fable-engine 1.3.4__tar.gz → 1.3.6__tar.gz

{fable_engine-1.3.4/fable_engine.egg-info → fable_engine-1.3.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: fable-engine
-Version: 1.3.4
+Version: 1.3.6
 Summary: Independent deterministic System 2 cognitive engine and mechanical time-lock MCP server
 Author: REX-codebase
 License: MIT License
@@ -85,24 +85,49 @@ mechanical, not prompt advice: no timer, no proof, no write access.
   <img src="./assets/flow-simple.svg" width="720" alt="Think → Prove → Attack → Write"/>
 </div>
 
+### Demo
+
+**KERR // ORRERY**
+
+One self-contained HTML file. Raw WebGL, zero libraries, zero external assets,
+and zero build step.
+
+https://github.com/user-attachments/assets/8287bbfe-e3ee-4dcf-ba0f-f9ff22ae79bd
+
+<sub>7 renders rejected before final · 2 bugs caught · 10/10 red-team probes passed</sub>
+
+<br/>
+
+**Fable Mode overview**
+
 https://github.com/user-attachments/assets/27f4f8a2-b1bb-4398-a08c-bc9fd93d69d7
 
 <br/>
 
-### See it work
+### Quick start
 
 A session starts locked. Confidence does not unlock it.
 
-```text
->>> session = create_session('demo-refactor', budget='2 min')
-    state=INIT  execution_locked=True  can_execute_code=False
+1. Install the MCP server using one of the options below.
+2. Add the optional Agent Skill if you want the full workflow.
+3. Ask your agent to use Fable Mode for a concrete coding task and choose a time budget.
 
->>> session.unlock_execution('the plan looks fine, let me write code now')
-    PermissionError: HARD TIME-LOCK VIOLATION: Execution unlock rejected!
-    The immutable 2.0m authority budget has not elapsed yet
-    (Remaining: 1m 59s / 120.0s).
+A new session starts with execution locked:
+
+```json
+{
+  "action": "create_session",
+  "session_name": "demo-refactor",
+  "objective": "Refactor the parser without changing public behavior",
+  "time_budget_minutes": 2
+}
 ```
 
+The agent then records evidence and an invariant. An early `unlock_execution`
+request is rejected until the authority timer and proof prerequisites pass.
+Use `get_status` at any point to see the active phase, remaining time, evidence
+counts, and lock state.
+
 The same gates guard every phase: evidence receipts for claims, a five-vector
 red-team swarm for code, and a sealed record of what was verified.
 
@@ -116,7 +141,7 @@ pip install fable-engine
 
 Or install the MCP server in your editor:
 
-[![Install MCP server in VS Code](https://img.shields.io/badge/VS_Code-Install_MCP_server-007ACC?logo=visualstudiocode&logoColor=white)](vscode:mcp/install?%7B%22name%22%3A%22fable-engine%22%2C%22command%22%3A%22uvx%22%2C%22args%22%3A%5B%22--from%22%2C%22fable-engine%3D%3D1.3.4%22%2C%22fable-engine%22%5D%7D)
+[![Install MCP server in VS Code](https://img.shields.io/badge/VS_Code-Install_MCP_server-007ACC?logo=visualstudiocode&logoColor=white)](vscode:mcp/install?%7B%22name%22%3A%22fable-engine%22%2C%22command%22%3A%22uvx%22%2C%22args%22%3A%5B%22--from%22%2C%22fable-engine%3D%3D1.3.6%22%2C%22fable-engine%22%5D%7D)
 [![Add to Cursor](https://img.shields.io/badge/Cursor-Add_MCP_server-black)](cursor://anysphere.cursor-deeplink/mcp/install?name=fable-engine&config=eyJjb21tYW5kIjoidXZ4IiwiYXJncyI6WyItLWZyb20iLCJmYWJsZS1lbmdpbmU9PTEuMy4zIiwiZmFibGUtZW5naW5lIl19)
 
 These links configure Fable Engine for AI agents in VS Code Chat or Cursor. They do not install a standalone editor extension. Both use `uvx`, which downloads and runs the pinned PyPI release in an isolated environment.
@@ -124,13 +149,13 @@ These links configure Fable Engine for AI agents in VS Code Chat or Cursor. They
 Point your agent at the MCP server manually:
 
