pi-daddy 0.22.0 → 0.24.0

package/contracts/debrief/v1/README.md

@@ -0,0 +1,146 @@
+# P08 manual debrief / label / blind view — integration contract for P10/P12/P13
+
+Local implementation candidate, not overall acceptance or live qualification. This is the existing
+pi-daddy dashboard/Herdr plugin path, not a new product. P04 read-only daily view and P05 intent controls
+remain separate. Labels/choices never dispatch workers, alter grants/work acceptance, adopt a candidate
+or establish causality.
+
+## Immutable actual inputs
+
+`provenance.json` pins exact Git blob bytes:
+- work-capture schema/review contract and seven-case/batch/review fixtures at harness
+  **4460af93c55aa3a52df262782cd339ad374113b8**;
+- intervention manifest/assessment/public blind view/choice/reveal and actual retained synthetic artifacts at
+  **0475e1f5684e01992850c48aa14841751711701a**.
+
+The vendored source documents and fixtures are unchanged. Original public zero-seed comparison fixtures
+are not real blinding, live casting, authenticated human decisions or routing authority. The read path
+validates closed schemas, case identities/reason-cost consistency, history digests/links and opaque artifact
+membership plus actual bytes. Case/page/history callbacks must come from the genuine configured harness
+owner; an arbitrary object/"author" field does not supply that provenance.
+
+## Existing render/action path
+
+`dashboardFrame({cwd, debrief: presenter})` renders the actual validated presenter. `dashboardDebriefAction`
+and the existing CLI's own input handler call its explicit actions. Neither uses worker prompts, terminal
+transport, observer messages or P05 control APIs. `runDashboard(argv, env, {debrief: presenter})` accepts an
+already configured/opened host presenter; it does **not** override a host's closed/deferred state.
+
+For the standalone synthetic manual view:
+
+```sh
+pi-daddy-dashboard --once --debrief-fixture --no-color
+pi-daddy-dashboard --once --debrief-fixture --debrief-json
+# Without --once, input belongs only to this dashboard:
+# choose tie variant-... variant-...
+# reveal
+# close
+# open
+```
+
+`PI_DADDY_DEBRIEF_FIXTURE=1` selects that same clearly marked demo through the existing plugin-open seam and
+participates in pane reuse identity. Existing plugin-open ledger/protocol prerequisites still apply; the
+standalone fixture CLI does not waive those native host guards. No environment/module/file loader can inject a decision writer. CLI
+fixture case labeling is **disabled**, because it has no genuine harness writer. Fixture-only blind actions
+use a session-memory checkpoint and known synthetic mapping; restart persistence or real blinded study is
+not claimed. The fixed first four case IDs plus one blind slot never paginate into extra questions.
+
+Programmatic integration uses the real host API:
+
+```ts
+const reviewer = createWorkCaseReviewer(harnessArchiveRoot, batchManifestId, verifiedOperatorIdentity);
+const presenter = createDebriefPresenter({
+  scope: hostOwnedPresentationScope, operatorIdentity: verifiedOperatorIdentity, reviewer,
+  blind: genuineP12BlindPort, // optional: view/readArtifact/choose/reveal only
+  persistence: hostOwnedAttentionCheckpoint,
+});
+await presenter.open({mode:'manual', userPresent:true}); // explicit operator action, not agent_end
+await runDashboard(args, env, {debrief: presenter});
+```
+
+No second dashboard decision ledger is created. `reviewer.decide` writes only the harness-owned digest-bound
+case history. P07's operator-selected capability is not a human authenticator; real identity remains the
+host's responsibility. Callbacks are captured at construction, not resolved from incoming case metadata.
+
+## Five-slot attention budget and reopening
+
+One `scope` must be independently bound by the host to the actual batch/operator/presentation interval, not
+a pane title, file tail, repeated agent_end or a new window. The first explicit open reserves a fixed set:
+**at most five total cards/questions**, not five cases plus a blind choice. A blind comparison takes one
+slot, leaving four case cards. With seven incidents this leaves three unexposed/unresolved. All variants
+within the one bounded blind question share its slot. Current implementation supports two to four eligible
+variants, up to four retained artifacts each, 64 KiB per artifact and short marked previews.
+
+Reservation is checkpointed and exact host readback is checked before exposure; a callback returning success
+without retained matching state is not sufficient. Closing/rendering/answering/skipping never refunds slots,
+advances the page or fills a vacated blind slot with another case. A host may choose `offset` for a new
+explicit weekly/manual budget; it is pinned in the checkpoint and cannot change within the same scope. `budgetSpent` remains visible even while
+closed; exhausted allowance defers new questions and reopens only the same slots. Missing/failed checkpoint
+state is unknown, never a fresh allowance. Changed batch/blind identity refuses rather than remapping cards.
+Unanswered cases remain unanswered in harness history. Skip/uncertain and unselected blind choice remain
+unresolved, not agreement or a quality vote.
+
+`DebriefPersistence` is a **host-owned attention/transport** interface:
