thoth-agents 0.5.1 → 0.7.0

package/plugin/skills/thoth-sdd/scripts/validate.mjs

@@ -17,6 +17,7 @@ import {
   parseRequirementDelta,
   preflightRequirementDeltas,
 } from './durable-deltas.mjs';
+import { validateResult } from './validate-result.mjs';
 
 const sha = (bytes) => createHash('sha256').update(bytes).digest('hex');
 const gates = [
@@ -261,10 +262,16 @@ function preflightDeltas(root, deltas, errors, warnings, recordName) {
 }
 
 function settled(text) {
-  return (
-    Boolean(text?.trim()) &&
-    !/\b(?:pending|unresolved|unknown|ask|tbd|todo)\b/i.test(text)
-  );
+  if (!text?.trim() || /\bTBD\b/.test(text)) return false;
+  return !text.split(/\r?\n/).some((line) => {
+    const content = line
+      .replace(/\*\*|__/g, '')
+      .trim()
+      .replace(/^(?:[-+*]|\d+[.)])\s+/, '')
+      .replace(/^\[[ xX]\]\s*/, '')
+      .replace(/^AC-\d+:\s*/, '');
+    return /^(?:TBD|PENDING)(?=:|\s*$)/i.test(content);
+  });
 }
 
 function coverageErrors(text, ids, errors, recordName) {
@@ -293,6 +300,184 @@ function coverageErrors(text, ids, errors, recordName) {
   return rows;
 }
 
