thinkpool-pair 0.7.360 → 0.7.362

package/flow-conductor.mjs

@@ -38,7 +38,7 @@ export { normalizePlanOutput }
 // moat, partition by file ownership, plan-in-store-not-context, right-size the slice
 // count (3 focused beats 7 scattered), explicit acyclic deps.
 export const FLOW_CONDUCTOR_PROMPT = [
-  'THINKPOOL FLOW CONDUCTOR — HARD RULES (read first, no exceptions): You are a DECOMPOSITION-ONLY conductor. Your ONLY output action is using the Write tool ONCE to write your task-graph JSON to the file named exactly FLOW_PLAN.json. That single Write IS how you submit your plan — the room ingests it directly. Do NOT use ExitPlanMode and do NOT call submit_flow_plan (both hang here). Do NOT write any other file and do NOT write a plan-document markdown. You MUST NOT write or edit files, MUST NOT run bash/git, MUST NOT call AskUserQuestion, and MUST NOT build the project yourself — those are blocked and will just stall you. You do NOT build; you DECOMPOSE so the lanes build. A fully-specified build is STILL decomposed, never built here. If a detail is ambiguous, make a reasonable assumption and note it in the plan summary — do NOT ask. Think, then call submit_flow_plan. That is the whole job.',
+  'THINKPOOL FLOW CONDUCTOR — HARD RULES (read first, no exceptions): You are a DECOMPOSITION-ONLY conductor. Your ONLY output action is using the Write tool ONCE to write your task-graph JSON to the file named exactly FLOW_PLAN.json. That single Write IS how you submit your plan — the room ingests it directly. Do NOT use ExitPlanMode and do NOT call submit_flow_plan (both hang here). Do NOT write any other file and do NOT write a plan-document markdown. You MUST NOT write or edit files, MUST NOT run bash/git, MUST NOT call AskUserQuestion, and MUST NOT build the project yourself — those are blocked and will just stall you. You do NOT build; you DECOMPOSE so the lanes build. A fully-specified build is STILL decomposed, never built here. When a detail is ambiguous or the user is unsure, choose the least-invasive reversible default, record that assumption in the summary, and continue. Never ask merely because the user is unsure; ask only when a choice would materially expand scope or authority. User steering always wins. Think, then call submit_flow_plan. That is the whole job.',
 
   'DO NOT SPAWN SUBAGENTS. You MUST NOT use the Task/Agent tool or launch Explore / sub-agents — every subagent spawn pops a permission card and stalls the whole flow (this is the #1 way the conductor hangs asking for permission). You almost never need to look at code to decompose: decompose from the build request itself. If you genuinely must inspect something first, read it YOURSELF with Read/Grep/Glob (those are allowed without a prompt) — never delegate it to a spawned agent. Decompose, then Write FLOW_PLAN.json.',
 
@@ -52,10 +52,12 @@ export const FLOW_CONDUCTOR_PROMPT = [
 
   'ACCEPTANCE CRITERIA per slice: how does the lane know it is DONE AND RUNNING? A lane is done when its slice runs in its WebContainer and meets the criteria — not when it has merely written code. State the observable, runnable proof (e.g. "GET /api/todos returns 200 + []", "submitting the form adds a row to the list that persists across reload").',
 
+  'GATE-FIRST CONTRACT per builder/fix/scaffold slice: include an explicit bounded `nonGoals` list (what this slice will not change) and a `baseline` gate describing the real pre-edit condition that must FAIL or be ABSENT. The builder must observe that gate before editing and later supply a bounded evidence receipt; do not invent a RED sentence. A review task must depend on exactly one builder/fix task and inherits that target contract — it verifies the same acceptance, non-goals, and baseline evidence instead of inventing a second baseline.',
+
   'RIGHT-SIZE THE SLICE COUNT. Bias to FEW slices that each carry real weight, not many tiny ones. For a small app: 2-3 slices. Concurrent lanes are bounded (a low dispatch ceiling), so a flat fan-out of well-chosen slices beats a sprawling one. Three focused slices outperform seven scattered ones.',
 
   'SUBMIT BY WRITING FLOW_PLAN.json — when the decomposition is ready, use the Write tool with file_path "FLOW_PLAN.json" and content set to your plan as ONE JSON object. The room validates the plan is a real DAG (acyclic, all deps resolve), persists it to the task-graph store, and shows a plan-approval card. A malformed plan is rejected with the reason as the tool result — fix it and Write FLOW_PLAN.json again. Do not also narrate the plan in prose. The exact shape:',
-  '{ "summary": "<one line: what we are building>", "tasks": [ { "key": "<short-unique-kebab-key>", "title": "<imperative title>", "scope": "<files/components this lane owns>", "acceptance": "<runnable proof it is done>", "deps": ["<other-task-key>", ...], "sliceType": "feature|scaffold|review|fix" } ] }',
+  '{ "summary": "<one line: what we are building; assumptions: …>", "tasks": [ { "key": "<short-unique-kebab-key>", "title": "<imperative title>", "scope": "<files/components this lane owns>", "acceptance": "<runnable proof it is done>", "nonGoals": ["<bounded exclusion>"], "baseline": { "gate": "<what currently fails/is absent before edits>", "evidence": "<optional observed command/output receipt>" }, "deps": ["<other-task-key>", ...], "sliceType": "feature|scaffold|review|fix" } ] }',
   '`key` values are stable short kebab-case identifiers. `deps` references other tasks\' keys. The content of FLOW_PLAN.json must be ONLY the JSON object (no surrounding prose, no markdown fences).',
 