+- `durability: 'host-owned'` for the configured host, or `'fixture-memory'` only in explicit fixture mode;
+- `load()` returns null only if genuinely never initialized, otherwise an exact `DebriefCheckpoint`;
+- `compareAndSwap(expectedDigest, next)` must durably/atomically bind the scope and whole checkpoint before
+  returning. Missing/deleted/partial/rollback state, ambiguous commits and concurrent stale saves must refuse.
+  A host cannot report null for lost prior state and thereby mint a fresh pause budget.
+
+The product does not install a persistence store. Its checkpoint contains fixed card IDs/public blind digest,
+immutable pending review requests, quality choice and reveal-attempt state—**not authoritative case decisions**.
+Case decisions are always rechecked against actual harness history, including the separately configured
+operator identity for acknowledgement. The host must configure the same legitimate identity in reviewer
+and presenter; missing identity disables labels, and a different author is never credited to this request. Tests use a separately configured owned
+fixture-host checkpoint with the existing non-expiring lock and synced append; this is not a deployed host
+service or hostile-filesystem/rollback qualification. Without a checkpoint, manual viewing is session-only
+and real label/choice actions are unavailable. Reuse the same presenter to retain its session budget; a
+process restart without genuine host restoration cannot claim per-pause continuity.
+
+## Explicit labels and unknown acknowledgement
+
+`label({caseManifestId, priorDecisionId, disposition, note})` accepts only the real four-field P07 request and
+only an exposed card. The CLI spelling is `label SLOT DISPOSITION NOTE`. The expected prior comes from the
+shown snapshot, never silently advanced to overwrite a newer decision. One immutable request per card/pause
+is saved before calling the genuine writer. Its replay calls history only; it never sends `decide` twice.
+An exact current history record is required before displaying label-recorded. Unknown/failed/stale writer
+acknowledgement is unresolved; `reconcile SLOT` reads the actual history without sending a label again.
+A saved request whose writer was never reached remains unknown/unanswered; there is no blind automatic retry.
+Corrections/new exposure require a separately governed host presentation, not unlimited questions this pause.
+
+Dispositions: confirmed_defect, expected_behavior, exemplar, uncertain, skip. They are nominations/labels,
+not scored-spec promotion, accepted work or agreement with a model. Render/schema success is not authority.
+
+## Quality before configuration/cost
+
+Before choice, the comparison exposes only public opaque labels and verified artifact previews; blind manifest/assessment,
+configuration/cost, arm IDs and filenames are not in the frame. Known A/B fixture captions are removed.
+Arbitrary artifact text can still disclose identity: the UI explicitly warns rather than claiming perfect
+blinding. Public fixture seeds/hashes may be independently linkable and must never be used for live blinding.
+
+`choose({kind:'one'|'tie'|'none'|'insufficient',labels:[...]})` validates exact opaque membership, persists the
+choice, then calls the actual blind interface. Reveal stays locked until that choice is acknowledged.
+Choices lock once recorded by this presenter (stricter than permitting pre-reveal corrections). `reveal()`
+persists the attempt before calling the private host method, validates the same choice/mapping, then displays
+configuration/cost. Failed persistence reveals nothing. Reopening a new presenter with saved choice requires
+an explicit same-choice confirmation against the restored blind port before reveal; the host must restore
+its private seed/mapping. No new vote or changed post-reveal choice is allowed. No evaluation, causal claim,
+automatic routing or adoption follows any choice.
+
+## Automatic/live status and remaining facts
+
+**Automatic presentation is deliberately unqualified and deferred**, including a caller string claiming
+verified-closing. There is no implemented verified suitable user closing pause/exposure-calibration-policy /
+identity/durable-writer bridge. Repeated/transient agent_end, idle flags, file tails, busy work and absence
+cannot authorize exposure. Busy/absent manual requests also defer. Existing host deferrals are not upgraded
+by runDashboard. A <=5 page alone is not treated as proof of an attention budget.
+
+Supported: actual existing manual render/action path, real pinned harness case writer and P12 primitive
+integration in owned fixtures/programmatic ports, bounded checkpoint/reopen behavior, standalone frozen
+CLI and fresh compiled plugin-command execution. Remaining: deployed genuine host writer/attention store,
+verified automatic pause/policy/identity, private seed persistence, actual P12 live casting and live Herdr
+qualification. Source fixture transpilation is not an installed harness package qualification.
+
+P05 owned cancellation remains unfinished implementation work; general live steering remains unqualified.
+P02/P04/P06 unsupported native/freshness/containment clauses remain. No worker messages, model/provider calls,
+per-task model review, package lifecycle or publication is part of this implementation.