 ```jsonc
-// Claude Code: claude mcp add fable-engine -- uvx --from fable-engine==1.3.4 fable-engine
+// Claude Code: claude mcp add fable-engine -- uvx --from fable-engine==1.3.6 fable-engine
 // Cursor: ~/.cursor/mcp.json
 {
   "mcpServers": {
     "fable-engine": {
       "command": "uvx",
-      "args": ["--from", "fable-engine==1.3.4", "fable-engine"]
+      "args": ["--from", "fable-engine==1.3.6", "fable-engine"]
     }
   }
 }
@@ -152,7 +177,7 @@ The complete skill tree ships inside the wheel. To install it into your
 project's skills directory (the cross-client `.agents/skills/` convention):
 
 ```bash
-uvx --from fable-engine==1.3.4 fable-mode install-skill --yes
+uvx --from fable-engine==1.3.6 fable-mode install-skill --yes
 ```
 
 This copies the skill to `.agents/skills/fable-mode`. Preview first with
@@ -170,6 +195,18 @@ agent afterwards so it picks up the skill.
 
 <br/>
 
+### Optional: AI evidence adjudicator
+
+The evidence in a session is written by an AI agent, so Fable can optionally
+ask an external reviewer model to audit that evidence before the workspace
+unlocks. Stdlib-only, one bounded HTTPS call, no local model, no extra RAM to
+speak of. Off by default; fail-closed when enforcing. It raises the cost of
+fabricated proof - it cannot guarantee deception is impossible, and the
+mechanical gates stay the primary authority. Setup and honest limits:
+[AI evidence adjudicator](./docs/ai-evidence-adjudicator.md).
+
+<br/>
+
 ### What it is not
 
 - Not a claim of flawless code. It is a checkable workflow, not a guarantee.
@@ -180,10 +217,12 @@ agent afterwards so it picks up the skill.
 
 ### Docs
 
+- [Start here: practical guide](./docs/stop-ai-agents-writing-too-early.md)
+- [Agent Skill reference](./skills/fable-mode/SKILL.md)
 - [V1 → V2 migration](./docs/fable-v1-v2-migration.md)
 - [V2 architecture](./docs/fable-v2-architecture.md)
 - [System 3 (experimental)](./docs/system3-architecture.md)
-- [Stop AI coding agents from writing too early](./docs/stop-ai-agents-writing-too-early.md)
+- [AI evidence adjudicator (optional)](./docs/ai-evidence-adjudicator.md)
 
 <br/>
 

{fable_engine-1.3.4 → fable_engine-1.3.6}/README.md

@@ -42,24 +42,49 @@ mechanical, not prompt advice: no timer, no proof, no write access.
   <img src="./assets/flow-simple.svg" width="720" alt="Think → Prove → Attack → Write"/>
 </div>
 
+### Demo
+
+**KERR // ORRERY**
+
+One self-contained HTML file. Raw WebGL, zero libraries, zero external assets,
+and zero build step.
+
+https://github.com/user-attachments/assets/8287bbfe-e3ee-4dcf-ba0f-f9ff22ae79bd
+
+<sub>7 renders rejected before final · 2 bugs caught · 10/10 red-team probes passed</sub>
+
+<br/>
+
+**Fable Mode overview**
+
 https://github.com/user-attachments/assets/27f4f8a2-b1bb-4398-a08c-bc9fd93d69d7
 
 <br/>
 
-### See it work
+### Quick start
 
 A session starts locked. Confidence does not unlock it.
 
-```text
->>> session = create_session('demo-refactor', budget='2 min')
-    state=INIT  execution_locked=True  can_execute_code=False
+1. Install the MCP server using one of the options below.
+2. Add the optional Agent Skill if you want the full workflow.
+3. Ask your agent to use Fable Mode for a concrete coding task and choose a time budget.
 
