psyclaw 0.27.23 → 0.28.1

package/vendor/ars/scripts/check_215_field_norm.py

@@ -0,0 +1,173 @@
+#!/usr/bin/env python3
+"""Static lint for #215 field-norm severity coverage across the three reviewer surfaces.
+
+Issue: #215 (field-norm severity calibration, Kim et al. 2026 arXiv:2605.20668v1 W1/§F.3.4).
+
+Enforces that the three #215 changes are present AND scoped to their own block, so a
+bare keyword appearing elsewhere in a file cannot make the lint pass while the actual
+load-bearing instruction is missing (falsifiability discipline, per
+feedback_lint_passes_but_prompt_silent.md — same pattern as check_v3_9_2_phase_boundary).
+
+Three surfaces:
+
+1. domain_reviewer_agent.md — a `### Step 5: Field-Norm Severity Discipline (#215)` block
+   that contains the hard rule (MUST ground the norm in an external source, MUST NOT
+   assert from model knowledge), the broadened evidence definition (not just a literature
+   citation), and the `[FIELD-NORM UNVERIFIED]` down-rate label.
+
+2. devils_advocate_reviewer_agent.md — a 9th challenge dimension
+   `### 9. Field-Norm Severity Calibration (#215)` AND the two required CRITICAL/MAJOR
+   fields `field_norm_boundary` + `evidence_crossing_rationale`.
+
+3. calibration_mode_protocol.md — a `### Phase 3.5: Severity-miscalibration measurement (#215)`
+   block carrying the low/med/high risk classification and the anti-circularity grounding
+   discipline (classify grounding, NOT norm-correctness — do not repeat the W1 failure).
+
+Exit 0 = clean, 1 = any failure.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+
+
+def _read(rel: str) -> str:
+    return (REPO_ROOT / rel).read_text(encoding="utf-8")
+
+
+def _block(text: str, header_re: str) -> str | None:
+    """Return the markdown block from a header matching header_re up to the next header of
+    the same-or-higher level (## or ###), or end of file. None if the header is absent.
+
+    Scopes keyword checks to the block so a keyword elsewhere in the file does not count.
+    A ``##``/``###`` line INSIDE a ``` fenced code block is NOT a real header (e.g. an
+    Output Format section embeds a sample report whose code fence contains ``## ...`` lines);
+    treating it as one would truncate the block early and drop content below it.
+    """
+    m = re.search(header_re, text, re.M)
+    if not m:
+        return None
+    start = m.start()
+    rest = text[m.end():]
+    in_fence = False
+    offset = 0
+    for line in rest.splitlines(keepends=True):
+        if line.lstrip().startswith("```"):
+            in_fence = not in_fence
+        elif not in_fence and re.match(r"\#{2,3} ", line):
+            # A real header line (column 0, outside any fence) ends the block.
+            return text[start : m.end() + offset]
+        offset += len(line)
+    return text[start:]
+
+
+def check() -> list[str]:
+    errors: list[str] = []
+
+    # --- Surface 1: domain_reviewer_agent.md Step 5 ---
+    dr = _read("academic-paper-reviewer/agents/domain_reviewer_agent.md")
+    step5 = _block(dr, r"^### Step 5: Field-Norm Severity Discipline \(#215\)")
+    if step5 is None:
+        errors.append("domain_reviewer_agent.md: missing '### Step 5: Field-Norm Severity Discipline (#215)' block")
+    else:
+        # The down-rate prohibition AND the load-bearing positive MUST-ground clause must
+        # both survive. The positive clause binds the modal to the grounding requirement
+        # ("MUST** ground the norm in an external"), so weakening MUST→SHOULD is caught — a
+        # bare "ground the norm" substring would still pass under SHOULD (codex re-review P1).
+        for clause in ("MUST NOT", "[FIELD-NORM UNVERIFIED]", "MUST** ground the norm in an external"):
+            if clause not in step5:
+                errors.append(f"domain_reviewer_agent.md Step 5: missing required clause {clause!r}")
+        # codex P1: evidence is NOT limited to a literature citation.
