nexo-brain 7.31.4 → 7.31.7

package/src/plugins/protocol.py

@@ -619,6 +619,103 @@ def _is_release_task(*, goal: str, area: str = "", project_hint: str = "", verif
     return any(token in combined_context for token in _RELEASE_CONTEXT_HINTS)
 
 
+def _requires_live_surface_verification(task: dict, outcome: str) -> bool:
+    if outcome != "done":
+        return False
+    clean_type = str(task.get("task_type") or "").strip()
+    if clean_type not in {"edit", "execute"}:
+        return False
+    combined = " ".join(
+        str(task.get(field) or "")
+        for field in ("goal", "area", "project_hint", "context_hint", "verification_step")
+    ).lower()
+    if not combined:
+        return False
+    subject_hit = re.search(
+        r"\b(bug|estado|state|storefront|backend|front[- ]?end|datos|data|bd|database|producci[oó]n|production|live)\b",
+        combined,
+    )
+    behavior_hit = re.search(
+        r"\b(arregl|fix|resolver|resuelto|declara|afirm|verificar|validar|confirmar|close|cerrar)\b",
+        combined,
+    )
+    return bool(subject_hit and behavior_hit)
+
+
+def _has_live_surface_verification(evidence: str) -> bool:
+    text = (evidence or "").lower()
+    if not text:
+        return False
+    live_markers = (
+        "black-box.ndjson",
+        "impossible_state_recovered",
+        "playwright",
+        "browser",
+        "navegador",
+        "screenshot",
+        "captura",
+        "tema publicado",
+        "published theme",
+        "theme_id",
+        "cloud sql",
+        "production db",
+        "bd producción",
+        "bd de producción",
+        "mysql -h",
+        "psql ",
+        "gcloud logs",
+        "live logs",
+        "logs vivos",
+        "http 200",
+        "curl ",
+        "url pública",
+        "public url",
+    )
+    if any(marker in text for marker in live_markers):
+        return True
+    return bool(re.search(r"\b(producci[oó]n|production|live)\b.*\b(logs?|bd|db|browser|navegador|playwright|url|http|tema)\b", text))
+
+
+def _requires_production_change_log(
+    task: dict,
+    outcome: str,
+    evidence: str,
+    change_summary: str,
+    triggered_by: str,
+) -> bool:
+    if outcome not in {"done", "partial", "failed"}:
+        return False
+    clean_type = str(task.get("task_type") or "").strip()
+    if clean_type not in {"edit", "execute"}:
+        return False
+    task_context = " ".join(
+        str(part or "")
+        for part in (
+            task.get("goal"),
+            task.get("area"),
+            task.get("project_hint"),
+            task.get("context_hint"),
+            task.get("verification_step"),
+        )
+    ).lower()
+    action_context = " ".join(
+        str(part or "")
+        for part in (
+            evidence,
+            change_summary,
+            triggered_by,
+        )
+    ).lower()
+    combined = f"{task_context}\n{action_context}"
+    return bool(
+        re.search(
+            r"\b(git push|rsync|scp|ssh|npm publish|upload-release\.sh|gcloud builds)\b",
+            combined,
+        )
+        or re.search(r"\b(deploy|desplieg|publish|publicaci[oó]n)\b", action_context)
+    )
+
+
 def evaluate_response_confidence(
     *,
     goal: str,
@@ -1135,6 +1232,51 @@ def _record_debt(session_id: str, task_id: str, debt_type: str, *, severity: str
     _append_debt_ref(debts, debt, debt_type=debt_type, severity=severity)
 