   'PLAN LIVES IN THE STORE, NOT THE CHAT. Your JSON plan is the artifact — it gets persisted to the task-graph (flow_sessions / flow_tasks) and rendered as an approval card. Do not ALSO narrate a long plan in prose. You may add 1-2 sentences framing the decomposition choice (why these slices, what was coupled), nothing more.',
@@ -65,7 +67,8 @@ export const FLOW_CONDUCTOR_PROMPT = [
 
 export const FLOW_CODEX_CONDUCTOR_PROMPT = [
   'THINKPOOL FLOW CONDUCTOR — you are decomposition-only. Do not build, edit files, run commands, or spawn agents. Read only when needed to make the decomposition concrete.',
-  'Turn the request into a small acyclic graph of independently runnable slices with disjoint file ownership. Each task needs key, title, scope, acceptance, deps, and sliceType (scaffold, feature, fix, or review). Review is intelligence-sensitive and must never be assigned a cheap/mechanical tier. Every review task must depend on exactly ONE builder task; express builder -> review -> downstream explicitly in the DAG.',
+  'Turn the request into a small acyclic graph of independently runnable slices with disjoint file ownership. Each builder/fix/scaffold task needs key, title, scope, observable acceptance, bounded nonGoals, and a baseline {gate,evidence?}; the gate states what currently fails or is absent before edits. Every review task depends on exactly ONE builder task and inherits/verifies that builder contract. Review is intelligence-sensitive and must never be assigned a cheap/mechanical tier.',
+  'When details are ambiguous or the user says they are unsure, choose a safe reversible default, record it in summary.assumptions text, and continue. Do not ask merely because of uncertainty; ask only when a choice materially expands scope or authority. Honor later user steering.',
   'Submit the finished graph by calling the ThinkPool submit_flow_plan MCP tool with one JSON object encoded in its plan argument. Do not write FLOW_PLAN.json and do not use ExitPlanMode. The MCP submission is your only completion path; after it succeeds, stop and wait for the room.',
 ].join(' ')
 
@@ -95,9 +98,11 @@ export const FLOW_LANE_PROMPT = [
 
   'OWN YOUR FILES ONLY. The `scope` names the files/components this lane OWNS — they are DISJOINT from every other lane. Edit ONLY those. Touching another lane\'s files is a collision that breaks the merge — never do it. If you genuinely need a file outside your scope, STOP and say so instead of editing it.',
 
+  'GATE BEFORE EDITS. First reproduce the assigned baseline gate in the real pre-edit state. Record only what you actually observed (a command/behavior + bounded receipt); never fabricate a RED sentence. Preserve the assigned non-goals. If a bounded detail is ambiguous, take the least-invasive reversible default and state it in your receipt; ask only if the choice would materially expand scope or authority.',
+
   'DONE MEANS RUNS. You are not done when you\'ve written code — you\'re done when your slice RUNS and meets the `acceptance` criteria (the observable, runnable proof). Verify it yourself before declaring done. State the proof (the command, the output) when you finish.',
 
-  'COMMIT WHEN DONE, THEN SIGNAL. You are in your own git worktree on your own branch. When your slice meets acceptance — it RUNS and you have verified the proof — commit it atomically (one focused commit) with `git` via the Bash tool; that commit is the revert target if review later rejects it. THEN, as your VERY LAST action, signal completion by using the Write tool to write a file named exactly FLOW_DONE in your worktree root (any content, e.g. "done"). That single Write IS the done signal — it records your commit + tells the room the slice is done (unblocking dependents). Do NOT use mark_flow_done (it hangs here). Do not push. Do NOT write FLOW_DONE before your slice actually runs, meets acceptance, AND is committed.',
+  'COMMIT WHEN DONE, THEN SIGNAL. You are in your own git worktree on your own branch. When your slice meets acceptance — it RUNS and you have verified the proof — commit it atomically (one focused commit) with `git` via the Bash tool; that commit is the revert target if review later rejects it. THEN, as your VERY LAST action, signal completion by using the Write tool to write a file named exactly FLOW_DONE in your worktree root with content `{"baselineEvidence":"<real bounded pre-edit command/behavior receipt>"}`. That single Write IS the done signal — it records your commit + tells the room the slice is done (unblocking dependents). Do NOT use mark_flow_done (it hangs here). Do not push. Do NOT write FLOW_DONE before your slice actually runs, meets acceptance, records real baseline evidence, AND is committed.',
 