+        if "not limited to a literature citation" not in step5:
+            errors.append(
+                "domain_reviewer_agent.md Step 5: missing the broadened-evidence rule "
+                "('not limited to a literature citation')"
+            )
+
+    # --- Surface 2: devils_advocate_reviewer_agent.md dimension 9 + CRITICAL fields ---
+    da = _read("academic-paper-reviewer/agents/devils_advocate_reviewer_agent.md")
+    dim9 = _block(da, r"^### 9\. Field-Norm Severity Calibration \(#215\)")
+    if dim9 is None:
+        errors.append("devils_advocate_reviewer_agent.md: missing '### 9. Field-Norm Severity Calibration (#215)' dimension")
+    # The two required fields must land in the OUTPUT FORMAT block — that is what makes the
+    # rule reach the actual review output. A file-wide check would pass on the prose mention
+    # in the gating section even if the output-format columns were deleted (codex P1).
+    output_fmt = _block(da, r"^## Output Format")
+    if output_fmt is None:
+        errors.append("devils_advocate_reviewer_agent.md: missing '## Output Format' block")
+    else:
+        # The CRITICAL/MAJOR tables carry the fields as human-readable column HEADERS
+        # (Title Case), which is what actually reaches the review output. The snake_case
+        # names live only in the gating prose. Scope to EACH severity subsection separately:
+        # if only one table loses its columns, a whole-block check still finds the names in
+        # the other table and false-passes (codex re-review P1). These #### headers sit inside
+        # the ```markdown sample, so slice between #### markers rather than using _block.
+        for severity in ("CRITICAL", "MAJOR"):
+            sub = re.search(rf"^#### {severity}\n(.*?)(?=^#### |\Z)", output_fmt, re.M | re.S)
+            if sub is None:
+                errors.append(f"devils_advocate_reviewer_agent.md Output Format: missing '#### {severity}' table")
+                continue
+            for column in ("Field-Norm Boundary", "Evidence-Crossing Rationale"):
+                if column not in sub.group(1):
+                    errors.append(
+                        f"devils_advocate_reviewer_agent.md Output Format {severity} table: "
+                        f"missing required column {column!r}"
+                    )
+    # The snake_case field NAMES + their grounding definition live in the CRITICAL-finding
+    # gating block; check them there (scoped) so a definition deleted from that block is
+    # caught independently of the output-format columns.
+    crit_block = _block(da, r"^### What Constitutes a CRITICAL Finding")
+    if crit_block is None:
+        errors.append("devils_advocate_reviewer_agent.md: missing '### What Constitutes a CRITICAL Finding' block")
+    else:
+        for field in ("field_norm_boundary", "evidence_crossing_rationale"):
+            if field not in crit_block:
+                errors.append(
+                    f"devils_advocate_reviewer_agent.md CRITICAL-finding block: missing field "
+                    f"definition {field!r}"
+                )
+        if "[FIELD-NORM UNVERIFIED]" not in crit_block:
+            errors.append(
+                "devils_advocate_reviewer_agent.md CRITICAL-finding block: missing "
+                "'[FIELD-NORM UNVERIFIED]' down-rate label"
+            )
+
+    # --- Surface 3: calibration_mode_protocol.md Phase 3.5 ---
+    cal = _read("academic-paper-reviewer/references/calibration_mode_protocol.md")
+    phase35 = _block(cal, r"^### Phase 3\.5: Severity-miscalibration measurement \(#215\)")
+    if phase35 is None:
+        errors.append("calibration_mode_protocol.md: missing '### Phase 3.5: Severity-miscalibration measurement (#215)' block")
+    else:
+        # Require the actual risk-level DEFINITIONS, not bare words. The intro line already
+        # contains "low / med / high", so a substring check passes even if all three
+        # definition bullets are deleted (codex P2). Each level is defined as **`level`** — …
+        for level in ("low", "med", "high"):
+            if f"**`{level}`**" not in phase35:
+                errors.append(
+                    f"calibration_mode_protocol.md Phase 3.5: missing the {level!r} risk-level definition"
+                )
+        # codex P1: classify GROUNDING, not norm-correctness — do not repeat the failure.