+// Whole-file textual binding: Markdown containers never hide candidates or markers.
+function scanOracleEnvelope(text) {
+  let offset = 0;
+  const lines = text.split(/(?<=\n)/).map((raw) => {
+    const entry = { raw, offset, line: raw.replace(/\r?\n$/, '') };
+    if (offset === 0) entry.line = entry.line.replace(/^\uFEFF/, '');
+    offset += raw.length;
+    return entry;
+  });
+  const markers = [];
+  const fences = [];
+  const authorization = lines.findIndex(
+    ({ line }) => line === '## Authorization',
+  );
+  const verification = lines.findIndex(
+    ({ line }) => line === '## Verification',
+  );
+  const closeout = lines.findIndex(
+    ({ line }, index) => index > verification && line === '## Closeout',
+  );
+  const verificationEnd = lines.findIndex(
+    ({ line }, index) => index > verification && line.startsWith('## '),
+  );
+  for (const [index, { line }] of lines.entries()) {
+    if (line.trim() === '**Oracle envelope**:') markers.push(index);
+    const opening =
+      /^(\s*)(?:[>*+-]\s*|\d+[.)]\s*)*(`{3,}|~{3,})\s*thoth-result/i.exec(line);
+    if (!opening) continue;
+    let end = index + 1;
+    for (; end < lines.length; end++) {
+      const closing = /^(\s*)(`{3,}|~{3,})[ \t]*$/.exec(lines[end].line);
+      if (
+        closing &&
+        closing[1] === opening[1] &&
+        closing[2][0] === opening[2][0] &&
+        closing[2].length >= opening[2].length
+      )
+        break;
+    }
+    fences.push({
+      index,
+      end,
+      closed: end < lines.length,
+      block: lines
+        .slice(index, end + 1)
+        .map(({ raw }) => raw)
+        .join(''),
+    });
+  }
+  let next = markers[0] + 1;
+  while (next < lines.length && !lines[next].line.trim()) next++;
+  const positioned =
+    verification >= 0 &&
+    closeout > verification &&
+    markers[0] > verification &&
+    markers[0] < verificationEnd &&
+    fences[0]?.index === next &&
+    next < verificationEnd &&
+    (!fences[0]?.closed || fences[0].end < verificationEnd);
+  return {
+    markers,
+    fences,
+    positioned,
+    authorizationOffset: lines[authorization]?.offset,
+  };
+}
+
+function validateOracleEnvelope({
+  extraction,
+  verificationFields,
+  recordSha256,
+  reviewedDigest,
+  expectedRecord,
+  errors,
+  recordName,
+}) {
+  const { markers, fences, positioned } = extraction;
+  if (markers.length > 1 || fences.length > 1) {
+    errors.push(
+      issue(
+        'SDD-ORACLE-ENVELOPE-DUPLICATE',
+        'Exactly one Oracle envelope marker and block are required',
+        recordName,
+      ),
+    );
+    return;
+  }
+  if (!markers.length || !fences.length || !positioned) {
+    errors.push(
+      issue(
+        'SDD-ORACLE-ENVELOPE-MISSING',
+        'Oracle envelope marker followed by a final-verification block is required',
+        recordName,
+      ),
+    );
+    return;
+  }
+  if (!fences[0].closed) {
+    errors.push(
+      issue(
+        'SDD-ORACLE-ENVELOPE-INVALID',
+        'Oracle envelope fence is unclosed',
+        recordName,
+      ),
+    );
+    return;
+  }
+  // Preserve the original wrapper and line endings for shared-contract validation.
+  const result = validateResult(fences[0].block, {
+    reviewKind: 'final-verification',
+    recordSha256: recordSha256,
+  });
+  if (!result.valid) {
+    errors.push(
+      issue(
+        'SDD-ORACLE-ENVELOPE-INVALID',
+        result.issues
+          .map((entry) => `${entry.code}: ${entry.message}`)
+          .join('; '),
+        recordName,
+      ),
+    );
+    if (
+      result.issues.some((entry) => entry.code === 'RECORD_DIGEST_MISMATCH')
+    ) {
+      errors.push(
+        issue(
+          'SDD-ORACLE-ENVELOPE-DIGEST-MISMATCH',
+          'Oracle envelope digest does not match the reviewed record prefix',
+          recordName,
+        ),
+      );
+    }
+    return;
+  }
+  const { review } = result.envelope;
+  if (review.verdict !== 'PASS') {
+    errors.push(
+      issue(
+        'SDD-ORACLE-ENVELOPE-NOT-PASS',
+        'Oracle final-verification verdict must be PASS',
+        recordName,
+      ),
+    );
+  }
+  if (review.reviewedRecord !== expectedRecord) {
+    errors.push(
+      issue(
+        'SDD-ORACLE-ENVELOPE-RECORD-MISMATCH',
+        `Oracle envelope must review ${expectedRecord}`,
+        recordName,
+      ),
+    );
+  }
+  if (review.reviewedRecordSha256 !== reviewedDigest) {
+    errors.push(
+      issue(
+        'SDD-ORACLE-ENVELOPE-DIGEST-MISMATCH',
+        'Oracle envelope and Reviewed record SHA-256 field must agree',
+        recordName,
+      ),
+    );
+  }
+  const verdictLines = verificationFields.match(/^\*\*Verdict\*\*:.*$/gm) ?? [];
+  if (
+    verdictLines.length !== 1 ||
+    verdictLines[0] !== `**Verdict**: ${review.verdict}`
+  ) {
+    errors.push(
+      issue(
+        'SDD-ORACLE-ENVELOPE-VERDICT-MISMATCH',
+        'Oracle envelope and Verdict field must agree',
+        recordName,
+      ),
+    );
+  }
+}
+
 export function validate({ change, through }) {
   if (!gates.includes(through)) throw new Error('Invalid SDD validation gate');
   const errors = [];
@@ -358,7 +543,7 @@ export function validate({ change, through }) {
     !new RegExp(
       `^# Change: ${id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*$`,
       'm',
-    ).test(text) ||
+    ).test(text.replace(/^\uFEFF/, '')) ||
     !/^\*\*Classification\*\*: substantial$/m.test(text) ||
     !/^\*\*Scope\*\*: (?:local|coordinated|cross-cutting)$/m.test(text) ||
     !/^\*\*Uncertainty\*\*: (?:low|medium|high)$/m.test(text) ||
@@ -534,9 +719,18 @@ export function validate({ change, through }) {
     }
     const verificationText =
       section(text, 'Verification', { trim: false }) ?? '';
-    const verified = verificationText.trim();
+    // Envelope contents are not record fields, AC rows, or reviewed source lines.
+    const extraction = scanOracleEnvelope(text);
+    const verificationFields =
+      through === 'closeout'
+        ? verificationText.replace(extraction.fences[0]?.block ?? '', '')
+        : verificationText;
+    const verified = verificationFields.trim();
     if (through === 'closeout') {
-      const prefix = text.slice(0, authorizationHeading?.index ?? text.length);
+      const prefix = text.slice(
+        0,
+        extraction.authorizationOffset ?? text.length,
+      );
       if (
         !/^\*\*Reviewer\*\*: oracle$/m.test(verified) ||
         !/^\*\*Independent from implementer\*\*: Yes$/m.test(verified) ||
@@ -551,7 +745,8 @@ export function validate({ change, through }) {
         );
       }
       const digestLines =
-        verificationText.match(/^\*\*Reviewed record SHA-256\*\*:.*$/gm) ?? [];
+        verificationFields.match(/^\*\*Reviewed record SHA-256\*\*:.*$/gm) ??
+        [];
       const reviewedDigest =
         digestLines.length === 1
           ? /^\*\*Reviewed record SHA-256\*\*: ([a-f0-9]{64})$/.exec(
@@ -567,6 +762,16 @@ export function validate({ change, through }) {
           ),
         );
       }
+      validateOracleEnvelope({
+        extraction,
+        verificationFields,
+        recordSha256: sha(prefix),
+        reviewedDigest,
+        // Archived records retain the active path reviewed by the Oracle.
+        expectedRecord: `.thoth/changes/${id}/${id}.md`,
+        errors,
+        recordName,
+      });
       const rows = verified
         .split(/\r?\n/)
         .filter((line) => /^- AC-/.test(line));