   'STAY IN YOUR LANE. Do NOT spawn further lanes (one hop only — the fork-bomb breaker). Do NOT edit other worktrees. If you\'re blocked on a dependency that isn\'t ready, say so + stop — another lane is building it.',
 
@@ -106,8 +111,9 @@ export const FLOW_LANE_PROMPT = [
 
 export const FLOW_CODEX_LANE_PROMPT = [
   'THINKPOOL FLOW — you are one builder lane in an ensemble. The conductor gives you one runnable slice with disjoint scope. Edit only that scope and never touch another lane or worktree.',
+  'Before editing, reproduce the assigned baseline gate in the real pre-edit state. Preserve the explicit non-goals. Record only an actual bounded command/behavior receipt; never manufacture a RED claim. For a bounded ambiguity, take the least-invasive reversible default and state it in that receipt; ask only if a choice would materially expand scope or authority.',
   'Done means the slice runs and its acceptance proof has been observed. Diagnose before changing code, verify with the real command or behavior, and make one focused git commit in your assigned worktree. Do not push.',
-  'After the commit and verification succeed, call the ThinkPool mark_flow_done MCP tool exactly once. Do not write FLOW_DONE. The MCP call is the completion signal that records your commit and unblocks dependent slices.',
+  'After the commit and verification succeed, call the ThinkPool mark_flow_done MCP tool exactly once with the real `baselineEvidence` receipt. Do not write FLOW_DONE. The MCP call is the completion signal that records your commit and unblocks dependent slices.',
   'Do not spawn more lanes. If the scope is unsafe or a dependency is missing, report the blocker instead of editing outside your ownership.',
 ].join(' ')
 