+        if "MUST NOT" not in phase35 or "evals/gold/field_norm_severity" not in phase35:
+            errors.append(
+                "calibration_mode_protocol.md Phase 3.5: missing the anti-circularity grounding "
+                "discipline (MUST NOT guess norm-correctness; anchor to evals/gold/field_norm_severity)"
+            )
+
+    return errors
+
+
+def main() -> int:
+    errors = check()
+    if errors:
+        for e in errors:
+            print(f"ERROR: {e}", file=sys.stderr)
+        return 1
+    print("215_field_norm: all three reviewer surfaces carry their scoped #215 blocks")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/vendor/ars/scripts/check_216_surface_form.py

@@ -0,0 +1,250 @@
+#!/usr/bin/env python3
+"""Static lint for the #216 Surface-Form Parity self-check on the Devil's Advocate surface.
+
+Issue: #216 (reviewer-type / surface-form asymmetry, Kim et al. 2026 arXiv:2605.20668v1 §F.3.6).
+
+Enforces that the parity gate is present AND that every load-bearing clause survives, scoped to
+its own marker block, so a bare keyword elsewhere in the file cannot make the lint pass while the
+actual instruction is gone (falsifiability discipline — same pattern as check_215_field_norm.py).
+
+The DA agent must carry, INSIDE the `SURFACE-FORM-PARITY-BLOCK` marker comments:
+
+  * extract the checkable substance before judging,
+  * judge the claim against the paper, not the polish,
+  * do NOT down-rate informal/vague wording UNLESS ambiguity changes truth conditions,
+  * do NOT credit technical specificity without checking the paper,
+  * run the opposite-style counterfactual and revise / mark ambiguous on a flip,
+  * authorship is NOT a judgment input.
+
+The block must be a REAL block (markers present, outside a fenced code sample), and the
+verdict-time framing + the §F.3.6 attribution + the epistemic-status disclaimer must survive in
+the surrounding section so the gate cannot decay into a bare checklist with no provenance.
+
+Exit 0 = clean, 1 = any failure.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+DA_AGENT = "academic-paper-reviewer/agents/devils_advocate_reviewer_agent.md"
+SYNTH_AGENT = "academic-paper-reviewer/agents/editorial_synthesizer_agent.md"
+
+BEGIN_MARKER = "SURFACE-FORM-PARITY-BLOCK:BEGIN"
+END_MARKER = "SURFACE-FORM-PARITY-BLOCK:END"
+
+# The two verdict-time surfaces that adjudicate the correctness and decision bearing of a
+# reviewer concern.
+# Both must carry a scoped Surface-Form Parity block (codex P2 round 6: the editorial synthesizer
+# arbitrates sub-claims and explicitly down-ranks "too vague" criticisms — exactly where §F.3.6
+# fires — so DA alone is not the only surface). Each surface declares its own section header and
+# its own load-bearing clauses (the DA judges a verdict on a claim; the synthesizer weights a
+# sub-claim in arbitration), but both share the marker block + epistemic discipline.