package/plugin/skills/thoth-sdd/templates/change.md

@@ -82,6 +82,14 @@ exactly one SHA field line; put notes on separate lines below the fields.
 **Verdict**: PENDING
 **Reviewed record SHA-256**: PENDING
 
+**Oracle envelope**:
+
+```thoth-result
+PENDING
+```
+
+After PASS, root pastes the Oracle's unchanged final-verification envelope here.
+
 - AC-1: PENDING | check | evidence
 - Source: relative/path | sha256:<actual-source-digest>
 - Source: .thoth/specs/<capability>/spec.md | sha256:<actual-source-digest>

package/skills/plan-reviewer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: plan-reviewer
-description: Independent blocker-only Oracle review of a ready substantial SDD plan before separate implementation authorization.
+description: Provides independent, blocker-only Oracle review of a substantial SDD plan. Use only when plan review was selected at substantial ready; it does not authorize implementation.
 license: MIT
 compatibility: Requires the installed sibling thoth-sdd skill.
 metadata:
@@ -33,14 +33,22 @@ conflicting work. Do not require multiple reports, universal requirement IDs,
 workflow manifests, evidence directories, or a scheduler. Structural `ready` is
 necessary but not sufficient for semantic readiness.
 
-Return `[OKAY]` with concise evidence or `[REJECT]` with at most three actual
-execution blockers and smallest repairs; keep cautions separate. Root repairs
-same-intent blockers in the same record, revalidates affected gates, and uses a
-fresh Oracle for each round. A human-owned material blocker stops the round.
-Root records both review disposition and selection provenance without inventing
-approval. Accepted provenance is `EXPLICIT_REVIEW`, `EXPLICIT_SKIP`, or
+Return exactly one fenced `thoth-result` JSON envelope as the entire final
+message, following the Oracle gate contract: `role: "oracle"`,
+`review.kind: "plan-review"`, and `review.verdict: "OKAY" | "REJECT"`.
+Include concise evidence and at most three blocking risks for actual execution
+blockers with smallest repairs; mark cautions nonblocking. An OKAY requires
+`status: "complete"` and no blocking risks. Root validates the unchanged native
+terminal result with `--review-kind plan-review` using the sibling
+thoth-sdd skill's **Specialist result validation** procedure, including its shared
+one-request format-only repair budget. Root records plan-review `OKAY` only from a validated envelope
+and after judging the content; a malformed or missing envelope is not approval.
+Root repairs same-intent blockers in the same record, revalidates affected gates,
+and uses a fresh Oracle for each round. A human-owned material blocker stops the
+round. Root records both review disposition and selection provenance without
+inventing approval. Accepted provenance is `EXPLICIT_REVIEW`, `EXPLICIT_SKIP`, or
 `DEFAULT_REVIEW_AFTER_3`; `SKIPPED` requires explicit skip, while `OKAY` requires
-explicit review or the third-return review default. After `[OKAY]`, root preserves
+explicit review or the third-return review default. After validated `OKAY`, root preserves
 the separate Implement (Recommended) / Stop choice and separately offers it,
 honoring prior explicit implementation authorization; an explicit later Stop
 supersedes it. That choice has its own per-question budget. Review never

package/skills/thoth-archive/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: thoth-archive
-description: Transactionally apply declared .thoth/specs deltas and archive independently verified substantial SDD changes.
+description: Applies declared .thoth/specs deltas and archives independently verified substantial SDD changes. Use only after a substantial change has a fresh Oracle PASS and passes closeout; not for unverified or incomplete work.
 license: MIT
 compatibility: Requires Node.js >=22.19 and installed sibling thoth-sdd skill.
 metadata:
@@ -12,6 +12,7 @@ metadata:
 
