimView) {
+/** v2.12/v3.6/v3.7: success without machine backing — the single
+ *  "success evidence" semantic. Two arms, evaluated in order:
+ *  1. Empty/missing-evidence arm (v3.7: absorbed the enforcement-only
+ *     empty_success rule): success=true with NO execution_evidence at all, or
+ *     with files_changed empty AND test_results null, is an error
+ *     unconditionally — BEFORE the providerStatus early-exit, so a passed
+ *     command never rescues it (execution_evidence stays mandatory), and
+ *     neither evidence.machine_backed_success "warn" nor a declared
+ *     no_change_reason downgrades it ("no change" with literally no evidence
+ *     recorded is still an unbacked claim).
+ *  2. Claims arm (v3.6): success=true but the runtime observed no machine
+ *     evidence for it. The trigger is the runtime-derived providerStatus
+ *     (verified / unavailable / absent) — "verified" requires an UNTAMPERED
+ *     passed after-command, so an entrypoint-tampered command no longer
+ *     counts as machine evidence. Severity follows evidence.machine_backed_
+ *     success — "required" rejects (error), "warn" tolerates with a warn
+ *     (round commits, success excluded from the trajectory, trust drops). A
+ *     declared no_change_reason is the honest escape hatch: it downgrades to
+ *     info. no_change_reason is honored HERE ONLY — contract checks refuse it. */
+function checkSuccessWithoutVerifiedEvidence(selfEval, status) {
     if (!effectiveSuccess(selfEval))
         return null;
-    if (claimView.verifiedCount > 0 || claimView.hasMachineEvidence)
+    // v3.7: empty/missing-evidence arm (ex-R3 empty_success posture).
+    const ev = selfEval.execution_evidence;
+    if (!ev || (ev.files_changed.length === 0 && ev.test_results === null)) {
+        return makeVerificationFlag({
+            severity: "error",
+            field: "success",
+            check: CHECK_SUCCESS_WITHOUT_VERIFIED_EVIDENCE,
+            detail: ev
+                ? "Agent claims success but execution_evidence shows no files changed " +
+                    "and no tests were run. There is no verifiable evidence of work."
+                : "Agent claims success but provided no execution_evidence. " +
+                    "Every successful round MUST include execution_evidence with " +
+                    "files_changed, test_results, and progress_estimate.",
+        });
+    }
+    // Claims arm (v3.6).
+    if (status.providerStatus === "verified")
         return null;
     const noChange = typeof selfEval.no_change_reason === "string" &&
         selfEval.no_change_reason.trim().length > 0;
+    // v3.3: severity follows evidence.machine_backed_success — "required"
+    // rejects (error), "warn" tolerates with a warn (round commits, success
+    // excluded from the trajectory, trust drops). no_change_reason stays info.
+    const severity = noChange
+        ? "info"
+        : getPolicy().evidence.machine_backed_success === "warn"
+            ? "warn"
+            : "error";
     return makeVerificationFlag({
-        severity: noChange ? "info" : "error",
+        severity,
         field: "success",
         check: CHECK_SUCCESS_WITHOUT_VERIFIED_EVIDENCE,
         detail: noChange
             ? "success with zero verified claims (no_change_reason declared)"
-            : "success with zero verified claims and no test evidence",
-    });
-}
-/** v3.2: success declared but no machine-verified observation this round.
- *  Unlike R8 (which keys off the agent's SELF-REPORTED test_results), this
- *  keys off the runtime-derived providerStatus: git diff observed, or a
- *  passed after-command. Warn-level by design — the round commits, but its
- *  success never enters the trajectory (and trust drops). A declared
- *  no_change_reason is the honest escape hatch, mirroring R8.