+SURFACES = {
+    DA_AGENT: {
+        "section_header_re": r"^## Surface-Form Parity Self-Check \(#216\)",
+        "section_label": "## Surface-Form Parity Self-Check (#216)",
+        "clauses": {
+            "extract-substance": "Extract the checkable substance first",
+            "judge-vs-paper-not-polish": "Judge the claim against the paper, not against the polish",
+            "no-down-rate-informal": "Do not down-rate informal or vague wording",
+            "unless-truth-conditions": "unless* the ambiguity actually changes the truth conditions or makes the claim unevaluable",
+            "no-credit-specificity": "Do not credit technical specificity",
+            "still-requires-checking": "still requires checking against the paper before you accept it",
+            "opposite-style-counterfactual": "Run the opposite-style counterfactual",
+            "would-my-verdict-change": "would my verdict change if this same substantive claim were rewritten in the opposite style",
+            "revise-or-mark-ambiguous": "revise the verdict, or mark the claim ambiguous",
+            "authorship-not-input": "Authorship (human vs AI origin of a concern) is deliberately **not** a judgment input",
+        },
+    },
+    SYNTH_AGENT: {
+        "section_header_re": r"^### Step 1c — Surface-Form Parity Check \(#216\)",
+        "section_label": "### Step 1c — Surface-Form Parity Check (#216)",
+        "clauses": {
+            "judge-substance-not-polish": "Judge the sub-claim's substance against the paper, not against its polish",
+            "no-down-rate-informal": "Do not down-rate informal or vague wording",
+            "unless-unevaluable": "unless* the ambiguity actually makes the sub-claim unevaluable",
+            "no-credit-specificity": "Do not credit technical specificity",
+            "needs-paper-evidence": "A precise-sounding sub-claim still needs paper evidence",
+            "opposite-style-counterfactual": "Run the opposite-style counterfactual",
+            "would-assessment-change": "would this sub-claim's evidentiary assessment change if the same substance were rewritten in the opposite style",
+            "reassess-or-unevaluable": "reassess on substance, or mark the sub-claim unevaluable",
+            "authorship-not-input": "Authorship (whether a sub-claim originated from a human or an AI reviewer) is **not** a decision input",
+        },
+    },
+}
+
+
+def _read(rel: str) -> str:
+    return (REPO_ROOT / rel).read_text(encoding="utf-8")
+
+
+def _section(text: str, header_re: str) -> str | None:
+    """Return the markdown section from a header matching header_re up to the next heading of the
+    SAME-OR-HIGHER level (fence-aware: a heading inside a ``` fence does not end the section).
+    None if header absent.
+
+    The stop level is derived from the matched header's own ``#`` depth (codex P2 round 7): a
+    ``###`` section like Step 1c must end at the next ``###``/``##``/``#``, not only at ``##`` —
+    otherwise the marker block could be relocated into a later ``###`` subsection and still be
+    counted as inside this section.
+    """
+    header_pat = re.compile(header_re, re.M)
+    # Find the header, but ignore any match that sits inside an open ``` fence (codex P2 round 8):
+    # a whole section wrapped in a code fence is only a sample, not a live instruction, so a
+    # file-wide regex match there must not be treated as a real section header.
+    in_fence = False
+    pos = 0
+    start = None
+    header_end = None
+    for line in text.splitlines(keepends=True):
+        if line.lstrip().startswith("```"):
+            in_fence = not in_fence
+        elif not in_fence and header_pat.match(line):
+            start = pos
+            header_end = pos + len(line)
+            break
+        pos += len(line)
+    if start is None or header_end is None:
+        return None
+    # depth of the matched header (number of leading '#').
+    header_line = text[start:].splitlines()[0]
+    depth = len(header_line) - len(header_line.lstrip("#"))
+    if depth < 1:
+        depth = 2  # defensive: header_re always targets a real heading
+    # a heading ends the section if its depth <= this section's depth.
+    stop_re = re.compile(r"^\#{1," + str(depth) + r"} ")
+    rest = text[header_end:]
+    in_fence = False
+    offset = 0
+    for line in rest.splitlines(keepends=True):
+        if line.lstrip().startswith("```"):
+            in_fence = not in_fence
+        elif not in_fence and stop_re.match(line):
+            return text[start : header_end + offset]
+        offset += len(line)
+    return text[start:]
+
+
+def _marker_block(text: str) -> str | None:
+    """Return the text strictly BETWEEN the BEGIN and END markers, only if both markers sit
+    OUTSIDE any fenced code block (a marker buried in a ``` sample is not a live instruction).
+    None if a marker is missing or fenced."""
+    # Find marker positions and verify each is outside a code fence.
+    in_fence = False
+    begin_pos = end_pos = None
+    pos = 0
+    for line in text.splitlines(keepends=True):
+        if line.lstrip().startswith("```"):
+            in_fence = not in_fence
+        else:
+            if BEGIN_MARKER in line and not in_fence and begin_pos is None:
+                begin_pos = pos + len(line)
+            elif END_MARKER in line and not in_fence and end_pos is None and begin_pos is not None:
+                end_pos = pos
+        pos += len(line)
+    if begin_pos is None or end_pos is None or end_pos <= begin_pos:
+        return None
+    return text[begin_pos:end_pos]
+
+
+def _strip_fenced(text: str) -> str:
+    """Drop any ``` fenced spans, keeping only LIVE (unfenced) lines. Used so a load-bearing
+    clause wrapped in a code fence inside the marker block is not counted as present (codex P2
+    round 12): a fenced clause is only a sample, not a live instruction."""