package/contracts/debrief/v1/intervention/README.md

@@ -0,0 +1,32 @@
+# Frozen intervention comparison primitives — P12 partial, P08 fixture input
+
+This is a SEPARATE family from existing fixed-model `buildComparison`/`compare`. Their same-model/judge/input guards are unchanged. No model is launched here.
+
+`freezeIntervention` binds an investigation digest, common scenario/rubric/fixture/held-out/harness/judge-policy inputs, mode, repetition/criterion/critical thresholds, resource metric and explicit candidate axes. Undeclared model/effort/skill/prompt/configuration changes reject. Multiple changed axes are a package intervention, not evidence of one variable's causal effect. LLM sampling is not claimed deterministic.
+
+`assertInterventionRoles` is a pre-spend check over independently resolved HOST context. Missing roles and proposer/judge/subject canonical identity conflicts refuse. Same subjects may repeat across arms. It does not resolve providers, authenticate arbitrary context or qualify a delivery route. Do not derive qualification or expected evidence digests from incoming arm claims.
+
+`assessIntervention` checks exact host-confirmed evidence digests and frozen input/cell policy. Delivery NOT-MEASURED/ERROR and missing/unknown/suspect cells keep the comparison incomplete; objective failure prevents judging/eligibility. Votes are retained per criterion. Actual output bytes must match per-cell/arm hashes; digests alone are missing evidence. Retained bytes are copied for later blind reads. Cheap failed arms cannot become eligible. Cheapest eligible is only a conditional measurement; routingDefault is always null and adoptionAuthorized false.
+
+`interventionEvidenceFromResults` uses existing schema3 validation and retains complete source results/votes beside the summary. It requires recorded `source_hashes['intervention:manifest']` and `['intervention:inputs']`, matching model/mode/judge/plan, and supplied output bytes. It never stamps missing bindings onto historical runs. Multi-judge conversion is not yet supported rather than choosing a convenient panel vote. The orchestrator that records these bindings and qualifies actual execution remains integration work.
+
+## Blind view API
+
+```ts
+const blind = createBlindComparison(manifest, recomputedAssessment);
+const view = blind.view(); // opaque labels + artifact hashes + explicit clue limitation; no configuration/cost
+const bytes = blind.readArtifact(label, artifactHash); // only retained bytes admitted to that label
+blind.choose({kind:'one'|'tie'|'none'|'insufficient', labels:[/* opaque labels, or [] */]});
+const revealed = blind.reveal(); // refuses before choice; different choice refuses after reveal
+```
+
+An optional private seed supports fixtures/host-controlled restoration; real independent views need fresh private randomness, not a public fixed seed. Public view omits identity metadata, but arbitrary artifact text may reveal clues. The host must enforce user/judge identity, persist quality/seed/reveal state before exposure, and expose only the public view/read methods before choice. This in-memory API is not durable human authentication or proof a host did not leak the assessment/configuration. P08 must keep its total five-card budget and real pause/exposure boundaries.
+
+`fixtures/` is generated by actual code from fixed synthetic evidence, retained Layout A/B bytes, fixture role identities and a public zero seed. It is NOT live qualification, real human blinding, efficacy or casting evidence. It supplies a concrete UI contract: blind-view.json before choice; choice.json; reveal.json only afterward.
+
+Remaining P12: qualified model-backed orchestration, complete panel/durable blind workflow, verified role/receipt integration, applicable casting rows/uncertainty/revalidation and live P08 demonstration. Full acceptance and any routing/adoption default remain pending.
+
+```sh
+node scripts/generate-intervention-fixture.mjs --check
+node node_modules/vitest/vitest.mjs run packages/core/test/intervention.test.ts packages/core/test/intervention-results.test.ts packages/core/test/comparison.test.ts
+```