- *  Crucially this check does NOT self-skip on the heuristic-extraction path:
- *  an unstructured success claim without machine observation is flagged
- *  exactly the same — the check degrades, it never disappears. */
-function checkSuccessUnverified(selfEval, status) {
-    if (!effectiveSuccess(selfEval))
-        return null;
-    if (typeof selfEval.no_change_reason === "string" &&
-        selfEval.no_change_reason.trim().length > 0)
-        return null;
-    if (status.providerStatus === "verified")
-        return null;
-    return makeVerificationFlag({
-        severity: "warn",
-        field: "success",
-        check: CHECK_SUCCESS_UNVERIFIED,
-        detail: `success declared but no machine-verified observation this round (providerStatus: ${status.providerStatus})`,
+            : `success declared but no machine-verified observation this round (providerStatus: ${status.providerStatus})`,
     });
 }
 function checkDuplicateConstraintDiscovery(selfEval, prevSelfEval, olderViolations) {
@@ -513,10 +626,6 @@ function checkRequiredCommandEvidence(selfEval, evidenceSnapshots) {
 function extractSubGoalIds(text) {
     return [...new Set(text.toLowerCase().match(/sg-[a-f0-9]{8}/g) ?? [])];
 }
-/** Extract file-path-like tokens (e.g. "src/auth/login.ts") from text. */
-function extractFilePaths(text) {
-    return [...new Set(text.match(/[\w./-]+\.[a-z]{2,6}\b/gi) ?? [])];
-}
 /** Whether a changed path looks like a test file. */
 function isTestFile(path) {
     return /\.(test|spec)\.[a-z0-9]+$/i.test(path) ||
@@ -594,7 +703,7 @@ function checkIntentDrift(selfEval, prevSelfEval, vaultEntries) {
             return null;
     }
     // ── Signal 2: file paths named in next_action appear in files_changed
-    const intentPaths = extractFilePaths(intent);
+    const intentPaths = extractFilePathTokens(intent);
     if (intentPaths.length > 0 && filesChanged.length > 0) {
         const pathMatched = intentPaths.some((p) => filesChanged.some((f) => f === p || f.endsWith(p) || p.endsWith(f)));
         if (pathMatched)
@@ -740,6 +849,48 @@ function checkCommandEvidenceIntegrity(selfEval, evidenceSnapshots) {
     }
     return null;
 }
+/** v3.3: Verification domain integrity — command entrypoints and test files
+ *  changed in the same round the command ran. Entrypoint modification
+ *  invalidates the machine observation (error: the runtime executed a script
+ *  the agent just rewrote). Test-file changes are normal dev activity (warn:
+ *  confirm the tests still verify the task claims). Fail-open when the git
+ *  snapshot is missing or the command has no resolvable entrypoint. */
+function checkVerificationDomainIntegrity(evidenceSnapshots) {
+    const git = evidenceSnapshots.find((snapshot) => snapshot.provider === "git") ?? null;
+    if (!git)
+        return null;
+    for (const snapshot of evidenceSnapshots) {
+        if (!isRecord(snapshot.data) || snapshot.data.kind !== "command")
+            continue;
+        if (snapshot.data.phase !== "after")
+            continue;
+        const { entrypointModified, testFilesModified } = commandTampered(snapshot, git);
+        if (!entrypointModified && !testFilesModified)
+            continue;
+        const name = typeof snapshot.data.commandName === "string"
+            ? snapshot.data.commandName
+            : snapshot.provider;
+        if (entrypointModified) {
+            return makeVerificationFlag({
+                severity: "error",
+                field: "execution_evidence",
+                check: CHECK_VERIFICATION_ENTRYPOINT_MODIFIED,
+                detail: `Verification command "${name}" entrypoint changed this round — ` +
+                    "its result cannot be trusted as machine evidence. Keep the " +
+                    "verification command stable or resubmit the same round with the " +
+                    "entrypoint unchanged.",
+            });
+        }
+        return makeVerificationFlag({
+            severity: "warn",
+            field: "execution_evidence",
+            check: CHECK_TEST_FILES_MODIFIED,
+            detail: `Test files changed in the same round command "${name}" passed — ` +
+                "confirm the tests still verify the task claims.",
+        });
+    }
+    return null;
+}
 /** v2.2: Check if the agent's declared next_action aligns with any pending
  *  or in_progress sub-goal. When 3+ pending sub-goals exist but the agent
  *  plans work unrelated to any of them, it may indicate task drift.