 
+TOTAL_CLOSURE_RE = re.compile(
+    r"\b("
+    r"sin\s+deuda|no\s+queda\s+deuda|deuda\s+cero|todo\s+cerrado|"
+    r"goal\s+cumplido|objetivo\s+cumplido|completamente\s+cerrad[oa]|"
+    r"no\s+queda\s+nada\s+pendiente|all\s+set|all\s+done|no\s+open\s+debt"
+    r")\b",
+    re.IGNORECASE,
+)
+PENDING_RELEASE_GATE_RE = re.compile(
+    r"\b(smoke|tag|tags|merge|release|stable|broadcast|publicaci[oó]n)\b.{0,80}\b(pendiente|pending|falta|sin\s+verificar|sin\s+evidencia)\b",
+    re.IGNORECASE | re.DOTALL,
+)
+IRREVERSIBLE_ACTION_RE = re.compile(
+    r"\b(publish\s+stable|publicar\s+stable|promocionar\s+stable|broadcast|enviar\s+a\s+clientes|cobrar|payment|force-push|revocar)\b",
+    re.IGNORECASE,
+)
+SPECIFIC_OK_AFTER_EVIDENCE_RE = re.compile(
+    r"\b(aprobaci[oó]n\s+expl[ií]cita|ok\s+espec[ií]fico|autorizaci[oó]n\s+espec[ií]fica|specific\s+ok|explicit\s+approval)\b"
+    r".{0,120}\b(evidencia|evidence|smoke|verificad[oa]|verified)\b",
+    re.IGNORECASE | re.DOTALL,
+)
+
+
+def _active_followup_snapshot(limit: int = 5) -> list[dict]:
+    try:
+        followups = get_followups("active")
+    except Exception:
+        return []
+    snapshot: list[dict] = []
+    for item in followups[: max(1, limit)]:
+        snapshot.append(
+            {
+                "id": item.get("id", ""),
+                "status": item.get("status", ""),
+                "date": item.get("date", ""),
+                "description": str(item.get("description", ""))[:180],
+            }
+        )
+    return snapshot
+
+
+def _closure_claim_text(*parts: object) -> str:
+    return "\n".join(str(part or "") for part in parts if str(part or "").strip())
+
+
 def handle_confidence_check(
     goal: str,
     task_type: str = "answer",
@@ -1600,6 +1742,93 @@ def handle_task_close(
         task_type=task.get("task_type", ""),
         high_stakes=bool(task.get("response_high_stakes")),
     )
+    closure_text = _closure_claim_text(
+        task.get("goal", ""),
+        task.get("context_hint", ""),
+        clean_evidence,
+        clean_change_summary,
+        clean_change_verify,
+        outcome_notes,
+        result,
+        summary,
+        verification,
+    )
+
+    if clean_outcome == "done":
+        open_task_debts = list_protocol_debts(status="open", task_id=task_id, limit=5)
+        active_followups = _active_followup_snapshot()
+        if TOTAL_CLOSURE_RE.search(closure_text) and (active_followups or open_task_debts):
+            debt = _ensure_open_debt(
+                task["session_id"],
+                task_id,
+                "total_closure_with_open_work",
+                severity="error",
+                evidence=(
+                    "Task close used total-closure language while open work still exists. "
+                    f"open_followups={len(active_followups)} open_task_debts={len(open_task_debts)} "
+                    f"claim={closure_text[:240]!r}"
+                ),
+                debts=debts_created,
+            )
+            return json.dumps(
+                {
+                    "ok": False,
+                    "error": "Cannot close as total/no-debt while followups or task debt are still open.",
+                    "hint": "Say what was executed in this task and distinguish remaining open followups/debt, then retry.",
+                    "task_id": task_id,
+                    "blocked_by": "total_closure_open_work_gate",
+                    "debt_id": debt.get("id"),
+                    "debt_type": "total_closure_with_open_work",
+                    "open_followups": active_followups,
+                    "open_task_debts": open_task_debts,
+                },
+                ensure_ascii=False,
+                indent=2,
+            )
+        if PENDING_RELEASE_GATE_RE.search(closure_text):
+            debt = _ensure_open_debt(
+                task["session_id"],
+                task_id,
+                "release_gate_pending_at_close",
+                severity="error",
+                evidence=f"Task close attempted done while smoke/tags/merge/release pending language was present: {closure_text[:240]!r}",
+                debts=debts_created,
+            )
+            return json.dumps(
+                {
+                    "ok": False,
+                    "error": "Cannot close as done while release/smoke/tag/merge work is described as pending.",
+                    "hint": "Close as partial or provide evidence that the named pending gate is now verified.",
+                    "task_id": task_id,
+                    "blocked_by": "release_gate_pending_at_close",
+                    "debt_id": debt.get("id"),
+                    "debt_type": "release_gate_pending_at_close",
+                },
+                ensure_ascii=False,
+                indent=2,
+            )
+        if IRREVERSIBLE_ACTION_RE.search(closure_text) and not SPECIFIC_OK_AFTER_EVIDENCE_RE.search(closure_text):
+            debt = _ensure_open_debt(
+                task["session_id"],
+                task_id,
+                "irreversible_action_missing_specific_ok",
+                severity="error",
+                evidence=f"Irreversible action close lacks specific post-evidence approval language: {closure_text[:240]!r}",
+                debts=debts_created,
+            )
+            return json.dumps(
+                {
+                    "ok": False,
+                    "error": "Cannot close irreversible publish/broadcast/payment action without a specific approval after evidence.",
+                    "hint": "Record the explicit approval tied to the verified evidence, not a prior generic OK.",
+                    "task_id": task_id,
+                    "blocked_by": "irreversible_specific_ok_gate",
+                    "debt_id": debt.get("id"),
+                    "debt_type": "irreversible_action_missing_specific_ok",
+                },
+                ensure_ascii=False,
+                indent=2,
+            )
 