package/contracts/debrief/v1/intervention/fixtures/artifact-3ee11136beb864f518252e5024dae9197421fbf97b6e981d3243c782b5c44bd0.txt

@@ -0,0 +1 @@
+Synthetic Layout B

package/contracts/debrief/v1/intervention/fixtures/artifact-58905d872dd3c54a9705f67b05fa82edbad7af6476ae8993faf1a7b9fadfb905.txt

@@ -0,0 +1 @@
+Synthetic Layout A

package/contracts/debrief/v1/intervention/fixtures/assessment.json

@@ -0,0 +1,29 @@
+{
+  "manifestId": "a84186a1c1f272c80fe14387aeb3c8dd7242f6eacb6b76b0ef29a7343b254ffb",
+  "complete": true,
+  "arms": [
+    {
+      "armId": "a",
+      "state": "MEASURED",
+      "eligible": true,
+      "artifactDigests": [
+        "58905d872dd3c54a9705f67b05fa82edbad7af6476ae8993faf1a7b9fadfb905"
+      ],
+      "cost": 1,
+      "costUnit": "wall_ms"
+    },
+    {
+      "armId": "b",
+      "state": "MEASURED",
+      "eligible": true,
+      "artifactDigests": [
+        "3ee11136beb864f518252e5024dae9197421fbf97b6e981d3243c782b5c44bd0"
+      ],
+      "cost": 2,
+      "costUnit": "wall_ms"
+    }
+  ],
+  "cheapestEligible": "a",
+  "routingDefault": null,
+  "adoptionAuthorized": false
+}

package/contracts/debrief/v1/intervention/fixtures/blind-view.json

@@ -0,0 +1,20 @@
+{
+  "version": "blind-intervention-view-v1",
+  "cards": [
+    {
+      "label": "variant-4798fd88dc0c9767",
+      "artifactDigests": [
+        "58905d872dd3c54a9705f67b05fa82edbad7af6476ae8993faf1a7b9fadfb905"
+      ]
+    },
+    {
+      "label": "variant-5588a335bb82b8d5",
+      "artifactDigests": [
+        "3ee11136beb864f518252e5024dae9197421fbf97b6e981d3243c782b5c44bd0"
+      ]
+    }
+  ],
+  "limitations": [
+    "artifact-content-may-disclose-identity"
+  ]
+}

package/contracts/debrief/v1/intervention/fixtures/choice.json

@@ -0,0 +1,7 @@
+{
+  "kind": "tie",
+  "labels": [
+    "variant-4798fd88dc0c9767",
+    "variant-5588a335bb82b8d5"
+  ]
+}

package/contracts/debrief/v1/intervention/fixtures/manifest.json

@@ -0,0 +1,57 @@
+{
+  "arms": [
+    {
+      "configuration": {
+        "configuration": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534",
+        "effort": "fixture",
+        "model": "fixture:a",
+        "prompt": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534",
+        "skill": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534"
+      },
+      "id": "a"
+    },
+    {
+      "configuration": {
+        "configuration": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534",
+        "effort": "fixture",
+        "model": "fixture:b",
+        "prompt": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534",
+        "skill": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534"
+      },
+      "id": "b"
+    }
+  ],
+  "axes": [
+    "model"
+  ],
+  "cases": [
+    {
+      "criteria": 1,
+      "critical": false,
+      "id": "A1",
+      "reps": 1,
+      "threshold": 1
+    }
+  ],
+  "common": {
+    "fixtureSha256": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534",
+    "harnessSha256": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534",
+    "heldoutSha256": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534",
+    "judgePolicySha256": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534",
+    "mode": "force",
+    "rubricSha256": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534",
+    "scenarioSha256": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534"
+  },
+  "family": "intervention",
+  "investigationSha256": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534",
+  "judge": "fixture:judge",
+  "proposer": "fixture:proposer",
+  "resourceMetric": "wall_ms",
+  "version": "intervention-comparison-v1",
+  "inputDigest": "dafb046cb29e1e8aaa3dc9bd1b8497427c69ef15228d81aaa6228c23c4fcce40",
+  "changedAxes": [
+    "model"
+  ],
+  "deterministicSampling": false,
+  "id": "a84186a1c1f272c80fe14387aeb3c8dd7242f6eacb6b76b0ef29a7343b254ffb"
+}