->>> session.unlock_execution('the plan looks fine, let me write code now')
-    PermissionError: HARD TIME-LOCK VIOLATION: Execution unlock rejected!
-    The immutable 2.0m authority budget has not elapsed yet
-    (Remaining: 1m 59s / 120.0s).
+A new session starts with execution locked:
+
+```json
+{
+  "action": "create_session",
+  "session_name": "demo-refactor",
+  "objective": "Refactor the parser without changing public behavior",
+  "time_budget_minutes": 2
+}
 ```
 
+The agent then records evidence and an invariant. An early `unlock_execution`
+request is rejected until the authority timer and proof prerequisites pass.
+Use `get_status` at any point to see the active phase, remaining time, evidence
+counts, and lock state.
+
 The same gates guard every phase: evidence receipts for claims, a five-vector
 red-team swarm for code, and a sealed record of what was verified.
 
@@ -73,7 +98,7 @@ pip install fable-engine
 
 Or install the MCP server in your editor:
 
-[![Install MCP server in VS Code](https://img.shields.io/badge/VS_Code-Install_MCP_server-007ACC?logo=visualstudiocode&logoColor=white)](vscode:mcp/install?%7B%22name%22%3A%22fable-engine%22%2C%22command%22%3A%22uvx%22%2C%22args%22%3A%5B%22--from%22%2C%22fable-engine%3D%3D1.3.4%22%2C%22fable-engine%22%5D%7D)
+[![Install MCP server in VS Code](https://img.shields.io/badge/VS_Code-Install_MCP_server-007ACC?logo=visualstudiocode&logoColor=white)](vscode:mcp/install?%7B%22name%22%3A%22fable-engine%22%2C%22command%22%3A%22uvx%22%2C%22args%22%3A%5B%22--from%22%2C%22fable-engine%3D%3D1.3.6%22%2C%22fable-engine%22%5D%7D)
 [![Add to Cursor](https://img.shields.io/badge/Cursor-Add_MCP_server-black)](cursor://anysphere.cursor-deeplink/mcp/install?name=fable-engine&config=eyJjb21tYW5kIjoidXZ4IiwiYXJncyI6WyItLWZyb20iLCJmYWJsZS1lbmdpbmU9PTEuMy4zIiwiZmFibGUtZW5naW5lIl19)
 
 These links configure Fable Engine for AI agents in VS Code Chat or Cursor. They do not install a standalone editor extension. Both use `uvx`, which downloads and runs the pinned PyPI release in an isolated environment.
@@ -81,13 +106,13 @@ These links configure Fable Engine for AI agents in VS Code Chat or Cursor. They
 Point your agent at the MCP server manually:
 
 ```jsonc
-// Claude Code: claude mcp add fable-engine -- uvx --from fable-engine==1.3.4 fable-engine
+// Claude Code: claude mcp add fable-engine -- uvx --from fable-engine==1.3.6 fable-engine
 // Cursor: ~/.cursor/mcp.json
 {
   "mcpServers": {
     "fable-engine": {
       "command": "uvx",
-      "args": ["--from", "fable-engine==1.3.4", "fable-engine"]
+      "args": ["--from", "fable-engine==1.3.6", "fable-engine"]
     }
   }
 }
@@ -109,7 +134,7 @@ The complete skill tree ships inside the wheel. To install it into your
 project's skills directory (the cross-client `.agents/skills/` convention):
 
 ```bash
-uvx --from fable-engine==1.3.4 fable-mode install-skill --yes
+uvx --from fable-engine==1.3.6 fable-mode install-skill --yes
 ```
 
 This copies the skill to `.agents/skills/fable-mode`. Preview first with
@@ -127,6 +152,18 @@ agent afterwards so it picks up the skill.
 