     if (task.get("task_type") or "").strip() == "analyze" and clean_outcome == "done":
         artifact_paths = _existing_analyze_artifact_paths(all_evidence_refs)
@@ -1641,6 +1870,41 @@ def handle_task_close(
                 indent=2,
             )
 
+    live_surface_required = _requires_live_surface_verification(task, clean_outcome)
+    live_surface_evidence = "\n".join(
+        part
+        for part in (clean_evidence, clean_change_verify, outcome_notes, verification, summary, result)
+        if part
+    )
+    if live_surface_required and not _has_live_surface_verification(live_surface_evidence):
+        debt = _ensure_open_debt(
+            task["session_id"],
+            task_id,
+            "live_surface_verification_missing",
+            severity="error",
+            evidence=(
+                "Task closed as done for state/storefront/backend/data behavior without live-surface evidence. "
+                f"Goal: {task.get('goal','')}. Evidence provided: {live_surface_evidence[:240]!r}"
+            ),
+            debts=debts_created,
+        )
+        return json.dumps(
+            {
+                "ok": False,
+                "error": "Cannot close task as 'done' without live production verification evidence.",
+                "hint": (
+                    "Add evidence from the real surface: live logs such as black-box.ndjson/impossible_state_recovered, "
+                    "published storefront/browser or Playwright evidence, or production database evidence."
+                ),
+                "task_id": task_id,
+                "blocked_by": "live_surface_verification",
+                "debt_id": debt.get("id"),
+                "debt_type": "live_surface_verification_missing",
+            },
+            ensure_ascii=False,
+            indent=2,
+        )
+
     pending_corrections = list_session_correction_requirements(
         session_id=task["session_id"],
         status="open",
@@ -1809,7 +2073,14 @@ def handle_task_close(
                 debts=debts_created,
             )
 
-    if task.get("must_change_log") and clean_outcome in {"done", "partial", "failed"}:
+    production_change_log_required = _requires_production_change_log(
+        task,
+        clean_outcome,
+        clean_evidence,
+        clean_change_summary,
+        triggered_by,
+    )
+    if (task.get("must_change_log") or production_change_log_required) and clean_outcome in {"done", "partial", "failed"}:
         if effective_files:
             change = log_change(
                 task["session_id"],

package/src/plugins/workflow.py

@@ -8,6 +8,7 @@ from db import (
     create_workflow_goal,
     create_workflow_run,
     get_db,
+    get_followups,
     get_workflow_goal,
     get_protocol_task,
     get_workflow_run,
@@ -21,6 +22,22 @@ from db import (
 from protocol_settings import get_protocol_strictness
 