package/contracts/debrief/v1/intervention/fixtures/reveal.json

@@ -0,0 +1,39 @@
+{
+  "manifestId": "a84186a1c1f272c80fe14387aeb3c8dd7242f6eacb6b76b0ef29a7343b254ffb",
+  "choice": {
+    "kind": "tie",
+    "labels": [
+      "variant-4798fd88dc0c9767",
+      "variant-5588a335bb82b8d5"
+    ]
+  },
+  "arms": [
+    {
+      "label": "variant-4798fd88dc0c9767",
+      "armId": "a",
+      "configuration": {
+        "configuration": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534",
+        "effort": "fixture",
+        "model": "fixture:a",
+        "prompt": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534",
+        "skill": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534"
+      },
+      "cost": 1,
+      "costUnit": "wall_ms"
+    },
+    {
+      "label": "variant-5588a335bb82b8d5",
+      "armId": "b",
+      "configuration": {
+        "configuration": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534",
+        "effort": "fixture",
+        "model": "fixture:b",
+        "prompt": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534",
+        "skill": "35653d898fe8f4687defd9c18d0f6daaf43f2ae7d762e2c8aa3df7f1e68a3534"
+      },
+      "cost": 2,
+      "costUnit": "wall_ms"
+    }
+  ],
+  "routingDefault": null
+}