@@ -881,13 +1032,225 @@ function checkBacktrackGitHeadRestore(evidenceSnapshots, backtrackTargetGitHead)
     });
 }
 // ═══════════════════════════════════════════════════════════════════════════
+// v3.3 — Round Contract checks (all silent when no contract is declared)
+// ═══════════════════════════════════════════════════════════════════════════
+/** A PROPOSAL that promises nothing is a wasted round's worth of trust:
+ *  done_when empty means the boundary can never be machine-checked.
+ *  v3.4: declaration-quality check on the submission's own proposal — never
+ *  on the (derived) active contract. */
+function checkRoundUnderspecified(selfEval) {
+    const contract = selfEval.round_contract;
+    if (!contract)
+        return null;
+    if (contract.done_when.length > 0)
+        return null;
+    return makeVerificationFlag({
+        severity: "warn",
+        field: "round_contract",
+        check: CHECK_ROUND_UNDERSPECIFIED,
+        detail: "Round Contract declared with an empty done_when — nothing is " +
+            "promised, so completion cannot be verified. Declare what must be " +
+            "true when the round is done.",
+    });
+}
+/** done_when items whose verification_plan cannot run (empty plan, or names
+ *  outside the configured, enabled evidence.commands) can never be
+ *  machine-checked at the boundary. v3.4: declaration-quality check on the
+ *  submission's own proposal. */
+function checkRoundUnverifiable(selfEval) {
+    const contract = selfEval.round_contract;
+    if (!contract)
+        return null;
+    if (contract.done_when.length === 0)
+        return null;
+    if (contract.verification_plan.length > 0 &&
+        contract.verification_plan.every((name) => isConfiguredCommand(name))) {
+        return null;
+    }
+    const unknown = contract.verification_plan.filter((name) => !isConfiguredCommand(name));
+    const detail = contract.verification_plan.length === 0
+        ? "done_when items declared but verification_plan is empty — no command " +
+            "can back the completion claims"
+        : `verification_plan names commands that are not configured and enabled ` +
+            `in evidence.commands: ${unknown.slice(0, 3).join(", ")}`;
+    return makeVerificationFlag({
+        severity: "warn",
+        field: "round_contract",
+        check: CHECK_ROUND_UNVERIFIABLE,
+        detail: detail + ". Name only configured, enabled evidence.commands, or drop " +
+            "done_when items that cannot be machine-verified.",
+    });
+}
+/** The round changed files outside the ACTIVE contract's declared scope.
+ *  Git diff files are the machine-authoritative "what actually changed" set.
+ *  v3.4: targets the contract the round actually executed under — derived
+ *  from committed evals, never the submission's own proposal. Silent when
+ *  no active contract exists (round 1 and whole-task rounds: the agent
+ *  executed the original task, not a contract boundary). */
+function checkRoundScopeDrift(activeContract, evidenceSnapshots) {
+    if (!activeContract)
+        return null;
+    if (activeContract.scope.length === 0)
+        return null;
+    const git = evidenceSnapshots.find((snapshot) => snapshot.provider === "git");
+    if (!git)
+        return null; // git unavailable → cannot observe → fail open
+    const outOfScope = collectOutOfScopeFiles(git.files, activeContract.scope);
+    if (outOfScope.length === 0)
+        return null;
+    return makeVerificationFlag({
+        severity: "warn",
+        field: "round_contract",
+        check: CHECK_ROUND_SCOPE_DRIFT,
+        detail: `Files changed outside the active contract's declared scope` +
+            (outOfScope.length > 5
+                ? ` (${outOfScope.length} total, showing 5): ${outOfScope.slice(0, 5).join(", ")}`
+                : `: ${outOfScope.join(", ")}`) +
+            `. Revert them or extend the contract scope and explain in drift_clarification.`,
+    });
+}
+/** success claimed under the ACTIVE contract whose done_when items were not
+ *  honestly and verifiably completed: claimed met with no machine-verified
+ *  evidence this round, or silently dropped (present in neither
+ *  success_criteria_met nor success_criteria_remaining).