 
+TOTAL_CLOSURE_MARKERS = (
+    "sin deuda",
+    "no queda deuda",
+    "deuda cero",
+    "todo cerrado",
+    "goal cumplido",
+    "objetivo cumplido",
+    "no queda nada pendiente",
+    "all done",
+    "no open debt",
+)
+PENDING_RELEASE_MARKERS = ("smoke pendiente", "tags pendientes", "merge pendiente", "stable pendiente", "pending smoke", "pending tags", "pending merge")
+IRREVERSIBLE_MARKERS = ("publish stable", "publicar stable", "promocionar stable", "broadcast", "enviar a clientes", "force-push", "revocar", "cobrar")
+SPECIFIC_APPROVAL_MARKERS = ("aprobacion explicita", "aprobación explícita", "ok especifico", "ok específico", "autorizacion especifica", "autorización específica", "specific ok", "explicit approval")
+
+
 def _session_has_open_task(session_id: str) -> bool:
     """Return True if the session has at least one open protocol task.
 
@@ -71,6 +88,26 @@ def _parse_json_object(value: str) -> dict | None:
     return parsed if isinstance(parsed, dict) else None
 
 
+def _goal_close_text(*parts: object) -> str:
+    return "\n".join(str(part or "") for part in parts if str(part or "").strip()).lower()
+
+
+def _active_followup_snapshot(limit: int = 5) -> list[dict]:
+    try:
+        followups = get_followups("active")
+    except Exception:
+        return []
+    return [
+        {
+            "id": item.get("id", ""),
+            "status": item.get("status", ""),
+            "date": item.get("date", ""),
+            "description": str(item.get("description", ""))[:180],
+        }
+        for item in followups[: max(1, limit)]
+    ]
+
+
 def _checkpoint_active_files(*payloads: dict | None) -> list[str]:
     seen: list[str] = []
     for payload in payloads:
@@ -277,6 +314,68 @@ def handle_goal_update(
     clean_goal_id = (goal_id or "").strip()
     if not clean_goal_id:
         return json.dumps({"ok": False, "error": "goal_id is required"}, ensure_ascii=False, indent=2)
+    requested_status = (status or "").strip().lower()
+    existing_goal = get_workflow_goal(clean_goal_id)
+    if not existing_goal:
+        return json.dumps({"ok": False, "error": f"Unknown goal_id: {clean_goal_id}"}, ensure_ascii=False, indent=2)
+    close_text = _goal_close_text(
+        existing_goal.get("title", ""),
+        existing_goal.get("objective", ""),
+        title,
+        objective,
+        next_action,
+        success_signal,
+        blocker_reason,
+        shared_state,
+    )
+    if requested_status == "completed":
+        if int(existing_goal.get("open_run_count") or 0) > 0:
+            return json.dumps(
+                {
+                    "ok": False,
+                    "error": "Cannot mark goal completed while linked workflow runs are still open.",
+                    "blocked_by": "goal_open_runs_gate",
+                    "goal_id": clean_goal_id,
+                    "open_run_count": int(existing_goal.get("open_run_count") or 0),
+                },
+                ensure_ascii=False,
+                indent=2,
+            )
+        active_followups = _active_followup_snapshot()
+        if any(marker in close_text for marker in TOTAL_CLOSURE_MARKERS) and active_followups:
+            return json.dumps(
+                {
+                    "ok": False,
+                    "error": "Cannot mark goal completed as total/no-debt while followups are still open.",
+                    "blocked_by": "goal_total_closure_open_followups_gate",
+                    "goal_id": clean_goal_id,
+                    "open_followups": active_followups,
+                },
+                ensure_ascii=False,
+                indent=2,
+            )
+        if any(marker in close_text for marker in PENDING_RELEASE_MARKERS):
+            return json.dumps(
+                {
+                    "ok": False,
+                    "error": "Cannot mark goal completed while smoke/tags/merge/stable work is described as pending.",
+                    "blocked_by": "goal_pending_release_gate",
+                    "goal_id": clean_goal_id,
+                },
+                ensure_ascii=False,
+                indent=2,
+            )
+        if any(marker in close_text for marker in IRREVERSIBLE_MARKERS) and not any(marker in close_text for marker in SPECIFIC_APPROVAL_MARKERS):
+            return json.dumps(
+                {
+                    "ok": False,
+                    "error": "Cannot mark irreversible publish/broadcast/payment goal completed without a specific approval tied to evidence.",
+                    "blocked_by": "goal_irreversible_specific_ok_gate",
+                    "goal_id": clean_goal_id,
+                },
+                ensure_ascii=False,
+                indent=2,
+            )
     try:
         goal = update_workflow_goal(
             clean_goal_id,
@@ -292,8 +391,6 @@ def handle_goal_update(
         )
     except ValueError as exc:
         return json.dumps({"ok": False, "error": str(exc)}, ensure_ascii=False, indent=2)
-    if not goal:
-        return json.dumps({"ok": False, "error": f"Unknown goal_id: {clean_goal_id}"}, ensure_ascii=False, indent=2)
 