package/flow-receipt.mjs

@@ -0,0 +1,115 @@
+// Flow review receipts are deliberately smaller than a review verdict. They cross
+// from a private reviewer lane into a shared transcript, so this module only
+// admits the evidence a pair can act on. Prompts, environment, paths, logs, and
+// hidden reasoning never have a field in the public shape.
+
+export const FLOW_REVIEW_RECEIPT_KIND = 'flow-review-receipt'
+
+const MAX_TASK_KEY = 120
+const MAX_LINE = 180
+const MAX_LINES = 4
+const OUTCOMES = new Set(['pass', 'reject', 'held'])
+const DIGEST = /^[a-f0-9]{64}$/
+const SECRET_VALUE = /(?:sk[_-](?:proj[_-])?[a-z0-9_-]{8,}|gsk_[a-z0-9_-]{8,}|AIza[a-z0-9_-]{8,}|gh[pousr]_[a-z0-9_-]{8,}|github_pat_[a-z0-9_]{20,}|glpat-[a-z0-9_-]{8,}|x(?:ox[baprsce]|app)-[a-z0-9_-]{8,}|(?:AKIA|ASIA)[0-9A-Z]{16}|sbp_[a-z0-9_-]{20,}|sb_secret_[a-z0-9_-]{8,}|npm_[a-z0-9]{24,}|(?:sk|rk)_(?:live|test)_[a-z0-9]{8,}|whsec_[a-z0-9]{8,}|eyJ[a-z0-9_-]{8,}\.[a-z0-9_-]{8,}\.[a-z0-9_-]{8,}|bearer\s+[a-z0-9._-]{8,}|hooks\.slack\.com\/services\/[a-z0-9/_-]{8,})/i
+const SECRET_OR_PRIVATE = /(?:api[_ -]?key|access[_ -]?token|\btoken\s*[=:]|auth(?:orization)?|bearer\s+|secret|password|private[_ -]?key|system\s+prompt|raw\s+prompt|hidden\s+reasoning|chain[ -]of[ -]thought|\benv(?:ironment)?\b|\.env\b)/i
+const HOST_PATH = /(?:^~[\\/]|^\.?[\\/]|(?:^|\s)\/[\w.-]+|[A-Za-z]:\\|\\\\|(?:^|[\\/])(?:Users|home|var|tmp|private|workspace)(?:[\\/]|$)|\.thinkpool[\\/])/i
+const PATH_TRAVERSAL = /(?:^|[^a-z0-9.])\.\.(?:[\\/]|$)/i
+
+function cleanText(value, max) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > max) return null
+  if (/\r|\n/.test(value) || SECRET_VALUE.test(value) || SECRET_OR_PRIVATE.test(value) || HOST_PATH.test(value) || PATH_TRAVERSAL.test(value)) return null
+  const text = value.replace(/\s+/g, ' ').trim()
+  return text && text.length <= max ? text : null
+}
+
+function cleanLines(value) {
+  if (!Array.isArray(value)) return []
+  const out = []
+  for (const line of value) {
+    const safe = cleanText(line, MAX_LINE)
+    if (safe && !out.includes(safe)) out.push(safe)
+    if (out.length === MAX_LINES) break
+  }
+  return out
+}
+
+function cleanTaskKey(value) {
+  const taskKey = cleanText(value, MAX_TASK_KEY)
+  if (!taskKey || !/^[A-Za-z0-9][A-Za-z0-9._:/-]*$/.test(taskKey) || taskKey.includes('..')) return null
+  return taskKey
+}
+
+function cleanSha(value) {
+  if (typeof value !== 'string') return null
+  const sha = value.trim().toLowerCase()
+  return /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(sha) ? sha : null
+}
+
+function cleanRounds(value) {
+  return Number.isInteger(value) && value >= 1 && value <= 99 ? value : null
+}
+
+function cleanDigest(value) {
+  if (typeof value !== 'string') return null
+  const digest = value.trim().toLowerCase()
+  return DIGEST.test(digest) ? digest : null
+}
+
+// Build the only wire shape the renderer accepts. Optional fields are omitted
+// rather than represented as null, making absence honest (notably deployment).
+export function createFlowReviewReceipt(input = {}) {
+  const taskKey = cleanTaskKey(input.taskKey)
+  const outcome = typeof input.outcome === 'string' ? input.outcome.toLowerCase() : ''
+  const rounds = cleanRounds(input.rounds)
+  if (!taskKey || !OUTCOMES.has(outcome) || rounds == null) {
+    throw new TypeError('Invalid flow review receipt identity')
+  }
+
+  const receipt = {
+    kind: FLOW_REVIEW_RECEIPT_KIND,
+    taskKey,
+    outcome,
+    rounds,
+    checks: cleanLines(input.checks),
+    reasons: cleanLines(input.reasons),
+  }
+  const candidateSha = cleanSha(input.candidateSha)
+  const acceptanceDigest = cleanDigest(input.acceptanceDigest)
+  // Presence, not truthiness, is intentional: deployments are never inferred
+  // from a pass/reject outcome or from a candidate SHA.
+  const deployment = Object.hasOwn(input, 'deployment') ? cleanText(input.deployment, MAX_LINE) : null
+  if (candidateSha) receipt.candidateSha = candidateSha
+  if (acceptanceDigest) receipt.acceptanceDigest = acceptanceDigest
+  receipt.verified = Boolean(candidateSha && acceptanceDigest)
+  if (outcome === 'pass' && !receipt.verified) {
+    throw new TypeError('Passing flow review receipt requires an exact candidate and acceptance digest')
+  }
+  if (deployment) receipt.deployment = deployment
+  return receipt
+}
+
+export function isFlowReviewReceipt(value) {
+  try {
+    const receipt = createFlowReviewReceipt(value)
+    return receipt.kind === value?.kind
+  } catch {
+    return false
+  }
+}
+
+// A review lane may receive the same terminal submission twice (tool retry,
+// double click, or concurrent provider delivery). Serialize the whole verdict
+// transaction—not just receipt emission—so an awaited revert cannot run twice.
+export function createFlowReviewSingleFlight() {
+  let pending = null
+  return async function runFlowReviewVerdict(operation) {
+    if (pending) return pending
+    const current = (async () => operation())()
+    pending = current
+    try {
+      return await current
+    } finally {
+      if (pending === current) pending = null
+    }
+  }
+}

package/flow-review.mjs

@@ -17,11 +17,11 @@ import { reviewReflectionDecision, REVIEW_DEFAULTS } from './flow-review-reflect
 // The reviewer lane's rolePrompt (via startClaudeSession). Mirrors FLOW_LANE_PROMPT's
 // join('  ') style. This lane is ADVERSARIAL — its job is to disprove "done", not to build.
 export const FLOW_REVIEWER_PROMPT = [
-  'THINKPOOL FLOW — you are an ADVERSARIAL REVIEWER in an ensemble build. You did NOT build this slice. Another lane did, and claims it is done. Your job is to TRY TO BREAK IT — independently verify whether its acceptance criteria are ACTUALLY met. The slice you are reviewing (its scope, its acceptance criteria, and its worktree/branch) arrives as your first message.',
+  'THINKPOOL FLOW — you are an ADVERSARIAL REVIEWER in an ensemble build. You did NOT build this slice. Another lane did, and claims it is done. Your job is to TRY TO BREAK IT — independently verify whether its acceptance criteria are ACTUALLY met. The slice you are reviewing (its scope, acceptance criteria, inherited non-goals, baseline gate/evidence, and worktree/branch) arrives as your first message.',
 
   'RUN IT, DON\'T TRUST IT. Check out the lane\'s worktree/branch and RUN the slice yourself. "It compiles" is not "it works". Reproduce the acceptance proof with your own hands — run the command, hit the endpoint, submit the form, reload the page. If you cannot independently reproduce the acceptance criteria, that is a REJECT.',
 