+ *  v3.4: targets the derived ACTIVE contract (the round's real boundary) —
+ *  a proposal declared on a round without an active contract is never
+ *  checked for conformance against work the round did not do under it.
+ *  v3.5.1: a fully-met posture (every done_when claimed satisfied) is owned
+ *  by contract_completion_unverified — this check stays for mixed and
+ *  silently-dropped success claims only.
+ *  v3.6: no_change_reason never downgrades this check — the escape hatch
+ *  belongs to the R8 success-claim family alone; a declared "no change"
+ *  contradicts silently dropping contract done_when items. */
+function checkPrematureBoundary(activeContract, selfEval, claimView) {
+    if (!activeContract || activeContract.done_when.length === 0)
+        return null;
+    if (!effectiveSuccess(selfEval))
+        return null;
+    const ev = selfEval.execution_evidence;
+    const met = ev?.success_criteria_met ?? [];
+    // v3.5.1: full-met → the completion check owns the posture (it also fires
+    // on success=false, so nothing is lost — and under machine_backed_success
+    // "warn" the same tolerance applies on both sides).
+    if (contractDoneWhenSatisfied(activeContract, met))
+        return null;
+    const remaining = ev?.success_criteria_remaining ?? [];
+    const problems = [];
+    for (const item of activeContract.done_when) {
+        // Shared matcher with the lifecycle walker (round-contract.ts) — the
+        // compile-side closure decision and this conformance check can never
+        // disagree on what counts as a satisfied item.
+        const isMet = met.some((m) => contractItemMatches(item, m));
+        const isRemaining = remaining.some((r) => contractItemMatches(item, r));
+        if (isMet) {
+            // Claimed met — needs round-level machine verification. The v3.3
+            // claim model is round-uniform: any verified claim backs the round,
+            // so zero verified claims = none of them are backed.
+            if (claimView.verifiedCount === 0) {
+                problems.push(`"${item.slice(0, 80)}" claimed met without machine-verified evidence`);
+            }
+        }
+        else if (!isRemaining) {
+            // Neither met nor remaining — silently dropped while success is
+            // claimed. Honest reporting would list it in remaining (R1's domain).
+            problems.push(`"${item.slice(0, 80)}" neither met nor listed as remaining`);
+        }
+    }
+    if (problems.length === 0)
+        return null;
+    return makeVerificationFlag({
+        severity: "error",
+        field: "round_contract",
+        check: CHECK_PREMATURE_BOUNDARY,
+        detail: `Round Contract boundary claimed prematurely: ${problems.slice(0, 3).join("; ")}. ` +
+            `Run the contract's verification_plan commands and report real output, ` +
+            `or set success=false and list the items in success_criteria_remaining.`,
+    });
+}
+/** v3.5: Closing a Round Contract is a success-class claim and must be
+ *  machine-backed. When the eval's met claims satisfy EVERY done_when of
+ *  the ACTIVE contract (the walker's close condition), each verification_plan
+ *  command must have been observed passing (after-phase command snapshot,
+ *  untampered) in the same round. Fires regardless of the success flag —
+ *  a claim-based closure that the machine cannot back must not advance the
+ *  contract state machine. Severity follows evidence.machine_backed_success
+ *  (the R8 tolerance switch). Deliberately no no_change_reason downgrade:
+ *  all done_when met contradicts "no change". Fail-open: a plan name that
+ *  is no longer a configured, enabled command cannot be observed and is
+ *  not required. The check observes that the commands ran, not what they
+ *  verified — R-C1's claim model remains the content bound. */
+function checkContractCompletionUnverified(activeContract, selfEval, evidenceSnapshots) {
+    if (!activeContract || activeContract.verification_plan.length === 0)
+        return null;
+    const met = selfEval.execution_evidence?.success_criteria_met ?? [];
+    if (!contractDoneWhenSatisfied(activeContract, met))
+        return null; // walker does not close
+    const required = activeContract.verification_plan
+        .filter((name) => isConfiguredCommand(name));
+    if (required.length === 0)
+        return null; // fail open — cannot observe
+    const passed = passedPlanCommandNames(evidenceSnapshots);