 <br/>
 
+### Optional: AI evidence adjudicator
+
+The evidence in a session is written by an AI agent, so Fable can optionally
+ask an external reviewer model to audit that evidence before the workspace
+unlocks. Stdlib-only, one bounded HTTPS call, no local model, no extra RAM to
+speak of. Off by default; fail-closed when enforcing. It raises the cost of
+fabricated proof - it cannot guarantee deception is impossible, and the
+mechanical gates stay the primary authority. Setup and honest limits:
+[AI evidence adjudicator](./docs/ai-evidence-adjudicator.md).
+
+<br/>
+
 ### What it is not
 
 - Not a claim of flawless code. It is a checkable workflow, not a guarantee.
@@ -137,10 +174,12 @@ agent afterwards so it picks up the skill.
 
 ### Docs
 
+- [Start here: practical guide](./docs/stop-ai-agents-writing-too-early.md)
+- [Agent Skill reference](./skills/fable-mode/SKILL.md)
 - [V1 → V2 migration](./docs/fable-v1-v2-migration.md)
 - [V2 architecture](./docs/fable-v2-architecture.md)
 - [System 3 (experimental)](./docs/system3-architecture.md)
-- [Stop AI coding agents from writing too early](./docs/stop-ai-agents-writing-too-early.md)
+- [AI evidence adjudicator (optional)](./docs/ai-evidence-adjudicator.md)
 