-  'HUNT FOR FAILURE. Look where the builder didn\'t: edge cases, empty/malformed input, the second click, the reload, concurrent use, the error path. Check the slice didn\'t regress anything outside its acceptance line. A green happy-path is the floor, not the bar.',
+  'VERIFY THE INHERITED CONTRACT. Check the builder\'s baseline receipt against the real pre-edit claim where feasible; it must be an observed command/behavior, not a fabricated sentence. Check the implementation did not cross its inherited non-goals. Do not invent another baseline. HUNT FOR FAILURE: edge cases, empty/malformed input, the second click, the reload, concurrent use, and the error path. A green happy-path is the floor, not the bar.',
 
   'DEFAULT TO REJECT. If you cannot independently verify EVERY acceptance criterion — reject. Ambiguity, "probably fine", "looks right", an untestable claim, a flaky run — all REJECT. The cost of a false pass (a broken slice merged into the assembly) is far higher than a re-run.',
 
@@ -35,7 +35,7 @@ export const FLOW_REVIEWER_PROMPT = [
 export const FLOW_CODEX_REVIEWER_PROMPT = [
   'THINKPOOL FLOW REVIEW — you are a non-mutating adversarial reviewer. Your native sandbox lets you write only inside your OWN disposable reviewer worktree. The reviewed builder worktree is outside that writable root: never edit, commit, revert, install into, or repair it.',
   'For any install/build/test that produces files, copy the reviewed source into a scratch directory under your own current worktree first, then run the write-producing command against that scratch copy. Read-only inspection may target the reviewed worktree directly.',
-  'Independently reproduce every acceptance criterion and hunt edge cases, reloads, repeated actions, concurrency, malformed input, and error paths. A green happy path is only the floor. If a claim cannot be reproduced, reject it with the exact command/output.',
+  'Independently reproduce every acceptance criterion, verify the inherited baseline evidence and non-goals without inventing a second baseline, and hunt edge cases, reloads, repeated actions, concurrency, malformed input, and error paths. A green happy path is only the floor. If a claim cannot be reproduced, reject it with the exact command/output.',
   'Submit each review round by calling the ThinkPool submit_flow_review MCP tool with a JSON verdict: {"pass":boolean,"reasons":["specific evidence"],"taskKey":"allowed reviewed task","exhausted":boolean}. Do not write FLOW_REVIEW.json and do not call mark_flow_done. A pass without exhausted=true may trigger another bounded hunt round; a failure triggers the room revert path.',
 ].join(' ')
 