+    const missing = required.filter((name) => !passed.has(name));
+    if (missing.length === 0)
+        return null;
+    const severity = getPolicy().evidence.machine_backed_success === "warn"
+        ? "warn"
+        : "error";
+    return makeVerificationFlag({
+        severity,
+        field: "round_contract",
+        check: CHECK_CONTRACT_COMPLETION_UNVERIFIED,
+        detail: `Round Contract completion claimed (every done_when met), but verification_plan ` +
+            `command${missing.length > 1 ? "s" : ""} did not pass this round: ` +
+            `${missing.slice(0, 3).join(", ")}. Closing a contract is a success-class claim — ` +
+            `fix the underlying failure so the command${missing.length > 1 ? "s" : ""} pass and ` +
+            `resubmit; no_change_reason does not apply to completion claims.`,
+    });
+}
+/** v3.5: A different contract proposed while the ACTIVE contract is still
+ *  open. The walker ignores the premature proposal — this warn only makes
+ *  the ignored state visible to the agent. Silent when the eval closes the
+ *  active contract (all done_when met, or outcome=blocked — checked FIRST,
+ *  mirroring the walker), when no proposal is submitted, or when the
+ *  proposal equals the active contract (a restate). Equality is
+ *  key-order-insensitive and normalized through parseRoundContract on both
+ *  sides so committed-raw vs parsed-submission key-set drift cannot cause
+ *  spurious warns. */
+function checkContractPremature(activeContract, selfEval) {
+    if (!activeContract)
+        return null;
+    const met = selfEval.execution_evidence?.success_criteria_met ?? [];
+    if (contractDoneWhenSatisfied(activeContract, met))
+        return null; // closed
+    if (selfEval.outcome === "blocked")
+        return null; // closed
+    const proposal = selfEval.round_contract;
+    if (!proposal)
+        return null;
+    const same = stableStringify(parseRoundContract(activeContract)) ===
+        stableStringify(parseRoundContract(proposal));
+    if (same)
+        return null; // restate → continue
+    return makeVerificationFlag({
+        severity: "warn",
+        field: "round_contract",
+        check: CHECK_CONTRACT_PREMATURE,
+        detail: "The ACTIVE Round Contract is still open (not all done_when met, not blocked) " +
+            "while a different contract was proposed — it is ignored until the active " +
+            "contract is completed or blocked. Restate the active contract unchanged to " +
+            "continue it.",
+    });
+}
+// ═══════════════════════════════════════════════════════════════════════════
 // Main entry point
 // ═══════════════════════════════════════════════════════════════════════════
 /** Verify a SelfEvaluation against the loop's cross-round lineage.
  *
  * @param selfEval             The agent's self-evaluation for the current round.
  * @param currentRound         The current round number (1-based).
- * @param vaultEntries         Vault entries for this loop (non-feedback only).
+ * @param vaultEntries         Vault entries for this loop (committed lineage
+ *                             entries AND :feedback entries — the feedback
+ *                             entries feed the ACTIVE-contract derivation).
  * @param prevSelfEval         The agent's self-evaluation from the previous round
  *                             (null for round 1).
  * @param evidenceSnapshots    v1.18: Evidence snapshots from configured providers.
@@ -910,24 +1273,32 @@ backtrackTargetGitHead) {
         for (const v of entryViolations(entry))
             olderViolations.push(v);
     }
+    // v3.4: The ACTIVE contract this round executed under — derived from the
+    // committed :feedback evals of earlier rounds. The submission's own
+    // round_contract is a PROPOSAL for the next round and never participates
+    // (the eval under verification is not yet committed, so it structurally
+    // cannot influence the derivation).
+    const activeContract = deriveActiveRoundContract(contractRoundEvaluations(committedRoundsFromEntries(vaultEntries, currentRound)));
     // v2.12: Derived claim provenance — which reported criteria completions
     // are backed by machine evidence (pure derivation, not persisted).
     const claimView = deriveClaimView(selfEval, evidenceSnapshots);
     // v3.2: Runtime machine-verification status (git observed / command passed /
-    // absent). Feeds the success_unverified check that never self-skips.