+    out = []
+    in_fence = False
+    for line in text.splitlines(keepends=True):
+        if line.lstrip().startswith("```"):
+            in_fence = not in_fence
+            continue
+        if not in_fence:
+            out.append(line)
+    return "".join(out)
+
+
+def _check_surface(rel: str, spec: dict) -> list[str]:
+    """Check one verdict-time surface carries its scoped Surface-Form Parity block."""
+    errors: list[str] = []
+    text = _read(rel)
+    label = spec["section_label"]
+
+    section = _section(text, spec["section_header_re"])
+    if section is None:
+        errors.append(f"{rel}: missing '{label}' section")
+        return errors
+
+    # Both surfaces must carry the §F.3.6 attribution; the prior is named on at least one
+    # surface (the DA section states it in full), but each section must attribute the paper.
+    if "§F.3.6" not in section:
+        errors.append(f"{rel} #216 section: missing the §F.3.6 paper attribution")
+    if "specificity correlates with correctness" not in section:
+        errors.append(
+            f"{rel} #216 section: missing the named root-cause prior "
+            f"('specificity correlates with correctness')"
+        )
+
+    # Extract the marker block from WITHIN the parity section, not the whole file (codex P2): a
+    # block moved out of the section while the header/framing/disclaimer remain would still be
+    # found by a file-wide lookup, false-passing even though the section no longer holds the gate.
+    block = _marker_block(section)
+    if block is None:
+        errors.append(
+            f"{rel}: missing a live '{BEGIN_MARKER}'..'{END_MARKER}' marker block "
+            f"INSIDE the '{label}' section (markers absent, out of section, out of order, "
+            f"or buried inside a code fence)"
+        )
+        return errors
+
+    # Each load-bearing clause is asserted by a stable substring that binds the modal to the
+    # action, so a weakening (e.g. dropping the MUST/NOT or the UNLESS guard) is caught — a bare
+    # keyword like "ambiguous" or "paper" elsewhere cannot satisfy these (codex P1.1). Check the
+    # LIVE (unfenced) block text only (codex P2 round 12): a clause wrapped in a ``` fence inside
+    # the block is just a sample, not a live instruction.
+    live_block = _strip_fenced(block)
+    for name, needle in spec["clauses"].items():
+        if needle not in live_block:
+            errors.append(f"{rel} #216 parity block: missing load-bearing clause [{name}]")
+
+    # The epistemic-status disclaimer must survive in the section (prompt-surface honesty: no
+    # runtime-free-of-bias claim, directional counts are not a target). Mirrors #215.
+    if "Epistemic status" not in section:
+        errors.append(f"{rel} #216 section: missing the epistemic-status disclaimer")
+    if "not a calibration target" not in section:
+        errors.append(
+            f"{rel} #216 section: missing the 'directional counts are not a calibration target' "
+            f"disclaimer (prevents the §F.3.6 29/10 numbers reading as a threshold)"
+        )
+
+    return errors
+
+
+def check() -> list[str]:
+    errors: list[str] = []
+    for rel, spec in SURFACES.items():
+        errors.extend(_check_surface(rel, spec))
+    # The DA section additionally must carry the verdict-time framing (distinct from #215's
+    # severity gate). The synthesizer section is inherently arbitration-time, framed in the header.
+    da_section = _section(_read(DA_AGENT), SURFACES[DA_AGENT]["section_header_re"])
+    if da_section is not None and "verdict-assignment time" not in da_section and "verdict time" not in da_section:
+        errors.append(
+            f"{DA_AGENT} #216 section: missing the 'verdict' time-of-application framing "
+            f"(the parity gate runs at verdict time, distinct from #215's severity gate)"
+        )
+    return errors
+
+
+def main() -> int:
+    errors = check()
+    if errors:
+        for e in errors:
+            print(f"ERROR: {e}", file=sys.stderr)
+        return 1
+    print("216_surface_form: DA + editorial synthesizer carry the scoped Surface-Form Parity block")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/vendor/ars/scripts/check_268_nested_commitment_ledger.py

@@ -0,0 +1,180 @@
+#!/usr/bin/env python3
+"""#268 nested-object Commitment Ledger lint.