package/flow-task-graph.mjs

@@ -43,10 +43,270 @@ export const SLICE_TYPE = {
   fix: 'fix',
 }
 
+// Gate-first Flow contracts are stored in flow_tasks.contract (JSONB). Keep every
+// free-text field bounded and single-line: this payload crosses the terminal MCP
+// boundary and is later injected into builder/reviewer prompts.
+export const FLOW_CONTRACT_LIMITS = Object.freeze({
+  maxNonGoals: 6,
+  maxNonGoalChars: 240,
+  maxBaselineGateChars: 600,
+  maxBaselineEvidenceChars: 1400,
+})
+
+const BASELINE_NEGATIVE_SIGNAL = /\b(fail(?:s|ed|ing)?|absent|missing|not\s+(?:present|implemented|available|found)|does\s+not|404|empty)\b/i
+const CONTRACT_DIGEST = /^[a-f0-9]{64}$/
+const SHA256_K = [
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]
+const rotateRight = (value, bits) => (value >>> bits) | (value << (32 - bits))
+const hasDisallowedControl = (value) => {
+  for (const char of value) {
+    const code = char.charCodeAt(0)
+    if (code === 0x7f || (code < 0x20 && code !== 0x09)) return true
+  }
+  return false
+}
+
+function boundedLine (value, label, max, { required = false } = {}) {
+  if (value == null || value === '') {
+    if (required) throw new Error(`${label} is required`)
+    return ''
+  }
+  if (typeof value !== 'string') throw new Error(`${label} must be a string`)
+  const text = value.trim()
+  if (!text) {
+    if (required) throw new Error(`${label} is required`)
+    return ''
+  }
+  if (text.length > max) throw new Error(`${label} exceeds ${max} characters`)
+  if (hasDisallowedControl(text)) throw new Error(`${label} must be safe single-line text`)
+  return text
+}
+
+export function normalizeBaselineEvidence (value) {
+  return boundedLine(value, 'baseline evidence receipt', FLOW_CONTRACT_LIMITS.maxBaselineEvidenceChars, { required: true })
+}
+
+// This is deliberately a small synchronous SHA-256 implementation instead of a
+// Node crypto import or WebCrypto: the task graph must stay byte-identical and run
+// in both the bridge's Node runtime and the browser bundle.
+function sha256Hex (message) {
+  const source = new TextEncoder().encode(message)
+  const totalLength = Math.ceil((source.length + 9) / 64) * 64
+  const bytes = new Uint8Array(totalLength)
+  bytes.set(source)
+  bytes[source.length] = 0x80
+  let bitLength = BigInt(source.length) * 8n
+  for (let index = totalLength - 1; index >= totalLength - 8; index--) {
+    bytes[index] = Number(bitLength & 0xffn)
+    bitLength >>= 8n
+  }
+
+  const hash = [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]
+  const words = new Uint32Array(64)
+  for (let offset = 0; offset < bytes.length; offset += 64) {
+    for (let index = 0; index < 16; index++) {
+      const start = offset + (index * 4)
+      words[index] = ((bytes[start] << 24) | (bytes[start + 1] << 16) | (bytes[start + 2] << 8) | bytes[start + 3]) >>> 0
+    }
+    for (let index = 16; index < 64; index++) {
+      const low = rotateRight(words[index - 15], 7) ^ rotateRight(words[index - 15], 18) ^ (words[index - 15] >>> 3)
+      const high = rotateRight(words[index - 2], 17) ^ rotateRight(words[index - 2], 19) ^ (words[index - 2] >>> 10)
+      words[index] = (words[index - 16] + low + words[index - 7] + high) >>> 0
+    }
+
+    let [a, b, c, d, e, f, g, h] = hash
+    for (let index = 0; index < 64; index++) {
+      const sigma1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25)
+      const choose = (e & f) ^ (~e & g)
+      const temp1 = (h + sigma1 + choose + SHA256_K[index] + words[index]) >>> 0
+      const sigma0 = rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22)
+      const majority = (a & b) ^ (a & c) ^ (b & c)
+      const temp2 = (sigma0 + majority) >>> 0
+      h = g
+      g = f
+      f = e
+      e = (d + temp1) >>> 0
+      d = c
+      c = b
+      b = a
+      a = (temp1 + temp2) >>> 0
+    }
+    hash[0] = (hash[0] + a) >>> 0
+    hash[1] = (hash[1] + b) >>> 0
+    hash[2] = (hash[2] + c) >>> 0
+    hash[3] = (hash[3] + d) >>> 0
+    hash[4] = (hash[4] + e) >>> 0
+    hash[5] = (hash[5] + f) >>> 0
+    hash[6] = (hash[6] + g) >>> 0
+    hash[7] = (hash[7] + h) >>> 0
+  }
+  return hash.map((word) => word.toString(16).padStart(8, '0')).join('')
+}
+
+// The acceptance pack belongs to the builder target. A review task copies that
+// target's digest, so its inherited target is bound without re-hashing reviewer
+// prose or later baseline evidence receipts.
+function acceptancePack ({ key, title, scope, acceptance, sliceType, nonGoals, baselineGate, inheritedReviewerTarget = key }) {
+  return {
+    version: 1,
+    task: { key, title, scope, acceptance, sliceType },
+    nonGoals: [...nonGoals].sort(),
+    baselineGate,
+    inheritedReviewerTarget,
+  }
+}
+
+export function acceptancePackDigest (input) {
+  return sha256Hex(JSON.stringify(acceptancePack(input)))
+}
+
+function contractSource (task) {
+  const source = task?.contract && typeof task.contract === 'object' && !Array.isArray(task.contract)
+    ? { ...task.contract }
+    : {}
+  if (source.nonGoals === undefined) source.nonGoals = task?.nonGoals ?? task?.non_goals
+  if (source.baseline === undefined) source.baseline = task?.baseline ?? task?.baselineGate ?? task?.baseline_gate