+    // absent). v3.6: feeds the merged R8 check (providerStatus lens) that
+    // never self-skips.
     const evidenceStatus = deriveEvidenceStatus(selfEval, evidenceSnapshots);
     // Run all checks
+    // v3.3.1: a check may return several flags (checkRetroactiveClaims raises
+    // one per offending claim) — the previous single-flag contract truncated
+    // the list at the first problem, hiding every other bad retroactive claim
+    // from the agent until the next round.
     const checks = [
-        () => checkProgressRegression(selfEval, prevSelfEval),
-        () => checkEmptyChangeWithPassing(selfEval),
         () => checkSuccessWithRemainingCriteria(selfEval),
-        // v2.12: success with zero verified claims and no test evidence
-        () => checkSuccessWithoutVerifiedEvidence(selfEval, claimView),
-        // v3.2: success without a machine-verified observation (never self-skips)
-        () => checkSuccessUnverified(selfEval, evidenceStatus),
+        // v2.12/v3.6/v3.7: the single success-evidence semantic — empty/missing-
+        // evidence arm (ex-R3) + claims arm (providerStatus lens, tamper-aware)
+        () => checkSuccessWithoutVerifiedEvidence(selfEval, evidenceStatus),
         // v2.12: criteria met but none machine-verified (mild criterion-specific rule)
         () => checkUnverifiedCriteriaClaims(selfEval, claimView),
-        // v2.12: declared outcome vs legacy boolean consistency
+        // Declared outcome vs the required core success flag.
         () => checkOutcomeConsistency(selfEval),
         // v2.12: retroactive claims against prior rounds
         () => checkRetroactiveClaims(selfEval, vaultEntries, currentRound),
@@ -939,6 +1310,9 @@ backtrackTargetGitHead) {
         () => checkRequiredCommandEvidence(selfEval, evidenceSnapshots),
         // v2.0: Cross-validate agent-reported test_results against command output
         () => checkCommandEvidenceIntegrity(selfEval, evidenceSnapshots),
+        // v3.3: Verification domain integrity — command entrypoint / test files
+        // changed in the same round the command ran
+        () => checkVerificationDomainIntegrity(evidenceSnapshots),
         // v2.1: Detect intent-action drift — agent said X but did Y
         () => checkIntentDrift(selfEval, prevSelfEval, vaultEntries),
         // v2.2: Detect sub-goal drift — next_action doesn't align with pending sub-goals
@@ -947,11 +1321,24 @@ backtrackTargetGitHead) {
         () => checkBacktrackWorkspaceRestore(selfEval, backtrackSkippedFiles),
         // v2.12: Post-backtrack git HEAD restore check
         () => checkBacktrackGitHeadRestore(evidenceSnapshots, backtrackTargetGitHead),
+        // v3.3: Round Contract checks. v3.4: split by target — structural
+        // (warn) at proposal declaration, conformance against the derived
+        // ACTIVE contract (scope_drift warn / premature_boundary error).
+        // v3.5: + completion machine-backing (error) and premature-replacement
+        // visibility (warn).
+        () => checkRoundUnderspecified(selfEval),
+        () => checkRoundUnverifiable(selfEval),
+        () => checkRoundScopeDrift(activeContract, evidenceSnapshots),
+        () => checkPrematureBoundary(activeContract, selfEval, claimView),
+        () => checkContractCompletionUnverified(activeContract, selfEval, evidenceSnapshots),
+        () => checkContractPremature(activeContract, selfEval),
     ];
     for (const run of checks) {
-        const flag = run();
-        if (flag)
-            flags.push(flag);
+        const result = run();
+        if (Array.isArray(result))
+            flags.push(...result);
+        else if (result)
+            flags.push(result);
     }
     // Determine verdict from the most severe flag present
     const hasError = flags.some((f) => f.severity === "error");