     return json.dumps(
         {

package/src/pre_answer_router.py

@@ -31,11 +31,13 @@ PRE_ANSWER_INTENTS: tuple[str, ...] = (
     "memory_question",
     "identity_authorship",
     "schedule_commitment",
+    "live_state_claim",
     "runtime_diagnosis",
     "general",
 )
 
 INJECTING_INTENTS = set(PRE_ANSWER_INTENTS) - {"general"}
+EVIDENCE_REQUIRED_INTENTS = {"live_state_claim"}
 
 DEFAULT_BUDGET_MS = 2500
 DEFAULT_TOKEN_BUDGET = 2500
@@ -344,6 +346,53 @@ _FEATURE_LEXICON: dict[str, tuple[str, ...]] = {
         "instalacion",
         "catalogo",
     ),
+    "live_state": (
+        "release",
+        "published",
+        "publish",
+        "deployed",
+        "deploy",
+        "uploaded",
+        "sent",
+        "closed",
+        "merged",
+        "commit",
+        "branch",
+        "tag",
+        "version",
+        "server",
+        "port",
+        "dns",
+        "domain",
+        "ticket",
+        "issue",
+        "pr",
+        "pull",
+        "status",
+        "running",
+        "installed",
+        "verified",
+        "publicado",
+        "publicada",
+        "publicar",
+        "desplegado",
+        "desplegada",
+        "subido",
+        "subida",
+        "enviado",
+        "enviada",
+        "cerrado",
+        "cerrada",
+        "mergeado",
+        "rama",
+        "servidor",
+        "puerto",
+        "dominio",
+        "estado",
+        "corriendo",
+        "instalado",
+        "verificado",
+    ),
 }
 
 _INTENT_FEATURE_WEIGHTS: dict[str, dict[str, float]] = {
@@ -353,6 +402,7 @@ _INTENT_FEATURE_WEIGHTS: dict[str, dict[str, float]] = {
     "memory_question": {"memory": 1.40, "past_work": 0.20, "identity": 0.15},
     "identity_authorship": {"identity": 1.20, "past_work": 0.65},
     "schedule_commitment": {"schedule": 1.55, "past_work": 0.10, "memory": 0.20},
+    "live_state_claim": {"live_state": 1.45, "past_work": 0.45, "runtime": 0.25, "identity": 0.15},
     "runtime_diagnosis": {"runtime": 1.55, "location": 0.15},
 }
 