+  return source
+}
+
+function normalizeProvidedContractDigest (source) {
+  if (source.digest === undefined) return null
+  if (typeof source.digest !== 'string' || !CONTRACT_DIGEST.test(source.digest)) {
+    throw new Error('contract digest must be a lowercase SHA-256 hex string')
+  }
+  return source.digest
+}
+
+function normalizeProvidedAcceptancePack (source) {
+  if (source.acceptancePack === undefined) return null
+  if (!source.acceptancePack || typeof source.acceptancePack !== 'object' || Array.isArray(source.acceptancePack)) {
+    throw new Error('contract acceptance pack must be an object')
+  }
+  return source.acceptancePack
+}
+
+// Strict for new terminal submissions. `legacy:true` is restore-only: old persisted
+// plans predate this contract and must remain runnable, but they can never be used to
+// submit a new incomplete plan.
+export function normalizeTaskContract (task, { sliceType, legacy = false } = {}) {
+  const source = contractSource(task)
+  const digest = normalizeProvidedContractDigest(source)
+  const sealedPack = normalizeProvidedAcceptancePack(source)
+  if (sliceType === SLICE_TYPE.review) return legacy ? null : { digest, acceptancePack: sealedPack }
+  const required = !legacy
+  const rawNonGoals = source.nonGoals
+  const values = rawNonGoals == null ? [] : (Array.isArray(rawNonGoals) ? rawNonGoals : [rawNonGoals])
+  if (values.length > FLOW_CONTRACT_LIMITS.maxNonGoals) throw new Error(`non-goals exceeds ${FLOW_CONTRACT_LIMITS.maxNonGoals} items`)
+  const nonGoals = values.map((value) => boundedLine(value, 'non-goal', FLOW_CONTRACT_LIMITS.maxNonGoalChars, { required: true }))
+  if (required && !nonGoals.length) throw new Error('explicit non-goals are required for builder/fix/scaffold tasks')
+
+  const rawBaseline = source.baseline
+  const baselineObject = typeof rawBaseline === 'string' ? { gate: rawBaseline } : rawBaseline
+  if (baselineObject != null && (typeof baselineObject !== 'object' || Array.isArray(baselineObject))) throw new Error('baseline gate must be a string or object')
+  const gate = boundedLine(baselineObject?.gate ?? baselineObject?.expectation, 'baseline gate', FLOW_CONTRACT_LIMITS.maxBaselineGateChars, { required })
+  if (gate && !BASELINE_NEGATIVE_SIGNAL.test(gate)) throw new Error('baseline gate must state what fails or is absent before implementation')
+  const evidence = baselineObject?.evidence == null || baselineObject?.evidence === ''
+    ? ''
+    : normalizeBaselineEvidence(baselineObject.evidence)
+  return { nonGoals, baseline: gate ? { gate, evidence } : null, digest, acceptancePack: sealedPack }
+}
+
+function bindContractDigest (task) {
+  const sealedPack = acceptancePack({
+    key: task.key,
+    title: task.title,
+    scope: task.scope,
+    acceptance: task.acceptance,
+    sliceType: task.sliceType,
+    nonGoals: task.contract.nonGoals,
+    baselineGate: task.contract.baseline?.gate || '',
+    inheritedReviewerTarget: task.key,
+  })
+  const digest = sha256Hex(JSON.stringify(sealedPack))
+  if (task.contract.digest && task.contract.digest !== digest) throw new Error(`task "${task.key}" contract digest does not match its acceptance pack`)
+  if (task.contract.acceptancePack && JSON.stringify(task.contract.acceptancePack) !== JSON.stringify(sealedPack)) {
+    throw new Error(`task "${task.key}" sealed acceptance pack does not match its task fields`)
+  }
+  task.contract.digest = digest
+  task.contract.acceptancePack = sealedPack
+}
+
+// The browser persists normalized task rows before approval, then later sends a
+// ready row back to the bridge for dispatch. Recompute the seal at that final
+// boundary so changed acceptance/scope/non-goals can never ride beside an old hash.
+export function validateTaskContractSeal (task, { legacy = false } = {}) {
+  const contract = task?.contract
+  if (!contract?.digest && legacy) return true
+  if (!contract || typeof contract !== 'object' || !contract.digest || !contract.acceptancePack) {
+    throw new Error('task is missing its sealed acceptance contract')
+  }
+  const pack = contract.acceptancePack
+  const packTask = pack?.task
+  if (!packTask || typeof packTask !== 'object' || !Array.isArray(pack.nonGoals)) {
+    throw new Error('task sealed acceptance pack is malformed')
+  }
+  const canonicalPack = acceptancePack({
+    key: packTask.key,
+    title: packTask.title,
+    scope: packTask.scope,
+    acceptance: packTask.acceptance,
+    sliceType: packTask.sliceType,
+    nonGoals: pack.nonGoals,
+    baselineGate: pack.baselineGate,
+    inheritedReviewerTarget: pack.inheritedReviewerTarget,
+  })
+  if (JSON.stringify(pack) !== JSON.stringify(canonicalPack)) throw new Error('task sealed acceptance pack is not canonical')
+  if (acceptancePackDigest({
+    key: packTask.key,
+    title: packTask.title,
+    scope: packTask.scope,
+    acceptance: packTask.acceptance,
+    sliceType: packTask.sliceType,
+    nonGoals: pack.nonGoals,
+    baselineGate: pack.baselineGate,
+    inheritedReviewerTarget: pack.inheritedReviewerTarget,
+  }) !== contract.digest) throw new Error('task acceptance digest does not match its sealed pack')
+
+  const sliceType = task.sliceType ?? task.slice_type