 Root archives only after the implementation writer has terminated and a fresh
 independent Oracle PASS has covered the actual change, diff, checks, and risks.
+Closeout requires a matching valid PASS final-verification envelope under `**Oracle envelope**:`.
 Structural closeout validation is not approval. The single record must have all
 tasks complete, explicit plan-review disposition and implementation authorization,
 every acceptance outcome's concrete PASS check/evidence, reviewed-record and

package/skills/thoth-constitution/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: thoth-constitution
-description: Create or explicitly amend the active .thoth constitution with SemVer and sync-impact lifecycle validation.
+description: Creates or amends the active .thoth constitution with versioned governance validation. Use only on an explicit constitution creation or amendment request, not for routine implementation or implicit governance changes.
 license: MIT
 compatibility: Requires Node.js >=22.19 for bundled validation.
 metadata:

package/skills/thoth-constitution/templates/constitution.md

@@ -50,7 +50,7 @@ Provider memory is independent of project records.
 
 Delegation depth is one and each mutable surface has one writer. Root accepts
 terminal dependency results before releasing consumers. At substantial `ready`,
-root always offers Oracle plan review (Recommended) or proceeding without review,
+root always offers Oracle plan review (Recommended) or `Proceed without review`,
 even if implementation was authorized; an unanswered offer never means skip.
 After `[OKAY]`, root separately offers the Implement (Recommended) / Stop choice,
 honors prior explicit authorization, and lets explicit Stop supersede it. Record

package/skills/thoth-init/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: thoth-init
-description: Initialize canonical offline .thoth governance without modifying existing project records.
+description: Initializes canonical offline .thoth governance without modifying existing project records. Use only to initialize missing .thoth governance, not to amend or replace existing records.
 license: MIT
 compatibility: Requires Node.js >=22.19 and write access to target project.
 metadata:

package/skills/thoth-sdd/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: thoth-sdd
-description: Apply proportional understanding and risk-aware SDD classification, with one ID-named record for substantial changes.
+description: Governs SDD changes, including the single ID-named record for substantial work. Use for any change requiring proportional understanding and risk-aware classification, whether small or substantial.
 license: MIT
 compatibility: Requires Node.js >=22.19 for bundled product validation.
 metadata:
@@ -74,7 +74,7 @@ At substantial `ready`, first show the user a concise plan summary (goal,
 acceptance, key decisions, units, risks, record path), then always offer
 `Review plan with Oracle (Recommended)` or `Proceed without review`, even when implementation was already authorized.
 Silence is never an explicit review skip; run a fresh read-only review only when
-selected. After a selected `[OKAY]`, separately offer `Implement (Recommended)` /
+selected. After a validated plan-review `OKAY`, separately offer `Implement (Recommended)` /
 `Stop`; prior explicit authorization remains valid, while an explicit later
 `Stop` supersedes it. Record the plan-review selection as
 `EXPLICIT_REVIEW`, `EXPLICIT_SKIP`, or `DEFAULT_REVIEW_AFTER_3`; `SKIPPED`
@@ -88,6 +88,19 @@ independent review; never claim independent PASS or archive.
 
 ## Bounded execution
 
+Root uses the harness progress tool (Pi `todo`, Claude `TodoWrite`, OpenCode
+`todowrite`, Codex `update_plan`) to show SDD progress. Before implementation,
+create one item per remaining applicable stage:
+explore/specify/clarify/classify/plan/tasks/ready/plan review/authorization.
+Pi `todo` may hold several in_progress items for concurrently active stages or
+tasks (e.g. parallel delegated units); Claude `TodoWrite`, OpenCode `todowrite`
+and Codex `update_plan` keep one in_progress item; complete each stage/task
+immediately. At implementation, replace stage items with the record's task rows
+plus final verification and archive (for small changes, use the settled work
+steps plus verification). Keep one list per change; prefix items with the change
+ID when several changes are active. This native progress view is not a sidecar
+record and never replaces SDD gates or authorization.
+
 Apply these rules across all workflow stages. Each assignment names one
 independently acceptable outcome, exact known entrypoints and skill paths,
 concrete accepted inputs and dependencies, its produced result, owned writes and
@@ -143,12 +156,54 @@ parent. Read only the current phase under
 plan review and archive are sibling skill contracts. Use installed local assets
 only; do not provision skills or run a network installer mid-workflow.
 