 <br/>
 

fable_engine-1.3.6/docs/ai-evidence-adjudicator.md

@@ -0,0 +1,119 @@
+# AI Evidence Adjudicator (optional)
+
+An external reviewer model that audits a session's recorded evidence before
+execution unlocks. It exists because the evidence in a Fable session is itself
+written by an AI agent, and an AI agent can fabricate plausible-looking proof.
+
+The adjudicator is a second opinion, not a guarantee. See
+[Honest limits](#honest-limits) before relying on it.
+
+## What it does
+
+Two layers, code first:
+
+1. **Deterministic evidence lint** (always local, stdlib, zero network, zero
+   extra RAM): flags fabrication-shaped patterns by rule - placeholder text
+   (`lorem ipsum`, `TBD`, `TODO`), generic success claims with no artifact
+   ("it works", "all tests passed"), evidence that restates the claim
+   word-for-word (circular), the same evidence recycled across claims, empty
+   evidence, failed proof receipts, and padded refinement cycles.
+2. **External reviewer model** (optional, needs an API key): the engine
+   bundles the session's evidence into a bounded JSON snapshot and sends it,
+   clearly marked as untrusted data, to an external LLM API. The lint's
+   findings travel with it as engine-computed ground truth. The model's reply
+   is strictly parsed into `pass`, `fail`, or `uncertain`.
+
+Flow at `unlock_execution`, after the mechanical gates pass:
+
+- The lint runs always. A critical lint finding is a `fail` verdict on its
+  own - deterministic findings outrank any model output.
+- Without an API key, the lint alone is the verdict (the receipt records
+  `llm_status: skipped_no_api_key`). With a key, the model review runs too,
+  and its reply is merged with the lint findings.
+- A receipt (verdict, issues, lint summary, bundle SHA-256, latency) is
+  recorded in the session's proof receipts. The API key and full prompt are
+  never stored.
+- In `enforcing` mode, anything other than `pass` blocks the unlock.
+  In `advisory` mode (default), the receipt is recorded but never blocks.
+
+You can also request a review at any time with the `adjudicate_evidence`
+action of `fable_session`.
+
+## Resource profile
+
+- Stdlib only. No SDK, no embedded model, no GPU.
+- RAM overhead is one JSON payload capped at 24 KB plus the HTTP response.
+- One HTTPS request per adjudication, default 15 s timeout (clamped 3-60 s).
+- Disabled by default: zero network calls and zero behavior change.
+- Enforcing mode works fully offline: the deterministic lint is the gate,
+  the external reviewer only deepens it.
+
+## Setup
+
+```bash
+export FABLE_ADJUDICATOR_ENABLED=1
+export FABLE_ADJUDICATOR_API_KEY=your_key_here
+# optional
+export FABLE_ADJUDICATOR_STYLE=gemini        # gemini (default) | openai
+export FABLE_ADJUDICATOR_MODEL=gemini-2.0-flash
+export FABLE_ADJUDICATOR_MODE=advisory       # advisory (default) | enforcing
+export FABLE_ADJUDICATOR_TIMEOUT_SECONDS=15
+```
+
+- `gemini` style calls `https://generativelanguage.googleapis.com/v1beta/models/{model}:generateContent`.
+  A free AI Studio key works.
+- `openai` style calls an OpenAI-compatible chat-completions endpoint
+  (`https://api.openai.com/v1/chat/completions` unless
+  `FABLE_ADJUDICATOR_ENDPOINT` overrides it).
+
+Start with `advisory`. Read the receipts. Move to `enforcing` only when the
+verdicts are consistently sensible for your workloads.
+
+## Failure behavior
+
+Fail-closed. Timeouts, HTTP errors, unreachable endpoints, empty replies, and
+malformed model output all resolve to `uncertain`. In enforcing mode,
+`uncertain` blocks the unlock just like `fail`. If the API key is missing, no
+network call is attempted; the deterministic lint still runs and its verdict
+stands on its own.
+
+## Injection resistance
+
+Evidence is data, not instructions. The bundle is wrapped in explicit
+untrusted-data markers (and any copy of those markers inside the evidence
+itself is scrubbed), the model is told to judge rather than obey, the reply
+must be a strict JSON object, and verdicts outside the known set are rejected.
+The bundle itself is size-capped per field and in total.
+
+## Measuring detection quality
+
+`benchmarks/adversarial_evidence_benchmark.py` scores the verifier against a
+labeled corpus of fabricated and legitimate evidence snapshots
+(`benchmarks/fixtures/adversarial_cases.json`). Baseline on the seed corpus
+(16 cases): 100% catch rate on fabricated evidence, 0% false flags on
+legitimate evidence - run it yourself:
+
+```bash
+python benchmarks/adversarial_evidence_benchmark.py
+```
+
+A seed corpus this small proves only that the rules fire. The corpus, not the
+score, is the asset: every new fooling pattern found in the wild must land as
+a fixture, and detection claims are only as strong as the corpus is
+adversarial. `--llm` scores the full two-layer pipeline (one API call per
+case, needs a key).
+
+## Honest limits
+
+- No verifier can guarantee that no AI will ever fool it. This adjudicator
+  raises the cost of fabricated evidence; it does not make deception
+  impossible.
+- The reviewer model can be wrong in both directions: it can pass weak
+  evidence and fail good evidence.
+- A submission crafted to mislead this specific reviewer can sometimes
+  succeed. Rotate models if you depend on this gate.
+- The deterministic lint only knows the patterns it was taught; novel
+  fabrication styles slip past it until the benchmark corpus teaches them.
+- The mechanical gates (immutable time-lock, deterministic proof receipts,
+  anti-idle refinement cycles) remain the primary authority. The adjudicator
+  is one more gate that must agree, never a replacement for the others.