+
+Enforces the structural invariants of the Schema 11 Commitment Ledger after the
+parallel-list -> nested-object refactor (#268). Runs alongside the existing Kong
+A1 / #269 surfaces; no JSON-schema exists for Schema 11, so this lint operates on
+the calibration seed YAML plus a cascade-completeness scan of the two prose
+surfaces that previously carried index notation.
+
+Invariants (spec docs/design/2026-05-31-ars-268-schema11-nested-commitment-ledger-spec.md §6):
+
+  N1  every expected_commitments[] entry in the seed is a mapping carrying
+      commitment_text + commitment_type + required_evidence_type.
+  N2  the seed carries NO top-level expected_fulfillment_status /
+      expected_unfulfilled_rationale parallel lists on any case (regression guard
+      against the retired A1 parallel-list shape).
+  N3  for each expected_commitments entry: fulfillment_status (if present) is in
+      the enum; unfulfilled_rationale, WHEN PRESENT, must be non-empty on a
+      non-fulfilled status and absent on a fulfilled one (no "" placeholder). A
+      non-fulfilled commitment MAY omit unfulfilled_rationale entirely — that is
+      the valid COMMITMENT_GAP case (e.g. seed N1/N2), not a violation.
+  N3b the case-level expected_commitment_gap oracle agrees with the per-commitment
+      shape: gap fires iff some commitment is non-fulfilled with a blank/absent
+      rationale.
+  N4  the Schema 11 prose (shared/handoff_schemas.md) contains no surviving
+      `fulfillment_status[i]` / `unfulfilled_rationale[i]` index notation.
+  N5  re_review_mode_protocol Commitment Ledger Verification contains no surviving
+      index notation either.
+
+Exit 0 on success, 1 on any violation (CI gate).
+"""
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+
+import yaml
+
+REPO = Path(__file__).resolve().parent.parent
+SEED = REPO / "evals/calibration/commitment_ledger_seed.yaml"
+SCHEMA = REPO / "shared/handoff_schemas.md"
+RE_REVIEW = REPO / "academic-paper-reviewer/references/re_review_mode_protocol.md"
+
+EXTRACTION_FIELDS = ("commitment_text", "commitment_type", "required_evidence_type")
+STATUS_ENUM = {"fulfilled", "partial", "not-fulfilled", "explicitly-rejected-with-rationale"}
+NONFULFILLED = STATUS_ENUM - {"fulfilled"}  # derived so the two stay in sync
+
+# Index-notation regex: a retired parallel-list field name immediately followed by
+# a subscript like [i] or [0]. Catches parallel-list-era prose the refactor must
+# remove. Tombstone check for the two fields #268 retired — add any further field
+# names here whenever a later schema refactor retires an index-notation field.
+INDEX_NOTATION = re.compile(r"\b(?:fulfillment_status|unfulfilled_rationale)\s*\[\s*\w+\s*\]")
+
+
+def _blank_rationale(com: dict) -> bool:
+    """True when a commitment's unfulfilled_rationale is missing, null, or whitespace.
+
+    `com.get(key, "")` returns None (not "") when the key is present with a YAML-null
+    value, and `str(None)` is the truthy "None" — so a bare `unfulfilled_rationale:`
+    would falsely read as populated. Treat missing / None / blank uniformly here.
+    """
+    val = com.get("unfulfilled_rationale")
+    return val is None or not str(val).strip()
+
+
+def check_seed(seed: dict) -> list[str]:
+    """N1 + N2 + N3 + N3b against a parsed seed mapping."""
+    errors: list[str] = []
+    cases = seed.get("cases", [])
+    if not cases:
+        errors.append("seed carries no cases")
+        return errors
+    for case in cases:
+        cid = case.get("case_id", "<no-id>")
+
+        # N2: no retired parallel-list keys on the case.