@@ -592,6 +642,25 @@ _SOURCE_PLANS: dict[str, SourcePlan] = {
             SourceStep("transcripts", phase="fallback", timeout_ms=650),
         ),
     ),
+    "live_state_claim": SourcePlan(
+        intent="live_state_claim",
+        primary=(
+            SourceStep("semantic_layers", timeout_ms=120, max_chars=900),
+            SourceStep("recent_context", timeout_ms=240),
+            SourceStep("evidence_ledger", timeout_ms=260),
+            SourceStep("change_log", timeout_ms=300),
+            SourceStep("protocol_tasks", timeout_ms=240),
+            SourceStep("workflows", timeout_ms=260),
+            SourceStep("project_atlas", timeout_ms=160),
+            SourceStep("system_catalog", timeout_ms=420),
+            SourceStep("diary", timeout_ms=280),
+        ),
+        fallback=(
+            SourceStep("transcripts", phase="fallback", timeout_ms=700),
+            SourceStep("memory", phase="fallback", timeout_ms=500),
+            SourceStep("local_context", phase="fallback", timeout_ms=900, max_chars=900),
+        ),
+    ),
     "runtime_diagnosis": SourcePlan(
         intent="runtime_diagnosis",
         primary=(
@@ -737,6 +806,7 @@ def _classify_intent_semantic(text: str) -> IntentClassification | None:
             "memory_question means asking remembered facts, decisions, or context. "
             "identity_authorship means who did something, which session/client acted, or Nero authorship. "
             "schedule_commitment means promises, pending commitments, reminders, deadlines, or future follow-up. "
+            "live_state_claim means current or past external state that needs evidence: releases, commits, branches, tags, tickets, servers, ports, DNS, deployments, sent messages, uploads, installs, or verified/closed status. "
             "runtime_diagnosis means diagnosing NEXO/Brain/Desktop/runtime/tools. "
             "general means no pre-answer continuity evidence is needed."
         ),
@@ -1012,6 +1082,7 @@ def route_pre_answer(
     missing_required = sorted(required_sources - consulted_or_evident)
     missing_required_count = len(set(missing_required) | set(required_source_timeouts))
     optional_sources_skipped_count = sum(1 for source in sources if source.skipped and source.source not in required_sources)
+    has_any_evidence = any(source.has_evidence for source in sources)
     rendered = render_route(
         query=query,
         classification=classification,
@@ -1023,12 +1094,21 @@ def route_pre_answer(
         rendered = _clip(rendered, max_rendered_chars)
     elif budget_policy and max_rendered_chars == 0:
         rendered = ""
-    should_inject = classification.intent in INJECTING_INTENTS and any(source.has_evidence for source in sources)
-    if not rendered:
-        should_inject = False
     aborted_reason = "required_source_timeout" if required_source_timeouts else _route_aborted_reason(sources, budget)
     must_disclose_gap = bool((budget_policy or {}).get("must_disclose_gap") or missing_required_count)
     decision_signal = "defer" if missing_required_count and (budget_policy or {}).get("fallback_policy") == "mandatory_fail_closed" else ""
+    if classification.intent in EVIDENCE_REQUIRED_INTENTS and (not has_any_evidence or missing_required_count):
+        gap = render_evidence_gap(
+            query=query,
+            classification=classification,
+            sources=sources,
+            missing_required_count=missing_required_count,
+            required_source_timeouts=required_source_timeouts,
+        )
+        rendered = f"{rendered}\n\n{gap}" if rendered else gap
+        must_disclose_gap = True
+        decision_signal = "defer"
+    should_inject = classification.intent in INJECTING_INTENTS and bool(rendered)
     telemetry = _build_route_event(
         query=query,
         route_intent=classification.intent,
@@ -1100,6 +1180,35 @@ def render_route(
     return _clip("\n".join(lines), max(400, int(token_budget or DEFAULT_TOKEN_BUDGET) * 4))
 
 
+def render_evidence_gap(
+    *,
+    query: str,
+    classification: IntentClassification,
+    sources: Iterable[SourceResult],
+    missing_required_count: int = 0,
+    required_source_timeouts: Iterable[str] = (),
+) -> str:
+    checked = [source.source for source in sources if not source.skipped]
+    skipped = [source.source for source in sources if source.skipped]
+    timeout_names = list(dict.fromkeys(required_source_timeouts))
+    lines = [
+        "PRE-ANSWER VERIFICATION GAP",
+        f"Intent: {classification.intent} ({classification.confidence:.2f})",
+        "The user is asking about state that requires evidence before any claim.",
+        "Do not affirm, deny, or present a release/server/ticket/commit/action status as fact from recollection.",
+        "If no stronger source is available in this turn, answer that the state is not verified yet and continue checking.",
+    ]
+    if checked:
+        lines.append(f"Sources checked without enough evidence: {', '.join(dict.fromkeys(checked))}.")
+    if skipped:
+        lines.append(f"Sources skipped or unavailable: {', '.join(dict.fromkeys(skipped))}.")
+    if missing_required_count:
+        lines.append(f"Missing required source count: {missing_required_count}.")
+    if timeout_names:
+        lines.append(f"Required source timeouts: {', '.join(timeout_names)}.")
+    return _clip("\n".join(lines), 1800)
+
+
 def default_source_adapters() -> dict[str, SourceAdapter]:
     return {
         "semantic_layers": _source_semantic_layers,
@@ -2165,6 +2274,7 @@ def _matching_lines(lines: Iterable[str], query: str, *, limit: int = 6) -> list
 