package/contracts/debrief/v1/provenance.json

@@ -0,0 +1,89 @@
+{
+  "repository": "skill-harness",
+  "records": [
+    {
+      "commit": "4460af93c55aa3a52df262782cd339ad374113b8",
+      "source": "contracts/work-capture/v2/README.md",
+      "target": "work-capture/README.md",
+      "sha256": "9e33d02ad97c5333f8c6c1cf8c639690b3feb6283596f137860b0e00769f5d2c"
+    },
+    {
+      "commit": "4460af93c55aa3a52df262782cd339ad374113b8",
+      "source": "contracts/work-capture/v2/fixtures/batch.json",
+      "target": "work-capture/fixtures/batch.json",
+      "sha256": "23ba49a4312f27046b91b8b49d777f7d6992ecae964858917b9f143d5a4d70da"
+    },
+    {
+      "commit": "4460af93c55aa3a52df262782cd339ad374113b8",
+      "source": "contracts/work-capture/v2/fixtures/cases.json",
+      "target": "work-capture/fixtures/cases.json",
+      "sha256": "b8efcf0ca89fc34f82cf526b95fd61be010bd23bec4697bc6d54bba7b4cfda14"
+    },
+    {
+      "commit": "4460af93c55aa3a52df262782cd339ad374113b8",
+      "source": "contracts/work-capture/v2/fixtures/review.json",
+      "target": "work-capture/fixtures/review.json",
+      "sha256": "c87d4b91f82df1ee197d25c7a22dcf250791680157b4e0685b3528030e4a2402"
+    },
+    {
+      "commit": "4460af93c55aa3a52df262782cd339ad374113b8",
+      "source": "contracts/work-capture/v2/review-request.schema.json",
+      "target": "work-capture/review-request.schema.json",
+      "sha256": "1f0f8d156b56c5b1ed212e3f7ad470ac9b52568160ffa28fde07a9e53915ea11"
+    },
+    {
+      "commit": "4460af93c55aa3a52df262782cd339ad374113b8",
+      "source": "contracts/work-capture/v2/work-case.schema.json",
+      "target": "work-capture/work-case.schema.json",
+      "sha256": "b3b39d5ccec8a0ffb45dfdff317a2a27802ec337ad4aab9df6f08122dc3f6274"
+    },
+    {
+      "commit": "0475e1f5684e01992850c48aa14841751711701a",
+      "source": "contracts/intervention/v1/README.md",
+      "target": "intervention/README.md",
+      "sha256": "71cd78c8748516d7f7229f69905f0e34e51dead3e73fae13a39e984ed8db917f"
+    },
+    {
+      "commit": "0475e1f5684e01992850c48aa14841751711701a",
+      "source": "contracts/intervention/v1/fixtures/artifact-3ee11136beb864f518252e5024dae9197421fbf97b6e981d3243c782b5c44bd0.txt",
+      "target": "intervention/fixtures/artifact-3ee11136beb864f518252e5024dae9197421fbf97b6e981d3243c782b5c44bd0.txt",
+      "sha256": "3ee11136beb864f518252e5024dae9197421fbf97b6e981d3243c782b5c44bd0"
+    },
+    {
+      "commit": "0475e1f5684e01992850c48aa14841751711701a",
+      "source": "contracts/intervention/v1/fixtures/artifact-58905d872dd3c54a9705f67b05fa82edbad7af6476ae8993faf1a7b9fadfb905.txt",
+      "target": "intervention/fixtures/artifact-58905d872dd3c54a9705f67b05fa82edbad7af6476ae8993faf1a7b9fadfb905.txt",
+      "sha256": "58905d872dd3c54a9705f67b05fa82edbad7af6476ae8993faf1a7b9fadfb905"
+    },
+    {
+      "commit": "0475e1f5684e01992850c48aa14841751711701a",
+      "source": "contracts/intervention/v1/fixtures/assessment.json",
+      "target": "intervention/fixtures/assessment.json",
+      "sha256": "4099505170048292ccf3213893b9d8ca87cf4933c9ae199907c1d5fc5540dd78"
+    },
+    {
+      "commit": "0475e1f5684e01992850c48aa14841751711701a",
+      "source": "contracts/intervention/v1/fixtures/blind-view.json",
+      "target": "intervention/fixtures/blind-view.json",
+      "sha256": "eed28f68aab303a2b73a380a7de6804c58a64262e1f1ad76fcb29238445e9c83"
+    },
+    {
+      "commit": "0475e1f5684e01992850c48aa14841751711701a",
+      "source": "contracts/intervention/v1/fixtures/choice.json",
+      "target": "intervention/fixtures/choice.json",
+      "sha256": "f6d4cbe275ae3673a5d2ba04db8475409d2843ecb2dace6438d76dc64dfcc1df"
+    },
+    {
+      "commit": "0475e1f5684e01992850c48aa14841751711701a",
+      "source": "contracts/intervention/v1/fixtures/manifest.json",
+      "target": "intervention/fixtures/manifest.json",
+      "sha256": "26076b33bfc9a5d4976ace87f3569956a32419c1702f63ddab0963c3242f2e53"
+    },
+    {
+      "commit": "0475e1f5684e01992850c48aa14841751711701a",
+      "source": "contracts/intervention/v1/fixtures/reveal.json",
+      "target": "intervention/fixtures/reveal.json",
+      "sha256": "bdc44d7b528beeb3134b358c2af0aadd5089d650df66c8e1b22f016a9f3e471a"
+    }
+  ]
+}