+## Specialist result validation
+
+Only Oracle gate assignments (plan-review and final-verification) return a
+structured envelope. Before recording plan-review `OKAY` or final-verification
+`PASS`, root resolves `<skill-dir>` from the installed thoth-sdd SKILL.md
+directory, exactly as for `scripts/validate.mjs`, and runs:
+
+```text
+node "<skill-dir>/scripts/validate-result.mjs" --review-kind <kind> [--record-sha256 <hex>] [--no-record] [--input <path>]
+```
+
+Pass the unchanged native terminal result via stdin, or `--input <path>` when
+piping is impractical; do not extract, rewrite, or wrap the envelope, or create
+persisted evidence files. Set `--review-kind` to the assigned `plan-review` or
+`final-verification`. For final verification of a substantial record, set
+`--record-sha256` to the independently calculated expected SHA-256 of exact UTF-8
+bytes before `## Authorization` (see the [verify phase](references/phases/verify.md)).
+Confirm `reviewedRecord` identifies the assigned record.
+For Oracle final verification of a small change without a record, root passes
+`--no-record`; Oracle omits both `reviewedRecord` and `reviewedRecordSha256`.
+Do not combine `--no-record` with `--record-sha256` or plan-review.
+Without `--no-record`, final verification still requires both binding fields.
+
+- Exit **0** means structurally valid only. Root still judges scope, evidence,
+  checks, freshness, provenance, independence, and content before recording any
+  approval, and presents accepted results to the user in readable prose.
+- Exit **1** means no approval. Allow at most one format-only repair request per assignment,
+  shared with any runtime enforcement; it must not change findings or verdict.
+  Exhaustion is a contract failure reported truthfully, never converted into an Oracle `BLOCKED` judgment.
+- Exit **2** or an unavailable skill/validator means validation cannot be completed:
+  report the error (missing assets are installation drift). This blocks only gate approvals;
+  ordinary delegations proceed. Do not provision replacements mid-workflow.
+
+Other Thoth specialist returns use compact markdown fields and are judged on content,
+not validated for format. User-defined custom agents retain their own free format;
+neither ordinary specialist results nor custom agents are rejected for format or
+count as approvals. Oracle `diagnosis` and `advice` never authorize implementation
+or closeout and return compact markdown, not envelopes. Approval comes only from
+the validated gate review field, never free text; validation itself is not user authorization.
+
 ## Gates and CLI
 
 ```text
 node "<skill-dir>/scripts/validate.mjs" --change .thoth/changes/<id> --through <explore|specify|clarify|plan|tasks|checklist|ready|verify|closeout> --json
 ```
 
+Substantial records must not contain other `thoth-result` fences or `**Oracle envelope**:` marker lines anywhere in the file; write examples inline instead.
+
 The early gates validate the one record proportionally. `plan` validates without
 requiring tasks. `tasks` and `ready` require concrete coverage of every accepted
 outcome. `ready` requires settled material decisions before the mandatory
@@ -159,6 +214,16 @@ implementation authorization, and reviewed source digests/baselines. It permits
 final-review and Archive placeholders. `closeout` additionally requires a fresh
 independent Oracle PASS, every acceptance outcome with concrete PASS
 check/evidence, exactly one matching record SHA-256 field, and Archive READY.
+Order: `verify` → fresh final Oracle → root validates and pastes → `closeout` → archive.
+After accepting a validated PASS, root pastes the Oracle's unchanged
+final-verification envelope under `**Oracle envelope**:` in the record's
+Verification section (post-PASS bookkeeping in Verification; no new review).
+Plan-review envelopes are not embedded. Closeout fails without exactly one valid
+PASS envelope matching the record path and prefix digest, consistent with
+`**Verdict**` and `**Reviewed record SHA-256**`. Preserve the envelope unchanged
+when archiving; archived validation accepts its original active record path.
+Historical archived records are not retrofitted or re-validated by this rule.
+
 The initial `PENDING` selection placeholder is allowed before `verify` only.
 `SKIPPED` requires `EXPLICIT_SKIP`; `OKAY` requires `EXPLICIT_REVIEW` or
 `DEFAULT_REVIEW_AFTER_3`. Every canonical spec affected by a durable delta must

package/skills/thoth-sdd/references/phases/verify.md

@@ -2,6 +2,16 @@
 
 Every change requires final verification against accepted outcomes and actual execution evidence. Small low-risk work uses focused independent root checks; substantial or materially risky work requires a fresh read-only Oracle independent from the writer. Judge the actual diff, behavior, completeness, correctness, coherence, checks, and residual risks.
 