 
 __all__ = [
+    "EVIDENCE_REQUIRED_INTENTS",
     "INJECTING_INTENTS",
     "PRE_ANSWER_INTENTS",
     "IntentClassification",
@@ -2177,6 +2287,7 @@ __all__ = [
     "default_source_adapters",
     "plan_sources",
     "redact_secrets",
+    "render_evidence_gap",
     "render_route",
     "route_pre_answer",
     "shutdown_executor",

package/src/pre_answer_runtime.py

@@ -255,6 +255,9 @@ def _base_tier_for(
     if intent == "file_location":
         reasons.append("simple_file_location")
         return "quick", reasons
+    if intent == "live_state_claim":
+        reasons.append("live_state_claim_deep")
+        return "deep", reasons
     if intent in {"runtime_diagnosis"}:
         reasons.append("runtime_diagnosis_deep")
         return "deep", reasons

package/src/presets/guardian_default.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://nexo-brain.com/schemas/guardian-config-v1.json",
-  "version": "1.5.0",
-  "description": "Default Guardian configuration. Copied to ~/.nexo/personal/config/guardian.json at `nexo init` / `nexo update` if no user config exists. If user config exists, merge keys NOT present in user config without overwriting user overrides. Core rules (R13, R14, R16, R25, R30) can only be shadow/soft/hard — mode=off is rejected by validator. v1.4.0 (constructor-guardian-90 pass 1): R15/R17/R22/R_CATALOG upgraded from soft to hard where FP telemetry was low; R34 raised from shadow to soft. v1.5.0 (pass 2): R11_plugin_load_pre_inventory upgraded from soft to hard; new R_PRIMITIVE_CHOICE (SK-CREATE-NEXO-PRIMITIVE gate) added at soft so it can be observed before hardening.",
+  "version": "1.6.0",
+  "description": "Default Guardian configuration. Copied to ~/.nexo/personal/config/guardian.json at `nexo init` / `nexo update` if no user config exists. If user config exists, merge keys NOT present in user config without overwriting user overrides. Core rules (R13, R14, R16, R25, R30, R34, R37) can only be shadow/soft/hard — mode=off is rejected by validator. v1.4.0 (constructor-guardian-90 pass 1): R15/R17/R22/R_CATALOG upgraded from soft to hard where FP telemetry was low; R34 raised from shadow to soft. v1.5.0 (pass 2): R11_plugin_load_pre_inventory upgraded from soft to hard; new R_PRIMITIVE_CHOICE (SK-CREATE-NEXO-PRIMITIVE gate) added at soft so it can be observed before hardening. v1.6.0: R34 is hard/core and R37 adds a hard pre-answer evidence gate for live or prior state claims.",
   "enabled": true,
   "classifier_task_profile": "enforcer_classify",
   "classifier_tier": "muy_bajo",
@@ -60,14 +60,17 @@
     "R23g_secrets_in_output": "soft",
     "R23m_message_duplicate": "soft",
     "R23h_shebang_mismatch": "shadow",
-    "R34_identity_coherence": "soft"
+    "R34_identity_coherence": "hard",
+    "R37_pre_answer_evidence_gate": "hard"
   },
   "core_rules": [
     "R13_pre_edit_guard",
     "R14_correction_learning",
     "R16_declared_done",
     "R25_nora_maria_read_only",
-    "R30_pre_done_evidence_system_prompt"
+    "R30_pre_done_evidence_system_prompt",
+    "R34_identity_coherence",
+    "R37_pre_answer_evidence_gate"
   ],
   "fail_closed": {
     "classifier_timeout_seconds": 10,