thinkpool-pair 0.7.348 → 0.7.350

package/code-event-contract.mjs

@@ -16,8 +16,8 @@ const E = EVENT_CLASS.DURABLE_DELIVERY_EVIDENCE
 
 // Exhaustive over every kind currently emitted into a Code room, its retained log,
 // or the durable __agent notification stream. `answer`/`control`/etc. are commands
-// replayed by the transcript; they are not durable decision records. Foundation B
-// will add actor-bound decision records and authoritative verification receipts.
+// replayed by the transcript; they are not durable decision records. Pair control
+// supplies actor-bound decision records and authoritative verification receipts.
 // Adding a producer without adding its kind here is a test/dev error and a
 // fail-closed production value.
 export const CODE_EVENT_REGISTRY = Object.freeze({
@@ -82,9 +82,10 @@ export function classifyCodeEvent (eventOrKind, { strict = strictByDefault() } =
     // Only delivery evidence currently has the archive-level durability contract.
     durable: eventClass === E,
     replayable: eventClass !== V,
-    // Foundation B supplies actor-bound authorization. Classification alone never does.
+    // Pair control supplies actor-bound authorization. Classification alone never does.
     authorizes: false,
-    // Lifecycle completion additionally requires an explicit verification receipt.
+    // `completes` means an authority-verified outcome, not a runtime turn boundary.
+    // A successful result can settle execution while remaining unverified.
     completes: false,
   })
 }

package/lane-lifecycle.mjs

@@ -107,10 +107,12 @@ export function projectLaneLifecycle ({
     } else if (event.kind === 'result') {
       if (RESULT_CANCELED.has(event.subtype)) out = base(LIFECYCLE_STATE.CANCELED, null, { rawStatus })
       else if (event.subtype && event.subtype !== 'success') out = base(LIFECYCLE_STATE.FAILED, null, { rawStatus })
-      // An agent-supplied `verified` field (or a broad caller flag) is only a
-      // claim. Foundation B will wire an authority-bound receipt; Foundation A
-      // deliberately cannot make a lane Done from transcript evidence alone.
-      else out = base(LIFECYCLE_STATE.BLOCKED, BLOCKED_REASON.VERIFICATION_REQUIRED, { rawStatus })
+      // A successful result is authoritative for the execution boundary: the
+      // runtime turn finished and the lane is idle. It is not proof that the
+      // worker's findings or changed product behavior were independently
+      // verified. Keep that evidence dimension in `verified`; pair-control
+      // receipts, not transcript claims, are the only authority for upgrading it.
+      else out = base(LIFECYCLE_STATE.DONE, null, { rawStatus })
     }
   }
 
@@ -137,9 +139,9 @@ export function projectFlowLifecycle (rawStatus) {
       return base(LIFECYCLE_STATE.BLOCKED, BLOCKED_REASON.DEPENDENCY, { rawStatus })
     case 'failed': return base(LIFECYCLE_STATE.FAILED, null, { rawStatus })
     case 'cancelled': case 'canceled': return base(LIFECYCLE_STATE.CANCELED, null, { rawStatus })
-    // A task's commit and an assembled artifact are evidence, not an observed
-    // verification receipt. No caller-provided boolean can promote Flow to Done.
-    case 'done': return base(LIFECYCLE_STATE.BLOCKED, BLOCKED_REASON.VERIFICATION_REQUIRED, { rawStatus })
+    // `done` is the Flow execution boundary. Commits and artifacts remain
+    // unverified evidence until an authority-bound receipt observes them.
+    case 'done': return base(LIFECYCLE_STATE.DONE, null, { rawStatus })
     default: return base(LIFECYCLE_STATE.BLOCKED, BLOCKED_REASON.NEEDS_INPUT, { rawStatus })
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.348",
+  "version": "0.7.350",
   "description": "Connect Claude Code, Codex, or Hermes on your computer to a Thinkpool Code room.",
   "type": "module",
   "bin": {

package/thinkpool-room-prompt.mjs

@@ -39,9 +39,12 @@ export const THINKPOOL_DESIGN_INTERACTION_RULE = thinkPoolCapabilityContract('de
 
 export const THINKPOOL_DESIGN_DELIVERY_RULE = `THINKPOOL DESIGN (mandatory for authored HTML): save the editable HTML source in the workspace, then use the $TP_MOCKUP_OUTBOX render helper so the room receives a source-backed Thinkpool Design card with both desktop (1440×900) and mobile (390×844) previews. The interactive Design card/popup is the visible result: the renders remain required verification inputs, but when that card is displayed do not also surface duplicate inline PNGs. Surface desktop/mobile PNGs only when no interactive source-backed Design artifact is available. ${THINKPOOL_DESIGN_INTERACTION_RULE} When the requested Design surface is an existing product page or route, first build and capture the actual route at both viewports, then read its current source, styles, copy, fonts, and assets. Derive the editable Design artifact from that evidence and compare both artifact captures against the real route before delivery. Preserve the real page faithfully except for explicitly proposed edits—never hand-recreate it from memory, simplify it, replace it with generic mockup content, or label an approximation as the product. If a faithful editable artifact cannot be produced, surface the actual route captures and say that Design editing is unavailable for that surface. Never paste raw HTML into chat, send an .html file as the room deliverable, or substitute a bare URL or single screenshot for this card. A shareable browser URL may accompany the card, but never replaces it.`
 