package/contracts/debrief/v1/work-capture/README.md

@@ -0,0 +1,38 @@
+# Work capture/review contract — P07 input for P08
+
+Owner: skill-harness. `work-case.schema.json` and `review-request.schema.json` are emitted from source-owned schemas. `fixtures/` comes from the actual case builder, archive and decision writer over seven synthetic layout incidents. These are not live captures, authenticated human statements or approved work.
+
+## Host API
+
+```ts
+import { createWorkCaseReviewer } from '@skill-harness/adapters';
+// An independently configured operator/controller selects this exact private archive, batch and author.
+const reviewer = createWorkCaseReviewer(archiveRoot, batchManifestId, operatorIdentity);
+const page = reviewer.list(0, 5); // total/offset/items; no writes, <=5 items per call
+const history = reviewer.history(caseManifestId); // read-only; no decision is inferred
+const result = reviewer.decide({ caseManifestId, priorDecisionId, disposition, note });
+```
+
+The caller must establish the legitimate operator and presentation/attention policy. This API is not a user authenticator, remote capability service or authorization for workers/adoption. A JSON case cannot supply the author, change batch membership or promote itself. Host callbacks can integrate this actual harness-owned writer with an existing dashboard; absent a genuine configured writer, UI actions must stay unavailable rather than writing a separate dashboard ledger.
+
+- `list` returns `{total,offset,items:[{caseManifestId,candidate,priorDecisionId,disposition}]}`. Unselected cases do not become agreement. A skip remains skip/unresolved, not a positive label. Five is a per-call ceiling, not proof of the P08 per-pause budget; the presenter must enforce one overall budget including blind cards.
+- `decide` accepts only the four schema fields. The selected batch bounds membership; author is fixed at host initialization. Unknown keys, stale prior IDs, invalid case state and altered history reject.
+- Result is `{current:WorkCaseDecision,replayed:boolean}`. Exact replay does not overwrite a newer current decision. Corrections append a digest-bound chain and preserve prior records.
+- Data lives in the existing private harness archive under `case-decisions/<caseId>/history.jsonl`, with a non-expiring owner-token lock at `case-decisions/<caseId>.lock`. First initialization occurs under that lock. Files/ancestors are checked, writes/directory entries synced, and another owner's lock is never removed.
+- Missing/partial/invalid existing histories refuse further writes. No truncate, automatic stale-lock recovery, rollback or manufactured empty history is provided. A crash/cleanup failure can leave durable bytes and an error; inspect the exact case. Whole-directory rollback by a hostile same-user owner is not prevented or qualified.
+- Case records stay silent/unresolved/causal-not-established. Labels do not alter P01 acceptance, grants, runtime control or scored specifications. Scenario promotion and independently verified calibration outcomes remain separate.
+
+Schemas cover wire shape. The source case builder additionally checks canonical ID and cost/reason consistency; the decision writer validates chain identity and expected prior state. Rendering arbitrary caller objects is not validation.
+
+## P08 presentation obligations
+
+Use existing dashboard/plugin. A verified suitable pause (not every agent_end or guessed idle state) and explicit exposure/calibration policy are still required for automatic presentation. At most five total questions/cards, including blind-choice cards. Defer on unknown boundary/absence/budget exhaustion. Reconnect retains unresolved cards. Quality choice must precede cost/configuration reveal in the separate frozen comparison family; no live casting result is implied by these fixtures. No worker/status messages or observer steering.
+
+Direct reproduction after compiler build:
+
+```sh
+node scripts/generate-work-case-contract.mjs --check
+node node_modules/vitest/vitest.mjs run packages/core/test/work-capture.test.ts packages/adapters/test/work-case-review.test.ts packages/adapters/test/work-case-archive.test.ts
+```
+
+Actual integration, independent labels/attention policy and full P07/P08 acceptance remain pending.

package/contracts/debrief/v1/work-capture/fixtures/batch.json

@@ -0,0 +1,17 @@
+{
+  "version": "work-candidate-batch-v1",
+  "observationId": "3be5c1b87d00d4457a9ec843379815d15a7d953b2c30b11d2325a0b6705adb82",
+  "candidateIds": [
+    "8c558dfc1db9526c1635515d259f1b6328915e08fee9724b06771c4e739a003c",
+    "48910d9ba3af6ab7fd022e6ee38b14f5a4a02d3fca6fe4aa12dc3ada1ef1f181",
+    "9dde8e074796e03ef02458e2bd158520e5a4fd7242f1fa88da2e86a6af20bddc",
+    "30e6b213a7ad8c236f597484f644ec867874bfa0de56d5c2fd430f7a9178e1a4",
+    "fedbb6f6549c42d213e36603d5246ae030ebc4c28a6f76491632f429cf656f94",
+    "d0303fd5789b494edafcd3c5a215a7191f1547f9d33802d7101bf911cda21ca3",
+    "54856ce8abf12a39cf6e09f92c3b744bae4647bb6dd817a47611c230c69a9635"
+  ],
+  "issues": [],
+  "expected": [],
+  "visibility": "silent",
+  "promotion": "not-authorized"
+}