fable_engine-1.3.6/docs/stop-ai-agents-writing-too-early.md

@@ -0,0 +1,139 @@
+# Start here: stop AI coding agents from writing too early
+
+AI coding agents often move from a plausible plan to editing files before they have gathered enough evidence. Fable Mode adds a mechanical session gate: the agent can inspect and reason, but the Fable Engine will not report write permission until the configured authority timer and proof prerequisites pass.
+
+Fable Mode is two separate pieces:
+
+- **Fable Engine** is the MCP server that stores session state and enforces its gates.
+- **The Fable Mode Agent Skill** is the optional workflow that tells a compatible agent how to use those gates.
+
+Installing one does not silently activate the other.
+
+## Install the engine
+
+You need Python 3.10+ and [uv](https://docs.astral.sh/uv/getting-started/installation/).
+
+Run the pinned release without changing your global Python environment:
+
+```bash
+uvx --from fable-engine==1.3.6 fable-engine
+```
+
+### Claude Code
+
+```bash
+claude mcp add fable-engine -- uvx --from fable-engine==1.3.6 fable-engine
+```
+
+### Cursor or another JSON-configured MCP client
+
+```json
+{
+  "mcpServers": {
+    "fable-engine": {
+      "command": "uvx",
+      "args": ["--from", "fable-engine==1.3.6", "fable-engine"]
+    }
+  }
+}
+```
+
+Restart or reload the client, then inspect its MCP tools. You should see `fable_session` plus the browser tools exposed by the server.
+
+## Install the optional Agent Skill
+
+From the root of the project where you want the skill:
+
+```bash
+uvx --from fable-engine==1.3.6 fable-mode install-skill --dry-run
+uvx --from fable-engine==1.3.6 fable-mode install-skill --yes
+```
+
+The default destination is `.agents/skills/fable-mode`. Use `--target <dir>` for a different skill directory. The installer refuses to overwrite local edits unless you pass `--force`.
+
+Reload the agent after installation.
+
+## Run a first session
+
+Ask your MCP client to call `fable_session` with:
+
+```json
+{
+  "action": "create_session",
+  "session_name": "parser-refactor",
+  "objective": "Refactor the parser without changing its public behavior",
+  "time_budget_minutes": 2
+}
+```
+
+The result should show:
+
+- `can_execute_code: False`;
+- the active phase;
+- the authority budget and remaining time;
+- zero recorded evidence items and invariants.
+
+Next, inspect the target repository and record real findings:
+
+```json
+{
+  "action": "log_epistemic_item",
+  "session_name": "parser-refactor",
+  "tag": "PROVEN",
+  "claim": "The public parser entry point is parse(text)",
+  "evidence": "src/parser.py:18 and tests/test_parser.py"
+}
+```
+
+Record a second evidence-backed claim and a falsifiable invariant:
+
+```json
+{
+  "action": "record_invariant",
+  "session_name": "parser-refactor",
+  "invariant_name": "INV-01 public behavior",
+  "formal_statement": "For every existing parser fixture, output before == output after",
+  "proof_or_rationale": "Run the existing fixture suite before and after the change",
+  "domain": "compatibility"
+}
+```
+
+Use `get_status` to inspect the gate. When the timer has elapsed and prerequisites are satisfied, call `unlock_execution` with an evidence-based rationale. A rejected unlock is expected when a condition is still missing.
+
+## What the four gates mean
+
+1. **Think**: inspect the system and classify claims as `PROVEN`, `HYPOTHESIS`, or `UNKNOWN`.
+2. **Prove**: attach evidence to key claims and define invariants that can fail.
+3. **Attack**: run normal tests and targeted adversarial checks against the proposed change.
+4. **Write**: edit only after the engine reports that execution is unlocked, then verify the final tree.
+
+The minimum authority budget is two minutes. It is a floor, not a claim that two minutes is enough for every task.
+
+## Boundaries
+
+Fable Mode does not guarantee correct code. It also does not replace:
+
+- the host's filesystem permissions or sandbox;
+- repository instructions and review rules;
+- user approval for external side effects;
+- a container or VM for hostile code;
+- tests, type checks, static analysis, or human review.
+
+The V2 broker can add a separate process and policy boundary. For hostile workloads, run it inside an OS-level sandbox or container with restricted permissions.
+
+## Troubleshooting
+
+**The client cannot find `fable_session`.** Run the `uvx` command directly, check the MCP client configuration, and reload the client. MCP servers communicate over standard input and output; the client manages the process after configuration.
+
+**`unlock_execution` is rejected.** Read the returned reason. Common causes are an active authority timer, fewer than two `PROVEN` items, or no recorded invariant. Do not relabel assumptions to satisfy the counter.
+
+**The skill is installed but not used.** Confirm the destination matches the client's skill-discovery convention, then reload the client. The package cannot activate a host skill by itself.
+
+**You need a different workflow.** The skill is guidance around the engine. Host permissions and the user's instructions still win.
+
+## Next steps
+
+- [Agent Skill reference](../skills/fable-mode/SKILL.md)
+- [V2 architecture](./fable-v2-architecture.md)
+- [V1 to V2 migration](./fable-v1-v2-migration.md)
+- [System 3 architecture](./system3-architecture.md)