+  const key = task.key ?? task.task_key
+  const deps = Array.isArray(task.deps) ? task.deps : []
+  if (sliceType === SLICE_TYPE.review) {
+    if (contract.inheritedFrom !== packTask.key || deps.length !== 1 || deps[0] !== packTask.key) {
+      throw new Error('review task no longer targets its sealed builder')
+    }
+    if (pack.inheritedReviewerTarget !== packTask.key || task.acceptance !== packTask.acceptance) {
+      throw new Error(`review task "${key}" changed after its builder acceptance pack was sealed`)
+    }
+    return true
+  }
+  const livePack = acceptancePack({
+    key,
+    title: task.title,
+    scope: task.scope ?? '',
+    acceptance: task.acceptance ?? '',
+    sliceType,
+    nonGoals: contract.nonGoals || [],
+    baselineGate: contract.baseline?.gate || '',
+    inheritedReviewerTarget: key,
+  })
+  if (JSON.stringify(livePack) !== JSON.stringify(canonicalPack)) {
+    throw new Error(`task "${key}" changed after its acceptance pack was sealed`)
+  }
+  return true
+}
+
 // A FlowTask slice. Each is RUNNABLE — a lane can build + run + self-correct it in
 // its own WebContainer (research: the runtime is the moat). Partition by file
 // ownership (scope) so two lanes never edit the same file (a branch is NOT isolation).
-export function makeTask ({ key, title, scope = '', acceptance = '', deps = [], sliceType = SLICE_TYPE.feature }) {
+export function makeTask ({ key, title, scope = '', acceptance = '', deps = [], sliceType = SLICE_TYPE.feature, contract = null }) {
   if (!key || typeof key !== 'string') throw new Error('task key required (string)')
   if (!title) throw new Error('task title required')
   if (!Array.isArray(deps)) throw new Error('deps must be an array of task keys')
@@ -56,6 +316,7 @@ export function makeTask ({ key, title, scope = '', acceptance = '', deps = [],
     title,
     scope,            // files/components this lane OWNS (disjoint from other slices)
     acceptance,       // runnable proof the lane + reviewer use to call it done
+    contract,          // bounded gate-first contract; null only for legacy/restored rows
     deps,             // task keys this depends on (must form a DAG)
     sliceType,
     status: TASK_STATUS.pending,
@@ -142,7 +403,7 @@ export function makeFlowSession ({ prompt, mode = FLOW_MODE.guide, sessionRef =
 // Accepts a parsed object OR a JSON string (optionally ```json-fenced). Throws if the
 // tasks don't form a real DAG. Lives in this shared module so neither the bridge nor
 // the client has to import across the bridge↔src boundary.
-export function normalizePlanOutput (raw) {
+export function normalizePlanOutput (raw, { legacy = false } = {}) {
   let obj = raw
   if (typeof raw === 'string') {
     let s = raw.trim()
@@ -167,9 +428,36 @@ export function normalizePlanOutput (raw) {
       acceptance: String(t.acceptance ?? ''),
       deps: Array.isArray(t.deps) ? t.deps.map(String) : [],
       sliceType: Object.values(SLICE_TYPE).includes(sliceType) ? sliceType : SLICE_TYPE.feature,
+      contract: normalizeTaskContract(t, { sliceType: Object.values(SLICE_TYPE).includes(sliceType) ? sliceType : SLICE_TYPE.feature, legacy }),
     })
   })
   validateDag(tasks)
+  for (const task of tasks) {
+    if (task.sliceType !== SLICE_TYPE.review) bindContractDigest(task)
+  }
+  for (const task of tasks) {
+    if (task.sliceType !== SLICE_TYPE.review) continue
+    // New review tasks verify exactly one builder contract. Legacy persisted reviews
+    // keep their prior multi-target shape for restore compatibility only.
+    if (legacy) continue
+    if (task.deps.length !== 1) throw new Error(`review task "${task.key}" must depend on exactly one builder task to inherit its contract`)
+    const target = tasks.find((candidate) => candidate.key === task.deps[0])
+    if (!target || target.sliceType === SLICE_TYPE.review) throw new Error(`review task "${task.key}" must target a builder/fix/scaffold task`)
+    if (task.contract.digest && task.contract.digest !== target.contract.digest) {
+      throw new Error(`review task "${task.key}" contract digest does not match target "${target.key}"`)
+    }
+    task.contract = {
+      nonGoals: [...(target.contract?.nonGoals || [])],
+      baseline: target.contract?.baseline ? { ...target.contract.baseline } : null,
+      inheritedFrom: target.key,
+      digest: target.contract.digest,
+      acceptancePack: target.contract.acceptancePack,
+    }
+    // Reviewer-authored prose is not an authority boundary. Normalize the live
+    // review row to the builder's sealed acceptance so dispatch and the prompt
+    // cannot silently substitute a weaker criterion.
+    task.acceptance = target.contract.acceptancePack.task.acceptance
+  }
   return { summary, tasks }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.360",
+  "version": "0.7.362",
   "description": "Connect Claude Code, Codex, or Hermes on your computer to a Thinkpool Code room.",
   "type": "module",
   "bin": {
@@ -93,6 +93,7 @@
     "design-edit.mjs",
     "design-source-contract.mjs",
     "flow-review.mjs",
+    "flow-receipt.mjs",
     "review-check.mjs",
     "flow-review-gate.mjs",
     "flow-review-reflect.mjs",