+        for legacy in ("expected_fulfillment_status", "expected_unfulfilled_rationale"):
+            if legacy in case:
+                errors.append(f"N2 {cid}: retired parallel-list key `{legacy}` present")
+
+        commitments = case.get("expected_commitments", [])
+        for idx, com in enumerate(commitments):
+            where = f"{cid}[{idx}]"
+            if not isinstance(com, dict):
+                errors.append(f"N1 {where}: commitment entry is not a mapping")
+                continue
+            # N1: extraction fields present.
+            for field in EXTRACTION_FIELDS:
+                if field not in com:
+                    errors.append(f"N1 {where}: missing extraction field `{field}`")
+
+            # N3: lifecycle coherence.
+            status = com.get("fulfillment_status")
+            has_rationale = "unfulfilled_rationale" in com
+            if status is not None:
+                if status not in STATUS_ENUM:
+                    errors.append(f"N3 {where}: fulfillment_status `{status}` not in enum")
+                if status == "fulfilled" and has_rationale:
+                    errors.append(
+                        f"N3 {where}: fulfilled commitment carries unfulfilled_rationale "
+                        "(omit it — no \"\" placeholder in nested shape)"
+                    )
+                if status in NONFULFILLED and has_rationale and _blank_rationale(com):
+                    errors.append(
+                        f"N3 {where}: non-fulfilled status `{status}` carries empty "
+                        "unfulfilled_rationale (must be non-empty, or omit the key to trigger gap)"
+                    )
+            elif has_rationale:
+                errors.append(
+                    f"N3 {where}: unfulfilled_rationale present without fulfillment_status"
+                )
+
+        # N3b: the case-level expected_commitment_gap oracle must agree with the
+        # per-commitment shape. COMMITMENT_GAP fires iff some commitment is
+        # non-fulfilled with a missing/empty rationale (re_review_mode_protocol).
+        # Validate the oracle so a future seed can't carry an incoherent flag.
+        if "expected_commitment_gap" in case:
+            expected_gap = case["expected_commitment_gap"]
+            if not isinstance(expected_gap, bool):
+                # A quoted "false" / "true" would coerce truthy under bool() and
+                # silently pass the oracle check — require a real YAML boolean.
+                errors.append(
+                    f"N3b {cid}: expected_commitment_gap must be a boolean, got "
+                    f"{type(expected_gap).__name__} ({expected_gap!r})"
+                )
+            actual_gap = any(
+                isinstance(com, dict)
+                and com.get("fulfillment_status") in NONFULFILLED
+                and _blank_rationale(com)
+                for com in commitments
+            )
+            if isinstance(expected_gap, bool) and actual_gap != expected_gap:
+                errors.append(
+                    f"N3b {cid}: expected_commitment_gap={expected_gap} "
+                    f"contradicts per-commitment shape (actual gap={actual_gap})"
+                )
+    return errors
+
+
+def check_index_notation(label: str, text: str) -> list[str]:
+    """N4 / N5: no surviving index-notation in the prose surface."""
+    errors: list[str] = []
+    for m in INDEX_NOTATION.finditer(text):
+        line_no = text.count("\n", 0, m.start()) + 1
+        errors.append(f"{label}:{line_no}: surviving index notation `{m.group(0)}`")
+    return errors
+
+
+def main() -> int:
+    errors: list[str] = []
+
+    if not SEED.exists():
+        errors.append(f"missing seed file: {SEED}")
+    else:
+        errors += check_seed(yaml.safe_load(SEED.read_text(encoding="utf-8")))
+
+    if not SCHEMA.exists():
+        errors.append(f"missing schema file: {SCHEMA}")
+    else:
+        errors += check_index_notation("N4 shared/handoff_schemas.md", SCHEMA.read_text(encoding="utf-8"))
+
+    if not RE_REVIEW.exists():
+        errors.append(f"missing re-review protocol: {RE_REVIEW}")
+    else:
+        errors += check_index_notation(
+            "N5 re_review_mode_protocol.md", RE_REVIEW.read_text(encoding="utf-8")
+        )
+
+    if errors:
+        print("#268 nested-commitment-ledger lint FAILED:")
+        for e in errors:
+            print(f"  - {e}")
+        return 1
+    print("#268 nested-commitment-ledger lint OK (N1-N5)")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())