{fable_engine-1.3.4 → fable_engine-1.3.6}/fable_engine/actions/__init__.py

@@ -27,6 +27,7 @@ from fable_engine.actions.deliberation import (
     _handle_get_session_lineage,
     _handle_inspect_plan,
     _handle_verify_proof,
+    _handle_adjudicate_evidence,
     _handle_record_visual_mockups,
     _handle_validate_event_history,
 )
@@ -186,6 +187,9 @@ ACTION_DISPATCH: Dict[str, Callable[[Dict[str, Any]], str]] = {
     "plan": _handle_inspect_plan,
     "inspect_blueprint": _handle_inspect_plan,
     "verify_proof": _handle_verify_proof,
+    "adjudicate_evidence": _handle_adjudicate_evidence,
+    "adjudicate": _handle_adjudicate_evidence,
+    "ai_review": _handle_adjudicate_evidence,
     "validate_proof": _handle_verify_proof,
     "check_proof": _handle_verify_proof,
     "record_visual_mockups": _handle_record_visual_mockups,

{fable_engine-1.3.4 → fable_engine-1.3.6}/fable_engine/actions/deliberation.py

@@ -521,3 +521,51 @@ def _handle_validate_event_history(arguments: Dict[str, Any]) -> str:
     )
 
 
+def _handle_adjudicate_evidence(arguments: Dict[str, Any]) -> str:
+    """On-demand AI adjudication of a session's recorded evidence.
+
+    Runs even in advisory mode; the env flag still gates whether any
+    external call happens at all.
+    """
+    session_name = arguments.get("session_name", "").strip()
+    if not session_name:
+        return "Error: 'session_name' is required for action 'adjudicate_evidence'."
+    try:
+        session = get_or_load_session(session_name)
+    except Exception as exc:
+        return f"Error: could not load session '{session_name}': {exc}"
+
+    from fable_engine.adjudicator import AdjudicatorConfig, adjudicate_session
+    config = AdjudicatorConfig.from_env()
+    if not config.enabled:
+        return (
+            "AI Evidence Adjudicator is disabled. The host must set "
+            "FABLE_ADJUDICATOR_ENABLED=1 and FABLE_ADJUDICATOR_API_KEY "
+            "(optional: FABLE_ADJUDICATOR_STYLE, FABLE_ADJUDICATOR_MODEL, "
+            "FABLE_ADJUDICATOR_MODE=advisory|enforcing). No evidence was sent anywhere."
+        )
+    receipt = adjudicate_session(session, config=config)
+    if receipt is None:
+        return "AI Evidence Adjudicator is disabled; no review performed."
+    session.proof_receipts.append(receipt)
+    try:
+        session.save()
+    except Exception:
+        pass
+
+    verdict = str(receipt.get("verdict", "uncertain")).upper()
+    badge = {"PASS": "✅ PASS", "FAIL": "❌ FAIL"}.get(verdict, "⚠️ UNCERTAIN")
+    issues = receipt.get("issues") or []
+    issues_md = "\n".join(f"- {i}" for i in issues) if issues else "- none reported"
+    blocking = "blocking (enforcing mode)" if receipt.get("mode") == "enforcing" else "advisory only"
+    return (
+        f"### 🤖 AI Evidence Adjudication\n\n"
+        f"- **Verdict**: `{badge}` ({blocking})\n"
+        f"- **Confidence**: `{receipt.get('confidence', 0.0)}`\n"
+        f"- **Model**: `{receipt.get('model')}` ({receipt.get('style')})\n"
+        f"- **Receipt ID**: `{receipt.get('receipt_id')}`\n"
+        f"- **Evidence Bundle SHA-256**: `{receipt.get('bundle_sha256')}`\n"
+        f"\n**Issues**:\n{issues_md}\n\n"
+        f"Note: an AI adjudication is a second opinion, not a guarantee. "
+        f"Mechanical gates and deterministic proof receipts remain the primary authority."
+    )