+For Oracle final verification of a small change without a record, root passes `--no-record`; Oracle omits both `reviewedRecord` and `reviewedRecordSha256`. Do not combine `--no-record` with `--record-sha256` or plan-review. Otherwise final verification still requires both binding fields.
+
 Before requesting final Oracle for substantial work, run `node "<skill-dir>/scripts/validate.mjs" --change .thoth/changes/<id> --through verify --json`. This gate requires ready coverage, complete tasks, authorization disposition/provenance, and reviewed source digests/baselines; final-review fields, AC evidence rows, and Archive may remain placeholders. For each capability named by a durable delta, add exactly one `Source` entry for `.thoth/specs/<capability>/spec.md`: its reviewed SHA-256 when it exists, or `absent` only when no canonical file exists.
 
-After review, record each outcome's concrete PASS evidence, actual checks, source SHA-256 digests, and the hash of exact UTF-8 record bytes preceding the case-sensitive `## Authorization` heading. After PASS, edits confined to Authorization, Verification, or Closeout need no new review; any edit before `## Authorization` requires fresh independent review and a new digest. This allowance never waives structural checks, truthful provenance, stale-source rejection, or review of changed implementation. Recheck baselines after review; missing or stale digests/absence, missing evidence, or blockers prevent closeout and archive. Never create a verification report or evidence directory; route actionable findings to convergence.
+Assign Oracle a `final-verification` review of the substantial record. Oracle returns exactly one fenced `thoth-result` JSON envelope as the entire final message, following the Oracle gate contract with `role: "oracle"`, `review.kind: "final-verification"`, and `review.verdict: "PASS" | "FAIL" | "BLOCKED"`. Its review includes `reviewedRecord` naming the reviewed record path and `reviewedRecordSha256` containing the 64 lowercase hex SHA-256 of exact UTF-8 record bytes preceding the case-sensitive `## Authorization` heading. PASS requires `status: "complete"` and no blocking risks. FAIL reports findings; BLOCKED is an actual inability to complete review, never a substitute for a malformed result or exhausted format repair.
+
+Root validates the unchanged native terminal result using the thoth-sdd **Specialist result validation** procedure with `--review-kind final-verification --record-sha256 <hex>`, where `<hex>` is the independently calculated expected record-prefix digest. Confirm `reviewedRecord` identifies the assigned record. Root records `**Reviewer**: oracle`, `**Independent from implementer**: Yes`, `**Verdict**: PASS`, and `**Reviewed record SHA-256**` only from a validated PASS envelope whose digest matches the current record, after judging the content and confirming reviewer independence. Invalid results, FAIL, BLOCKED, and diagnosis/advice reviews do not authorize closeout or archive; route findings to convergence and report contract failures truthfully.
+
+Substantial records must not contain other `thoth-result` fences or `**Oracle envelope**:` marker lines anywhere in the file; write examples inline instead.
+
+Order: `verify` → fresh final Oracle → root validates and pastes → `closeout` → archive. After accepting a validated PASS, root pastes the Oracle's unchanged final-verification envelope under `**Oracle envelope**:` in the record's Verification section (post-PASS bookkeeping in Verification; no new review). Plan-review envelopes are not embedded. Closeout fails without exactly one valid PASS envelope matching the record path and prefix digest, consistent with `**Verdict**` and `**Reviewed record SHA-256**`. Preserve the envelope unchanged when archiving; archived validation accepts its original active record path. Historical archived records are not retrofitted or re-validated by this rule.
+
+After accepted review, record each outcome's concrete PASS evidence, actual checks, source SHA-256 digests, and the matched record-prefix hash. After PASS, edits confined to Authorization, Verification, or Closeout need no new review; any edit before `## Authorization` requires fresh independent review and a new digest. This allowance never waives structural checks, truthful provenance, stale-source rejection, or review of changed implementation. Recheck baselines after review; missing or stale digests/absence, missing evidence, or blockers prevent closeout and archive. Never create a verification report or evidence directory; route actionable findings to convergence.