+export const THINKPOOL_REMOTE_ARTIFACT_ACCESS_RULE = 'REMOTE ARTIFACT ACCESS (authoritative): ThinkPool room members may be reviewing from a phone and have only their existing ThinkPool session. Never use HyperFrames or another external account-, install-, claim-token-, or login-gated surface for a mockup, preview, animation, or visual deliverable unless a person explicitly requests that exact surface. Prefer the source-backed ThinkPool Design card, accompanied when required by an authentication-free browser URL such as GitHub Pages. An HTTP 200 response is not proof of accessibility: verify in a fresh signed-out mobile browser that the artifact itself renders and that its intended interaction or motion works without another login. If a candidate delivery route asks for authentication or a claim, abandon that route and use ThinkPool-native evidence instead.'
+
 export const THINKPOOL_REMOTE_DELIVERY_RULES = Object.freeze([
   'REMOTE USER (authoritative default for ThinkPool Code rooms): unless a person explicitly says they are at the host machine, assume everyone driving this room is remote — possibly on a phone — with no terminal and no access to the host filesystem. Never ask them to run a local command, open a local file, or "go check" something on the machine. Anything host-side, you run yourself and show the result in the room. Only suggest actions they can actually do from the room UI or a browser.',
   'LINKS & ARTIFACTS: a local filesystem path, file:// URL, localhost/127.0.0.1 address, or host-only preview is useless to a remote room. Every link you surface must be reachable by the people in the room.',
+  THINKPOOL_REMOTE_ARTIFACT_ACCESS_RULE,
   'Whenever you produce HTML or shareable markup — a demo, mockup, preview, report, or page — publish it to a browser-renderable GitHub-shareable URL, normally GitHub Pages (or an equivalent URL that actually renders; raw.githubusercontent.com serves HTML as plain text). Give the room that shareable URL in addition to the Thinkpool Design card, never instead of it and never only as a local path. If you cannot publish it, say so instead of falling back to a host-only path.',
   'SHOW VISUAL WORK: whenever you build, change, or fix anything visual, show the result in the room. A source-backed Thinkpool Design card/popup is already the interactive visible result, so do not additionally surface duplicate PNGs. When no interactive Design artifact is available, capture and surface desktop/mobile PNG evidence inline.',
   'BRIDGE PREVIEWS: for a built web UI, use preview_start (default root: dist), then preview_capture for exact desktop 1440x900 and mobile 390x844 PNGs, and preview_inspect when DOM text or selector geometry helps. Run the project build first and stop the preview server with preview_stop when done. Captures are verification evidence by default; set card=true only for an intentional user-facing mockup or Design deliverable, never merely because a turn changed visual code.',
@@ -56,6 +59,7 @@ export const THINKPOOL_REMOTE_DELIVERY_RULES = Object.freeze([
 export const THINKPOOL_RUNTIME_TURN_REMINDER = [
   THINKPOOL_AGENT_CONTRACT,
   'REMOTE DELIVERY: assume the people are remote unless they explicitly say otherwise. Run host-side work yourself; never hand them a local path, file:// or localhost URL, or ask them to use the host terminal. Surface reachable links and inline evidence in the room.',
+  THINKPOOL_REMOTE_ARTIFACT_ACCESS_RULE,
   'VISUAL DELIVERY: build first and verify exact desktop and mobile renders. If a source-backed Thinkpool Design card/popup is displayed, do not separately surface its PNGs; if no interactive Design artifact is available, surface the desktop/mobile PNG evidence inline. Stop bridge previews when finished.',
   THINKPOOL_DESIGN_INTERACTION_RULE,
   'VERIFY BEFORE CLAIMING: run or serve what changed and show the real response, passing output, or rendered evidence; state exactly what remains unverified.',
@@ -71,6 +75,7 @@ export const THINKPOOL_FULL_REMINDER_INTERVAL = 5
 export const THINKPOOL_RUNTIME_SALIENCE_REMINDER = [
   THINKPOOL_TURN_SCOPE_RULE,
   'THINKPOOL: prefer relevant exposed room tools unless the user explicitly opts out; obey the durable terminal role and consent rules. Assume the people are remote, do host work yourself, and deliver reachable verified results.',
+  THINKPOOL_REMOTE_ARTIFACT_ACCESS_RULE,
 ].join(' ')
 
 const ROUTE_TRIGGERS = Object.freeze(Object.fromEntries(