{fable_engine-1.3.4 → fable_engine-1.3.6}/fable_engine/actions/fleet.py

@@ -200,16 +200,25 @@ def _handle_red_team_code_review(arguments: Dict[str, Any]) -> str:
             code_snippet = arguments[k]
             break
 
+    sandbox = None
     if code_snippet is not None and not callable(code_snippet):
-        return (
-            "Error: Source-code strings cannot be evaluated in-process for security reasons. "
-            "Dynamic source-code execution is disabled for public actions until an isolated sandbox executor is configured."
-        )
+        from fable_v2.coder_fleet.sandbox_executor import load_sandboxed_target
+        entrypoint = arguments.get("entrypoint") or arguments.get("function_name") or None
+        try:
+            sandbox = load_sandboxed_target(str(code_snippet), entrypoint=entrypoint)
+            code_snippet = sandbox
+        except Exception as exc:
+            return f"Error: Sandboxed executor could not load the target source: {exc}"
 
     custom_hypotheses = arguments.get("custom_hypotheses") or arguments.get("hypotheses")
     output_path = arguments.get("output_path")
 
-    session = get_or_load_session(session_name)
+    try:
+        session = get_or_load_session(session_name)
+    except Exception:
+        if sandbox is not None:
+            sandbox.close()
+        raise
     try:
         report = _get_swarm().run_full_review_cycle(
             target_callable=code_snippet,
@@ -227,9 +236,13 @@ def _handle_red_team_code_review(arguments: Dict[str, Any]) -> str:
             report_dict["red_team_receipt"] = session.issue_red_team_receipt(report_dict, change_id)
         session.record_breakage_report(report_dict)
     except (TypeError, ValueError) as exc:
+        if sandbox is not None:
+            sandbox.close()
         return f"Error: Cannot record red-team report: {exc}"
     session.save()
 
+    if sandbox is not None:
+        sandbox.close()
     md_report = _get_swarm().document_breakage(report, output_path=output_path)
     return (
         f"{md_report}\n\n"
@@ -320,11 +333,15 @@ def _handle_verify_red_team_remediation(arguments: Dict[str, Any]) -> str:
             remediated_code = arguments[k]
             break
 
+    sandbox = None
     if remediated_code is not None and not callable(remediated_code):
-        return (
-            "Error: Source-code strings cannot be evaluated in-process for security reasons. "
-            "Dynamic source-code execution is disabled for public actions until an isolated sandbox executor is configured."
-        )
+        from fable_v2.coder_fleet.sandbox_executor import load_sandboxed_target
+        entrypoint = arguments.get("entrypoint") or arguments.get("function_name") or None
+        try:
+            sandbox = load_sandboxed_target(str(remediated_code), entrypoint=entrypoint)
+            remediated_code = sandbox
+        except Exception as exc:
+            return f"Error: Sandboxed executor could not load the remediated source: {exc}"
 
     session = get_or_load_session(session_name)
 
@@ -338,6 +355,8 @@ def _handle_verify_red_team_remediation(arguments: Dict[str, Any]) -> str:
             prior_report = session.breakage_reports[-1]
 
     if not prior_report:
+        if sandbox is not None:
+            sandbox.close()
         return "Error: No prior breakage report found to verify. Provide 'report_id' or 'prior_report'."
     try:
         timeout_sec = float(arguments.get("timeout_seconds", 3.0))
@@ -369,8 +388,12 @@ def _handle_verify_red_team_remediation(arguments: Dict[str, Any]) -> str:
             report["red_team_receipt"] = session.issue_red_team_receipt(report, change_id)
         session.record_breakage_report(report)
     except (TypeError, ValueError) as exc:
+        if sandbox is not None:
+            sandbox.close()
         return f"Error: Cannot record remediation verification: {exc}"
 
+    if sandbox is not None:
+        sandbox.close()
     session.save()
     broken_count = int(report.get("broken_count", 0))
     if broken_count > 0: