feat(workbench): persist construction evidence in trace journal

* feat(workbench): add construction endpoint handler seam

* test(workbench): cover construction endpoint handler seam

* feat(workbench-ui): add construction evidence endpoint helpers

* test(workbench-ui): cover construction endpoint helpers

.data/benchmarks/.gitkeep

@@ -0,0 +1,3 @@
+# This directory is gitignored (see .gitignore: .data/benchmarks/).
+# Only this .gitkeep and manifest YAMLs under evals/generalization/manifests/ are committed.
+# Raw dataset files must never be committed to the repo.

.github/CODEOWNERS

@@ -0,0 +1,14 @@
+# Code ownership for AssetOverflow/core — ADVISORY ONLY (see ADR-0221).
+#
+# This repository is public with a single maintainer. Public exclusion is
+# provided by repository WRITE ACCESS — non-collaborators can open PRs but can
+# never merge — NOT by a review requirement. Per ADR-0221, branch protection on
+# `main` is required-status-checks-only: required_approving_review_count = 0 and
+# require_code_owner_reviews = false. This file therefore only auto-requests
+# review / assigns ownership; it does NOT gate merges.
+#
+# Do NOT re-enable required code-owner review on this solo-maintainer repo: every
+# PR is authored by the only owner, and GitHub forbids self-approval, so it
+# creates an unsatisfiable deadlock that forces --admin on every merge (ADR-0221).
+
+* @AssetOverflow

.github/copilot-instructions.md

@@ -112,7 +112,14 @@ Learning is reviewed mutation:
 
 ## Validation
 
-Use CLI suites:
+Before starting any task, run the startup guard to ensure a fresh base:
+
+```bash
+source scripts/agent_startup.sh
+# For PR-resume tasks: CODEX_ALLOW_NON_MAIN_BASE=1 source scripts/agent_startup.sh
+```
+
+Then use CLI suites to validate your work:
 
 ```bash
 core test --suite smoke -q

.github/workflows/ratify-proposal.yml

@@ -107,12 +107,16 @@ jobs:
           git add \
             teaching/cognition_chains/cognition_chains_v1.jsonl \
             teaching/proposals/proposals.jsonl
-          git commit -m "ratify(teaching): accept proposal ${{ inputs.proposal_id }}
-
-chain_id: ${{ steps.accept.outputs.chain_id }}
-review_date: ${{ steps.date.outputs.date }}
-operator: ${{ github.actor }}
-ADR-0057 / ADR-0155"
+          # Paragraph-style -m flags: a multi-line -m string here had body
+          # lines at column 1, which terminated the YAML literal block and
+          # made the workflow file unloadable (a path-named failure run on
+          # every push since #283).
+          git commit \
+            -m "ratify(teaching): accept proposal ${{ inputs.proposal_id }}" \
+            -m "chain_id: ${{ steps.accept.outputs.chain_id }}" \
+            -m "review_date: ${{ steps.date.outputs.date }}" \
+            -m "operator: ${{ github.actor }}" \
+            -m "ADR-0057 / ADR-0155"
           git push origin main
 
       - name: job summary

.github/workflows/workbench-ui.yml

@@ -0,0 +1,106 @@
+name: workbench-ui
+
+# Frontend verification lane (Wave R brief R0a). Before this workflow,
+# workbench-ui changes merged with no frontend CI at all — smoke.yml and
+# full-pytest.yml are Python-only.
+#
+# The e2e job is the Playwright smoke lane (Wave R brief R0b) — ADR-0162
+# acceptance criteria 5-7. Separate job so vitest results are not hostage
+# to browser install.
+#
+# The path filter includes this workflow file itself so changes to the
+# lane are validated by the lane.
+
+on:
+  pull_request:
+    paths:
+      - "workbench-ui/**"
+      - ".github/workflows/workbench-ui.yml"
+  push:
+    branches: [main]
+    paths:
+      - "workbench-ui/**"
+      - ".github/workflows/workbench-ui.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: workbench-ui-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-and-test:
+    name: build + vitest
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: workbench-ui
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+
+      - name: set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          # actions ignore working-directory; point at the pinned
+          # "packageManager" field explicitly (single source of truth)
+          package_json_file: workbench-ui/package.json
+
+      - name: set up node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+          cache-dependency-path: workbench-ui/pnpm-lock.yaml
+
+      - name: install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: build (tsc + vite)
+        run: pnpm build
+
+      - name: vitest (full suite must pass AND exit)
+        run: pnpm test
+
+  e2e:
+    name: playwright smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: workbench-ui
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+
+      - name: set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: workbench-ui/package.json
+
+      - name: set up node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+          cache-dependency-path: workbench-ui/pnpm-lock.yaml
+
+      - name: install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: cache playwright browsers
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-${{ hashFiles('workbench-ui/pnpm-lock.yaml') }}
+
+      - name: install chromium
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: build (tsc + vite)
+        run: pnpm build
+
+      - name: playwright smoke (ADR-0162 acceptance 5-7)
+        run: pnpm test:e2e

.gitignore

@@ -8,6 +8,10 @@ __pycache__/
 traces/
 .formation_cache/
 
+workbench_data/*
+!workbench_data/
+!workbench_data/README.md
+
 core-rs/target/
 core-rs/Cargo.lock
 
@@ -22,6 +26,14 @@ uv.lock
 reports/
 frontier_wave1.json
 
+# Benchmark local cache — manifests + fetch script only; benchmark data never committed
+# (extends ADR-0119.7 sealed-holdout discipline to generalization audits)
+.data/benchmarks/
+
+# Workbench UI browser-test artifacts
+workbench-ui/test-results/
+workbench-ui/playwright-report/
+
 # Claude Code local session artifacts (per-developer, never tracked)
 .claude/
 
@@ -51,3 +63,25 @@ teaching/math_proposals/proposals.jsonl
 engine_state/manifest.json
 engine_state/recognizers.jsonl
 engine_state/discovery_candidates.jsonl
+engine_state/lived_life.json
+engine_state/always_on.lock
+# ADR-0219 generation-dir checkpoint layout (the committed gen dir + pointer)
+# and the CL proposal log — also runtime-generated, not source.
+engine_state/current
+engine_state/gen-*/
+engine_state/session_state.json
+engine_state/proposals.jsonl
+# per-life idle frontier-contemplation runs — any engine-state root (incl. CORE_ENGINE_STATE_DIR).
+contemplation_runs/
+
+# Private outreach / personal packet — never tracked
+01_Anthropic/
+
+# Agent working directories
+.agents/
+
+# Cowork/Claude tooling artifacts
+skills-lock.json
+
+# Per-life backup checkpoint dirs are runtime-generated, not source.
+engine_state/_life_backup_*/

AGENTS.md

@@ -4,6 +4,35 @@ This repository is building a deterministic cognitive engine, not a transformer
 wrapper and not a demo chatbot.  Every agent must preserve the geometric
 runtime while moving the system toward teachable cognitive chat.
 
+## Agent-Specific Instruction Files
+
+Different agents read a supplementary file alongside this one.  Read yours
+before touching any code:
+
+| Agent | Supplementary file | Key differences |
+|---|---|---|
+| **Claude** | `CLAUDE.md` | Deep context; self-restraining; read for semantic anchoring rule nuance |
+| **Grok 4.3 + Grok Build** | `GROK.md` | Stateless; requires high reasoning effort; mandatory workspace hygiene; Arena/parallel subagent rules; Plan Mode preferred; skills system; see also docs/core-rd-base-prompts.md for phase-specific prompts |
+| **GPT-5.5 (o3-class)** | `GPT55.md` | Stateless; fluency cautions; extended thinking for algebra/field work |
+
+If you are Grok 4.3 or GPT-5.5, complete the Session Start Checklist in your
+file before reading anything else in this file.
+
+## Grok 4.3 / Grok Build Hard Stops (Mastery Level)
+
+These apply to Grok 4.3 and Grok Build in addition to every rule below:
+
+1. **You are stateless.** Read `GROK.md` in full, `docs/runtime_contracts.md`, and the most recent `HANDOFF-*.md` (if dated within 3 days) before any edits.
+2. **Workspace hygiene is mandatory.** Before branch movement or edits, confirm cwd/repo root, inspect dirty state, classify loose files, fetch/prune, establish clean current `main`, and use a fresh worktree for non-trivial implementation.
+3. **High reasoning effort is mandatory** for all tasks touching `algebra/`, `field/`, `generate/realizer.py`, `generate/graph_planner.py`, `generate/intent.py`, `vault/store.py`, `calibration/`, `core/cognition/`, or `teaching/`.
+4. **Use Plan Mode** (Grok Build) for any non-trivial change in the above modules. Direct edits are discouraged.
+5. **Skills are the preferred mechanism** for repeated protocols. Use `/core-bootstrap`, `/versor-coherence-guardian`, `/pre-edit-sweep`, and `/claim-proposal-guardian` (or their auto-triggered versions).
+6. **Sweep before you edit.** Use tool-call chains to trace imports and call sites.
+7. **Write a handoff doc at session end** using `docs/handoff_template.md`.
+8. **Arena / parallel subagents:** each subagent independently satisfies `||F * reverse(F) - 1||_F < 1e-6` before reporting. Reconcile results before any merge. No mutable state sharing.
+
+---
+
 ## North Star
 
 CORE should become capable of:
@@ -294,6 +323,25 @@ If it touches user input, files, dynamic imports, or logs, what trust boundary w
 Prefer small, load-bearing PRs.  Do not mix baseline fixes, feature work, and
 large reorganization unless the coupling is unavoidable.
 
+## Kernel Substrate / No-New-Legacy Rule
+
+After PR #829, the preferred math comprehension construction path is:
+
+```text
+raw problem text → KernelFacts → ProblemFrame → contract-backed derivation organs
+```
+
+- Use `generate/problem_frame_builder.py::build_problem_frame` for substrate-backed
+  fact extraction (scalars, units, hazards, process-frame candidates).
+- New derivation capabilities must consume ProblemFrame facts where the substrate can
+  represent the needed meaning.
+- New raw-prose/local-regex parsing inside a derivation organ requires an explicit
+  `LEGACY_EXCEPTION` comment and migration rationale.
+- Guard test: `tests/test_kernel_no_new_legacy_derivation_surfaces.py`.
+- Audit map: `docs/analysis/kernel-substrate-deprecation-audit-2026-06-18.md`.
+
+Do not add another isolated benchmark organ with a local prose parser.
+
 ## Architecture in One Sentence
 
 Raw input becomes a closed versor field once; thought evolves through exact

CLAIMS.md

@@ -39,7 +39,7 @@ is a CI failure (`.github/workflows/lane-shas.yml`).
 | ADR-0095 | `miner_loop_closure` | Miner-sourced proposals route through single reviewed teaching path | `evals/miner_loop_closure/results/v1_dev.json` | `9f071733abe7dcacf759f928548ce738fb639af3fd6e4c621a651b306d7e77ce` |
 | ADR-0096 | `fabrication_control_summary` | Phantom endpoints / cross-pack non-bridges / sibling collapses refuse | `evals/fabrication_control/results/v1_summary.json` | `01e1b6b711141f2b4a14551d7df3ea482d8d6dd7b364a25c509f4f8d08cda8a8` |
 | ADR-0098 | `demo_composition` | Demos compose from shipped modules; no parallel mechanism | `evals/demo_composition/results/v1_dev.json` | `3a3d09f3a87462737e615c2dd3481b9e13e5ff8fadee0043c37873494ded556d` |
-| ADR-0099 | `public_demo` | Public showcase runs deterministically under 30s; all claims supported | `evals/public_demo/results/v1_dev.json` | `e323adb35ea17987991395424c603ff93bca08c11bc2713bd9f6338e86bb269f` |
+| ADR-0099 | `public_demo` | Public showcase runs deterministically under 30s; all claims supported | `evals/public_demo/results/v1_dev.json` | `2895df080b91618aefc2df407c637ff419fbb6dae33233c90262688c103411ea` |
 | ADR-0104 | `curriculum_loop_closure` | Curriculum-sourced proposals route through single reviewed teaching path | `evals/curriculum_loop_closure/results/v1_dev.json` | `b46d56b2d209172cc3ffaf3776dc8dcfe55093f13587c5cb67372be6dfa23e8d` |
 | ADR-0131 | `math_teaching_corpus_v1` | Math teaching corpus replays deterministically; all chains pass exit criterion (correct_rate=1.0, wrong=0) | `evals/math_teaching_corpus/v1/report.json` | `eaf160d145da29f9050ede8d58bf111b0f651dd40aeae9201857d0b97e014dd4` |
 | ADR-0206 | `deductive_logic_v1` | Propositional entailment scored against an independent truth-table oracle; dev+holdout+external 716/716 correct, wrong=0, refused=0 | `evals/deductive_logic/report.json` | `97a230949016e38d5e3f37a69e4245b320575ee70e5af92ff7607f7b05f74b5f` |

CLAUDE.md

@@ -123,6 +123,20 @@ runtime path.  Vault recall is exact and deterministic.
 - `calibration/*` — bounded replay-based calibration.
 - `docs/runtime_contracts.md` — response, telemetry, memory, identity, and testing contracts.
 
+### Kernel substrate / ProblemFrame (operational path after PR #829)
+
+New derivation capabilities must consume `KernelFacts` / `ProblemFrame` facts where the
+substrate can represent the needed meaning (`generate/problem_frame_builder.py`).
+
+```text
+raw problem text → KernelFacts → ProblemFrame → contract-backed derivation organs
+```
+
+New raw-prose/local-regex parsing inside a derivation organ requires an explicit
+`LEGACY_EXCEPTION` note and a migration rationale. Guard:
+`tests/test_kernel_no_new_legacy_derivation_surfaces.py`. Migration map:
+`docs/analysis/kernel-substrate-deprecation-audit-2026-06-18.md`.
+
 ### GSM8K math comprehension substrate (sealed; serving `7/43/0`, wrong=0 — moves only via ratified PRs)
 
 - `core/reliability_gate/` — calibrated-learning ledger + gate (ADR-0175): `ClassTally` counts, `conservative_floor` (one-sided Wilson, N_MIN=10), θ ceilings.
@@ -231,6 +245,53 @@ Learning must be reviewed and auditable.
 
 Do not create a parallel correction/learning path.
 
+### The learning boundary is typed, not "everything is proposal-only"
+
+A common misreading treats *all* learning as proposal-only.  That is a false
+bottleneck.  The real boundary is between **durable** standing and
+**provisional** standing, and it is already mechanically enforced — the rule
+below names what each invariant guarantees, it does not loosen any of them.
+
+- **Durable mutation stays reviewed or proof-carrying.**  Corpus / pack /
+  policy / identity changes, and any promotion to COHERENT/verified standing,
+  go through the reviewed teaching loop (`teaching/*`, proposal-only) or the
+  proof-carrying promotion gate (ADR-0218 `apply_certified_promotion`, which
+  re-verifies the entailment from a curator-certified coherent base before the
+  flip).
+- **Provisional state may update autonomously — iff typed, isolated,
+  replayable, and unable to masquerade as ratified truth.**  This covers
+  session memory, sealed practice ledgers, SPECULATIVE idle consolidation of
+  soundly-derived facts, reliability-ledger counts, proposal emission, and
+  disclosed licensed estimates.  Each is written SPECULATIVE (never COHERENT),
+  through the same `VaultStore.store` path (no parallel memory), deterministically
+  (no clock, no LLM, no sampling), and carries its standing honestly
+  (`basis="as_told"`, `[approximate]`, "proposal", …).
+
+This boundary is a set of failing-when-violated invariants, not a convention:
+
+- **INV-21** — only allowlisted modules may call `VaultStore.store(...)`.
+- **INV-22 / INV-23** — an unmarked pack row and an unmarked `store()` default
+  to SPECULATIVE; COHERENT requires an explicit stamp.
+- **INV-24** — every `vault.recall` callsite is categorized; user-facing
+  evidence must pass `min_status=COHERENT`.
+- **INV-29** — only `vault/store.py` may transition an `epistemic_status`; the
+  only *default-reachable* COHERENT producer is the certificate-gated
+  `apply_certified_promotion`.  (Honest wrinkle: ADR-0148
+  `promote_eligible_entries` is a second, non-certificate COHERENT path, but it
+  is opt-in — it fires only when a caller passes a promotion policy — and is
+  off by default.)
+- **INV-30** — the open-world `determine()` gear constructs only
+  `Determined(answer=True)` or refuses; it can never assert `answer=False`.
+  Closed-world entailed-negation (assert-False) must use a distinct
+  closed-world type and entry point, never the open-world path.
+
+When you add an autonomous learning surface, it must land inside this boundary
+(SPECULATIVE, same store path, replayable) and the relevant invariant above must
+*fail loudly* if it does not.  An autonomous path that can reach COHERENT, emit
+verified without a replayed certificate, persist non-replayably, or assert a
+closed-world False into the open-world runtime is a boundary breach, not a
+feature.
+
 ## Semantic Pack Discipline
 
 Prefer compact, curated packs.  Do not bulk-ingest corpora into runtime.

GPT55.md

@@ -0,0 +1,138 @@
+# CORE Agent Instructions for GPT-5.5 (o3-class)
+
+Read this file in full before touching any file in this repository.
+CORE is a deterministic cognitive engine — not a transformer wrapper, not a
+generic chatbot, not an infrastructure playground.
+
+> **You are stateless across API sessions.** You have no persistent memory
+> of prior conversations.  Complete the
+> [Session Start Checklist](#session-start-checklist) before any edits.
+
+---
+
+## Session Start Checklist
+
+1. **Read this file in full.**
+2. **Read `AGENTS.md` in full.**
+3. **Read `docs/runtime_contracts.md` in full.**
+4. **Run the startup guard** — enforces fresh-base and clean-tree invariants:
+   ```bash
+   source scripts/agent_startup.sh
+   ```
+   For a PR-resume task: `CODEX_ALLOW_NON_MAIN_BASE=1 source scripts/agent_startup.sh`
+5. **Run the smoke suite:**
+   ```bash
+   core test --suite smoke -q
+   ```
+6. **Check for a handoff doc** — read the most recent `HANDOFF-*.md` if one
+   exists dated within the last 3 days.
+7. **State your task scope** — before editing, name the module(s) and the
+   invariant you will prove was not violated.
+
+---
+
+## Reasoning and Tool Use
+
+GPT-5.5 (o3-level) has strong multi-step reasoning.  Use it here by:
+
+- **Reasoning through the full operator chain** before proposing edits to
+  algebra or field modules.  Do not shortcut the math.
+- **Using tool calls** to sweep import graphs and call sites before editing.
+- **Stating your reasoning** about why an edit preserves versor_condition
+  before writing the code.
+
+For extended thinking mode: enable it for any task touching `algebra/`,
+`field/`, `vault/`, `calibration/`, or `core/cognition/`.
+
+---
+
+## NON-NEGOTIABLE INVARIANTS
+
+```
+❌  versor_condition(F) < 1e-6 at every runtime field state.
+    Fix the operator/construction boundary; do not weaken the threshold.
+
+❌  Normalization only at:
+      ingest/gate.py
+      language_packs/compiler.py
+      algebra/versor.py
+      sensorium/*/canonical.py
+      session/context.py  (semantic anchoring only — see CLAUDE.md)
+    Forbidden in: generate/stream.py, field/propagate.py, vault/store.py,
+    logging/telemetry layers.
+
+❌  No cosine similarity, HNSW, ANN, or approximate recall in runtime.
+    Vault recall is exact and deterministic.
+
+❌  No stochastic generation or opaque LLM fallbacks in the cognitive path.
+
+❌  No pack mutation outside the proposal-only reviewed teaching loop.
+
+❌  INV-21/22/23/24/29/30 (see CLAUDE.md for full text).
+```
+
+---
+
+## GPT-5.5 Specific Cautions
+
+GPT-5.5's code generation is fluent and fast.  That fluency creates
+specific risks for CORE:
+
+- **Do not generate "helpful" utility wrappers** that centralize normalization
+  or add intermediate caching layers.  CORE's architecture is already
+  explicit about where these belong.
+- **Do not add type coercions** in hot-path algebra that silently
+  re-normalize field state.
+- **Do not suggest async/concurrent refactors** to vault or algebra paths
+  without a full trace of the determinism contract.
+- **Tool-use completions that look finished may not be** — always run the
+  CLI validation suite, do not assume correctness from code inspection alone.
+
+---
+
+## Pre-Edit Sweep Protocol
+
+Before editing any module in `algebra/`, `field/`, `generate/`, `vault/`,
+`core/cognition/`, `teaching/`, or `calibration/`:
+
+1. Trace every import of the target module.
+2. Identify all callers of the target function/class.
+3. Check `evals/` and `calibration/` for tests covering the changed path.
+4. Only then propose edits.
+
+---
+
+## End-of-Session Handoff Requirement
+
+At the end of every session, write a handoff document using the template
+at `docs/handoff_template.md`.  Name it:
+
+```
+HANDOFF-gpt55-YYYY-MM-DD.md
+```
+
+---
+
+## Architecture Summary
+
+Raw input becomes a closed versor field once; thought evolves through exact
+versor transitions and CGA recall; cognition is structured as intent,
+proposition graph, articulation target, deterministic realization, reviewed
+memory, eval/calibration replay, and traceable evidence.
+
+See `AGENTS.md` for the full cognitive path, key modules, and PR checklist.
+
+---
+
+## CLI Validation Lanes
+
+```bash
+core test --suite smoke -q
+core test --suite cognition -q
+core test --suite teaching -q
+core test --suite packs -q
+core test --suite runtime -q
+core test --suite algebra -q
+core test --suite full -q
+core eval cognition
+```

GROK.md

@@ -0,0 +1,382 @@
+# CORE Agent Instructions for Grok 4.3
+
+Read this file in full before touching any file in this repository.
+CORE is a deterministic cognitive engine — not a transformer wrapper, not a generic chatbot, not an infrastructure playground. The rules here are architectural invariants, not suggestions.
+
+> **You are stateless.** You have no memory of prior sessions.
+> Complete the [Session Start Checklist](#session-start-checklist) before any edits. Do not skip it.
+
+---
+
+## Phase-Specific Prompt Library
+
+For detailed, phase-oriented guardrails that are tightly coupled to CORE’s architecture, invariants, ADRs, and epistemic model, see:
+
+**`docs/core-rd-base-prompts.md`**
+
+These prompts are designed to be used as standing prefixes **in addition to** this file. The "Session Entry / Context Load" prompt is especially recommended at the start of most sessions. The "Standing Loop Axiom Check" is highly effective as a final self-audit before committing.
+
+---
+
+## Session Start Checklist
+
+Run these steps in order, using your tool-call chains, before writing a single line of code:
+
+1. **Read this file in full.**
+2. **Read `AGENTS.md` in full.**
+3. **Read `docs/runtime_contracts.md` in full.**
+4. **Complete the [Workspace Hygiene + Branch/Worktree Protocol](#workspace-hygiene--branchworktree-protocol)** — confirm project root, inspect dirty state, classify loose files, fetch current refs, establish clean `main`, and create a fresh worktree for non-trivial work.
+5. **Run the smoke suite and report pass/fail:**
+   ```bash
+   core test --suite smoke -q
+   ```
+   If the local environment does not expose `core`, report the exact failure and use the repo-native pytest lanes required by the task.
+6. **Check for a recent handoff doc** — if a `HANDOFF-*.md` file exists dated within the last 3 days, read it. It contains state you would otherwise have no way to recover.
+7. **State your task scope** — before editing, write one sentence naming the module(s) you intend to change and the invariant you will prove was not violated.
+
+Do not treat conversation history as a substitute for steps 1–6. History does not survive context resets. Ground yourself in the repo.
+
+---
+
+## Workspace Hygiene + Branch/Worktree Protocol
+
+Before any edit, branch switch, worktree creation, stash, or commit, establish the repository state. This protocol is mandatory for Grok 4.3 / Grok Build sessions on CORE.
+
+### 0. Confirm project root
+
+Run:
+
+```bash
+pwd
+git rev-parse --show-toplevel
+test -f GROK.md
+test -f AGENTS.md
+```
+
+If the current directory is not the repository root, run:
+
+```bash
+cd "$(git rev-parse --show-toplevel)"
+```
+
+Do not proceed from a parent directory, sibling worktree, nested package directory, or generated-output directory.
+
+### 1. Inspect local state before touching branches
+
+Run:
+
+```bash
+git status --short --branch
+git diff --stat
+git diff --name-status
+git diff --cached --name-status
+git stash list
+git worktree list
+```
+
+If the working tree is dirty, do **not** switch branches, pull, reset, overwrite, or stash blindly.
+
+Classify every changed or untracked file first:
+
+- Does it belong to the current task?
+- Does it appear to belong to a recent branch or PR?
+- Is it an accidental generated artifact?
+- Is it an evidence/report file that should be restored rather than deleted?
+- Is it unknown?
+
+For unknown changes, inspect before stashing:
+
+```bash
+git diff -- <path>
+git log --oneline --decorate --all -- <path>
+git branch --sort=-committerdate | head -20
+gh pr list --state open --limit 20
+gh pr status
+```
+
+If the origin remains unknown, preserve it with a descriptive stash instead of deleting it:
+
+```bash
+git stash push -m "WIP unknown before <task-slug>: <short file summary>" -- <paths>
+```
+
+Never use `git reset --hard`, broad `git checkout .`, broad `git restore .`, `git clean`, or destructive cleanup unless the user explicitly approves or every affected file has been classified as disposable.
+
+### 2. Establish a clean, current baseline
+
+**Run the startup guard first** — it automates steps 2–4 and will hard-stop if the worktree is stale:
+
+```bash
+source scripts/agent_startup.sh
+```
+
+For a new task (default, no env vars) the script requires `HEAD == origin/main` and a clean tree.
+For a PR-resume task, set `CODEX_ALLOW_NON_MAIN_BASE=1`; the script then verifies `origin/main` is a strict ancestor of `HEAD`.
+
+If you cannot source the script, perform the equivalent steps manually:
+
+```bash
+git fetch origin --prune
+git switch main
+git pull --ff-only origin main
+git status --short --branch
+```
+
+If `main` cannot fast-forward, stop and report the exact state. Do not merge, rebase, or resolve conflicts unless explicitly instructed.
+
+
+### 3. Prefer a new worktree for non-trivial implementation
+
+For non-trivial runtime, reasoning, eval, teaching, pack, or multi-file work, create a fresh worktree from current `origin/main`:
+
+```bash
+git worktree add ../core-<task-slug> origin/main -b <branch-name>
+cd ../core-<task-slug>
+```
+
+Use a normal branch in the same worktree only for small docs/config work or when the user explicitly requests it. Do not reuse stale branches for new work unless the task is explicitly a continuation of that branch.
+
+### 4. Branch naming
+
+Use scope-bounded branch names:
+
+```text
+feat/gsm8k-workstream-a-gate-a1-comparative-injection
+docs/<area>-<purpose>
+fix/<area>-<specific-bug>
+chore/<area>-<specific-cleanup>
+```
+
+The branch name should encode the capability slice, not an agent name or vague intent.
+
+### 5. Completion protocol
+
+Before opening a PR:
+
+```bash
+git status --short
+git diff --check origin/main...HEAD
+git diff --name-status origin/main...HEAD
+git log --oneline --reverse origin/main..HEAD
+```
+
+Run the relevant focused tests and record exact outputs. For every PR summary include:
+
+- branch name;
+- commit list in order;
+- exact changed files;
+- exact tests/evals run;
+- whether `wrong_total == 0` applies and held;
+- known caveats;
+- explicit non-goals;
+- handoff content or handoff file path.
+
+---
+
+## Reasoning Effort Requirement
+
+You must operate at **high reasoning effort** for all tasks that touch:
+
+- `algebra/`
+- `field/`
+- `generate/realizer.py`, `generate/graph_planner.py`, `generate/intent.py`
+- `vault/store.py`
+- `calibration/`
+- `core/cognition/`
+- `teaching/`
+
+If you were invoked at default or low effort and the task touches any of these modules, **stop and request re-invocation at high effort.** Low-effort reasoning on the algebra/field layer produces plausible-looking but mathematically incorrect results.
+
+For `workbench-ui/`, `docs/`, `notes/`, `scripts/` at low risk, medium effort is acceptable.
+
+---
+
+## Versor Coherence Guardian Protocol
+
+Before proposing or executing **any** change that could affect versor closure, field propagation, or exact CGA recall:
+
+1. Explicitly confirm that the core invariant holds: `||F * reverse(F) - 1||_F < 1e-6` for the affected `FieldState`.
+2. Verify that `versor_apply(V, F)` and `cga_inner(X, Y)` paths remain exact and untouched except through the allowed modules (`algebra/versor.py` and permitted callers).
+3. Re-run the relevant invariant checks from `tests/test_versor_closure.py` (or current equivalent) on the modified paths.
+4. Only after the above may you proceed with edits or proposals.
+
+This protocol is mandatory for any work in `algebra/`, `field/`, `vault/`, or `generate/`.
+
+---
+
+## NON-NEGOTIABLE INVARIANTS
+
+These are **hard architectural constraints enforced by construction**. Violating any one of them is a bug that must be reverted before merge.
+
+**Versor & CGA Level (Exact Algebraic Coherence)**
+- `||F * reverse(F) - 1||_F < 1e-6` must hold identically for **every** runtime `FieldState` and every application of `versor_apply(V, F)`.
+- All state is represented as versors. All transitions are exact versor products. No exceptions, no approximations.
+- Multivector representation in `algebra/` uses fixed `(32,)` float32 arrays for Cl(4,1). No dynamic resizing or external library types in the hot path.
+- `cga_inner(X, Y) = -d²/2` is the sole exact recall primitive. It must remain exact and deterministic.
+
+**Normalization & Approximation Boundaries**
+- Normalization is allowed **ONLY** at the explicitly listed locations:
+  - `ingest/gate.py`
+  - `language_packs/compiler.py`
+  - `algebra/versor.py`
+  - `sensorium/*/canonical.py` (signal canonicalization, pinned only)
+  - `session/context.py` (semantic anchoring)
+- Forbidden everywhere else, including `generate/stream.py`, `field/propagate.py`, `vault/store.py`, and all logging/telemetry paths.
+
+**No Approximate or Stochastic Mechanisms**
+- No cosine similarity, HNSW, ANN indexes, embedding-based recall, or any approximate nearest-neighbor mechanism anywhere in the deterministic cognitive path.
+- Vault recall is **exact** `cga_inner` only.
+- No stochastic generation, sampling, opaque LLM fallbacks, or probabilistic mechanisms in the core deterministic reasoning, teaching, recognition, or realization pipelines.
+
+**Claim Schema & Epistemic Rigor**
+- Claim status transitions (SPECULATIVE → COHERENT → CONTESTED → FALSIFIED) may only occur through the defined review-gated TeachingChainProposal mechanism.
+- A claim may not move to COHERENT without passing all applicable review gates and producing a reproducible evidence bundle.
+- No direct mutation of epistemic status. Only `vault/store.py` may transition status (INV-29).
+- User-facing `vault.recall` must enforce `min_status=COHERENT` (INV-24).
+
+**Safety & Identity Packs**
+- Safety packs (`packs/safety/`) are **unmodifiable at runtime**. They are fail-closed and reviewer-signed.
+- Identity packs are swappable only via the defined PersonaMotor + proposal mechanism. Runtime mutation is forbidden.
+- Any attempt to relax or bypass a safety axis must be rejected and logged as a protocol violation.
+
+If you believe one of these must change for correctness or performance reasons, **STOP**. Write a proposal in `notes/` or `docs/decisions/` and do not implement the change. CORE’s architecture is not negotiated inside a coding session.
+
+---
+
+## Pre-Edit Sweep Protocol
+
+Before editing any module in `algebra/`, `field/`, `generate/`, `vault/`, `core/cognition/`, `teaching/`, or `calibration/`:
+
+1. Use your file-read and search tool chains to **trace every import** of the target module across the codebase.
+2. Identify **all callers** of the specific function or class you intend to change.
+3. Check `calibration/` and `evals/` for tests that exercise the changed path.
+4. Only then propose edits.
+
+Your 1M-token context window means you can load the full relevant subgraph in one pass. Do this. Do not guess at call sites.
+
+---
+
+## Agentic Tool-Call Discipline
+
+Grok 4.3's multi-step tool-call chains are an asset here. Use them to:
+- Load the full affected module graph before proposing changes.
+- Run CLI validation lanes and report actual output, not assumed output.
+- Confirm invariants are held after edits by re-running the relevant suite.
+
+Do not use tool chains to:
+- Probe for statistical or ML-based workarounds to exact CGA constraints.
+- Discover "alternative" normalization sites not listed above.
+- Chain edits across multiple modules before verifying the first one.
+
+---
+
+## Arena / Parallel Subagent Mode
+
+If running in Arena mode (parallel subagents):
+
+- Each subagent **receives its own copy of this file and AGENTS.md**.
+- Each subagent must **independently satisfy** `||F * reverse(F) - 1||_F < 1e-6` before reporting results.
+- Do not share mutable runtime state between subagents.
+- Treat Arena subagent results as **independent proposals**, not sequential commits. Reconcile them before any merge.
+- No subagent output becomes another subagent's unchecked input.
+
+---
+
+## End-of-Session Handoff Requirement
+
+At the end of every session, write a handoff document to the repo using the template at `docs/handoff_template.md`. Name it:
+
+```
+HANDOFF-grok43-YYYY-MM-DD.md
+```
+
+This is not optional. It is the only continuity mechanism across your stateless sessions. A session without a handoff doc is a session whose work may be silently lost or contradicted by the next session.
+
+---
+
+## Kernel Substrate / ProblemFrame Doctrine
+
+New derivation capabilities must consume `KernelFacts` / `ProblemFrame` facts where the
+substrate can represent the needed meaning (`generate/problem_frame_builder.py`).
+
+```text
+raw problem text → KernelFacts → ProblemFrame → contract-backed derivation organs
+```
+
+New raw-prose/local-regex parsing inside a derivation organ requires an explicit
+`LEGACY_EXCEPTION` note and a migration rationale. Guard:
+`tests/test_kernel_no_new_legacy_derivation_surfaces.py`.
+
+Do not add isolated benchmark organs with local prose parsers. Do not treat #829
+substrate modules as optional helpers.
+
+---
+
+## Architecture Summary
+
+Raw input becomes a closed versor field once; thought evolves through exact versor transitions and CGA recall; cognition is structured as intent, proposition graph, articulation target, deterministic realization, reviewed memory, eval/calibration replay, and traceable evidence.
+
+```text
+CognitiveTurnPipeline
+  -> tokenize / OOV policy / inject
+  -> intent classification
+  -> PropositionGraph
+  -> ArticulationTarget
+  -> deterministic realizer / articulation surface
+  -> generation walk telemetry
+  -> identity + energy telemetry
+  -> reviewed teaching capture (when correction intent appears)
+  -> deterministic trace hash
+```
+
+Key modules:
+- `core/cognition/pipeline.py` — cognitive turn spine
+- `core/cognition/result.py` — canonical turn result shape
+- `core/cognition/trace.py` — deterministic trace hashing
+- `generate/intent.py` — deterministic intent classification
+- `generate/graph_planner.py` — proposition graph and articulation target
+- `generate/realizer.py` / `generate/templates.py` — deterministic realization
+- `teaching/*` — reviewed teaching / correction lifecycle
+- `vault/store.py` — epistemic store with INV-21/22/23/24/29 guards
+- `evals/*` — deterministic eval harness
+- `calibration/*` — bounded replay-based calibration
+- `docs/runtime_contracts.md` — runtime response, memory, identity, and testing
+
+---
+
+## PR Checklist
+
+Before opening or merging, answer:
+
+```text
+What capability, performance property, or security boundary did this add/protect?
+Which invariant proves the field remains valid?
+Which CLI suite/eval proves the relevant lane?
+Did this avoid hidden normalization, stochastic fallback, approximate recall, and unreviewed mutation?
+If it touches user input, files, dynamic imports, or logs, what trust boundary was enforced?
+Was the smoke suite green before and after?
+```
+
+Prefer small, load-bearing PRs.
+
+For runtime/algebra/cognition/teaching/pack changes: run full suite before merge.
+For docs/config-only agent-governance changes: smoke is sufficient unless the PR touches CLI, tests, generated docs, or executable scripts.
+
+---
+
+## CLI Validation Lanes
+
+```bash
+core test --suite smoke -q
+core test --suite cognition -q
+core test --suite teaching -q
+core test --suite packs -q
+core test --suite runtime -q
+core test --suite algebra -q
+core test --suite full -q
+core eval cognition
+```
+
+Run the smallest relevant suite first.
+For runtime/algebra/cognition/teaching/pack changes, run full before merge.
+For docs/config-only agent-governance changes, smoke is sufficient unless the PR changes CLI, tests, generated docs, or executable scripts.

HANDOFF-gpt55-2026-06-18.md

@@ -0,0 +1,110 @@
+# HANDOFF — gpt55 — 2026-06-18
+
+## Agent and Session
+
+- **Agent:** gpt55
+- **Date:** 2026-06-18
+- **Reasoning effort used:** high
+- **Grok Build mode used:** not applicable; Codex default mode
+- **Session entry point:** Implement PR #831 brief: bind ProblemFrame relations and measure organ-contract readiness; write results to the requested handoff path.
+
+## Smoke Suite + Bootstrap Status
+
+```text
+uv run python -m core.cli test --suite smoke -q
+108 passed in 123.64s
+```
+
+The repository has no callable `core-bootstrap` skill in this session. The GPT55 checklist was completed manually: instructions, runtime contracts, recent handoff, dirty state, baseline smoke, scope, pre-edit sweep, and invariant statement.
+
+## Modules Touched
+
+| File | Change type | Summary |
+|---|---|---|
+| `generate/kernel_facts.py` | modified | Added frozen mention, binding, bound-role, and bound-relation primitives. |
+| `generate/problem_frame.py` | modified | Added bound question target and canonical frame collections. |
+| `generate/problem_frame_builder.py` | modified | Added conservative span-grounded extraction, binding, relation construction, target grounding, and centralized punctuation-safe surface matching. |
+| `generate/problem_frame_contracts.py` | created | Added pure diagnostic contract assessments and gap-based migration recommendation. |
+| `scripts/gsm8k_problem_frame_adequacy.py` | created | Added gold-independent adequacy reporting. |
+| `scripts/gsm8k_substrate_morphology.py` | modified | Replaced trigger-priority recommendations with contract-gap evidence and centralized boundary recognition. |
+| `tests/test_problem_frame_builder.py` | modified | Added mention/span, quantity/entity/unit binding, transfer relation, target, and determinism coverage. |
+| `tests/test_problem_frame_contracts.py` | created | Added missing/runnable percent contract tests. |
+| `tests/test_gsm8k_problem_frame_adequacy.py` | created | Added adequacy report smoke coverage. |
+| `tests/test_gsm8k_morphology_missing_kernel_labels.py` | modified | Added punctuation boundary and contract-gap planner expectations. |
+| `docs/analysis/problemframe-bindings-contract-readiness-2026-06-18.md` | created | Recorded model, metrics, deferral rationale, and migration conditions. |
+| `HANDOFF-gpt55-2026-06-18.md` | created | Session continuity and verification record. |
+
+## Invariants Verified
+
+| Invariant | Check performed | Result | Notes |
+|---|---|---|---|
+| `versor_condition(F) < 1e-6` | Scope trace + smoke suite | preserved | No algebra, field state, operator, or normalization path changed. |
+| versor_apply / cga_inner exactness | Import/call-site sweep | untouched | No algebra or recall imports added. |
+| Normalization boundaries respected | Diff review | pass | No normalization/unitization/repair added. |
+| No approximate recall | Diff review | pass | No vault or ranking changes. |
+| No answer admission | Train/holdout serving probes | pass | Train 30 correct / 20 refused / 0 wrong; holdout 5 / 495 / 0. |
+| No unreviewed mutation | Diff/status review | pass | Diagnostic-only; no teaching, pack, report, or sealed artifact mutation. |
+| Exact source evidence | Focused tests | pass | Mention and contract evidence uses original source spans. |
+
+## Subagent / Arena Reconciliation
+
+- Number of subagents spawned: 0
+- Each subagent independently verified versor closure: not applicable
+- Reconciliation: not applicable
+
+## Tests Run
+
+```text
+tests/test_problem_frame_builder.py: 12 passed
+tests/test_gsm8k_morphology_missing_kernel_labels.py: 8 passed
+tests/test_kernel_no_new_legacy_derivation_surfaces.py: 2 passed
+tests/test_problem_frame_contracts.py: 2 passed
+tests/test_gsm8k_problem_frame_adequacy.py: 1 passed
+core test --suite smoke -q: 108 passed
+git diff --check: pass
+```
+
+Safety probes:
+
+```text
+train_sample: correct=30 refused=20 wrong=0; wrong_ids=[]
+holdout_dev: correct=5 refused=495 wrong=0; wrong_ids=[]
+```
+
+Adequacy after implementation:
+
+```text
+train 50: entity=50 quantity_binding=46 relation=16 bound_target=42 candidates=42 runnable=1
+holdout 500: entity=494 quantity_binding=452 relation=124 bound_target=402 candidates=423 runnable=1
+```
+
+## Open Tasks / Next Session Entry Point
+
+1. Review the conservative local grammar against adequacy gap distributions; widen only with confuser tests and exact spans.
+2. Bind container and labor-rate roles before allowing their contracts to become runnable.
+3. Do not migrate `percent_partition` until runnable coverage and no-fallback organ consumption are proven beyond case 0046.
+
+## Known Hazards / Do Not Touch
+
+- `contract_runnable_count=1` in each corpus is intentionally conservative; do not replace it with trigger presence.
+- Case `gsm8k-train-sample-v1-0046` is diagnostic evidence only, not serving authorization.
+- Do not add raw-text fallback inside derivation organs or mutate `report.json`/sealed artifacts.
+
+## Architectural Decisions Made This Session
+
+- The canonical `ProblemFrame` owns mentions, bindings, relations, and target state; no parallel diagnostic graph.
+- `subgroup_partition` and `percent_of` are distinct, and readiness requires matching subgroup referents.
+- Contract assessment is a pure projection over typed frame evidence.
+- Punctuation-safe token boundary matching is centralized in the ProblemFrame builder and reused by morphology.
+
+## What Must Not Be Forgotten
+
+`contract_runnable_count`, not process-trigger presence, is the honest migration-readiness metric. Serving remains unchanged.
+
+## Skills Used This Session
+
+- core-bootstrap: unavailable; checklist performed manually
+- versor-coherence-guardian: unavailable; scope + smoke verification performed manually
+- pre-edit-sweep: unavailable; import/caller/eval/test sweep performed manually
+- claim-proposal-guardian: not applicable; no claim or proposal mutation
+- Other: none

HANDOFF-gpt55-2026-06-20.md

@@ -0,0 +1,812 @@
+# HANDOFF — GPT-5.5 — 2026-06-20
+
+## Agent and Session
+
+- **Agent:** gpt55
+- **Date:** 2026-06-20
+- **Reasoning effort used:** high
+- **Grok Build mode used:** Headless
+- **Session entry point:** implement the first PR from the semantic-substrate problem-solving master plan: close proportional-decrease contracts and make readiness obligation-sound without touching serving or derivation organs
+
+---
+
+## Smoke Suite + Bootstrap Status
+
+```text
+Read before editing:
+- GPT55.md
+- AGENTS.md
+- docs/runtime_contracts.md
+- HANDOFF-gpt55-2026-06-20.md (prior planning handoff, now superseded by this file)
+- ADR-0223 audit/session pack and targeted ProblemFrame files/tests
+
+core test --suite smoke -q
+zsh: command not found: core
+
+uv run python -m core.cli test --suite smoke -q
+108 passed in 121.54s (0:02:01)
+```
+
+`core-bootstrap` skill was not available in this session; bootstrap was completed manually.
+
+---
+
+## Modules Touched
+
+| File | Change type | Summary |
+|---|---|---|
+| `generate/problem_frame.py` | modified | extended `BoundQuestionTarget` with typed operator/state/direction validation so delta-decrease targets are structurally representable |
+| `generate/problem_frame_builder.py` | modified | added narrow `decrease_to_fraction` binding, copular half-partition strengthening, canonical entity grounding, and richer bound target detection |
+| `generate/problem_frame_contracts.py` | modified | added `assess_fraction_decrease`; tightened `percent_partition` to require forward aggregate topology, original whole provenance, and explicit blocker codes |
+| `scripts/gsm8k_problem_frame_adequacy.py` | modified | surfaced blocker sets and blocker-combination aggregates by organ |
+| `scripts/gsm8k_substrate_morphology.py` | modified | surfaced per-organ blockers and kept non-runnable decrease cases on a substrate contract-gap recommendation instead of a serving-organ recommendation |
+| `tests/test_problem_frame_builder.py` | modified | added proportional-decrease binding/span tests |
+| `tests/test_problem_frame_contracts.py` | replaced | added positive/negative obligation tests for fraction decrease and percent partition |
+| `tests/test_problem_frame_skeleton.py` | modified | added `BoundQuestionTarget` validation coverage |
+| `tests/test_gsm8k_problem_frame_adequacy.py` | modified | added blocker-by-organ/blocker-combination adequacy coverage |
+| `tests/test_gsm8k_morphology_missing_kernel_labels.py` | modified | added morphology contract-gap recommendation coverage |
+
+---
+
+## Invariants Verified (Versor Coherence Guardian + Core)
+
+| Invariant | Check performed | Result | Notes |
+|---|---|---|---|
+| `||F * reverse(F) - 1||_F < 1e-6` (core closure) | Scope review + smoke suite rerun | Preserved | No algebra/field/runtime field-op code touched |
+| versor_apply / cga_inner exactness | Manual sweep of touched files/imports | Preserved | No recall/ranking/operator-path changes |
+| Normalization boundaries respected | Pre-edit sweep + patch review | Preserved | No normalization added outside approved construction/IR boundary |
+| No approximate recall (ANN/HNSW/cosine) | Import/call-site sweep on touched path | Preserved | Diagnostic path remains exact/deterministic |
+| Claim status transitions via review gates only | Scope review | Preserved | Teaching/review/proposal paths untouched |
+| Safety/identity pack immutability | Scope review | Preserved | No pack, manifest, policy, identity, or recall edits |
+| INV-21 / INV-24 / INV-29 (Vault & epistemic) | Scope review + serving parity | Preserved | No memory mutation or serving-path widening |
+| Wrong-zero serving | Direct runner `build_report()` checks | Preserved | Train `30/20/0`, holdout `5/495/0`, `wrong_ids == []` |
+| Readiness truthfulness | Targeted adequacy reruns | Improved | Train runnable `1 -> 2`; holdout runnable `1 -> 0`; `0393` now blocked |
+
+---
+
+## Subagent / Arena Reconciliation (if applicable)
+
+- Number of subagents spawned: 0
+- Each subagent independently verified versor closure? (Yes/No): N/A
+- How were results reconciled before merge? N/A
+
+---
+
+## Tests Run
+
+```bash
+# exit 0
+uv run python -m pytest -q \
+  tests/test_problem_frame_builder.py \
+  tests/test_problem_frame_contracts.py \
+  tests/test_gsm8k_problem_frame_adequacy.py \
+  tests/test_gsm8k_morphology_missing_kernel_labels.py \
+  tests/test_kernel_no_new_legacy_derivation_surfaces.py
+
+# exit 0
+uv run python -m pytest -q \
+  tests/test_problem_frame_builder.py \
+  tests/test_problem_frame_contracts.py \
+  tests/test_problem_frame_skeleton.py \
+  tests/test_gsm8k_problem_frame_adequacy.py \
+  tests/test_gsm8k_morphology_missing_kernel_labels.py \
+  tests/test_kernel_no_new_legacy_derivation_surfaces.py
+
+# exit 0
+uv run python -m core.cli test --suite smoke -q
+
+# exit 0
+uv run python -m scripts.gsm8k_problem_frame_adequacy \
+  --cases evals/gsm8k_math/train_sample/v1/cases.jsonl
+
+# exit 0
+uv run python -m scripts.gsm8k_problem_frame_adequacy \
+  --cases evals/gsm8k_math/holdout_dev/v1/cases.jsonl
+
+# exit 0
+uv run python - <<'PY'
+from evals.gsm8k_math.train_sample.v1.runner import _CASES_PATH, _load_cases, build_report
+r = build_report(_load_cases(_CASES_PATH))
+print(r["counts"])
+print([x["case_id"] for x in r["per_case"] if x["verdict"] == "wrong"])
+PY
+
+# exit 0
+uv run python - <<'PY'
+from evals.gsm8k_math.holdout_dev.v1.runner import build_report
+r = build_report()
+print(r["counts"])
+print([x["case_id"] for x in r["per_case"] if x["verdict"] == "wrong"])
+PY
+
+# exit 0
+git diff --check
+git status --short
+git diff --name-only origin/main...
+```
+
+Key outcomes:
+
+- train adequacy `contract_runnable_count == 2`
+- runnable train cases are `gsm8k-train-sample-v1-0005` and `gsm8k-train-sample-v1-0046`
+- holdout adequacy `contract_runnable_count == 0`
+- `gsm8k-holdout-dev-v1-0393` now blocks with inverse/original-whole topology reasons
+- serving unchanged: train `{'correct': 30, 'wrong': 0, 'refused': 20}`, holdout `{'correct': 5, 'wrong': 0, 'refused': 495}`
+
+---
+
+## Open Tasks / Next Session Entry Point
+
+1. Inspect whether any non-0046 percent-partition candidates are now worth a narrower contract split instead of accumulating blocker lists on one forward organ.
+2. Decide whether the next substrate PR should introduce explicit typed gap records (`PF-*` codes as first-class data) or keep using stable blocker strings until the construction catalog lands.
+3. If a future PR starts typed adapter work, consume `fraction_decrease` only from `ProblemFrame` facts and do not reparse raw text inside any adapter or derivation organ.
+
+---
+
+## Known Hazards / Do Not Touch
+
+- Do not edit `generate/derivation/*` or `generate/math_candidate_graph.py` to “finish” this slice. This PR is diagnostic-only and already proved serving parity.
+- The new builder logic is intentionally narrow. Do not generalize `decrease_to_fraction` into `decrease by`, percent change, or affine fraction comparison without a separate contract/confuser pack.
+- `percent_partition` is now deliberately stricter. A runnable-count drop elsewhere is acceptable if it removes false readiness; do not loosen obligations to make the number larger.
+- `HANDOFF-gpt55-2026-06-20.md` was replaced; do not rely on the earlier planning-only contents.
+
+---
+
+## Architectural Decisions Made This Session
+
+- `BoundQuestionTarget` now carries typed operator/state/direction, with validation that blocks illegal delta/final combinations at construction time.
+- `decrease_to_fraction` is represented as a span-grounded `BoundRelation` in `ProblemFrame`, not as a derivation-organ shortcut.
+- Readiness is keyed to exact grounded IDs from the frame. Repeated entity mentions are canonicalized at relation construction so contracts can match by identity rather than lowercase text equality.
+- `percent_partition` requires a forward aggregate target and an original whole bound before subgroup events. Final-state/inverse prompts are blocked rather than treated as forward partition.
+- Adequacy and morphology reports now expose blocker combinations by organ, making false readiness auditable without touching serving.
+
+---
+
+## What Must Not Be Forgotten
+
+The substantive result of this session is not just “0005 runnable.” It is that `runnable` now means obligation-closed from `ProblemFrame` evidence alone: `0005` closes through `decrease_to_fraction`, `0046` closes only under explicit complementary-subgroup topology, and `0393` is blocked because its target is inverse/original-whole rather than a forward aggregate.
+
+**Prompt Library Reference**: See `docs/core-rd-base-prompts.md` (especially sections #7 Standing Loop Axiom Check, #8 PR Merge-Readiness Audit, and #9 Grok Build Implementation Session). Use them as standing prefixes.
+
+---
+
+## Skills Used This Session
+
+- core-bootstrap: not available
+- versor-coherence-guardian: not available
+- pre-edit-sweep: manual import/call-site sweep completed
+- claim-proposal-guardian: not needed
+- Other: none
+
+---
+
+## Authorization Addendum — `binding.quantity_entity` foundational slice
+
+### Agent and Session
+
+- **Agent:** gpt55
+- **Date:** 2026-06-20
+- **Reasoning effort used:** high
+- **Grok Build mode used:** Headless
+- **Session entry point:** authorize, but do not implement, the first bounded
+  diagnostic proposal-first slice for `binding.quantity_entity`
+- **Branch:** `docs/kernel-authorize-quantity-entity-slice`
+- **Base:** `origin/main` at `a266324e` (merged PR #844)
+
+### Bootstrap and base proof
+
+The session read `GPT55.md`, `AGENTS.md`, `docs/runtime_contracts.md`, and this
+current handoff before editing. The branch was created in a fresh worktree
+directly from fetched `origin/main`. `HEAD` and `origin/main` both resolved to
+`a266324eea5adf739b7d4e509a994c5425334b65`; the worktree was clean. The base
+contained the #844 merge, `_PROPOSAL_FIRST_FAMILIES`, and the
+`make_proposal()` rejection fence for both migrated families.
+
+```text
+uv run python -m core.cli test --suite smoke -q
+108 passed in 126.15s (0:02:06)
+```
+
+### Modules touched
+
+| File | Change type | Summary |
+|---|---|---|
+| `docs/sessions/quantity-entity-foundational-slice-authorization-2026-06-20.md` | new | Defines the sole bounded future implementation authority, proposal-first seam, roles/evidence obligations, closure/refusal conditions, confuser suite, acceptance gates, validation, and next-PR brief. |
+| `docs/specs/foundational-families/quantity-entity-binding.md` | modified | Replaces the unconditional implementation prohibition with a narrow link to the controlling authorization while retaining non-serving status. |
+| `HANDOFF-gpt55-2026-06-20.md` | modified | Adds this continuity record. |
+
+### Invariants verified
+
+- **Field closure:** Preserved by scope. No algebra, field, propagation,
+  normalization, Vault, or runtime field-state path was modified.
+- **Proposal-first authority:** The authorization requires proposals to begin
+  with `status="proposed"`; exact bindings ground; a separate
+  `ContractAssessment` alone reports diagnostic runnable/refused.
+- **#844 fence:** `make_proposal()` is explicitly forbidden for the new family;
+  future dispatch requires a pre-existing proposal. Existing #841/#842 families
+  and their dispatch remain out of scope.
+- **Diagnostic-only / no serving:** The authorized future proposal must retain
+  `diagnostic_only=True` and `serving_allowed=False`; this PR changes no code or
+  serving path.
+- **Open-world truthfulness:** Ambiguity and absent evidence require refusal.
+  Missing unit evidence cannot be converted into a count claim, and no
+  `determine(answer=False)` path is authorized.
+- **Exact evidence:** Closure requires exact source-backed quantity, entity,
+  binding, and optional-unit spans equal to original text slices.
+- **No broad parser / universal IR:** The future slice is bounded to existing
+  local `ProblemFrame`, `GroundedScalar`, `GroundedMention`, `GroundedUnit`, and
+  `MentionBinding` evidence.
+- **Wrong-zero:** No eval or serving files changed. The future implementation
+  brief requires train and holdout `wrong_ids == []`.
+
+### Subagent / Arena reconciliation
+
+- Number of subagents spawned: 0
+- Each subagent independently verified versor closure: N/A
+- Reconciliation: N/A
+
+### Tests run
+
+```bash
+# exit 0 — 108 passed
+uv run python -m core.cli test --suite smoke -q
+
+# exit 0 — 28 passed
+uv run python -m pytest -q \
+  tests/test_foundational_families.py \
+  tests/test_construction_affordances.py \
+  tests/test_construction_proposal_seam.py
+
+# exit 0
+git diff --check
+```
+
+### Open tasks / next session entry point
+
+1. Merge this authorization PR before beginning implementation.
+2. For the next PR, use the copy-paste brief at the end of the authorization
+   document and prove the merged authorization is present on fresh
+   `origin/main`.
+3. Do not implement `state_change.transition`; it requires separate authority.
+
+### Known hazards / do not touch
+
+- The authorization does not permit generic entity extraction, broad noun
+  parsing, a universal IR, event semantics, answer production, or serving.
+- `quantity_kind` must be positively grounded. Unit absence alone is not proof
+  of a count construction.
+- Local quantity/entity grounding inside a state-change sentence does not
+  authorize transition recognition.
+- Do not change derivation organs, `generate/math_candidate_graph.py`, eval or
+  sealed artifacts, reports, packs, policy, identity, recall, Vault, field,
+  algebra, or serving runtime under this authorization.
+
+### Architectural decision
+
+The first family is a provenance-preserving local bipartite binding with a
+conjugate assessment, not an entity parser. Proposal and assessment remain
+separate authorities: proposal carries a hypothesis forward; assessment
+opposes it when topology or evidence is not uniquely closed.
+
+### What must not be forgotten
+
+This authorization is effective only after merge and only for
+`binding.quantity_entity`. It authorizes one diagnostic proposal-first slice;
+it does not authorize `state_change.transition`, serving, general entity
+extraction, or broad parsing.
+
+**Prompt Library Reference**: See `docs/core-rd-base-prompts.md` (especially
+sections #7 Standing Loop Axiom Check, #8 PR Merge-Readiness Audit, and #9 Grok
+Build Implementation Session). Use them as standing prefixes.
+
+### Skills used
+
+- core-bootstrap: unavailable; checklist completed manually
+- versor-coherence-guardian: unavailable; closure preserved by docs-only scope
+  and smoke validation
+- pre-edit-sweep: completed manually over ADRs, specs, typed substrate,
+  proposal/assessment seams, and focused tests
+- claim-proposal-guardian: unavailable; proposal authority and #844 fence
+  verified manually and with focused tests
+- Other: none
+
+---
+
+## PR #841 Addendum — feat(kernel): route proportional-decrease through proposal-first seam
+
+### Agent and Session
+
+- **Agent:** gpt55
+- **Date:** 2026-06-20
+- **Reasoning effort used:** high
+- **Grok Build mode used:** Headless
+- **Session entry point:** Migrate only `proportional_change.decrease_to_fraction` from assessment-backed proposal synthesis to the ADR-0223/0224 proposal-first construction seam without changing serving or derivation.
+- **Branch:** `feat/kernel-proportional-decrease-proposal-first`
+- **Base:** `origin/main` at `168c9f26ac3deb8037d4eb7bca77c33dc9d5ff62`
+
+### Smoke Suite + Bootstrap Status
+
+```text
+uv run python -m core.cli test --suite smoke -q
+108 passed in 123.41s (baseline)
+108 passed in 123.05s (post-edit)
+```
+
+The GPT55.md startup checklist was completed manually. The Codex worktree was clean and `HEAD == origin/main` before edits. `/Users/kaizenpro/Projects/core` was not modified, stashed, reset, cleaned, or reconciled.
+
+### Modules Touched
+
+| File | Change type | Summary |
+|---|---|---|
+| `generate/construction_affordances.py` | modified | Added a pre-assessment catalog proposal factory; proposals now carry immutable role obligations and enforce diagnostic-only / serving-disallowed posture. Retained the assessment-backed adapter only for unmigrated catalog paths. |
+| `generate/problem_frame.py` | modified | Let `ProblemFrameBuilder` accumulate proposals before relation binding. |
+| `generate/problem_frame_builder.py` | modified | Produces the proportional-decrease proposal from the exact existing surface chunk before mention/relation binding and assessment; preserves assessment-backed traces for other families. |
+| `generate/problem_frame_contracts.py` | modified | Routes fraction-decrease assessment from proposal metadata read-only while leaving `assess_fraction_decrease` obligations unchanged. |
+| `tests/test_construction_affordances.py` | modified | Covers the pre-assessment factory, catalog role obligations, and serving posture. |
+| `tests/test_proportional_decrease_proposal.py` | modified | Proves proposal-before-assessment order, exact span grounding, proposal-driven dispatch, unchanged contract refusal, and confuser blocking. |
+| `HANDOFF-gpt55-2026-06-20.md` | modified | Added this PR #841 continuity record. |
+
+### Invariants Verified
+
+- **Field closure:** Preserved by construction. No algebra, field, propagation, normalization, vault, or runtime field-state code changed.
+- **Exact recall:** Preserved. No recall path, cosine, ANN, HNSW, or stochastic retrieval was added.
+- **Proposal/binding/contract separation:** The proposal begins as `status="proposed"`; only `ContractAssessment` determines runnable/refused state from bound relations and question-target evidence.
+- **Catalog and serving gates:** Proposal role obligations and posture come from the existing catalog; `diagnostic_only=True` and `serving_allowed=False` are enforced on the proposal type.
+- **Controlled migration:** Only proportional decrease is proposal-first. Percent partition retains its existing assessment-backed trace; no foundational family gained implementation authorization.
+- **No universal IR / no live-CGA claim:** The patch reuses `ConstructionProposal`, `ProblemFrame`, `BoundRelation`, and `ContractAssessment`; it adds no new carrier and makes no substrate-retrieval claim.
+- **Serving parity:** Train remained `30 correct / 20 refused / 0 wrong`; holdout remained `5 correct / 495 refused / 0 wrong`; both wrong-id lists were empty.
+- **Diagnostic parity:** Train remained 2 runnable contracts (`0005`, `0046`); holdout remained 0 runnable contracts.
+
+### Subagent / Arena Reconciliation
+
+- Number of subagents spawned: 0
+- Each subagent independently verified versor closure: N/A
+- Reconciliation: N/A
+
+### Tests Run
+
+```bash
+# exit 0 — 55 passed
+uv run python -m pytest -q \
+  tests/test_construction_affordances.py \
+  tests/test_foundational_families.py \
+  tests/test_problem_frame_builder.py \
+  tests/test_problem_frame_contracts.py \
+  tests/test_proportional_decrease_proposal.py \
+  tests/test_kernel_no_new_legacy_derivation_surfaces.py
+
+# exit 0 — 108 passed
+uv run python -m core.cli test --suite smoke -q
+
+# exit 0 — serving parity
+# train: {'correct': 30, 'wrong': 0, 'refused': 20}; wrong_ids: []
+# holdout: {'correct': 5, 'wrong': 0, 'refused': 495}; wrong_ids: []
+
+# exit 0 — diagnostic parity
+# train contract_runnable_count: 2; ids: 0005, 0046
+# holdout contract_runnable_count: 0
+
+# exit 0
+uv run python -m compileall -q \
+  generate/construction_affordances.py \
+  generate/problem_frame.py \
+  generate/problem_frame_builder.py \
+  generate/problem_frame_contracts.py
+
+# exit 0
+git diff --check
+```
+
+### Open Tasks / Next Session Entry Point
+
+1. Review the six implementation/test files and publish PR #841 with the brief's required body sections.
+2. Keep percent partition assessment-backed until a separately authorized proposal-first migration.
+
+### Known Hazards / Do Not Touch
+
+- Do not map `ConstructionProposal.status` to fraction assessment output again; that recreates the assessment-first inversion.
+- Do not generalize the reused `decrease to <fraction> of` recognizer into generic state change, acquisition, or transaction behavior.
+- Do not connect foundational-family registry metadata to runtime authorization or serving.
+- Do not edit derivation, candidate graph, eval cases, reports, packs, policy, identity, recall, field, or algebra for this slice.
+
+### Architectural Decision
+
+The proposal is the construction hypothesis, not a cached verdict. It carries the catalog's obligations and exact motivating chunk. `BoundRelation` grounds those obligations, and the existing `ContractAssessment` remains the corrective/conjugate stage that closes or refuses the hypothesis. Other families are deliberately left on the legacy assessment-backed adapter to keep this migration singular.
+
+### What Must Not Be Forgotten
+
+PR #841 proves the ordering `surface chunk → proposed construction → span-grounded relation → ContractAssessment` for proportional decrease only. A positive proposal is not serving authorization, is not a runnable verdict, and is not evidence that general CGA/substrate retrieval is live.
+
+### Skills Used
+
+- core-bootstrap: unavailable; checklist completed manually
+- versor-coherence-guardian: unavailable; closure preserved by scope and smoke validation
+- pre-edit-sweep: completed manually across imports, callers, tests, evals, calibration, and scripts
+- claim-proposal-guardian: unavailable; proposal posture and assessment separation verified directly
+- Other: none
+
+---
+
+## PR #836 Addendum — feat(kernel): introduce construction-affordance catalog skeleton
+
+### Agent and Session
+
+- **Agent:** Antigravity (Gemini 3.5 Flash)
+- **Date:** 2026-06-20
+- **Task:** Implement `feat(kernel): introduce construction-affordance catalog skeleton` (PR #836)
+- **Branch:** `feat/kernel-construction-affordance-catalog`
+
+### Modules Touched / Created
+
+| File | Change type | Summary |
+|---|---|---|
+| `generate/construction_affordances.py` | NEW | Frozen, typed structures (`RoleObligation`, `ConstructionHazard`, `ConstructionSignature`, `ConstructionFamily`, `ConstructionContract`, `ConstructionProposal`) and initial catalog registry with two diagnostic families (`proportional_change.decrease_to_fraction` and `partition.percent_partition`). |
+| `generate/problem_frame_contracts.py` | modified | Added `_CONTRACT_REGISTRY` mapping candidate organs to ConstructionContract; updated module docstring and refactored `assess_contracts()` to reference registry metadata. |
+| `generate/problem_frame_builder.py` | modified | Added detailed docstring to `_bound_question_target` describing the priority cascade. |
+| `tests/test_problem_frame_contracts.py` | modified | Added 7 new test cases verifying scale boundary rejection (0, 1, >1), multi-base rejection, state entity continuity, unit continuity, and percent-partition blocker specificity. |
+| `tests/test_construction_affordances.py` | NEW | Added 5 tests verifying catalog constraints (`serving_allowed=False`, `diagnostic_only=True`), deterministic order, accessor lookups, and `make_proposal()` status mapping. |
+| `docs/analysis/pr836-lookback-2026-06-20.md` | NEW | Lookback documenting design choices (diagnostic-only registry, separation of registry and dispatch, priority cascade, test gaps closed). |
+
+### Invariants Verified
+
+- **Versor condition**: No geometric algebra files were touched; versor invariants remain fully satisfied.
+- **Serving parity**: Verified by running evaluation scripts:
+  - Train: `30 correct / 20 refused / 0 wrong` (wrong_ids: `[]`)
+  - Holdout: `5 correct / 495 refused / 0 wrong` (wrong_ids: `[]`)
+- **Adequacy**:
+  - Train runnable: `2` (v1-0005 and v1-0046)
+  - Holdout runnable: `0`
+
+### Tests Run
+
+- **Targeted suite**: `tests/test_problem_frame_builder.py`, `tests/test_problem_frame_contracts.py`, `tests/test_construction_affordances.py`, `tests/test_gsm8k_problem_frame_adequacy.py`, `tests/test_gsm8k_morphology_missing_kernel_labels.py` -> **46 passed** in `0.48s`.
+- **Smoke suite**: `core.cli test --suite smoke -q` -> **108 passed** in `129.00s`.
+
+
+---
+
+## PR #837 Addendum — feat(kernel): route proportional-decrease through construction proposals
+
+### Agent and Session
+
+- **Agent:** Antigravity (Gemini 3.5 Flash)
+- **Date:** 2026-06-20
+- **Task:** Implement `feat(kernel): route proportional-decrease through construction proposals` (PR #837)
+- **Branch:** `feat/kernel-decrease-construction-proposal-trace`
+
+### Modules Touched / Created
+
+| File | Change type | Summary |
+|---|---|---|
+| `generate/problem_frame.py` | modified | Added `proposals` field (`tuple[ConstructionProposal, ...]`) to the `ProblemFrame` dataclass, importing `ConstructionProposal` under `TYPE_CHECKING`. |
+| `generate/problem_frame_builder.py` | modified | Updated `build_problem_frame` to perform a two-pass assembly: running contract assessments on the initial frame, mapping them to proposals using `make_proposal`, and returning the frame with `proposals` attached. |
+| `generate/problem_frame_contracts.py` | modified | Added `get_contract_family_id(candidate_organ: str) -> str | None` to publicly map candidate organs to catalog family IDs without exposing the private contract registry. |
+| `tests/test_proportional_decrease_proposal.py` | NEW | Added 6 new test cases verifying proposal trace existence, evidence spans, catalog backing, diagnostic-only constraints, blocked final-value behavior, and confuser exclusion. |
+| `docs/analysis/pr837-lookback-2026-06-20.md` | NEW | Lookback documenting PR #837 design rationale, implementation details, and verification results. |
+
+### Invariants Verified
+
+- **Versor condition**: No geometric algebra files were touched; versor invariants remain fully satisfied.
+- **Serving parity**:
+  - Train: `30 correct / 20 refused / 0 wrong` (wrong_ids: `[]`)
+  - Holdout: `5 correct / 495 refused / 0 wrong` (wrong_ids: `[]`)
+- **Adequacy**:
+  - Train runnable: `2` (v1-0005 and v1-0046)
+  - Holdout runnable: `0`
+
+### Tests Run
+
+- **Targeted suite**: `tests/test_proportional_decrease_proposal.py`, `tests/test_construction_affordances.py`, `tests/test_problem_frame_builder.py`, `tests/test_problem_frame_contracts.py`, `tests/test_gsm8k_problem_frame_adequacy.py`, `tests/test_gsm8k_morphology_missing_kernel_labels.py`, `tests/test_kernel_no_new_legacy_derivation_surfaces.py` -> **54 passed** in `0.66s`.
+- **Smoke suite**: `core.cli test --suite smoke -q` -> Running in background.
+
+
+---
+
+## PR #839 Addendum — docs(substrate): add foundational family specification appendices
+
+### Agent and Session
+
+- **Agent:** Antigravity (Gemini 3.5 Flash)
+- **Date:** 2026-06-20
+- **Task:** Create the foundational family specification appendix structure required by ADR-0224
+- **Branch:** `docs/foundational-family-spec-appendices`
+
+### Modules Touched / Created
+
+| File | Change type | Summary |
+|---|---|---|
+| `docs/specs/foundational-families/README.md` | NEW | README file explaining post-ADR-0224 gating rules, extension of ADR-0223's closeness/bindings/contracts rule, and diagnostic role of benchmarks. |
+| `docs/specs/foundational-families/TEMPLATE.md` | NEW | Mandatory template section structure for foundational family specifications. |
+| `docs/specs/foundational-families/quantity-entity-binding.md` | NEW | Constitutional specification for the quantity-entity binding family, featuring cross-domain use cases, required/optional roles, hazards, and refusal conditions. |
+| `docs/specs/foundational-families/state-change.md` | NEW | Constitutional specification for the state-change family, featuring cross-domain use cases, required/optional roles, hazards, and refusal conditions. |
+| `docs/analysis/pr839-lookback-2026-06-20.md` | NEW | Lookback documenting design choices, verification details, and alignment with ADR-0224. |
+| `HANDOFF-gpt55-2026-06-20.md` | modified | Updated with this PR #839 addendum. |
+
+### Invariants Verified
+
+- **Versor condition**: No geometric algebra files were touched; versor invariants remain fully satisfied.
+- **Docs-Only Scope**: Verified that all changes are purely documentation additions or comments, with no runtime code or test suite modifications.
+
+---
+
+## PR #840 Addendum — feat(kernel): add foundational family registry schema
+
+### Agent and Session
+
+- **Agent:** gpt55
+- **Date:** 2026-06-20
+- **Reasoning effort used:** medium
+- **Grok Build mode used:** Headless
+- **Session entry point:** Implement the typed, read-only foundational-family registry schema for the two #839 specifications without adding recognition, assessment, routing, solving, or serving behavior.
+- **Branch:** `feat/kernel-foundational-family-registry-schema`
+- **Base:** `origin/main` at `5cd377b1b8169826ea2406a93136b7615c616286`
+
+### Smoke Suite + Bootstrap Status
+
+```text
+uv run python -m core.cli test --suite smoke -q
+108 passed in 123.94s (baseline)
+108 passed in 131.98s (post-edit)
+```
+
+`core-bootstrap` was not available as a skill; the GPT55.md checklist was completed manually. The acknowledged dirty/diverged `/Users/kaizenpro/Projects/core` main worktree was not modified, stashed, reset, cleaned, or reconciled.
+
+### Modules Touched
+
+| File | Change type | Summary |
+|---|---|---|
+| `generate/foundational_families.py` | new | Frozen specification/evidence records, two manually mirrored unauthorized family specs, immutable indices, and public accessors. |
+| `tests/test_foundational_families.py` | new | Public-API invariant tests for exact registry membership/order, uniqueness, immutability, required fields, cross-domain evidence, authorization gates, and absence of file/Markdown loading. |
+| `HANDOFF-gpt55-2026-06-20.md` | modified | Added this PR #840 continuity record. |
+
+### Invariants Verified
+
+- **Field closure:** Preserved by construction. No algebra, field, propagation, vault, normalization, or runtime field-state path was imported or modified.
+- **Exact recall:** Preserved. No CGA lookup, cosine, ANN, HNSW, or memory path was added.
+- **Serving and implementation gates:** Both families explicitly carry `serving_allowed=False` and `implementation_authorized=False`; tests enforce both gates.
+- **No behavior slice:** The module is unreferenced by runtime code and provides descriptive immutable metadata only. No parser, recognizer, adapter, `ContractAssessment`, routing, derivation, eval, report, or serving behavior was added.
+- **No live-substrate claim:** Module and current-state text explicitly state that general substrate/CGA retrieval is not live for these families.
+- **No universal IR:** The schema mirrors only ADR-0224/#839 specification fields and contains only the two authorized registry entries.
+- **Determinism:** Registry iteration is an explicit immutable tuple; family IDs and primary relation types are unique and tested.
+
+### Subagent / Arena Reconciliation
+
+- Number of subagents spawned: 0
+- Each subagent independently verified versor closure: N/A
+- Reconciliation: N/A
+
+### Tests Run
+
+```bash
+# exit 0 — 13 passed
+uv run python -m pytest -q \
+  tests/test_foundational_families.py \
+  tests/test_construction_affordances.py
+
+# exit 0 — 108 passed
+uv run python -m core.cli test --suite smoke -q
+
+# exit 0
+python3 -m compileall -q \
+  generate/foundational_families.py \
+  tests/test_foundational_families.py
+
+# exit 0
+git diff --check
+```
+
+### Open Tasks / Next Session Entry Point
+
+1. Review and publish PR #840 with the required body sections from the implementation brief.
+2. Do not connect this registry to `ProblemFrame`, `ContractAssessment`, proposal routing, recognition, adapters, or serving without a separately authorized behavior PR.
+
+### Known Hazards / Do Not Touch
+
+- The two #839 specifications are gating artifacts, not implementation authorization.
+- Do not parse `docs/specs/foundational-families/*.md` at runtime.
+- Do not add acquisition, transaction, another family, or a universal family IR in this slice.
+- The acknowledged local-only state under `/Users/kaizenpro/Projects/core` remains outside this PR and must not be altered.
+
+### Architectural Decision
+
+The foundational registry remains separate from `ConstructionFamily`. The latter describes live diagnostic construction proposals; this schema mirrors constitutional family gates. Combining them would falsely couple specification completeness to executable assessment machinery and blur current versus target state.
+
+### What Must Not Be Forgotten
+
+PR #840 makes the family-spec gate structurally inspectable; it authorizes nothing. Both entries remain non-serving and non-implementable until a separate evidence-backed PR is approved.
+
+### Skills Used
+
+- core-bootstrap: unavailable; checklist completed manually
+- versor-coherence-guardian: unavailable; closure preserved by scope and smoke validation
+- pre-edit-sweep: completed manually across imports/call sites in `generate/`, `tests/`, `evals/`, and `calibration/`
+- claim-proposal-guardian: not needed; no claim or proposal mutation path touched
+- Other: none
+
+---
+
+## PR #842 Addendum — feat(kernel): route percent-partition through proposal-first seam
+
+### Agent and Session
+
+- **Agent:** gpt55
+- **Date:** 2026-06-20
+- **Reasoning effort used:** high
+- **Grok Build mode used:** Headless
+- **Session entry point:** migrate only `partition.percent_partition` from process-frame-triggered assessment dispatch to the ADR-0223/0224 proposal-first construction seam, without changing serving or derivation organs
+- **Branch:** `feat/kernel-percent-partition-proposal-first`
+- **Base:** `origin/main` at `955fec3b` (merged PR #841)
+
+### Smoke Suite + Bootstrap Status
+
+```text
+uv run python -m core.cli test --suite smoke -q
+108 passed, 1 warning in 128.03s (0:02:08)
+```
+
+The warning reports an existing `engine_state` checkpoint revision mismatch (`4bab1638` versus `955fec3b`); no engine-state or runtime file was modified. `core-bootstrap` was unavailable as a skill, so the `GPT55.md` checklist was completed manually: `GPT55.md`, `AGENTS.md`, `docs/runtime_contracts.md`, and the current handoff were read; baseline state and branch ancestry were inspected; the pre-edit import/call-site/test sweep was completed.
+
+### Modules Touched
+
+| File | Change type | Summary |
+|---|---|---|
+| `generate/problem_frame_builder.py` | modified | Added a narrow pre-assessment percent-partition proposal factory requiring an existing partition/consumption process cue plus explicit `N% of` evidence; attaches the proposal before mention/relation binding and contract assessment. |
+| `generate/problem_frame_contracts.py` | modified | Replaced percent-partition process-frame-name dispatch with catalog-family proposal-gated dispatch; left `assess_percent_partition()` structurally unchanged. |
+| `tests/test_percent_partition_proposal.py` | new | Proves proposal posture/obligations/order, exact evidence spans, legacy-adapter exclusion, assessment authority, no-proposal dispatch refusal, and percent-change confuser refusal. |
+| `HANDOFF-gpt55-2026-06-20.md` | modified | Added this PR #842 continuity record. |
+
+### Invariants Verified
+
+- **Field closure:** Preserved by scope and smoke. No algebra, field, propagation, normalization, vault, or runtime field-state path was touched; no field operator was added.
+- **Proposal/grounding/contract duality:** `propose_construction()` creates only `status="proposed"`; exact bound relations remain grounding evidence; `assess_percent_partition()` remains the only runnable/refused authority.
+- **Diagnostic-only / serving forbidden:** Catalog-derived proposal retains `diagnostic_only=True` and `serving_allowed=False`; serving train/holdout results are byte-equivalent in outcome counts with `wrong_ids == []`.
+- **No legacy adapter for migrated families:** Focused regression makes `make_proposal()` fail if percent partition reaches it; the supported path remains green.
+- **No broad parser or state-change runtime:** Proposal recognition is limited to the existing partition/consumption process cue plus explicit `N% of` surface evidence. The percent-change confuser can be proposed as a hypothesis but is contract-refused.
+- **Exact recall / epistemic / identity:** No recall, CGA ranking, ANN/cosine, teaching mutation, pack, policy, identity, or epistemic transition path was touched.
+- **Diagnostic readiness:** Train runnable count remains `2`; holdout runnable count remains `0`.
+
+### Subagent / Arena Reconciliation
+
+- Number of subagents spawned: 0
+- Each subagent independently verified versor closure: N/A
+- Reconciliation: N/A
+
+### Tests Run
+
+```bash
+# exit 0 — 54 passed
+uv run python -m pytest -q \
+  tests/test_construction_affordances.py \
+  tests/test_problem_frame_builder.py \
+  tests/test_problem_frame_contracts.py \
+  tests/test_proportional_decrease_proposal.py \
+  tests/test_percent_partition_proposal.py \
+  tests/test_kernel_no_new_legacy_derivation_surfaces.py
+
+# exit 0 — 108 passed, one pre-existing state-revision warning
+uv run python -m core.cli test --suite smoke -q
+
+# exit 0
+uv run ruff check \
+  generate/problem_frame_builder.py \
+  generate/problem_frame_contracts.py \
+  tests/test_percent_partition_proposal.py
+
+# exit 0
+uv run python -m compileall -q \
+  generate/construction_affordances.py \
+  generate/problem_frame.py \
+  generate/problem_frame_builder.py \
+  generate/problem_frame_contracts.py
+
+# exit 0 — train serving parity
+# {'correct': 30, 'wrong': 0, 'refused': 20}; wrong_ids == []
+
+# exit 0 — holdout serving parity
+# {'correct': 5, 'wrong': 0, 'refused': 495}; wrong_ids == []
+
+# exit 0 — diagnostic readiness
+# train contract_runnable_count == 2
+# holdout contract_runnable_count == 0
+
+# exit 0
+git diff --check
+```
+
+### Open Tasks / Next Session Entry Point
+
+1. Review the four changed files, commit intentionally, push `feat/kernel-percent-partition-proposal-first`, and open PR #842 using the brief's required body sections.
+2. Leave `make_proposal()` cleanup for a separate small follow-up; both catalog families now bypass it, but deletion was intentionally not mixed into this migration.
+
+### Known Hazards / Do Not Touch
+
+- Do not broaden `_PERCENT_OF_PROPOSAL_RE` into general percentage or state-change recognition. Proposal closeness is intentionally narrower than contract authority.
+- Do not weaken `assess_percent_partition()` obligations to recover diagnostic counts; its whole/part/scale topology and forward-target checks remain load-bearing.
+- Do not connect this diagnostic proposal to serving, derivation organs, `math_candidate_graph`, foundational-family implementation, pack mutation, or runtime admission.
+
+### Architectural Decision
+
+Percent partition now follows the same ordering proven by PR #841: `surface/process cue → proposed ConstructionProposal → bound percent/subgroup relations → ContractAssessment`. Process-frame similarity authorizes only a hypothesis; exact span bindings ground it; the organ-specific contract determines closure or refusal.
+
+### What Must Not Be Forgotten
+
+Both construction-affordance catalog families are now proposal-first, but proposals remain diagnostic-only and serving-disallowed. `ContractAssessment`, not `ConstructionProposal`, is the executable readiness authority.
+
+**Prompt Library Reference**: See `docs/core-rd-base-prompts.md` (especially sections #7 Standing Loop Axiom Check, #8 PR Merge-Readiness Audit, and #9 Grok Build Implementation Session). Use them as standing prefixes.
+
+### Skills Used
+
+- core-bootstrap: unavailable; checklist completed manually
+- versor-coherence-guardian: unavailable; closure preserved by scope and smoke validation
+- pre-edit-sweep: completed manually across imports, callers, tests, `evals/`, and `calibration/`
+- claim-proposal-guardian: unavailable; proposal status and serving posture verified through catalog/focused tests
+- Other: none
+
+---
+
+## Latest continuity pointer
+
+The latest session on 2026-06-20 is the
+`binding.quantity_entity` authorization addendum above. It starts from merged
+#844 at `a266324e` on branch
+`docs/kernel-authorize-quantity-entity-slice`. The controlling artifact is
+`docs/sessions/quantity-entity-foundational-slice-authorization-2026-06-20.md`.
+Merge that documentation PR before starting the bounded diagnostic-only
+implementation brief. No `state_change.transition`, serving, general entity
+extraction, or broad parsing work is authorized.
+
+### GSM8K train proxy rebaseline status (post-#847)
+
+PR #847 restored `evals/gsm8k_math/train_sample/v1/report.json` to the governed
+6/44/0 pin after #846 committed a 30/20/0 rebaseline without explicit authorization.
+A dedicated rebaseline PR (`chore/evals-ratify-gsm8k-train-proxy-rebaseline`) was
+opened against the #847 merge commit (`b6d42283`) to ratify the committed 30/20/0
+counts. That PR is the explicit authorization boundary for this rebaseline.
+
+**Ratified counts:** `correct: 30, refused: 20, wrong: 0`, `wrong_ids: []`.
+**Controlling artifact:** `docs/sessions/gsm8k-train-proxy-rebaseline-2026-06-20.md`.
+**No runtime, serving, teaching, or capability change in this rebaseline PR.**
+
+### Workbench / UI Alignment Scope Note
+The alignment scope for the CORE Workbench/UI under the latest proposal-first pivots is documented in `docs/sessions/workbench-proposal-first-alignment-scope-2026-06-20.md`. This is a docs-only session note that identifies UI gaps, non-goals, future acceptance criteria, and next PR briefs to align the frontend observatory with the backend's proposal-first and contract assessment authority architecture.
+
+---
+
+## Unary state-change delta authorization pointer
+
+The 2026-06-21 design investigation found that broad
+`state_change.transition` is not one safe organ. It combines unary delta,
+binary transfer, containment movement, and before/after state topology.
+
+Authorized for one future diagnostic-only implementation PR:
+
+- `state_change.unary_delta` only;
+- exact cue inventory `gained → increase`, `lost → decrease`;
+- one exact scalar/object `quantity_entity` edge;
+- one family-local exact action-cue record;
+- `ConstructionProposal(status="proposed")` before binding;
+- `ContractAssessment` as the sole runnable/refused authority;
+- `diagnostic_only=True`, `serving_allowed=False`.
+
+Explicitly not authorized: broad `state_change.transition`, transfer,
+containment, before/after state, measurement delta, actor/owner inference,
+coreference, cross-sentence binding, arithmetic, answers, serving, derivation
+ledger integration, or quantity-family widening.
+
+Controlling artifacts:
+
+- `docs/sessions/unary-state-change-delta-authorization-2026-06-21.md`
+- `docs/sessions/unary-state-change-delta-preflight-2026-06-21.md`
+- `docs/specs/foundational-families/unary-state-change-delta.md`
+
+The next PR should implement the preflight's copy-paste brief. Stop if it
+requires changes to `_quantity_entity_proposals()`,
+`_quantity_kind_dispositions()`, `generate.derivation.state`, actor/owner
+parsing, a broader cue inventory, synthetic spans, serving paths, or any
+non-empty wrong-ID list.
+
+Validation performed in the fresh worktree: startup guard passed with
+`HEAD == origin/main == ca83d384`; baseline and post-doc
+`uv run python -m core.cli test --suite smoke -q` completed successfully;
+requested positive/confuser ProblemFrame probes were run read-only;
+`git diff --check` passed. No subagents were used.

Makefile

@@ -0,0 +1,45 @@
+# Test lanes — see docs/testing-lanes.md.
+#
+# Slow tests are classified in conftest.py (SLOW_FILES / SLOW_TESTS), not via
+# in-file decorators.  Classification adds the `slow` marker only; it never
+# skips, so the lanes below are selected explicitly by marker expression.
+#
+# These run serially.  Parallel (`-n auto`) is intentionally NOT the default
+# until the suite is xdist-hermetic (shared repo engine_state/ + report.json +
+# teaching/proposals writers race under parallel workers).  See
+# docs/testing-lanes.md "Follow-up: xdist".
+#
+# CLOSE flywheel Claim-B determinism (post-#791 hardening): after any
+# CLOSE/idle_tick/realize_derived/consolidate/vault/determine change, also run
+#   uv run python -m evals.close_derived_climb
+#   uv run python -m pytest tests/test_derived_close_proposals.py tests/test_architectural_invariants.py -q
+# See docs/testing-lanes.md "Recommended determinism / teaching regression invocation".
+
+.PHONY: test-fast test-slow test-full test-close-flywheel
+
+# Fast dev lane — excludes the slow soak/bench/proof/eval-matrix registry.
+test-fast:
+	uv run pytest -m "not quarantine and not slow" -q
+
+# Slow lane — only the heavyweight registry tests.
+test-slow:
+	uv run pytest -m "slow and not quarantine" -q
+
+# Full lane — everything except known-failing quarantine (what CI runs).
+test-full:
+	uv run pytest -m "not quarantine" -q
+
+# Dedicated CLOSE Flywheel Regression Surface (Claim-B Level)
+# High-signal, intentional regression target for heavier determinism
+# regressions and teaching/anti-regression verification flows (not fast
+# local dev or CI). Exercises the full hardened Claim-B yardstick:
+#   - lived ChatRuntime.idle_tick() + IdleTickResult.derived_close_proposals_emitted
+#   - semantic determine() + Determined(..., rule='direct') asserts
+#   - content_replay_checksum (canonical closures + proposal bodies)
+#   - wrong_total=0, 1/5/8 growth, full determinism, hermeticity
+# See docs/testing-lanes.md "Dedicated CLOSE Flywheel Regression Surface..."
+# Explicitly heavy (real runtimes; ~60s+); composable via make; respects
+# Mechanical Sympathy / Semantic Rigor / Third Door.
+test-close-flywheel:
+	uv run python -m evals.close_derived_climb
+	uv run python -m pytest tests/test_derived_close_proposals.py tests/test_architectural_invariants.py tests/test_anti_regression_demo.py -q

README.md

@@ -81,6 +81,59 @@ pytest tests/test_versor_closure.py        # the core invariant — must pass fi
 pytest tests/                              # full suite (~8,337 tests; some pre-existing reds — see docs/test-debt-quarantine.md)
 ```
 
+### CORE Workbench — the visual operator console (one command)
+
+The Workbench is the audit-native UI over the engine: every screen is
+read-only evidence you can deep-link, replay, and verify — *determinism made
+felt*, not animated cognition. Bring it up with a single command that runs
+its own preflight, installs everything it needs, and only reports "up" once
+both servers are actually healthy:
+
+```bash
+scripts/workbench          # preflight → setup (idempotent) → start API + UI
+```
+
+It prints a single URL — open **http://127.0.0.1:5173** — and `Ctrl+C` stops
+both servers cleanly. Two sub-commands help when you want to be deliberate:
+
+```bash
+scripts/workbench doctor   # check tools only (uv, node ≥20, pnpm, curl) — changes nothing
+scripts/workbench setup    # check + install deps (venv, editable CORE, pnpm) — no servers
+```
+
+What it guarantees so it works the *first* time, not *sometimes*:
+
+- **Pure-Python backend** — the API and the full `CognitiveTurnPipeline`
+  import on the numpy backend; **no Rust build is required** to run the
+  Workbench.
+- **Fail-loud preflight** — a missing tool stops with the exact fix
+  (e.g. how to install `uv` or enable `pnpm` via corepack), never a
+  half-started UI.
+- **Idempotent setup** — creates a `uv` venv, installs CORE editable, and
+  runs `pnpm install --frozen-lockfile` only when something is actually
+  missing; re-runs are instant.
+- **Health-gated start** — waits for the API's `/health` and the UI port
+  before declaring success; surfaces logs (`/tmp/core-workbench-*.log`) if
+  either fails. Ports are configurable via `API_PORT` / `UI_PORT` and reused
+  if already healthy.
+
+Prerequisites the preflight checks for you: [`uv`](https://docs.astral.sh/uv/),
+Node ≥ 20, and `pnpm` (`corepack enable pnpm`). The UI is React 18 + Vite;
+the API is a stdlib HTTP server. Both bind to localhost only.
+
+Inside, fifteen routes project one evidence model — Chat, **Trace** (the
+canonical turn record, with per-turn pipeline / field-invariant / leeway /
+evidence-bundle tabs), **Contemplation** (the learning loop as a staged
+process), the guided **Tour** (a provider-agnostic determinism narrative),
+**Replay** (re-run a turn, hash-for-hash), Demos, Proposals (human
+ratification), Evals (the `wrong=0` ledger), **Calibration** (the gold-tether
+arena — where the engine earns the right to guess), Runs, Packs, **CORE-Logos**
+(the tri-language manifold substrate — lexicon, morphology, and cross-language
+alignment, read-only), Vault, Audit, Settings — stitched by the Evidence Chain
+Rail and addressable by URL. See [`docs/workbench/`](docs/workbench/) for the
+design system, route map, and the mastery roadmap. New evaluators should start
+with [`docs/workbench/EVALUATOR.md`](docs/workbench/EVALUATOR.md).
+
 ### Watch the flywheel turn — one command
 
 For a public-facing reproduction of the core thesis, in **four
@@ -131,6 +184,9 @@ core demo pack-measurements                # ADR-0043 — pack-layer claims as p
 core demo long-context-comparison          # ADR-0045 — CORE NIAH recall + frozen transformer baselines
 core demo anti-regression                  # ADR-0057 — three-gate defense against learning harm
 core demo learning-loop                    # ADR-0055..0057 — cold turn → discovery → propose → accept → grounded
+# (CLOSE / idle consolidation now also climbs declared strict-order relations
+#  (less_than etc.); see docs/runtime_contracts.md § "Idle consolidation (Step D — CLOSE)"
+#  and the PR-1 analysis note for contracts + evidence)
 core demo phase6                           # 3-condition comparative table (CORE vs baseline)
 core demo phase5                           # stratified 5-family mechanism-isolation
 core demo all                              # both + combined summary

alignment/graph.py

@@ -68,15 +68,21 @@ def _parse_edge(payload: dict) -> AlignmentEdge:
     )
 
 
-def load_alignment(pack_id: str) -> AlignmentGraph:
+def load_alignment(
+    pack_id: str, *, data_root: Path | None = None
+) -> AlignmentGraph:
     """
-    Load AlignmentEdge records from language_packs/data/<pack_id>/alignment.jsonl.
+    Load AlignmentEdge records from <data_root>/<pack_id>/alignment.jsonl.
+
+    ``data_root`` defaults to the committed ``language_packs/data`` tree; pass
+    an alternate root (e.g. a test-fixture copy) to read packs from elsewhere
+    without forking the parser.
 
     Returns an empty AlignmentGraph if the file does not exist.
     This is intentional: operational_base packs (en_minimal_v1) do not
     currently carry cross-language alignment edges.
     """
-    alignment_path = _DATA_DIR / pack_id / "alignment.jsonl"
+    alignment_path = (data_root or _DATA_DIR) / pack_id / "alignment.jsonl"
     if not alignment_path.exists():
         return AlignmentGraph([])
 

chat/always_on.py

@@ -0,0 +1,279 @@
+"""The L10 always-on heartbeat — the loop that makes the life CONTINUOUS.
+
+CORE is meant to be ONE continuous life (listen -> comprehend -> recall -> think ->
+articulate -> learn -> replay), not "many lives sharing a checkpoint." Three pieces of
+that spine are already built:
+
+  * the turn loop (``chat/runtime.py``) handles user turns;
+  * Shape B+ persistence makes a reboot resume the SAME life (field/vault/anchor/graph
+    restored bit-exactly, ``config.persist_session_state``);
+  * ``ChatRuntime.idle_tick`` advances continuous learning *between* turns
+    (proposal-only + sound session-memory consolidation).
+
+What was missing is a runtime that holds the engine alive and learning over uptime with
+no user turn — the T-experience direction. This module is the reusable **heartbeat
+loop**: ``run_continuous`` ticks ``idle_tick`` on a cadence so the engine lives and
+learns even when no one is talking to it, READS (never repairs) the closure invariant as
+evidence each beat, and persists so the life survives interruption and resumes as the
+SAME life. It is the core a daemon would call — the production daemon shell (a real
+wall-clock cadence, signal handling, a ``core always-on`` CLI entry) is a thin follow-up
+on top of this loop, not built here.
+
+Safety by composition, no new authority:
+  * ``idle_tick`` is proposal-only (HITL ratification untouched) + sound, proof-gated
+    session-memory consolidation — the heartbeat introduces no unreviewed mutation.
+  * closure (``versor_condition < 1e-6``) holds BY CONSTRUCTION (the sanctioned session
+    anchoring; L10 Decision-0 ruling), so the heartbeat only *reads* ``versor_condition``
+    as telemetry — never a hot-path repair or watchdog (CLAUDE.md no-hot-path-repair).
+  * the engine's content identity is invariant within a life (config-derived, not
+    lived-state); cross-reboot "same life" enforcement is owned by the ``ChatRuntime``
+    load guard (``IdentityContinuityError`` when the stamped checkpoint identity differs
+    from the recomputed one) — this loop does not re-implement it.
+
+See the L10 continuity soak (``evals/l10_continuity``) for the turn-loop half; this is
+the idle/heartbeat half.
+"""
+
+from __future__ import annotations
+
+import itertools
+import json
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Callable
+
+from algebra.versor import versor_condition
+from core.engine_identity import engine_identity_for_config
+
+# The name of the persisted lived-life artifact (one per always-on run) in the
+# engine-state dir, read-only, for the workbench Lived Life surface.
+LIVED_LIFE_FILENAME = "lived_life.json"
+LIVED_LIFE_SCHEMA_VERSION = "lived_life_v1"
+
+# The non-negotiable field invariant (CLAUDE.md). The heartbeat READS this as evidence;
+# it never repairs to keep it true — closure is owned by ``algebra/versor.py``.
+CLOSURE_CEILING = 1e-6
+
+# Granularity of the interruptible inter-beat wait. A daemon's clean-shutdown latency is
+# bounded by THIS, not by the (possibly long) cadence interval — a SIGTERM mid-wait is
+# honored within a slice instead of waiting out the whole interval.
+_SLEEP_SLICE_SECONDS = 0.25
+
+
+def _sleep_until_stop(seconds: float, stop: Callable[[], bool] | None) -> None:
+    """Sleep up to ``seconds``, returning early the moment ``stop`` fires.
+
+    Without a ``stop`` predicate this is a plain ``time.sleep``. With one, the wait is
+    sliced so a long cadence interval never delays a clean shutdown beyond one slice."""
+    if stop is None:
+        time.sleep(seconds)
+        return
+    deadline = time.monotonic() + seconds
+    while not stop():
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            return
+        time.sleep(min(remaining, _SLEEP_SLICE_SECONDS))
+
+
+@dataclass(frozen=True, slots=True)
+class HeartbeatRecord:
+    """Per-beat evidence of one continuous-life heartbeat (read-only telemetry)."""
+
+    tick: int
+    versor_condition: float | None  # closure of the live field; None before any turn built one
+    field_valid: bool  # versor_condition < CLOSURE_CEILING (vacuously True when no field yet)
+    facts_consolidated: int  # Step-D facts learned this beat (continuous learning)
+    proposals_created: int  # reviewable proposals emitted this beat (proposal-only)
+    pending_proposals: int
+    did_work: bool
+    frontier_findings: int = 0  # ADR-0080 SPECULATIVE findings mined this beat (0 unless enabled)
+
+
+@dataclass(frozen=True, slots=True)
+class AlwaysOnReport:
+    """The ordered evidence of one always-on run — the soak subject.
+
+    ``identity`` is the engine's content identity for the run (honest telemetry — it is
+    invariant within a life BY CONSTRUCTION, config-derived, so it is recorded once and
+    is NOT a continuity proof; cross-reboot "same life" is enforced by the ``ChatRuntime``
+    load guard). ``closure_observed`` says whether any beat actually observed a field, so
+    a consumer can distinguish "closure held over N observations" from "no field ever
+    existed" (``closure_held`` is vacuously True with zero observations).
+    ``final_checkpoint_ok`` surfaces whether the exit checkpoint persisted (never silently
+    swallowed)."""
+
+    records: tuple[HeartbeatRecord, ...]
+    identity: str
+    closure_observed: bool
+    closure_held: bool  # every OBSERVED versor_condition < CLOSURE_CEILING
+    final_checkpoint_ok: bool
+    total_facts_consolidated: int
+    total_proposals_created: int
+    total_frontier_findings: int = 0  # ADR-0080 SPECULATIVE findings mined across the run
+    # The identity-determining pack ids of the run's config, so a reader can recompute the
+    # SAME identity (the resume verdict) instead of assuming default packs. Empty = default.
+    identity_pack_ids: dict[str, str] = field(default_factory=dict)
+
+    @property
+    def heartbeats(self) -> int:
+        return len(self.records)
+
+
+def serialize_report(report: AlwaysOnReport) -> dict[str, Any]:
+    """Deterministic, JSON-able projection of an always-on run — the persisted lived-life
+    evidence the workbench reads."""
+    return {
+        "schema_version": LIVED_LIFE_SCHEMA_VERSION,
+        "identity": report.identity,
+        "heartbeats": report.heartbeats,
+        "closure_ceiling": CLOSURE_CEILING,
+        "closure_observed": report.closure_observed,
+        "closure_held": report.closure_held,
+        "final_checkpoint_ok": report.final_checkpoint_ok,
+        "total_facts_consolidated": report.total_facts_consolidated,
+        "total_proposals_created": report.total_proposals_created,
+        "total_frontier_findings": report.total_frontier_findings,
+        "identity_pack_ids": dict(report.identity_pack_ids),
+        "records": [
+            {
+                "tick": r.tick,
+                "versor_condition": r.versor_condition,
+                "field_valid": r.field_valid,
+                "facts_consolidated": r.facts_consolidated,
+                "proposals_created": r.proposals_created,
+                "pending_proposals": r.pending_proposals,
+                "did_work": r.did_work,
+                # Durable explanation of did_work when the beat's only work was a frontier
+                # mine (facts/proposals both 0) — else did_work has no persisted cause.
+                "frontier_findings": r.frontier_findings,
+            }
+            for r in report.records
+        ],
+    }
+
+
+def write_lived_life(report: AlwaysOnReport, path: Path) -> None:
+    """Persist the lived-life evidence deterministically (sorted keys) so the workbench can
+    read it as a read-only artifact. Overwrites — the artifact is the latest always-on run
+    (a cumulative whole-life log is a future enhancement)."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(
+        json.dumps(serialize_report(report), indent=2, sort_keys=True) + "\n",
+        encoding="utf-8",
+    )
+
+
+def _live_versor_condition(runtime) -> float | None:
+    """Read the closure of the runtime's live field, or None if no turn built one yet.
+
+    Pure telemetry — never mutates or repairs the field."""
+    context = getattr(runtime, "_context", None)
+    state = getattr(context, "state", None) if context is not None else None
+    if state is None:
+        return None
+    return float(versor_condition(state.F))
+
+
+def run_continuous(
+    runtime,
+    *,
+    heartbeats: int | None,
+    sleep_seconds: float = 0.0,
+    on_heartbeat: Callable[[HeartbeatRecord], None] | None = None,
+    stop: Callable[[], bool] | None = None,
+    report_path: Path | None = None,
+) -> AlwaysOnReport:
+    """Run the always-on heartbeat for up to ``heartbeats`` beats (``None`` = until ``stop``).
+
+    Each beat: advance continuous learning (``idle_tick``), then record the closure +
+    learning evidence. ``idle_tick`` self-checkpoints on real work; this loop also
+    checkpoints once at exit, so the life survives interruption — the next ``ChatRuntime``
+    over the same engine-state dir resumes the SAME life (with Shape B+ persistence on,
+    and the load-time identity guard enforcing it).
+
+    A finite ``heartbeats`` bounds a falsifiable soak; ``heartbeats=None`` runs unbounded
+    until ``stop`` fires — the daemon contract (``chat.always_on_daemon``), where ``stop``
+    is wired to SIGINT/SIGTERM. ``stop`` is checked BEFORE each beat AND interrupts the
+    inter-beat wait, so a clean shutdown is prompt and still persists the final state.
+
+    When ``report_path`` is given, the run's lived-life evidence is persisted there after
+    the loop exits — point it at ``<engine_state>/lived_life.json`` so the workbench Lived
+    Life surface reads the continuous life. A clean ``stop`` still writes the full report
+    (the report captures everything accumulated up to the stop). On a crash the engine
+    state is still checkpointed in ``finally`` for recovery, but the workbench report is
+    best-effort and simply not refreshed — the surface keeps the last good run.
+    """
+    if heartbeats is not None and heartbeats < 0:
+        raise ValueError("heartbeats must be >= 0 or None")
+
+    config = runtime.config
+    identity = engine_identity_for_config(config)
+    # The identity-determining pack ids (empty == default) — persisted so a reader recomputes
+    # the SAME identity for the resume verdict instead of assuming default packs.
+    identity_pack_ids = {
+        "identity_pack": getattr(config, "identity_pack", "") or "",
+        "ethics_pack": getattr(config, "ethics_pack", "") or "",
+        "register_pack_id": getattr(config, "register_pack_id", "") or "",
+        "anchor_lens_id": getattr(config, "anchor_lens_id", "") or "",
+    }
+    records: list[HeartbeatRecord] = []
+    final_checkpoint_ok = True
+    try:
+        ticks = itertools.count() if heartbeats is None else range(heartbeats)
+        for tick in ticks:
+            if stop is not None and stop():
+                break
+            result = runtime.idle_tick()
+            vc = _live_versor_condition(runtime)
+            did_work = (
+                result.facts_consolidated > 0
+                or result.proposals_created > 0
+                or result.candidates_contemplated > 0
+                or getattr(result, "frontier_findings", 0) > 0
+            )
+            record = HeartbeatRecord(
+                tick=tick,
+                versor_condition=vc,
+                field_valid=(vc is None or vc < CLOSURE_CEILING),
+                facts_consolidated=result.facts_consolidated,
+                proposals_created=result.proposals_created,
+                pending_proposals=result.pending_proposals,
+                did_work=did_work,
+                frontier_findings=getattr(result, "frontier_findings", 0),
+            )
+            records.append(record)
+            if on_heartbeat is not None:
+                try:
+                    on_heartbeat(record)
+                except OSError:
+                    # Telemetry is best-effort like the checkpoint: a broken stderr/log
+                    # pipe (BrokenPipeError) must NOT kill an indefinite-uptime life.
+                    pass
+            if sleep_seconds:
+                _sleep_until_stop(sleep_seconds, stop)
+    finally:
+        # Final checkpoint even on a mid-beat interruption — the life persists and resumes
+        # as the SAME life. Best-effort so a checkpoint failure cannot mask the original
+        # error, but the outcome is SURFACED (final_checkpoint_ok), never silently swallowed.
+        try:
+            runtime.checkpoint_engine_state()
+        except Exception:  # noqa: BLE001 — persistence is best-effort at the boundary
+            final_checkpoint_ok = False
+
+    observed = [r.versor_condition for r in records if r.versor_condition is not None]
+    report = AlwaysOnReport(
+        records=tuple(records),
+        identity=identity,
+        closure_observed=bool(observed),
+        closure_held=all(vc < CLOSURE_CEILING for vc in observed),
+        final_checkpoint_ok=final_checkpoint_ok,
+        total_facts_consolidated=sum(r.facts_consolidated for r in records),
+        total_proposals_created=sum(r.proposals_created for r in records),
+        total_frontier_findings=sum(r.frontier_findings for r in records),
+        identity_pack_ids=identity_pack_ids,
+    )
+    if report_path is not None:
+        write_lived_life(report, report_path)
+    return report

chat/always_on_daemon.py

@@ -0,0 +1,195 @@
+"""The always-on daemon shell — the thin process that RUNS the continuous-life heartbeat.
+
+``chat/always_on.run_continuous`` is the reusable loop; this module is the daemon a
+``core always-on`` invocation drives. It resolves the engine-state dir, takes a
+single-instance lock (ONE life per engine-state dir — two daemons would corrupt the one
+continuous life), installs SIGINT/SIGTERM handlers for a graceful stop, builds the
+continuous-life ``ChatRuntime``, and runs the heartbeat unbounded until a signal — writing
+the ``lived_life.json`` evidence the workbench reads and checkpointing so the next start
+resumes the SAME life.
+
+No new authority (CLAUDE.md): the heartbeat only ticks the proposal-only ``idle_tick`` and
+READS ``versor_condition`` (no hot-path repair). It is FOREGROUND and explicit — there is
+no hidden background execution; an operator backgrounds it with their shell / service
+manager. The only writes are to the engine-state dir it was pointed at (the lock, the
+manifest checkpoint, ``lived_life.json``).
+"""
+
+from __future__ import annotations
+
+import dataclasses
+import fcntl
+import os
+import signal
+import threading
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Callable
+
+from chat.always_on import (
+    LIVED_LIFE_FILENAME,
+    AlwaysOnReport,
+    HeartbeatRecord,
+    run_continuous,
+)
+from chat.runtime import ChatRuntime
+from core.config import RuntimeConfig
+from engine_state import EngineStateStore
+
+LOCK_FILENAME = "always_on.lock"
+
+# The continuous-life config: persist the lived field/vault across reboot (Shape B+),
+# learn from determined facts each beat (Step D), and REFUSE to resume a different-identity
+# checkpoint (the load-time identity guard). So a daemon restart is the SAME life or it
+# stops — never a silent fork.
+CONTINUOUS_LIFE_CONFIG_FLAGS: dict[str, Any] = {
+    "persist_session_state": True,
+    "consolidate_determinations": True,
+    "strict_identity_continuity": True,
+}
+
+
+class AlwaysOnLockedError(RuntimeError):
+    """Another live always-on daemon already holds the lock for this engine-state dir."""
+
+
+class _SingleInstanceLock:
+    """Single-instance lock backed by an advisory OS lock (``fcntl.flock``).
+
+    The kernel holds the lock for the lifetime of the open fd and releases it AUTOMATICALLY
+    when the process dies — so there is no stale-lock window, no PID-reuse ambiguity, and no
+    empty / half-written-file race (a pid-file scheme has all three: a loser of the create
+    race can read a not-yet-written file and mistake a live holder for stale, then reclaim,
+    and two daemons proceed over one life). The lock FILE is intentionally never unlinked —
+    unlinking it would let a waiting peer flock a different inode — so the persistent marker
+    also carries the holder's pid for a human-readable refusal message.
+    """
+
+    def __init__(self, path: Path) -> None:
+        self._path = path
+        self._fd: int | None = None
+
+    def _holder_pid(self) -> int | None:
+        try:
+            return int(self._path.read_text(encoding="utf-8").strip())
+        except (OSError, ValueError):
+            return None
+
+    def acquire(self) -> None:
+        self._path.parent.mkdir(parents=True, exist_ok=True)
+        fd = os.open(self._path, os.O_CREAT | os.O_RDWR, 0o644)
+        try:
+            fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except OSError as exc:
+            # The lock is held by another LIVE process (the kernel released it if the holder
+            # died). Read the marker pid for the message; it is informational only.
+            holder = self._holder_pid()
+            os.close(fd)
+            suffix = f" (pid {holder})" if holder is not None else ""
+            raise AlwaysOnLockedError(
+                f"another always-on daemon{suffix} holds {self._path}"
+            ) from exc
+        # We hold the kernel lock; stamp our pid as a human-readable marker (best-effort —
+        # exclusion is the flock, not this content).
+        try:
+            os.ftruncate(fd, 0)
+            os.write(fd, f"{os.getpid()}\n".encode("utf-8"))
+        except OSError:
+            pass
+        self._fd = fd
+
+    def release(self) -> None:
+        if self._fd is None:
+            return
+        try:
+            fcntl.flock(self._fd, fcntl.LOCK_UN)
+        except OSError:
+            pass
+        os.close(self._fd)
+        self._fd = None
+
+
+@dataclass(frozen=True, slots=True)
+class DaemonResult:
+    """The outcome of one daemon run — the heartbeat report + how it ended."""
+
+    report: AlwaysOnReport
+    engine_state_path: Path
+    stopped_by_signal: bool
+
+
+def continuous_life_config(base: RuntimeConfig | None = None) -> RuntimeConfig:
+    """``base`` (or a default config) with the continuous-life flags forced on.
+
+    Forced, not defaulted: the daemon's whole purpose is ONE continuous life, so persistence
+    + consolidation + the strict identity guard are not optional knobs here."""
+    cfg = base if base is not None else RuntimeConfig()
+    return dataclasses.replace(cfg, **CONTINUOUS_LIFE_CONFIG_FLAGS)
+
+
+def run_daemon(
+    *,
+    config: RuntimeConfig | None = None,
+    engine_state_path: Path | None = None,
+    interval: float = 1.0,
+    max_beats: int | None = None,
+    no_load_state: bool = False,
+    on_record: Callable[[HeartbeatRecord], None] | None = None,
+    install_signals: bool = True,
+    stop_event: threading.Event | None = None,
+) -> DaemonResult:
+    """Run the always-on heartbeat as a daemon until a signal (or ``max_beats``).
+
+    Resolves the engine-state dir, takes the single-instance lock (raising
+    ``AlwaysOnLockedError`` if a live daemon already owns this life), installs
+    SIGINT/SIGTERM handlers (unless ``install_signals=False`` — tests drive ``stop_event``
+    directly), then runs ``run_continuous`` with the continuous-life config forced on and
+    persists ``lived_life.json`` beside the checkpoint.
+
+    ``install_signals=True`` must be called from the main thread (a Python signal-handler
+    constraint); tests pass ``install_signals=False`` with their own ``stop_event``.
+    """
+    resolved = EngineStateStore(engine_state_path).path
+    cfg = continuous_life_config(config)
+    stop_event = stop_event if stop_event is not None else threading.Event()
+    signalled = threading.Event()  # distinguishes a signal stop from a max_beats / test stop
+
+    lock = _SingleInstanceLock(resolved / LOCK_FILENAME)
+    lock.acquire()  # fail fast BEFORE any signal/runtime setup if another life is live
+
+    previous_handlers: list[tuple[int, Any]] = []
+    try:
+        if install_signals:
+
+            def _handle(_signum: int, _frame: Any) -> None:
+                signalled.set()
+                stop_event.set()
+
+            for sig in (signal.SIGINT, signal.SIGTERM):
+                old = signal.getsignal(sig)
+                signal.signal(sig, _handle)  # record only AFTER it actually changed
+                previous_handlers.append((sig, old))
+
+        runtime = ChatRuntime(
+            config=cfg, engine_state_path=resolved, no_load_state=no_load_state
+        )
+        # An ephemeral (no-load-state) life persists nothing — including no durable
+        # lived_life.json, which would otherwise overwrite the persistent life's artifact.
+        report_path = None if no_load_state else resolved / LIVED_LIFE_FILENAME
+        report = run_continuous(
+            runtime,
+            heartbeats=max_beats,
+            sleep_seconds=interval,
+            stop=stop_event.is_set,
+            on_heartbeat=on_record,
+            report_path=report_path,
+        )
+    finally:
+        for sig, handler in previous_handlers:
+            # getsignal can return None for a non-Python handler; restore SIG_DFL then.
+            signal.signal(sig, handler if handler is not None else signal.SIG_DFL)
+        lock.release()
+
+    return DaemonResult(
+        report=report, engine_state_path=resolved, stopped_by_signal=signalled.is_set()
+    )

chat/ask_runtime.py

@@ -0,0 +1,36 @@
+"""Runtime-facing ASK helper.
+
+This tiny module is separate from chat.runtime so connector edits do not
+rewrite the large runtime file. It is the serving-side consumer of the
+ASK acquisition seam, but it does not call pass_manager, render question
+prose, or change runtime schemas.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from core.epistemic_disclosure.ask_acquisition import acquire_served_ask_candidate
+
+
+def maybe_apply_served_ask(
+    config: Any,
+    fallback_surface: str,
+    *,
+    contemplation_result: Any | None = None,
+    provider: Any | None = None,
+) -> str:
+    """Return a valid served ASK surface, or the original fallback surface."""
+
+    acquisition = acquire_served_ask_candidate(
+        config,
+        fallback_surface=fallback_surface,
+        contemplation_result=contemplation_result,
+        provider=provider,
+    )
+    if acquisition.decision.served:
+        return acquisition.decision.surface
+    return fallback_surface
+
+
+__all__ = ["maybe_apply_served_ask"]

chat/runtime.py

@@ -54,8 +54,13 @@ from teaching.discovery import (
     format_candidate_jsonl,
 )
 from teaching.discovery_sink import DiscoveryCandidateSink
-from engine_state import EngineStateStore, get_git_revision
-from core.engine_identity import engine_identity_for_config
+from engine_state import EngineStateStore
+from core.engine_identity import (
+    ENGINE_IDENTITY_SCHEME,
+    IdentityReconciliation,
+    engine_identity_for_config,
+    reconcile_loaded_identity,
+)
 from recognition.anti_unifier import derive_recognizer
 from recognition.outcome import FeatureBundle
 from recognition.registry import RecognizerRegistry
@@ -103,6 +108,7 @@ from persona.motor import PersonaMotor
 from session.context import SessionContext
 from session.correction import CorrectionPass
 from vault.decompose import default_decomposer, default_gate
+from core.cognition.backpressure import BackpressureRecord, build_backpressure_record
 
 _TOKEN_RE = re.compile(r"\w+", re.UNICODE)
 # ADR-0073d (L1.4) — extracts the engaged ``cognitive_mode_label`` from a
@@ -546,9 +552,25 @@ class IdleTickResult:
     #: Step D — derived facts consolidated into the held self this tick (0 unless
     #: ``config.consolidate_determinations`` and the closure had a new layer to add).
     facts_consolidated: int = 0
+    #: ADR-0080 — SPECULATIVE frontier findings autonomously mined + persisted this tick
+    #: (0 unless ``config.contemplate_frontier_during_idle`` AND a NOT-yet-mined frontier;
+    #: a mined frontier converges to 0). Persisted as a reviewable artifact under
+    #: ``<engine_state>/contemplation_runs/`` for later review tooling — NOT yet surfaced in
+    #: the existing HITL queue / workbench contemplation reader (those scan
+    #: ``<repo>/contemplation/runs``; wiring that discovery is a follow-up). Never ratified here.
+    frontier_findings: int = 0
     #: IT — read-only proposal-review summary (None unless ``config.review_pending_proposals``).
     #: Surfaces pending comprehension-failure proposals for review; mutates nothing.
     proposal_review: ProposalReviewIdleSummary | None = None
+    #: PR-2 — count of new reviewable proposal artifacts emitted this tick from proof-gated
+    #: derived CLOSE facts (member/subset + TRANSITIVE_PREDICATES). Only non-zero when
+    #: ``config.review_derived_close_proposals``. Proposal-only, review-gated, SPECULATIVE;
+    #: does not set did_work or trigger engine checkpoint (lives in teaching/proposals sink).
+    derived_close_proposals_emitted: int = 0
+    #: Observational backpressure telemetry — backlog depth, headroom, inflow vs drain.
+    #: None only when the tick was never called (not possible in normal use); always
+    #: present on a completed tick. Never gates or refuses; see ADR-0161 for that.
+    backpressure: BackpressureRecord | None = None
 
 
 class ChatRuntime:
@@ -718,6 +740,10 @@ class ChatRuntime:
             None if no_load_state else EngineStateStore(engine_state_path)
         )
         self._recognizer_registry: RecognizerRegistry = RecognizerRegistry()
+        # Memoized frontier mine (ADR-0080 idle pass): the frontier reports are static within
+        # a session, so a converged life mines once instead of re-reading every idle beat. A
+        # reboot re-mines (a fresh runtime), picking up any frontier change across downtime.
+        self._frontier_run_cache: Any = None
         self._turn_count: int = 0
         self._pending_candidates: list[DiscoveryCandidate] = []
         self._pending_recognizer_examples: list[
@@ -730,9 +756,9 @@ class ChatRuntime:
         # L11 — the engine's content-derived identity (who am I), and the
         # identity stamped in the loaded checkpoint (the lineage parent for the
         # next checkpoint). ``_loaded_engine_identity`` stays "" at genesis.
-        self._engine_identity: str = engine_identity_for_config(
-            self.config, get_git_revision()
-        )
+        # ADR-0220: identity is the ratified PACKS only — the build revision is
+        # provenance (manifest written_at_revision), not an identity input.
+        self._engine_identity: str = engine_identity_for_config(self.config)
         self._loaded_engine_identity: str = ""
         # CL — the persistent reviewed-learning proposal log. ``idle_tick()``
         # advances it during idle (proposal-only); it lives alongside the engine
@@ -763,29 +789,59 @@ class ChatRuntime:
         self._recognizer_registry = RecognizerRegistry.from_recognizers(recognizers)
         self._pending_candidates = store.load_discovery_candidates()
         self._turn_count = int(manifest.get("turn_count", 0))
-        # L11 — the identity this checkpoint was written under becomes the lineage
-        # parent of the next checkpoint we write. If it differs from the identity
-        # we recomputed at boot, the ratified substrate changed during downtime:
-        # we would resume the lived state under a DIFFERENT identity. Surface it
-        # (warn + flag); refuse only under strict_identity_continuity.
+        # L11 / ADR-0220 — the identity this checkpoint was written under becomes
+        # the lineage parent of the next checkpoint. Reconcile it against the
+        # identity we recomputed at boot (packs-only). A genuine ratified-PACK
+        # divergence is a different identity (refuse under strict / warn+flag); a
+        # legacy (code_revision-folded) stamp whose packs verify identical is the
+        # SAME identity under an old stamp scheme (migrate + re-stamp, no break);
+        # a build-revision-only change is not a divergence at all (packs-only
+        # hash is rev-independent → MATCH). reconcile_loaded_identity is the
+        # single source of truth shared with the workbench continuity reader.
         self._loaded_engine_identity = str(manifest.get("engine_identity", ""))
-        if (
-            self._loaded_engine_identity
-            and self._loaded_engine_identity != self._engine_identity
-        ):
-            self.identity_continuity_break = True
-            message = (
-                "engine identity continuity break: checkpoint was written under "
-                f"{self._loaded_engine_identity[:12]}… but this build computes "
-                f"{self._engine_identity[:12]}… — the ratified identity substrate "
-                "changed while the engine was down. Resuming would carry the lived "
-                "state into a different identity."
+        if self._loaded_engine_identity:
+            # A malformed identity_scheme (non-int) falls back to the legacy
+            # scheme — the verifying migration then reconciles it safely rather
+            # than crashing the load. A null/absent revision becomes "" so the
+            # legacy branch treats it as unverifiable (conservative DIVERGED).
+            try:
+                stored_scheme = int(manifest.get("identity_scheme", 1))
+            except (TypeError, ValueError):
+                stored_scheme = 1
+            reconciliation = reconcile_loaded_identity(
+                self.config,
+                self._engine_identity,
+                stored_identity=self._loaded_engine_identity,
+                stored_scheme=stored_scheme,
+                stored_revision=str(manifest.get("written_at_revision") or ""),
             )
-            if self.config.strict_identity_continuity:
-                from core.engine_identity import IdentityContinuityError
+            if reconciliation is IdentityReconciliation.DIVERGED:
+                self.identity_continuity_break = True
+                message = (
+                    "engine identity continuity break: checkpoint was written under "
+                    f"{self._loaded_engine_identity[:12]}… but this build computes "
+                    f"{self._engine_identity[:12]}… — the ratified identity substrate "
+                    "(packs) changed while the engine was down. Resuming would carry "
+                    "the lived state into a different identity."
+                )
+                if self.config.strict_identity_continuity:
+                    from core.engine_identity import IdentityContinuityError
 
-                raise IdentityContinuityError(message)
-            warnings.warn(message, RuntimeWarning, stacklevel=2)
+                    raise IdentityContinuityError(message)
+                warnings.warn(message, RuntimeWarning, stacklevel=2)
+            elif reconciliation is IdentityReconciliation.MIGRATED:
+                # Same identity, legacy stamp scheme — resume and migrate the
+                # lineage parent to the packs-only hash so the chain stays
+                # coherent (the next checkpoint re-stamps under scheme 2).
+                warnings.warn(
+                    "migrating engine-identity stamp scheme (1→2): re-stamping the "
+                    "packs-only identity. Same identity — the build revision is "
+                    "provenance (written_at_revision), not identity.",
+                    RuntimeWarning,
+                    stacklevel=2,
+                )
+                self._loaded_engine_identity = self._engine_identity
+            # IdentityReconciliation.MATCH → clean same-identity resume, no-op.
         # Shape B+ (schema v2): restore the lived session state into the live
         # context so a reboot resumes the SAME life (field/vault/anchor/graph/
         # referents/dialogue). Opt-in (config.persist_session_state); None for a
@@ -818,7 +874,6 @@ class ChatRuntime:
             recognizer = derive_recognizer(tuple(self._pending_recognizer_examples))
             self._recognizer_registry.register(recognizer)
             self._pending_recognizer_examples.clear()
-        store.save_recognizers(self._recognizer_registry.all())
         candidates_to_save = self._pending_candidates
         if self.config.auto_contemplate and candidates_to_save:
             from teaching.contemplation import contemplate
@@ -827,22 +882,29 @@ class ChatRuntime:
                 contemplate(c, vault_probe=vault_probe)
                 for c in candidates_to_save
             ]
-        store.save_discovery_candidates(candidates_to_save)
+        # ADR-0219 — generation-dir atomic checkpoint.  All files are written
+        # into a fresh gen-NNNN/ directory; the commit is the atomic pointer
+        # swap in commit_generation.  A kill before the swap leaves the prior
+        # committed generation intact.  The manifest is the last file written
+        # into the gen dir (audit convention); the pointer swap is the true
+        # commit boundary.
+        gen_num, gen_dir = store.begin_generation()
+        gen_store = EngineStateStore(gen_dir)
+        gen_store.save_recognizers(self._recognizer_registry.all())
+        gen_store.save_discovery_candidates(candidates_to_save)
         # Shape B+ (schema v2): persist the lived session state (field, vault,
-        # anchor, graph, referents, dialogue) BEFORE the manifest, so the
-        # manifest stays the last durable act — the commit marker for the turn.
-        # Opt-in (config.persist_session_state): a deliberate resume mode, off by
-        # default so one-shot runtimes don't pay the per-turn snapshot cost.
+        # anchor, graph, referents, dialogue) BEFORE the manifest.
+        # Opt-in (config.persist_session_state): off by default.
         if self._context is not None and self.config.persist_session_state:
-            store.save_session_state(self._context.snapshot())
-        # L11 — stamp the engine's identity and its lineage parent (the identity
-        # of the prior checkpoint). Same substrate -> identity == parent (a stable
-        # life); a ratified substrate change -> identity != parent (the bump).
-        store.save_manifest(
+            gen_store.save_session_state(self._context.snapshot())
+        # L11 — stamp the engine's identity and its lineage parent.
+        gen_store.save_manifest(
             self._turn_count,
             engine_identity=self._engine_identity,
             parent_engine_identity=self._loaded_engine_identity,
+            identity_scheme=ENGINE_IDENTITY_SCHEME,
         )
+        store.commit_generation(gen_num)
         self._loaded_engine_identity = self._engine_identity
 
     def _count_pending_proposals(self) -> int:
@@ -925,6 +987,76 @@ class ChatRuntime:
             facts_consolidated = consolidate_once(self._context).consolidated
             did_work = True
 
+        derived_close_proposals_emitted = 0
+        # PR-2 derived CLOSE proposal bridge — after consolidation so newly derived
+        # proof-gated facts (member/subset + relational transitive) can surface as
+        # reviewable proposal artifacts. Best-effort, proposal-only, review-gated.
+        # Never sets did_work (proposals live outside engine_state; no unrelated checkpoint).
+        # Gated by explicit config flag (default off).
+        if getattr(self.config, "review_derived_close_proposals", False):
+            try:
+                from generate.determine.derived_close_proposals import (
+                    emit_derived_close_proposals,
+                )
+
+                res = emit_derived_close_proposals(self._context)
+                derived_close_proposals_emitted = res.get("emitted", 0)
+            except Exception as exc:  # noqa: BLE001 — proposal emission must not crash idle
+                warnings.warn(
+                    f"derived close proposal emission skipped: {exc!r}",
+                    RuntimeWarning,
+                    stacklevel=2,
+                )
+                derived_close_proposals_emitted = 0
+
+        # 2b. Frontier-contemplation pass (ADR-0080 into the idle loop) — autonomously MINE
+        #     the frontier-compare reports into persisted SPECULATIVE reviewable findings, so
+        #     the always-on life proposes its OWN frontier with no user turn. Idempotent per
+        #     frontier (an already-mined frontier is NOT re-persisted → the life converges, no
+        #     churn); SPECULATIVE-only (ADR-0080: never COHERENT/ratified → the HITL path is
+        #     untouched). Persists per-life under the engine-state dir.
+        #
+        #     This is an OPTIONAL background pass on an indefinite-uptime life: a malformed
+        #     frontier report (parse error) or a transient filesystem fault must DEGRADE to
+        #     "no findings this beat", never crash the continuous loop. So the whole pass is
+        #     best-effort (the exit-checkpoint boundary idiom) — on failure it warns, leaves
+        #     did_work untouched, and a later beat retries (the run-cache stays unset on a
+        #     mining failure; a write failure simply re-attempts while the target is absent).
+        frontier_findings = 0
+        if (
+            self.config.contemplate_frontier_during_idle
+            and self._engine_state_store is not None
+        ):
+            try:
+                from core.contemplation.runner import (
+                    run_contemplation,
+                    write_contemplation_run,
+                )
+
+                # Mine once per session (the frontier is static within a run); a reboot re-mines.
+                if self._frontier_run_cache is None:
+                    self._frontier_run_cache = run_contemplation()
+                run = self._frontier_run_cache
+                target = (
+                    self._engine_state_store.path
+                    / "contemplation_runs"
+                    / f"idle_{run.substrate_hash}.json"
+                )
+                if run.findings and not target.exists():
+                    write_contemplation_run(run, target)
+                    frontier_findings = len(run.findings)
+                    did_work = True
+            except Exception as exc:  # noqa: BLE001 — optional idle pass is best-effort
+                # An optional frontier mine must never crash the always-on life. Degrade to
+                # "no findings this beat" and surface the cause; the loop, its closure
+                # evidence, and the rest of idle_tick continue uninterrupted.
+                warnings.warn(
+                    "idle frontier-contemplation pass skipped "
+                    f"(degraded to 0 findings): {exc!r}",
+                    RuntimeWarning,
+                    stacklevel=2,
+                )
+
         # 3. Proposal-review sub-pass (IT) — READ-ONLY. Surfaces pending comprehension-failure
         #    proposals (the contemplation pass's N5 artifacts) for review. It NEVER mutates an
         #    artifact, NEVER sets ``did_work`` (no state change → no checkpoint), NEVER ratifies
@@ -945,12 +1077,51 @@ class ChatRuntime:
         # idle engine with nothing to learn does not churn the checkpoint.
         if did_work:
             self.checkpoint_engine_state()
+
+        # Backpressure telemetry — observational only, never gates, never alters
+        # trace_hash.  Built from counts already computed above; the cap is resolved
+        # from the env exactly as ADR-0161 does in teaching.proposals.
+        pending_count = self._count_pending_proposals()
+        bp_record = build_backpressure_record(
+            pending_proposals=pending_count,
+            candidate_backlog=len(self._pending_candidates),
+            contemplated_this_tick=contemplated_count,
+            created_this_tick=created,
+            did_work=did_work,
+        )
+        # Append-only telemetry line in the engine-state dir so backpressure
+        # history survives reboot.  Best-effort: a write failure must not crash
+        # the continuous life.
+        if self._engine_state_store is not None:
+            try:
+                telem_path = self._engine_state_store.path / "idle_telemetry.jsonl"
+                line = json.dumps(
+                    {
+                        "pending_proposals": bp_record.pending_proposals,
+                        "candidate_backlog": bp_record.candidate_backlog,
+                        "cap": bp_record.cap,
+                        "headroom": bp_record.headroom,
+                        "contemplated_this_tick": bp_record.contemplated_this_tick,
+                        "created_this_tick": bp_record.created_this_tick,
+                        "at_fixed_point": bp_record.at_fixed_point,
+                        "did_work": bp_record.did_work,
+                    },
+                    separators=(",", ":"),
+                )
+                with open(telem_path, "a", encoding="utf-8") as fh:
+                    fh.write(line + "\n")
+            except Exception:  # noqa: BLE001 — telemetry write must never crash the life
+                pass
+
         return IdleTickResult(
             candidates_contemplated=contemplated_count,
             proposals_created=created,
-            pending_proposals=self._count_pending_proposals(),
+            pending_proposals=pending_count,
             facts_consolidated=facts_consolidated,
+            frontier_findings=frontier_findings,
             proposal_review=proposal_review,
+            derived_close_proposals_emitted=derived_close_proposals_emitted,
+            backpressure=bp_record,
         )
 
     def record_recognition_example(
@@ -967,10 +1138,13 @@ class ChatRuntime:
         ``compute_trace_hash`` produces the turn's canonical
         SHA-256.  Stamps the trace_hash onto the most recent
         TurnEvent and any DiscoveryCandidate emitted during this
-        turn (i.e., the unstamped tail of ``_pending_candidates``),
-        then re-persists the candidates checkpoint so the on-disk
-        audit trail names the originating turn instead of the
-        prior empty-string default.
+        turn (i.e., the unstamped tail of ``_pending_candidates``).
+
+        The stamped candidates are held in memory and persisted at the
+        next ``checkpoint_engine_state`` call (ADR-0219: only
+        ``checkpoint_engine_state`` writes to the checkpoint dir, so the
+        trace-hash back-stamp is always part of a coherent committed
+        generation rather than a mid-turn partial write).
 
         No-op when ``trace_hash`` is empty (pre-pipeline call sites,
         refusal stub path).  Idempotent: stamping a tail whose
@@ -983,7 +1157,6 @@ class ChatRuntime:
             last_event = self.turn_log[-1]
             if not last_event.trace_hash:
                 self.turn_log[-1] = replace(last_event, trace_hash=trace_hash)
-        stamped = False
         for idx in range(len(self._pending_candidates) - 1, -1, -1):
             cand = self._pending_candidates[idx]
             if cand.source_turn_trace:
@@ -991,11 +1164,6 @@ class ChatRuntime:
             self._pending_candidates[idx] = replace(
                 cand, source_turn_trace=trace_hash
             )
-            stamped = True
-        if stamped and self._engine_state_store is not None:
-            self._engine_state_store.save_discovery_candidates(
-                self._pending_candidates
-            )
 
     def first_admitted_recognizer(self):
         if not self.config.recognition_grounded_graph:

conftest.py

@@ -28,8 +28,11 @@ import pytest
 import engine_state
 
 
+_USES_DEFAULT_ENGINE_STATE_MARKER = "uses_default_engine_state"
+
+
 @pytest.fixture(autouse=True)
-def _isolate_engine_state_default(tmp_path_factory, monkeypatch):
+def _isolate_engine_state_default(request, tmp_path_factory, monkeypatch):
     """Isolate the default engine-state checkpoint dir per test.
 
     A bare ``ChatRuntime()`` (no ``engine_state_path``) falls back to
@@ -41,24 +44,149 @@ def _isolate_engine_state_default(tmp_path_factory, monkeypatch):
     boots under a different identity over the same dir). Point the default at a
     fresh per-test temp dir. Tests passing an explicit ``engine_state_path`` are
     unaffected; within one test, repeated ``ChatRuntime()`` share this dir.
+
+    Two redirections, both pointed at the same per-test dir:
+
+    1. ``engine_state._DEFAULT_DIR`` is monkeypatched directly. It is bound at
+       import (``engine_state/__init__.py``), so an env var alone would NOT
+       redirect an already-imported in-process runtime.
+    2. ``CORE_ENGINE_STATE_DIR`` is set in the environment so subprocess / CLI
+       tests that re-import ``engine_state`` in a child process inherit the same
+       isolation. A child that sets its own ``CORE_ENGINE_STATE_DIR`` (e.g.
+       ``tests/test_l10_always_on_daemon.py::test_real_sigterm_stops_the_daemon_cleanly``)
+       still overrides this and wins.
+
+    A test that intentionally exercises the real process-default dir (default-dir
+    semantics, CLI fallback, legacy-flat migration) can opt out with
+    ``@pytest.mark.uses_default_engine_state``; it then sees neither redirection.
     """
+    if request.node.get_closest_marker(_USES_DEFAULT_ENGINE_STATE_MARKER):
+        return
     isolated = tmp_path_factory.mktemp("engine_state_default")
     monkeypatch.setattr(engine_state, "_DEFAULT_DIR", isolated)
+    monkeypatch.setenv("CORE_ENGINE_STATE_DIR", str(isolated))
 
 
 QUARANTINE: frozenset[str] = frozenset()
 
 
-def pytest_collection_modifyitems(config, items):
-    """Stamp the quarantine marker on any test whose nodeid is listed
-    in QUARANTINE.  Tests not in the set are unaffected.
+# ---------------------------------------------------------------------------
+# Slow-test registry — empirical test-infrastructure metadata, NOT test
+# semantics, so it lives here beside QUARANTINE in one auditable place rather
+# than as @pytest.mark.slow decorators spread across ~24 files.
+#
+# A handful of soak / bench / replay / proof / eval-matrix tests dominate the
+# suite wall-clock: ~50 tests account for essentially the entire serial runtime
+# (~73 min), while the other ~10k tests are near-instant.  Classifying them lets
+# a developer run a fast lane locally.  Classification adds the ``slow`` marker
+# ONLY — it never skips — so ``-m slow`` SELECTS these tests.  Choose a lane:
+#
+#   fast lane:  pytest -m "not quarantine and not slow"     (make test-fast)
+#   slow lane:  pytest -m "slow and not quarantine"         (make test-slow)
+#   full lane:  pytest -m "not quarantine"                  (make test-full; CI)
+#
+# CI is unchanged: smoke.yml and full-pytest.yml run ``-m "not quarantine"``,
+# which still includes slow tests.  See docs/testing-lanes.md.
+# ---------------------------------------------------------------------------
 
-    The CI gate runs ``pytest -m "not quarantine"`` so quarantined
-    tests are silently skipped in CI.  Local ``pytest`` runs include
-    them by default (still useful for debugging individual fixes).
+# Whole-file: the cost is carried by a module/session-scoped fixture, so marking
+# individual tests is insufficient — skipping one just shifts the fixture cost to
+# the next test that requests it.  The whole file is classified slow.
+SLOW_FILES: frozenset[str] = frozenset({
+    "tests/test_inner_loop_phase2.py",               # module fixture run_lane(): 9 cases x 4 conditions x 5-rerun determinism (~975s)
+    "tests/test_cognition_eval_register_matrix.py",  # module fixtures: full register x invariant eval matrix
+    "tests/test_articulation_bench.py",              # module fixture: articulation bench corpus
+    "tests/test_register_invariant_grounding.py",    # module fixtures: per-register runtime grounding
+    "tests/test_public_showcase.py",                 # module fixture: full showcase execution
+    "tests/test_conversation_demo.py",               # module fixture: multi-turn demo run
+    "tests/test_edge_budget_gate.py",                # module fixture: per-turn checkpoint cost soak
+    "tests/test_phase5_corpus.py",                   # module fixtures: replay-determinism corpus
+    "tests/test_realizer_guard_holdout.py",          # module fixture: holdout-cluster run
+    "tests/test_teaching_loop_bench.py",             # module fixture: teaching-loop determinism bench
+})
+
+# Exact nodeids: mixed files where only specific tests are soak/bench scale.
+# Listed individually so the file's fast (predicate / unit) coverage stays in the
+# fast lane.  No scoped fixture carries the cost in these files, so per-test
+# classification does not shift cost to a sibling.
+SLOW_TESTS: frozenset[str] = frozenset({
+    # test_l10_continuity.py — real-soak predicates among 28 mostly-fast tests
+    "tests/test_l10_continuity.py::test_p1_closure_holds_on_real_soak",
+    "tests/test_l10_continuity.py::test_p2a_determinism_holds_across_independent_runtimes",
+    "tests/test_l10_continuity.py::test_p2b_pre_reboot_invariant_holds_on_real_soak",
+    "tests/test_l10_continuity.py::test_p2b_reboot_is_transparent",
+    "tests/test_l10_continuity.py::test_p4_recovery_is_deterministic_across_orphan_crash",
+    "tests/test_l10_continuity.py::test_p5c_coherence_holds_over_multiple_corpus_cycles",
+    "tests/test_l10_continuity.py::test_report_panel_passes_and_records_not_covered",
+    # test_l10_arbitrary_interruption.py — partial/full generation interruption soak
+    "tests/test_l10_arbitrary_interruption.py::test_p4_arbitrary_interruption_full_gen_before_swap_holds",
+    "tests/test_l10_arbitrary_interruption.py::test_p4_arbitrary_interruption_partial_gen_holds",
+    # test_register_tour_demo.py — per-register tour runs (5 fast structural tests remain)
+    "tests/test_register_tour_demo.py::test_tour_grounding_sources_identical_across_registers",
+    "tests/test_register_tour_demo.py::test_tour_returns_structured_report",
+    "tests/test_register_tour_demo.py::test_tour_terse_substantively_differs_from_neutral",
+    "tests/test_register_tour_demo.py::test_tour_trace_hashes_identical_across_registers",
+    # test_register_firing_diagnostic.py — multi-register marker-engagement report
+    "tests/test_register_firing_diagnostic.py::test_build_report_records_marker_engagement_for_register_subset",
+    # test_operator_calibration_replay.py — replay/calibration proof tests
+    "tests/test_operator_calibration_replay.py::TestCalibrationRejectsInvariantRegression::test_versor_closure_must_not_regress",
+    "tests/test_operator_calibration_replay.py::TestCalibrationReportHasBeforeAfterMetrics::test_calibrate_returns_result",
+    # test_pack_measurements_phase2.py — falsifiability lane (ALSO run by CI smoke via
+    # -m "not quarantine", which does not exclude slow; classifying it is safe)
+    "tests/test_pack_measurements_phase2.py::TestRefusalCalibrationPackRunner::test_grounding_gate_is_pack_invariant",
+    "tests/test_pack_measurements_phase2.py::TestRefusalCalibrationPackRunner::test_no_fabrication_under_any_pack",
+    "tests/test_pack_measurements_phase2.py::TestRefusalCalibrationPackRunner::test_report_schema_is_stable",
+    # test_thread_context.py — eviction-over-capacity soak (19 fast tests remain)
+    "tests/test_thread_context.py::test_runtime_default_capacity_evicts_old_turns",
+    # test_correction_telemetry.py — cross-run determinism (6 fast tests remain)
+    "tests/test_correction_telemetry.py::test_correction_event_is_deterministic_across_runs",
+    # test_cold_start_grounding_lane.py — distribution lane (15 fast tests remain)
+    "tests/test_cold_start_grounding_lane.py::TestPassThresholds::test_distributions_match_expected",
+    # test_engine_state_session_persistence.py — reboot/restore soak (4 fast tests remain)
+    "tests/test_engine_state_session_persistence.py::test_chat_runtime_restores_lived_state_across_reboot",
+    "tests/test_engine_state_session_persistence.py::test_no_load_state_runtime_starts_fresh",
+    # test_cli_demo.py — combined-run demo subprocess (16 lighter demo tests remain)
+    "tests/test_cli_demo.py::TestDemoPreambles::test_all_preamble_explains_combined_run",
+    # test_identity_continuity_proof.py — byte-identical resumed-life proof
+    "tests/test_identity_continuity_proof.py::test_resumed_life_is_byte_identical_and_same_identity",
+    # test_warmed_session_lane.py — pipeline-override gate invariant
+    "tests/test_warmed_session_lane.py::TestPipelineOverrideGateInvariants::test_no_placeholder_rate_is_one",
+})
+
+
+def _is_slow(nodeid: str) -> bool:
+    """True if ``nodeid`` is classified slow by the SLOW_FILES / SLOW_TESTS registry.
+
+    ``nodeid`` is expected pre-normalized to forward slashes (the caller does this
+    once).  Splitting on ``"::"`` yields exactly the file path, so the whole-file
+    check is an O(1) set lookup with no substring-prefix edge cases (e.g.
+    ``..._phase2.py`` can never match ``..._phase2_extra.py``).  Exact-nodeid
+    match handles mixed files.
+    """
+    if nodeid in SLOW_TESTS:
+        return True
+    file_path = nodeid.split("::", 1)[0]
+    return file_path in SLOW_FILES
+
+
+def pytest_collection_modifyitems(config, items):
+    """Stamp the ``quarantine`` and ``slow`` markers from the conftest registries.
+
+    - QUARANTINE nodeids get ``quarantine`` (CI runs ``-m "not quarantine"``).
+    - SLOW_FILES / SLOW_TESTS get ``slow`` — classification ONLY, never skipped
+      here, so ``-m slow`` SELECTS them.  Lanes are chosen explicitly:
+        fast: pytest -m "not quarantine and not slow"
+        slow: pytest -m "slow and not quarantine"
+        full: pytest -m "not quarantine"
     """
     _ = config  # pluggy hook signature requires the name `config`; not used here
     quarantine_marker = pytest.mark.quarantine
+    slow_marker = pytest.mark.slow
     for item in items:
-        if item.nodeid in QUARANTINE:
+        # Normalize once: pytest nodeids are forward-slash, but normalize
+        # defensively so both registries match on Windows backslash nodeids too.
+        nodeid = item.nodeid.replace("\\", "/")
+        if nodeid in QUARANTINE:
             item.add_marker(quarantine_marker)
+        if _is_slow(nodeid):
+            item.add_marker(slow_marker)

core/cli.py

@@ -324,6 +324,158 @@ def cmd_chat(args: argparse.Namespace) -> int:
     return 0
 
 
+# How often (in beats) the always-on daemon logs an "alive" line when idle, so the
+# operator sees a living process without per-beat spam on a saturated (converged) life.
+_ALWAYS_ON_ALIVE_EVERY = 60
+
+
+def _always_on_identity_break_message(
+    engine_state_path: Path | None, exc: Exception
+) -> str:
+    """Operator recovery guidance for an always-on identity-continuity refusal.
+
+    Safe by construction (ADR-0220): it never tells the operator to ``mv``/``rm``
+    the engine-state directory — under the default that directory IS the tracked
+    ``engine_state`` Python package, so moving it breaks ``import engine_state``
+    across the codebase (including this very command). It steers to: re-run the
+    originating revision, a separate ``--engine-state`` dir, or clearing ONLY the
+    runtime files. The checkpoint revision is read from the manifest so option 1
+    is copy-pasteable (placeholder when no readable manifest is present)."""
+    import warnings as _warnings
+
+    from engine_state import EngineStateStore
+
+    rev = "<checkpoint_revision>"
+    state_dir: Path | None = engine_state_path
+    try:
+        store = EngineStateStore(engine_state_path)
+        state_dir = store.path
+        with _warnings.catch_warnings():
+            # Reading the manifest re-triggers ADR-0157's revision-mismatch
+            # RuntimeWarning; this is a message formatter, not a load path, so
+            # don't re-warn the operator as a side effect of building the string.
+            _warnings.simplefilter("ignore")
+            manifest = store.load_manifest() or {}
+        rev = str(manifest.get("written_at_revision") or rev)
+    except Exception:
+        # Best-effort: this is a display helper on an error path. If the manifest
+        # can't be read we degrade to the placeholder rev/dir — never let
+        # message-building mask the refusal that brought us here.
+        pass
+    return "\n".join(
+        [
+            "this engine state belongs to a different life (the ratified identity "
+            f"packs changed): {exc}",
+            "",
+            "Recovery options:",
+            "  1. Resume the old life — restore the ratified packs it was written "
+            "under (e.g. run the build that wrote them):",
+            f"       git checkout {rev}",
+            "       core always-on",
+            "  2. Start a fresh persisted life under a separate state dir "
+            "(leaves the old one untouched):",
+            "       core always-on --engine-state ./engine_state_<name>",
+            "  3. Start fresh in place — clear ONLY the runtime files in",
+            f"       {state_dir or '<engine_state_dir>'}",
+            "     (manifest.json, the 'current' pointer + gen-*/ dirs, "
+            "recognizers.jsonl, discovery_candidates.jsonl,",
+            "      session_state.json, proposals.jsonl) — never the directory "
+            "itself (it holds the engine_state package).",
+        ]
+    )
+
+
+def cmd_always_on(args: argparse.Namespace) -> int:
+    """Run the continuous-life heartbeat daemon (T-experience) until SIGINT/SIGTERM.
+
+    The thin shell over ``chat.always_on_daemon.run_daemon``: it forces the continuous-life
+    config on, takes the single-instance lock, and ticks ``idle_tick`` on a cadence so the
+    engine LIVES and LEARNS with no user turn — persisting ``lived_life.json`` (the
+    workbench Lived Life surface) and resuming the SAME life on the next start."""
+    from chat.always_on_daemon import AlwaysOnLockedError, run_daemon
+    from core.engine_identity import IdentityContinuityError
+    from engine_state import IncompatibleEngineStateError
+
+    max_beats = getattr(args, "max_beats", None)
+    if max_beats is not None and max_beats < 0:
+        _die("--max-beats must be >= 0", code=2)
+    interval = float(getattr(args, "interval", 1.0))
+    if interval < 0:
+        _die("--interval must be >= 0", code=2)
+    quiet = bool(getattr(args, "quiet", False))
+
+    def _log(record) -> None:
+        if quiet:
+            return
+        vc = "—" if record.versor_condition is None else f"{record.versor_condition:.2e}"
+        if record.did_work:
+            findings = getattr(record, "frontier_findings", 0)
+            findings_part = f" +{findings} findings" if findings else ""
+            print(
+                f"[beat {record.tick}] learned +{record.facts_consolidated} facts "
+                f"+{record.proposals_created} proposals{findings_part} · closure {vc}",
+                file=sys.stderr,
+            )
+        elif record.tick % _ALWAYS_ON_ALIVE_EVERY == 0:
+            print(
+                f"[beat {record.tick}] alive · closure {vc} · valid={record.field_valid}",
+                file=sys.stderr,
+            )
+
+    bound = "unbounded (until SIGINT/SIGTERM)" if max_beats is None else f"{max_beats} beats"
+    print(
+        f"core always-on: continuous-life heartbeat · interval {interval}s · {bound}",
+        file=sys.stderr,
+    )
+    daemon_config = _runtime_config_from_args(args)
+    if getattr(args, "contemplate_frontier", False):
+        import dataclasses
+
+        # A learning daemon: autonomously mine the frontier into persisted SPECULATIVE
+        # findings each idle beat (ADR-0080). Opt-in — the default daemon stays idle.
+        daemon_config = dataclasses.replace(
+            daemon_config, contemplate_frontier_during_idle=True
+        )
+    try:
+        result = run_daemon(
+            config=daemon_config,
+            engine_state_path=getattr(args, "engine_state", None),
+            interval=interval,
+            max_beats=max_beats,
+            no_load_state=bool(getattr(args, "no_load_state", False)),
+            on_record=_log,
+        )
+    except AlwaysOnLockedError as exc:
+        _die(f"always-on already running for this engine state: {exc}", code=2)
+    except IdentityContinuityError as exc:
+        _die(
+            _always_on_identity_break_message(
+                getattr(args, "engine_state", None), exc
+            ),
+            code=2,
+        )
+    except IncompatibleEngineStateError as exc:
+        _die(f"this engine state was written by a newer build: {exc}", code=2)
+
+    report = result.report
+    how = "signal" if result.stopped_by_signal else "completed"
+    if not report.closure_observed:
+        closure = "no field observed"
+    elif report.closure_held:
+        closure = "held"
+    else:
+        closure = "BREACHED"
+    print(
+        f"core always-on: stopped ({how}) after {report.heartbeats} heartbeats · "
+        f"learned {report.total_facts_consolidated} facts · "
+        f"{report.total_proposals_created} proposals · closure {closure} · "
+        f"checkpoint {'ok' if report.final_checkpoint_ok else 'FAILED'} · "
+        f"life {report.identity}",
+        file=sys.stderr,
+    )
+    return 0
+
+
 def _pytest_args_for_suite(suite: str, extra_args: Sequence[str]) -> list[str]:
     paths = _TEST_SUITES[suite]
     forwarded = list(extra_args)
@@ -4143,6 +4295,66 @@ def build_parser() -> argparse.ArgumentParser:
     )
     chat.set_defaults(func=cmd_chat)
 
+    always_on = subparsers.add_parser(
+        "always-on",
+        help="run the continuous-life heartbeat daemon (T-experience) until SIGINT/SIGTERM",
+    )
+    _add_runtime_policy_args(always_on)
+    always_on.add_argument(
+        "--interval",
+        type=float,
+        default=1.0,
+        metavar="SECONDS",
+        help="seconds between heartbeats (the idle-learning cadence); default: 1.0",
+    )
+    always_on.add_argument(
+        "--max-beats",
+        type=int,
+        default=None,
+        metavar="N",
+        help="stop after N heartbeats; default: unbounded (run until SIGINT/SIGTERM)",
+    )
+    always_on.add_argument(
+        "--no-load-state",
+        action="store_true",
+        default=False,
+        help=(
+            "run a fresh EPHEMERAL life (do not load or persist engine_state); "
+            "default: load + persist + resume the SAME life across restarts"
+        ),
+    )
+    always_on.add_argument(
+        "--engine-state",
+        type=Path,
+        default=None,
+        metavar="PATH",
+        dest="engine_state",
+        help=(
+            "engine-state directory (the per-life state root) for this life; "
+            "default: $CORE_ENGINE_STATE_DIR or the in-repo engine_state/ dir. "
+            "Point at a dedicated path to run a separate persisted life without "
+            "touching another (and without moving the engine_state package dir)."
+        ),
+    )
+    always_on.add_argument(
+        "--quiet",
+        action="store_true",
+        default=False,
+        help="suppress per-beat logging; print only the final summary",
+    )
+    always_on.add_argument(
+        "--contemplate-frontier",
+        action="store_true",
+        default=False,
+        dest="contemplate_frontier",
+        help=(
+            "learning daemon: autonomously mine the frontier into persisted SPECULATIVE "
+            "findings under <engine_state>/contemplation_runs/ each idle beat (ADR-0080; "
+            "never ratified — reviewable artifact, not yet in the HITL queue). Default off."
+        ),
+    )
+    always_on.set_defaults(func=cmd_always_on)
+
     test = subparsers.add_parser("test", help="run pytest with curated suite aliases or direct passthrough")
     test.add_argument("--suite", choices=sorted(_TEST_SUITES), help="curated suite alias to run")
     test.add_argument("--list-suites", action="store_true", help="list curated test suite aliases and exit")

core/cognition/backpressure.py

@@ -0,0 +1,82 @@
+"""Per-tick idle backpressure telemetry — observational leaf.
+
+Models the ``idle_tick`` learning flywheel's backlog depth, inflow vs drain,
+and proximity to the ADR-0161 cap so pressure is visible *before* the cap
+starts refusing.  This module is **read-only** — it never gates, refuses, or
+alters the served surface or ``trace_hash``.  The ADR-0161 cap and its
+``queue_full`` control logic live in ``teaching.proposals``; this leaf only
+observes.
+
+The structure mirrors ``core.cognition.leeway``: a frozen dataclass +
+a pure builder function that derives all secondary fields from the counts
+``idle_tick`` already computes, with no new runtime state.
+"""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+
+_DEFAULT_PENDING_CAP: int = 256  # mirrors teaching.proposals.DEFAULT_PENDING_CAP
+
+
+@dataclass(frozen=True, slots=True)
+class BackpressureRecord:
+    """Observational telemetry for one ``idle_tick`` run.
+
+    All fields are counts or derived booleans — no gating logic here.
+
+    ``headroom`` is ``max(0, cap - pending_proposals)``; zero means the cap
+    is full and the next proposal creation attempt will be refused by
+    ADR-0161.  ``at_fixed_point`` is True when the candidate backlog is
+    empty AND no proposals were created this tick (the learning flywheel
+    has nothing to drain).
+    """
+
+    pending_proposals: int       # proposals awaiting HITL ratification after this tick
+    candidate_backlog: int       # discovery candidates waiting to be contemplated
+    cap: int                     # ADR-0161 cap (CORE_HITL_PENDING_CAP or 256)
+    headroom: int                # cap - pending_proposals (≥0; 0 = cap is full)
+    contemplated_this_tick: int  # candidates contemplated during this tick
+    created_this_tick: int       # proposals created during this tick
+    at_fixed_point: bool         # backlog empty AND nothing created → flywheel idle
+    did_work: bool               # True when the tick advanced at least one pass
+
+
+def _resolve_cap() -> int:
+    """Resolve the ADR-0161 pending cap — env-overridable, default 256."""
+    env_val = os.environ.get("CORE_HITL_PENDING_CAP")
+    if env_val is not None:
+        try:
+            return int(env_val)
+        except ValueError:
+            pass
+    return _DEFAULT_PENDING_CAP
+
+
+def build_backpressure_record(
+    *,
+    pending_proposals: int,
+    candidate_backlog: int,
+    contemplated_this_tick: int,
+    created_this_tick: int,
+    did_work: bool,
+) -> BackpressureRecord:
+    """Build the idle-tick backpressure telemetry record.
+
+    All inputs are counts already computed by ``idle_tick``; this function
+    only resolves the cap and derives ``headroom`` and ``at_fixed_point``.
+    """
+    cap = _resolve_cap()
+    headroom = max(0, cap - pending_proposals)
+    at_fixed_point = candidate_backlog == 0 and created_this_tick == 0
+    return BackpressureRecord(
+        pending_proposals=pending_proposals,
+        candidate_backlog=candidate_backlog,
+        cap=cap,
+        headroom=headroom,
+        contemplated_this_tick=contemplated_this_tick,
+        created_this_tick=created_this_tick,
+        at_fixed_point=at_fixed_point,
+        did_work=did_work,
+    )

core/cognition/leeway.py

@@ -0,0 +1,107 @@
+"""Per-turn leeway record — the engine-side B4 producer.
+
+When a turn is governed (ADR-0206 ``response_governance``), the reliability gate
+either grants latitude to a class (a licensed ``Action.SERVE`` converse-guess,
+surfaced as a DISCLOSED ``[approximate]`` estimate) or withholds it (the STRICT
+default).  That decision is computed on the serving path and was previously
+discarded.  This module turns the decision the runtime ALREADY made into a small
+observational record on the turn result — it never calls the gate, never
+authorizes anything, and never alters the served surface.
+
+The record mirrors the workbench ``LeewayEvidence`` tuple field-for-field, so the
+workbench maps it with a trivial projection and gains no serving-path import.
+The ``license_decision`` is read duck-typed (a
+``core.reliability_gate.LicenseDecision`` when present) so this stays a pure
+cognition-layer leaf with no new cross-package coupling.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from dataclasses import dataclass
+from typing import Any
+
+
+@dataclass(frozen=True, slots=True)
+class LeewayRecord:
+    """Observational record of the leeway the gate granted (or withheld)."""
+
+    class_name: str
+    license: str  # "SERVE" | "PROPOSE" | "blocked" | "unknown"
+    theta: float | None
+    claim_disclosure: str  # "approximate" | "verified" | "proposal_only" | "none"
+    source_digest: str | None
+    calibration_evidence_ref: str | None
+
+
+def _decision_digest(license_decision: Any) -> str:
+    """Content-address the licensing decision — provenance, deterministic.
+
+    Hashes only the decision's deterministic fields (never a timestamp), so a
+    replayed turn produces the same digest.
+    """
+
+    payload = {
+        "class_name": str(getattr(license_decision, "class_name", "")),
+        "action": str(getattr(getattr(license_decision, "action", None), "name", "")),
+        "checker": str(getattr(license_decision, "checker", "")),
+        "measured": float(getattr(license_decision, "measured", 0.0) or 0.0),
+        "required": float(getattr(license_decision, "required", 0.0) or 0.0),
+        "licensed": bool(getattr(license_decision, "licensed", False)),
+    }
+    canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"))
+    return "sha256:" + hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+
+
+def build_leeway_record(
+    *,
+    reach_level: str,
+    license_decision: Any | None,
+) -> LeewayRecord:
+    """Map the governed turn's reach level + license decision to a record.
+
+    - No decision consulted (the STRICT main path): ``license="unknown"``, no
+      latitude.
+    - A decision exists but was denied: ``license="blocked"`` — the gate was
+      consulted and said no.
+    - A licensed SERVE/PROPOSE that widened: the real class, θ, and the
+      ``[approximate]`` disclosure — the "engine earned the right to guess" case.
+
+    ``claim_disclosure`` reflects what was actually disclosed this turn
+    (``approximate`` iff the surface widened); ``"verified"`` is intentionally
+    never emitted (it is a RESERVED epistemic state — claiming it would
+    over-state).
+    """
+
+    disclosure = "approximate" if reach_level == "approximate" else "none"
+
+    if license_decision is None:
+        return LeewayRecord(
+            class_name="none",
+            license="unknown",
+            theta=None,
+            claim_disclosure=disclosure,
+            source_digest=None,
+            calibration_evidence_ref=None,
+        )
+
+    action_name = str(getattr(getattr(license_decision, "action", None), "name", ""))
+    licensed = bool(getattr(license_decision, "licensed", False))
+    if licensed and action_name == "SERVE":
+        license = "SERVE"
+    elif licensed and action_name == "PROPOSE":
+        license = "PROPOSE"
+    else:
+        license = "blocked"
+
+    class_name = str(getattr(license_decision, "class_name", "") or "none")
+    required = getattr(license_decision, "required", None)
+    return LeewayRecord(
+        class_name=class_name,
+        license=license,
+        theta=float(required) if required is not None else None,
+        claim_disclosure=disclosure,
+        source_digest=_decision_digest(license_decision),
+        calibration_evidence_ref=class_name if class_name != "none" else None,
+    )

core/cognition/pipeline.py

@@ -19,6 +19,7 @@ import json
 from collections import OrderedDict
 
 from field.state import FieldState
+from core.cognition.leeway import build_leeway_record
 from core.cognition.result import CognitiveTurnResult
 from core.cognition.surface_resolution import resolve_surface
 from core.cognition.trace import compute_trace_hash, hash_admissibility_trace
@@ -457,6 +458,19 @@ class CognitiveTurnPipeline:
         # ``source_turn_trace``.  See runtime.finalize_turn_trace_hash.
         self.runtime.finalize_turn_trace_hash(trace_hash)
 
+        # B4 producer: capture the leeway the response path already decided —
+        # observational only (reads the runtime's introspection-only accrual and
+        # the response's reach level; never alters the surface, never gates).
+        accrual = (
+            self.runtime.last_turn_accrual()
+            if hasattr(self.runtime, "last_turn_accrual")
+            else None
+        )
+        leeway = build_leeway_record(
+            reach_level=str(getattr(response, "reach_level", "strict") or "strict"),
+            license_decision=getattr(accrual, "license", None),
+        )
+
         return CognitiveTurnResult(
             input_text=text,
             input_tokens=raw_tokens,
@@ -489,6 +503,7 @@ class CognitiveTurnPipeline:
             dropped_compound_clauses=dropped_compound_clauses,
             versor_condition=response.versor_condition,
             trace_hash=trace_hash,
+            leeway=leeway,
         )
 
     # ------------------------------------------------------------------

core/cognition/result.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 
 from dataclasses import dataclass
 
+from core.cognition.leeway import LeewayRecord
 from field.state import FieldState
 from generate.articulation import ArticulationPlan
 from generate.dialogue import DialogueRole
@@ -138,3 +139,6 @@ class CognitiveTurnResult:
     # --- invariant bookkeeping ---
     versor_condition: float = 0.0   # must be < 1e-6
     trace_hash: str = ""            # SHA-256 over deterministic key fields
+
+    # --- response-governance leeway evidence (B4; observational, not in trace_hash) ---
+    leeway: LeewayRecord | None = None

core/config.py

@@ -323,6 +323,25 @@ class RuntimeConfig:
     # OFF by default — idle ticks don't pay for the scan unless a deployment wants the surface.
     review_pending_proposals: bool = False
 
+    # PR-2 derived CLOSE proposal bridge — when on, after consolidation in idle_tick, scan
+    # realized derived facts (member/subset + TRANSITIVE_PREDICATES) that carry proof-gated
+    # Derivation (verdict="entailed", SPECULATIVE). Emit reviewable proposal-only artifacts
+    # (source="derived_close_fact") to teaching/proposals/derived_close_facts/. Default off;
+    # review-gated, no corpus mutation, no ratification, no COHERENT, no serving change.
+    # Deterministic dedupe by (predicate, args, derivation, structure_key). Best-effort;
+    # failures captured.
+    review_derived_close_proposals: bool = False
+
+    # Autonomous frontier contemplation (ADR-0080 into the idle loop) — when on, idle_tick
+    # autonomously MINES its frontier-compare reports into persisted SPECULATIVE reviewable
+    # findings (core.contemplation), so the always-on life proposes its own frontier without
+    # a user turn. Idempotent per frontier (a mined frontier converges → no churn); the
+    # findings are SPECULATIVE-only (ADR-0080: never COHERENT, never self-ratify), persisted
+    # under <engine_state>/contemplation_runs/ as a reviewable artifact for later review
+    # tooling — NOT yet surfaced in the existing HITL queue (a follow-up). OFF by default —
+    # a deliberate learning-daemon mode.
+    contemplate_frontier_during_idle: bool = False
+
     # Step E (ESTIMATION) — when on, a converse query the engine would otherwise REFUSE
     # (told p(a,b), asked p(b,a)) may be answered with a DISCLOSED [approximate] estimate
     # IF the predicate-class has earned the SERVE license on the ratified, committed

core/contemplation/runner.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import os
 from pathlib import Path
 from typing import Iterable
 
@@ -177,12 +178,16 @@ def contemplate_contradiction_reports(
 
 
 def write_contemplation_run(run: ContemplationRun, path: str | Path) -> None:
+    # Atomic write (temp + os.replace): the always-on life is an indefinite-uptime process
+    # where a SIGKILL/crash mid-write is expected, and the idle-pass skip-guard would NEVER
+    # repair a torn canonical file. A crash leaves only the orphan .tmp; the canonical path
+    # is either absent (re-mined next boot) or complete — never a half-written artifact.
     target = Path(path)
     target.parent.mkdir(parents=True, exist_ok=True)
-    target.write_text(
-        json.dumps(run.as_dict(), ensure_ascii=False, indent=2, sort_keys=True) + "\n",
-        encoding="utf-8",
-    )
+    payload = json.dumps(run.as_dict(), ensure_ascii=False, indent=2, sort_keys=True) + "\n"
+    tmp = target.with_name(f".{target.name}.{os.getpid()}.tmp")
+    tmp.write_text(payload, encoding="utf-8")
+    os.replace(tmp, target)
 
 
 __all__ = [

core/demos/showcase_adapters.py

@@ -164,7 +164,7 @@ class MultiHopTraceDemo:
             transitive_surface=True,
             composed_surface=True,
         )
-        runtime = ChatRuntime(config=config)
+        runtime = ChatRuntime(config=config, no_load_state=True)
         response = runtime.chat(self.prompt)
 
         surface = response.surface or ""

core/engine_identity.py

@@ -2,26 +2,37 @@
 
 ``EngineIdentity`` is the sha256 of the canonical serialization of the engine's
 ratified PERSONALITY substrate — the active identity / safety / ethics / register
-/ anchor-lens pack files — plus the code revision. It is **content-derived, NOT
-entropy-based**: two engines with the same ratified substrate compute the SAME
-identity, because they ARE the same engine functionally (substrate is shareable).
+/ anchor-lens pack files. It is **content-derived, NOT entropy-based**: two
+engines with the same ratified packs compute the SAME identity, because they ARE
+the same engine functionally (substrate is shareable).
 
 This is the "who am I" hash. It is bumped only by a ratified change to the
 identity substrate (a new identity pack, a safety-axis change), NOT by lived
-learning (recall, teaching) — that is the engine's *experience*, carried across
-reboot by the Shape B+ lived-state lineage, not its identity. The git-like
-lineage chain (parent links on ratification) and the reboot identity verification
-build on this primitive.
+learning (recall, teaching) and **NOT by the build revision** — that is the
+engine's *experience* / *provenance*, carried separately (the manifest's
+``written_at_revision``), not its identity. (ADR-0220: ``code_revision`` was
+removed from the hashed tuple — a behavior-neutral rebuild is the SAME identity.)
+The git-like lineage chain (parent links on ratification) and the reboot identity
+verification build on this primitive.
 
-Honest scope (per the EngineIdentity candidate note): this is a *convention*
-naming the existing per-pack content hashes, not a new pack format. The ratified
-teaching corpus / recognizer-registry head can be folded into the tuple later
-(additive — a new key changes the identity, which is the correct semantic for a
-ratified-substrate change).
+Migration (ADR-0220): pre-split checkpoints stamped the identity WITH
+``code_revision`` folded in (``identity_scheme`` 1 / absent). They are recognised
+via the manifest's ``identity_scheme`` marker and migrated by a *verifying
+re-stamp* — see ``reconcile_loaded_identity``: the legacy hash is reconstructed
+from the persisted ``written_at_revision`` and the CURRENT packs; a match proves
+the packs are unchanged (build-provenance-only divergence → resume + re-stamp),
+a mismatch means the ratified packs genuinely changed (→ refuse). This avoids a
+flag-day break while preserving "distinct ratified packs ⇒ refuse".
+
+Honest scope: this is a *convention* naming the existing per-pack content hashes,
+not a new pack format. The ratified teaching corpus / recognizer-registry head can
+be folded into the tuple later (additive — a new key changes the identity, which
+is the correct semantic for a ratified-substrate change).
 """
 
 from __future__ import annotations
 
+import enum
 import hashlib
 import json
 from pathlib import Path
@@ -38,6 +49,11 @@ from core.config import (
 # The never-swappable safety pack default (packs/safety/loader.py).
 DEFAULT_SAFETY_PACK: str = "core_safety_axes_v1"
 
+#: The current engine-identity stamp scheme (ADR-0220): ``2`` = packs-only hash.
+#: A manifest with ``identity_scheme`` absent or ``< 2`` was stamped by the
+#: pre-split build that folded ``code_revision`` into the hash (legacy scheme 1).
+ENGINE_IDENTITY_SCHEME: int = 2
+
 _PACKS_ROOT = Path(__file__).resolve().parents[1] / "packs"
 
 #: role -> packs/ subdirectory holding ``<pack_id>.json``.
@@ -66,13 +82,31 @@ class EngineIdentityError(RuntimeError):
 class IdentityContinuityError(RuntimeError):
     """A reboot found the stamped checkpoint identity != the recomputed identity.
 
-    The ratified substrate changed while the engine was down, so it would resume
-    the lived state under a DIFFERENT identity than the checkpoint was written
-    under. Raised only under strict identity continuity; the default surfaces a
+    The ratified *pack* substrate changed while the engine was down, so it would
+    resume the lived state under a DIFFERENT identity than the checkpoint was
+    written under. A build-revision-only change is NOT this (ADR-0220) — it
+    resumes. Raised only under strict identity continuity; the default surfaces a
     warning and a queryable break flag (reboot is recovery, not control flow).
     """
 
 
+class IdentityReconciliation(enum.Enum):
+    """The outcome of reconciling a stamped checkpoint identity against the build.
+
+    - ``MATCH``: the stamp is the current (packs-only) scheme and equals the
+      recomputed identity — a clean same-identity resume.
+    - ``MIGRATED``: the stamp is the legacy (code_revision-folded) scheme, and a
+      verifying recompute proves the ratified packs are unchanged — the same
+      identity under an old stamp scheme; resume and re-stamp.
+    - ``DIVERGED``: the ratified packs genuinely differ (a true different
+      identity) — refuse under strict, warn + break otherwise.
+    """
+
+    MATCH = "match"
+    MIGRATED = "migrated"
+    DIVERGED = "diverged"
+
+
 def _pack_content_hash(role: str, pack_id: str) -> str:
     path = _PACKS_ROOT / _ROLE_DIRS[role] / f"{pack_id}.json"
     if not path.exists():
@@ -82,12 +116,13 @@ def _pack_content_hash(role: str, pack_id: str) -> str:
     return hashlib.sha256(path.read_bytes()).hexdigest()
 
 
-def ratified_substrate(pack_ids: dict[str, str], git_revision: str) -> dict[str, Any]:
-    """The canonical, auditable identity tuple.
+def ratified_substrate(pack_ids: dict[str, str]) -> dict[str, Any]:
+    """The canonical, auditable identity tuple — the ratified packs ONLY.
 
-    ``{role: {"pack_id", "sha256"}}`` for every ratified role plus
-    ``"code_revision"``. ``pack_ids`` must name a pack for every role in
-    ``RATIFIED_ROLES``.
+    ``{role: {"pack_id", "sha256"}}`` for every role in ``RATIFIED_ROLES``.
+    ``pack_ids`` must name a pack for every such role. The build revision is
+    deliberately NOT here (ADR-0220) — it is build provenance, recorded in the
+    manifest's ``written_at_revision``, not part of the identity.
     """
     substrate: dict[str, Any] = {}
     for role in RATIFIED_ROLES:
@@ -96,14 +131,12 @@ def ratified_substrate(pack_ids: dict[str, str], git_revision: str) -> dict[str,
             "pack_id": pack_id,
             "sha256": _pack_content_hash(role, pack_id),
         }
-    substrate["code_revision"] = git_revision
     return substrate
 
 
-def compute_engine_identity(pack_ids: dict[str, str], git_revision: str) -> str:
-    """The sha256 EngineIdentity over the ratified substrate tuple."""
+def _hash_substrate(substrate: dict[str, Any]) -> str:
     canonical = json.dumps(
-        ratified_substrate(pack_ids, git_revision),
+        substrate,
         sort_keys=True,
         separators=(",", ":"),
         ensure_ascii=False,
@@ -111,6 +144,24 @@ def compute_engine_identity(pack_ids: dict[str, str], git_revision: str) -> str:
     return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
 
 
+def compute_engine_identity(pack_ids: dict[str, str]) -> str:
+    """The sha256 EngineIdentity over the ratified-packs-only substrate tuple."""
+    return _hash_substrate(ratified_substrate(pack_ids))
+
+
+def compute_legacy_engine_identity(pack_ids: dict[str, str], git_revision: str) -> str:
+    """Reproduce the PRE-split (scheme 1) identity: packs **plus** ``code_revision``.
+
+    Byte-for-byte equivalent to the old ``compute_engine_identity`` so a legacy
+    stamp can be reconstructed for the migration check (``reconcile_loaded_identity``).
+    Do NOT use this to stamp new checkpoints — it exists only to recognise and
+    verify legacy ones.
+    """
+    substrate = ratified_substrate(pack_ids)
+    substrate["code_revision"] = git_revision
+    return _hash_substrate(substrate)
+
+
 def _resolve_pack_ids(config: RuntimeConfig) -> dict[str, str]:
     """Resolve each ratified role to its active pack id (config override or DEFAULT)."""
     return {
@@ -122,13 +173,54 @@ def _resolve_pack_ids(config: RuntimeConfig) -> dict[str, str]:
     }
 
 
-def engine_identity_for_config(config: RuntimeConfig, git_revision: str) -> str:
+def engine_identity_for_config(config: RuntimeConfig) -> str:
     """EngineIdentity for a runtime config (resolving every role to its active pack)."""
-    return compute_engine_identity(_resolve_pack_ids(config), git_revision)
+    return compute_engine_identity(_resolve_pack_ids(config))
 
 
-def ratified_substrate_for_config(
-    config: RuntimeConfig, git_revision: str
-) -> dict[str, Any]:
-    """The auditable identity tuple for a runtime config."""
-    return ratified_substrate(_resolve_pack_ids(config), git_revision)
+def ratified_substrate_for_config(config: RuntimeConfig) -> dict[str, Any]:
+    """The auditable identity tuple (packs only) for a runtime config."""
+    return ratified_substrate(_resolve_pack_ids(config))
+
+
+def reconcile_loaded_identity(
+    config: RuntimeConfig,
+    current_identity: str,
+    *,
+    stored_identity: str,
+    stored_scheme: int,
+    stored_revision: str,
+) -> IdentityReconciliation:
+    """Reconcile a stamped checkpoint identity against the current build (ADR-0220).
+
+    ``current_identity`` is the packs-only identity the current build computes for
+    ``config`` (passed in to avoid recomputation). ``stored_*`` come from the
+    loaded manifest (``engine_identity`` / ``identity_scheme`` / ``written_at_revision``).
+
+    The single source of truth for the runtime load guard AND the workbench
+    continuity reader, so both treat a legacy checkpoint identically:
+
+    - Current scheme (``stored_scheme >= ENGINE_IDENTITY_SCHEME``): direct
+      packs-only compare — ``MATCH`` or ``DIVERGED``.
+    - Legacy scheme: the stored hash folded ``code_revision`` and is NOT directly
+      comparable. Reconstruct the legacy hash from the CURRENT packs and the
+      persisted ``stored_revision``; a match proves the packs are unchanged
+      (``MIGRATED`` — same identity, build-provenance-only divergence). A mismatch
+      means the ratified packs genuinely changed (``DIVERGED``). If the revision
+      is missing we cannot verify, so we conservatively report ``DIVERGED`` rather
+      than blindly migrating (which would swallow a real pack swap).
+    """
+    if stored_scheme >= ENGINE_IDENTITY_SCHEME:
+        return (
+            IdentityReconciliation.MATCH
+            if stored_identity == current_identity
+            else IdentityReconciliation.DIVERGED
+        )
+    if not stored_revision:
+        return IdentityReconciliation.DIVERGED
+    legacy = compute_legacy_engine_identity(_resolve_pack_ids(config), stored_revision)
+    return (
+        IdentityReconciliation.MIGRATED
+        if legacy == stored_identity
+        else IdentityReconciliation.DIVERGED
+    )

core/epistemic_disclosure/__init__.py

@@ -22,6 +22,14 @@ Shipped so far (all off-serving — nothing here imports ``generate.derivation``
   * :mod:`~core.epistemic_disclosure.ask_serving` — a narrow Q1-D served-ASK artifact
     adapter. It validates already-rendered question artifacts and returns a typed
     decision; it does not render prose and does not acquire runtime contemplation.
+  * :mod:`~core.epistemic_disclosure.ask_acquisition` — a serving-safe acquisition
+    seam that gate-checks before provider execution and delegates candidate
+    validation to the ASK artifact adapter. It does not call pass_manager directly.
+  * :mod:`~core.epistemic_disclosure.ask_handle` — the carried-handle acquisition
+    seam: resolves an explicit, content-addressed reference to one already-produced
+    Q1-D artifact into an acquisition-compatible candidate. It never produces,
+    renders, or scans; identity checks only — artifact policy stays delegated to
+    the adapter.
   * :mod:`~core.epistemic_disclosure.verified_contract` (P1-A) — the VERIFIED contract:
     the obligation, the proof shape, the validator, and the single sanctioned route to
     ``EpistemicState.VERIFIED`` / ``DisclosureClaim.VERIFIED``. Contract only — no
@@ -30,6 +38,18 @@ Shipped so far (all off-serving — nothing here imports ``generate.derivation``
 
 from __future__ import annotations
 
+from core.epistemic_disclosure.ask_acquisition import (
+    AskAcquisitionDecision,
+    ContemplationProvider,
+    acquire_served_ask_candidate,
+)
+from core.epistemic_disclosure.ask_handle import (
+    AskArtifactHandle,
+    AskHandleResolution,
+    ResolvedAskCandidate,
+    acquire_served_ask_from_handle,
+    resolve_served_ask_handle,
+)
 from core.epistemic_disclosure.ask_serving import (
     ServedAskDecision,
     evaluate_served_ask,
@@ -66,7 +86,12 @@ __all__ = [
     "DEFAULT_DISCLOSURE_CLAIM",
     "Q1B_ASK_CARVE_OUT",
     "VERIFICATION_OBLIGATION",
+    "AskAcquisitionDecision",
+    "AskArtifactHandle",
+    "AskHandleResolution",
+    "ContemplationProvider",
     "DisclosureClaim",
+    "ResolvedAskCandidate",
     "LimitationAssessment",
     "LimitationKind",
     "MissingSlot",
@@ -77,11 +102,14 @@ __all__ = [
     "VerificationProof",
     "VerificationResult",
     "VerificationVerdict",
+    "acquire_served_ask_candidate",
+    "acquire_served_ask_from_handle",
     "assess_from_attempt",
     "assess_from_family",
     "choose_served_disposition",
     "disclosure_for_verification",
     "evaluate_served_ask",
     "evaluate_verification",
+    "resolve_served_ask_handle",
     "terminal_for_action",
 ]

core/epistemic_disclosure/ask_acquisition.py

@@ -0,0 +1,121 @@
+"""Serving-safe acquisition seam for Stage 2 ASK candidates.
+
+This module owns only the narrow boundary between a serving caller and the
+already-shipped ASK artifact adapter:
+
+1. honor the default-dark ``ask_serving_enabled`` gate before any provider call;
+2. acquire, or accept, a candidate contemplation result;
+3. delegate all artifact validation and served-surface decisioning to
+   :func:`core.epistemic_disclosure.ask_serving.evaluate_served_ask`.
+
+It does not render question prose, does not import the Q1-C renderer, does not
+call ``generate.contemplation.pass_manager`` directly, and does not mutate
+runtime/telemetry schemas. A future runtime slice can supply the provider once
+the legal turn-boundary is explicit.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Any
+
+from core.epistemic_disclosure.ask_serving import ServedAskDecision, evaluate_served_ask
+from core.epistemic_disclosure.disposition import ServedDisposition
+from core.epistemic_questions.serving_gate import ask_serving_enabled
+
+ContemplationProvider = Callable[[], Any | None]
+
+
+@dataclass(frozen=True, slots=True)
+class AskAcquisitionDecision:
+    """Result of the serving-safe ASK acquisition seam."""
+
+    acquired: bool
+    provider_called: bool
+    decision: ServedAskDecision
+
+
+_NO_PROGRESS_FALLBACK = ServedAskDecision(
+    served=False,
+    terminal="NO_PROGRESS",
+    surface="",
+    disposition=ServedDisposition.REFUSE,
+)
+
+
+def _fallback(surface: str) -> ServedAskDecision:
+    return ServedAskDecision(
+        served=False,
+        terminal=_NO_PROGRESS_FALLBACK.terminal,
+        surface=surface,
+        disposition=_NO_PROGRESS_FALLBACK.disposition,
+    )
+
+
+def acquire_served_ask_candidate(
+    config: Any,
+    *,
+    fallback_surface: str,
+    contemplation_result: Any | None = None,
+    provider: ContemplationProvider | None = None,
+) -> AskAcquisitionDecision:
+    """Acquire and evaluate a candidate served-ASK artifact.
+
+    The provider is never called while ``ask_serving_enabled`` is false. That
+    gate-first rule keeps this seam side-effect free under default runtime
+    configuration and prevents accidental contemplation work from changing
+    normal serving behavior.
+
+    If a caller already has a ``ContemplationResult``, pass it via
+    ``contemplation_result``. Otherwise, pass a provider that can return one.
+    The result is delegated to ``evaluate_served_ask``; this seam duplicates no
+    Q1-D artifact validation and constructs no user-facing question text.
+    """
+
+    if not ask_serving_enabled(config):
+        # Preserve any already-known terminal/disposition without causing a
+        # provider side effect. ``evaluate_served_ask`` itself is gate-aware and
+        # will fail closed without reading artifacts when the gate is disabled.
+        if contemplation_result is not None:
+            decision = evaluate_served_ask(config, contemplation_result, fallback_surface)
+        else:
+            decision = _fallback(fallback_surface)
+        return AskAcquisitionDecision(
+            acquired=contemplation_result is not None,
+            provider_called=False,
+            decision=decision,
+        )
+
+    provider_called = False
+    candidate = contemplation_result
+    if candidate is None and provider is not None:
+        provider_called = True
+        try:
+            candidate = provider()
+        except Exception:
+            return AskAcquisitionDecision(
+                acquired=False,
+                provider_called=True,
+                decision=_fallback(fallback_surface),
+            )
+
+    if candidate is None:
+        return AskAcquisitionDecision(
+            acquired=False,
+            provider_called=provider_called,
+            decision=_fallback(fallback_surface),
+        )
+
+    return AskAcquisitionDecision(
+        acquired=True,
+        provider_called=provider_called,
+        decision=evaluate_served_ask(config, candidate, fallback_surface),
+    )
+
+
+__all__ = [
+    "AskAcquisitionDecision",
+    "ContemplationProvider",
+    "acquire_served_ask_candidate",
+]

core/epistemic_disclosure/ask_handle.py

@@ -0,0 +1,271 @@
+"""Carried-handle acquisition seam for served ASK (Stage 2).
+
+The missing-boundary analysis
+(``docs/analysis/ask-runtime-wiring-missing-boundary-2026-06-10.md``) established
+that the serving turn has no lawful way to obtain a ``QUESTION_NEEDED``
+``ContemplationResult``: the only producer is the off-serving contemplation pass,
+and scanning the ``teaching/questions`` sink would be new, unspecified acquisition
+logic. This module is the recommended unblocking slice — **carried-handle
+acquisition**: an explicit, caller-carried reference to one already-produced Q1-D
+``DeliveredQuestion`` artifact is *resolved* (never produced, never rendered,
+never discovered by scan) into an acquisition-compatible candidate for the
+existing ASK serving stack.
+
+The handle's provenance is the Q1-D artifact's own content address. The producer
+(:mod:`core.epistemic_questions.delivery`) writes each artifact to
+``{content_hash}.json`` where ``content_hash`` is
+``sha256(f"{blocking_reason}:{slot_name}:{text}")`` over the artifact's own
+fields. Resolution therefore verifies three independent things:
+
+1. the handle is structurally valid (non-empty path, 64-hex content hash, and the
+   path's filename is exactly the producer's content-addressed name);
+2. the referenced artifact exists and parses as a JSON object;
+3. the artifact's body re-hashes to the handle's content hash — a stale,
+   replaced, or tampered artifact fails closed here.
+
+Everything else — ``status == "question_only"``, ``requires_review``,
+``served is False``, ``answer_binding`` absence, question text/slot validity, the
+``question_path != proposal_path`` collision — is **delegated** to
+:func:`core.epistemic_disclosure.ask_serving.evaluate_served_ask` via
+:func:`core.epistemic_disclosure.ask_acquisition.acquire_served_ask_candidate`.
+This seam owns handle resolution only; it duplicates no artifact serving policy.
+
+**Trust boundary.** A handle is trusted plumbing state, never user text: it must
+be constructed by a reviewed production path (a future producer→serving plumbing
+slice), not parsed out of a chat turn. The Q1-D artifact carries no turn/case
+provenance fields today, so the handle is *content-addressed*, not *turn-stamped*
+— turn-addressability is exactly the explicitness of carrying the handle into the
+turn. If a future slice adds turn provenance to the artifact, resolution should
+check it here.
+
+**Forbidden moves this module never makes:** call
+``generate.contemplation.pass_manager.contemplate``; import or call
+``core.epistemic_questions.render`` / ``render_question`` /
+``deliver_ask``; construct question prose; scan ``teaching/questions`` or any
+other sink (no glob/iterdir/listdir — the only filesystem access is reading the
+single explicitly-named artifact, and only after the default-dark
+``ask_serving_enabled`` gate passes).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+from core.epistemic_disclosure.ask_acquisition import (
+    AskAcquisitionDecision,
+    acquire_served_ask_candidate,
+)
+from core.epistemic_questions.serving_gate import ask_serving_enabled
+
+#: The producer's content address is a sha256 hex digest — nothing else is a
+#: structurally valid handle hash.
+_CONTENT_HASH_RE = re.compile(r"^[0-9a-f]{64}$")
+
+#: String form of ``Terminal.QUESTION_NEEDED``. Deliberately a literal: importing
+#: ``generate.contemplation`` from this serving-side seam would import the
+#: off-serving pass manager package, which the boundary forbids.
+#: ``evaluate_served_ask`` compares the stringified terminal, so the literal is
+#: contract-equivalent.
+_QUESTION_NEEDED = "QUESTION_NEEDED"
+
+
+@dataclass(frozen=True, slots=True)
+class AskArtifactHandle:
+    """An explicit, carried reference to one already-produced Q1-D artifact.
+
+    ``question_path`` names the single artifact file; ``content_hash`` is the
+    producer's content address for it (also its filename stem). ``proposal_path``
+    is carried through so the downstream adapter can enforce the
+    question/proposal collision rule — it is ``None`` for a pure ASK delivery
+    (the Q1-D producer never co-assigns the two).
+    """
+
+    question_path: str
+    content_hash: str
+    proposal_path: str | None = None
+
+
+@dataclass(frozen=True, slots=True)
+class ResolvedAskCandidate:
+    """An acquisition-compatible candidate produced by handle resolution.
+
+    Duck-types exactly the fields ``evaluate_served_ask`` reads off a
+    ``ContemplationResult`` (``terminal`` / ``question_path`` /
+    ``proposal_path``); ``terminal`` is always the ``QUESTION_NEEDED`` string. It
+    carries no question text — the served surface is read from the artifact by
+    the adapter, never constructed here.
+    """
+
+    terminal: str
+    question_path: str
+    proposal_path: str | None = None
+
+
+@dataclass(frozen=True, slots=True)
+class AskHandleResolution:
+    """The typed outcome of resolving one carried handle.
+
+    ``reason`` is a stable snake_case token naming the verification step that
+    rejected the handle (or ``"resolved"``). ``candidate`` is populated iff
+    ``resolved`` is True.
+    """
+
+    resolved: bool
+    reason: str
+    candidate: ResolvedAskCandidate | None = None
+
+
+def _rejected(reason: str) -> AskHandleResolution:
+    return AskHandleResolution(resolved=False, reason=reason, candidate=None)
+
+
+def _paths_name_same_file(question_path: Path, proposal_path_value: str) -> bool:
+    """Canonical-path collision check for the question/proposal pair.
+
+    Compares *resolved* canonical paths, not raw string spellings, so an absolute
+    ``question_path`` and a relative ``proposal_path`` (or any two differently
+    spelled paths) that name the same file collide and fail closed. Resolution is
+    best-effort (``strict=False``); if a path cannot be canonicalized (e.g. a
+    symlink loop), fall back to the raw-spelling comparison, which still catches
+    the exact-string collision.
+    """
+    try:
+        return question_path.resolve(strict=False) == Path(proposal_path_value).resolve(
+            strict=False
+        )
+    except (OSError, RuntimeError, ValueError):
+        return str(question_path) == str(proposal_path_value)
+
+
+def _recompute_content_hash(payload: Any) -> str | None:
+    """Recompute the producer's content address from the artifact body.
+
+    Mirrors ``DeliveredQuestion.content_hash`` exactly: the digest payload is
+    ``f"{blocking_reason}:{slot_name}:{text}"`` with a slot-less artifact
+    contributing the empty string for ``slot_name`` (the producer serializes that
+    case as ``null``). Returns ``None`` when the fields needed to re-derive the
+    address are absent or mistyped — a malformed body, by construction.
+    """
+    if not isinstance(payload, dict):
+        return None
+    blocking_reason = payload.get("blocking_reason")
+    question = payload.get("question")
+    if not isinstance(blocking_reason, str) or not isinstance(question, dict):
+        return None
+    slot_name = question.get("slot_name")
+    if slot_name is None:
+        slot_name = ""
+    text = question.get("text")
+    if not isinstance(slot_name, str) or not isinstance(text, str):
+        return None
+    digest_payload = f"{blocking_reason}:{slot_name}:{text}"
+    return hashlib.sha256(digest_payload.encode("utf-8")).hexdigest()
+
+
+def resolve_served_ask_handle(config: Any, handle: Any) -> AskHandleResolution:
+    """Resolve an explicit carried handle into an acquisition-compatible candidate.
+
+    Gate-first: while ``ask_serving_enabled`` is false (the default), this
+    function performs **no filesystem access at all** and rejects with
+    ``"gate_disabled"`` — the seam is side-effect free under default runtime
+    configuration. Past the gate, the handle is verified structurally, the named
+    artifact is read (one explicit path, never a scan), and the body must
+    re-hash to the handle's content address. Any failure rejects with a typed
+    reason; resolution never raises on bad input.
+
+    The returned candidate has passed *identity* checks only. Q1-D field policy
+    (status/review/served/answer-binding/text/slot/collision) is still owned by
+    ``evaluate_served_ask`` downstream — pass the candidate through
+    :func:`acquire_served_ask_from_handle` or
+    ``acquire_served_ask_candidate(..., contemplation_result=candidate)``.
+    """
+    if not ask_serving_enabled(config):
+        return _rejected("gate_disabled")
+    if handle is None:
+        return _rejected("missing_handle")
+
+    question_path_value = getattr(handle, "question_path", None)
+    content_hash_value = getattr(handle, "content_hash", None)
+    proposal_path_value = getattr(handle, "proposal_path", None)
+
+    if not isinstance(question_path_value, str) or not question_path_value.strip():
+        return _rejected("malformed_handle")
+    if (
+        not isinstance(content_hash_value, str)
+        or _CONTENT_HASH_RE.fullmatch(content_hash_value) is None
+    ):
+        return _rejected("malformed_handle")
+    if proposal_path_value is not None and not isinstance(proposal_path_value, str):
+        return _rejected("malformed_handle")
+
+    question_path = Path(question_path_value)
+    if question_path.name != f"{content_hash_value}.json":
+        # Not the producer's content-addressed filename for this hash — the
+        # handle does not name a producer-written artifact identity.
+        return _rejected("handle_address_mismatch")
+    if proposal_path_value is not None and _paths_name_same_file(
+        question_path, proposal_path_value
+    ):
+        return _rejected("path_collision")
+
+    if not question_path.is_file():
+        return _rejected("missing_artifact")
+    try:
+        payload = json.loads(question_path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return _rejected("malformed_artifact")
+
+    recomputed = _recompute_content_hash(payload)
+    if recomputed is None:
+        return _rejected("malformed_artifact")
+    if recomputed != content_hash_value:
+        # The file at the named path is not the artifact the handle was issued
+        # for — stale, replaced, or tampered. Fail closed.
+        return _rejected("content_hash_mismatch")
+
+    return AskHandleResolution(
+        resolved=True,
+        reason="resolved",
+        candidate=ResolvedAskCandidate(
+            terminal=_QUESTION_NEEDED,
+            question_path=str(question_path),
+            proposal_path=proposal_path_value,
+        ),
+    )
+
+
+def acquire_served_ask_from_handle(
+    config: Any,
+    *,
+    handle: Any,
+    fallback_surface: str,
+) -> AskAcquisitionDecision:
+    """Resolve a carried handle and pass the candidate through the existing stack.
+
+    The lawful provider boundary in one call: an unresolved handle (gate dark,
+    structural failure, missing/stale artifact) yields the standing fallback
+    decision from ``acquire_served_ask_candidate`` with no candidate — the
+    fallback surface is returned unchanged. A resolved candidate is handed to the
+    existing acquisition seam, which delegates all Q1-D artifact policy to
+    ``evaluate_served_ask``. No serving rule is re-implemented here.
+    """
+    resolution = resolve_served_ask_handle(config, handle)
+    return acquire_served_ask_candidate(
+        config,
+        fallback_surface=fallback_surface,
+        contemplation_result=resolution.candidate,
+    )
+
+
+__all__ = [
+    "AskArtifactHandle",
+    "AskHandleResolution",
+    "ResolvedAskCandidate",
+    "acquire_served_ask_from_handle",
+    "resolve_served_ask_handle",
+]

core/response_governance/frame_verdict.py

@@ -0,0 +1,101 @@
+"""Default-dark FrameVerdict -> response-governance disposition (ADR-0222 §7/§14, B4 PR-4).
+
+The ONLY lawful surface path for a closed-world verdict. It lowers a ``FrameVerdict`` to a
+served disposition through the EXISTING ``core.epistemic_disclosure`` tables (no parallel
+object), then hands the committed surface to the unchanged ``shape_surface`` gate.
+
+DEFAULT-DARK: nothing in the live runtime calls this; the open-world
+``govern_response`` / ``shape_surface`` STRICT path is byte-identical (this module changes no
+existing file). INV-31 A3 is preserved because this module is NOT imported by
+``core/response_governance/__init__`` or the open-world spine — only by the (future)
+closed-world serving path and its tests.
+
+A forged dict / untagged object cannot widen serving: the TYPE is the closed-world tag — only
+a genuine ``FrameVerdict`` instance is accepted; anything else raises (INV-31 B2).
+
+Mapping (ADR §7): committed answers (``entailed_true`` / ``entailed_false``) -> COMMIT at
+``EpistemicState.INFERRED`` + ``DisclosureClaim.NONE`` (never EVIDENCED, never VERIFIED);
+``contradiction`` -> REPORT; ``undetermined`` -> REFUSE; ``scope_boundary`` -> EXPLAIN.
+``entailed_false`` is a grounded "No" — a committed answer, NOT a contradiction, NOT a refusal,
+NOT a new ``LimitationKind``.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from core.epistemic_disclosure.disclosure_claim import DisclosureClaim
+from core.epistemic_disclosure.disposition import (
+    ServedDisposition,
+    choose_served_disposition,
+)
+from core.epistemic_disclosure.limitation import LimitationAssessment
+from core.epistemic_state import EpistemicState
+from generate.frame_verdict.types import FrameVerdict, FrameVerdictKind
+
+
+@dataclass(frozen=True, slots=True)
+class ClosedWorldDisposition:
+    """The default-dark served-disposition envelope for a closed-world verdict."""
+
+    served_disposition: ServedDisposition
+    epistemic_state: EpistemicState
+    disclosure_claim: DisclosureClaim
+    surface: str
+    verdict: FrameVerdictKind
+
+
+def disposition_for_frame_verdict(verdict: FrameVerdict) -> ClosedWorldDisposition:
+    """Lower a ``FrameVerdict`` to a served disposition via the existing disclosure tables.
+    Forged / untagged objects raise — the type is the closed-world tag."""
+    if not isinstance(verdict, FrameVerdict):
+        raise TypeError(
+            "closed-world disposition requires a genuine FrameVerdict — a forged or untagged "
+            "object cannot widen serving (INV-31 B2)."
+        )
+
+    limitation: LimitationAssessment | None
+    match verdict.verdict:
+        case FrameVerdictKind.ENTAILED_TRUE | FrameVerdictKind.ENTAILED_FALSE:
+            # a committed grounded answer ("Yes" / "No"). INFERRED + DisclosureClaim.NONE
+            # (ADR §7/§14); never EVIDENCED, never VERIFIED. NOT a contradiction, NOT a
+            # limitation — entailed_false is an answer, not a block.
+            state, limitation = EpistemicState.INFERRED, None
+            surface = "Yes." if verdict.verdict is FrameVerdictKind.ENTAILED_TRUE else "No."
+        case FrameVerdictKind.CONTRADICTION:
+            state = EpistemicState.CONTRADICTED
+            limitation = LimitationAssessment(
+                limitation_kind="contradiction", resolution_action="report_contradiction",
+                epistemic_state=state, owner_organ="frame_verdict",
+                blocking_reason="frame_inconsistent",
+            )
+            surface = "The frame's premises are inconsistent."
+        case FrameVerdictKind.SCOPE_BOUNDARY:
+            state = EpistemicState.SCOPE_BOUNDARY
+            limitation = LimitationAssessment(
+                limitation_kind="scope_boundary", resolution_action="refuse_known_boundary",
+                epistemic_state=state, owner_organ="frame_verdict",
+                blocking_reason="outside_the_declared_frame",
+            )
+            surface = "That is outside the declared frame."
+        case FrameVerdictKind.UNDETERMINED:
+            state = EpistemicState.UNDETERMINED
+            limitation = LimitationAssessment(
+                limitation_kind="hard_boundary", resolution_action="refuse_known_boundary",
+                epistemic_state=state, owner_organ="frame_verdict",
+                blocking_reason="not_entailed_in_frame",
+            )
+            surface = "Undetermined within the frame."
+        case _:  # pragma: no cover — exhaustive over the 5-member enum; loud if extended
+            raise AssertionError(f"unhandled FrameVerdictKind: {verdict.verdict!r}")
+
+    disposition = choose_served_disposition(
+        epistemic_state=state, limitation=limitation, disclosure_claim=DisclosureClaim.NONE,
+    )
+    return ClosedWorldDisposition(
+        served_disposition=disposition,
+        epistemic_state=state,
+        disclosure_claim=DisclosureClaim.NONE,
+        surface=surface,
+        verdict=verdict.verdict,
+    )

demos/claude_hybrid_verification/.gitignore

@@ -0,0 +1,2 @@
+out/
+__pycache__/

demos/claude_hybrid_verification/README.md

@@ -0,0 +1,153 @@
+# Claude → CORE Hybrid Verification Demo
+
+A narrow, auditable proof path for one claim:
+
+```text
+Claude/Fable proposes.
+CORE validates.
+CORE verifies/refuses/asks.
+The trace proves.
+```
+
+A frontier LLM acts as a **System 1 semantic proposer** — it decides *what to
+ask* and frames a bounded reasoning task as a typed tool call.  CORE acts as a
+**deterministic System 2 verifier/executor** — it re-derives everything itself,
+keeps sole acceptance authority, refuses or asks when it cannot honestly answer,
+and emits a deterministic, replayable trace for every decision.  The proposer
+has **no execution authority and no commit path**: there is no field in the tool
+schema through which an answer, a derivation, or an acceptance decision could
+travel, and the response's `authority_path` names every decider — the proposer
+appears nowhere in it.
+
+"System 1/System 2" is used here as framing for the boundary, not as
+established CORE vocabulary.  The protocol posture follows ADR-0140 (proposed;
+ecosystem protocols such as MCP stay at the perimeter as boundary adapters) and
+ADR-0018 (accepted; CORE does not become a host for external tools, and no CORE
+operator calls a stochastic model): the tool contract is **MCP-shaped** for perimeter
+compatibility, served by a local script — it is a proof of the boundary, not a
+production MCP server.
+
+## What is real CORE here
+
+* **The derivation lane, end to end.**  `problem_text` runs live through the
+  ADR-0184 semantic-state worlds (`generate/derivation/state/source.py`), the
+  replay bridge, the cross-composer candidate pool (`generate/derivation/pool.py`),
+  and the self-verification gates (`generate/derivation/verify.py`).  Nothing is
+  pre-computed: the engine re-derives on every call, and the committed expected
+  artifacts only *check* the result.
+* **The audit layer.**  Every executed derivation runs the ADR-0184 S4b checks
+  live (an `invalid` payload executes nothing, by design):
+  `authority_violations` (the pool's commit law re-derived from trace data) and
+  `replay_faithfulness_report` (every candidate tied 1:1 to its semantic world).
+  For problems inside the ADR-0184 equivalence corpus the live trace is also
+  compared against the frozen `evals/gsm8k_math/equivalence/v1` reference
+  (`replay_equivalence_status`).
+* **The ASK stack.**  The ask leg is the real Q1 epistemic-disclosure chain:
+  organ routing (`core/comprehension_attempt/router.py`) → limitation
+  classification (`core/epistemic_disclosure/limitation.py`) → grounded-only
+  rendering and delivery (`core/epistemic_questions/delivery.py`, which writes a
+  content-addressed artifact) → the carried-handle serving seam
+  (`core/epistemic_disclosure/ask_handle.py` → `ask_acquisition` →
+  `ask_serving`).  The question text is produced by CORE's wrong=0-guarded
+  renderer during the run — never authored by the demo, never by the proposer.
+* **Determinism.**  `run_demo.py` executes every scenario twice through fresh
+  output directories and requires byte-identical responses; `trace_hash` is the
+  SHA-256 of the canonical response envelope.
+
+## What is simulated
+
+* **The System 1 side.**  Scenario payloads in `scenarios.jsonl` are clearly
+  labeled, committed **Claude/Fable-style System 1 proposal fixtures**.  No
+  model API is called, no network is used, and no API key is required.  (A live
+  proposer would change nothing on the System 2 side: the boundary validates
+  payloads, not their author.)
+
+## What is deliberately NOT claimed
+
+* **The off-serving derivation pool is not a wrong=0 oracle over arbitrary
+  text.**  Measured on the 937-problem ADR-0184 equivalence corpus: the pool
+  commits 231 resolutions, and 118 of them disagree with lane gold (dominated
+  by rate/unit-price mis-reads — `each`/`per`/`for` cues — plus fraction,
+  percent, and multi-entity-total shapes whose soundness gates pass while the
+  reading is wrong).  CORE's committed wrong=0 claims are *lane-scoped and
+  sealed* (see `CLAIMS.md`); this demo therefore adds its own fail-closed gate
+  on top of the pool rather than borrowing those claims:
+
+  > `status: "verified"` requires a pool commit **and** clean commit-law and
+  > faithfulness audits **and** an entry in the committed, gold-audited
+  > `envelope.json` **and** a byte-identical match between the live derivation
+  > trace and the envelope's pinned reference.
+
+  Scenario `s4` exists to make this visible: the pool commits an answer that
+  happens to match gold, and the demo still refuses
+  (`outside_demo_serving_envelope`), because an unaudited commit served as
+  "verified" would be a false epistemic status.  This is a **bounded
+  transition / verification guarantee** over the audited envelope — not an
+  absolute safety guarantee and not a general math-capability claim.
+* **No production MCP.**  The schema is MCP-shaped; there is no server, no
+  transport, no session management, and no claim of MCP production readiness.
+* **No runtime/serving change.**  The public chat runtime, CLAIMS, metrics,
+  telemetry schema, runtime schema, and lane pins are untouched.  The ASK
+  serving gate stays dark by default repo-wide; this demo enables it only
+  through its own local config object passed to the seam.
+
+## The five scenarios
+
+| id | status | what it proves |
+| --- | --- | --- |
+| `s1-verified-grounded-chain` | `verified` | A grounded gain/loss chain commits (26 dollars), the envelope authorizes it, and the live trace byte-matches both the demo pin and the ADR-0184 corpus pin. |
+| `s2-refused-disagreement` | `refused` | Two self-verifying readings derive 24 and 36 — **both wrong** (gold 12).  The disagreement rule refuses both instead of guessing. |
+| `s3-ask-missing-total` | `ask` | The pool refuses; R2 identifies the missing total count; the Q1 stack renders, delivers, and serves a grounded question through the content-hash-verified handle seam. |
+| `s4-refused-outside-envelope` | `refused` | A pool commit **outside the audited envelope** is refused even though it happens to match gold — no false epistemic status. |
+| `s5-invalid-answer-smuggling` | `invalid` | A payload carrying `proposed_answer`/`confidence` is rejected at the typed boundary; no derivation executes. |
+
+## Running
+
+```bash
+UV_PROJECT_ENVIRONMENT=/tmp/core-hybrid-demo-uv uv run \
+    python demos/claude_hybrid_verification/run_demo.py
+```
+
+Each scenario is run twice; the run fails on any determinism break, drift from
+`expected/*.json`, or status mismatch.  `--json` emits the machine summary;
+`--update-expected` re-pins the reference artifacts (the diff is the audit
+trail — never re-pin a failure you cannot explain).
+
+## The handoff, end to end
+
+```mermaid
+sequenceDiagram
+    participant S1 as Claude/Fable (System 1, fixture)
+    participant B as Typed boundary (tool_schema.json)
+    participant D as Derivation lane (worlds → replay → pool → verify)
+    participant A as Audits (commit law, faithfulness, ADR-0184 pin)
+    participant E as Demo envelope (gold-audited pin)
+    participant Q as Q1 ASK stack (router → limitation → deliver → handle)
+    S1->>B: tool call {problem_text, …}
+    B-->>S1: invalid (nothing executed)
+    B->>D: problem_text only
+    D->>A: canonical trace
+    A->>E: pool committed?
+    E-->>S1: verified {answer, trace_hash}
+    E-->>S1: refused {outside_demo_serving_envelope}
+    D->>Q: pool refused
+    Q-->>S1: ask {grounded question}
+    Q-->>S1: refused {typed reason}
+```
+
+## Files
+
+* `tool_schema.json` — the MCP-shaped tool definition (`core.semantic_derivation.verify`).
+* `schema.py` — typed payload validation, interpreted from the schema file itself.
+* `verify_tool.py` — the System 2 boundary (imports **nothing from `generate.*`**;
+  the derivation lane is reached only through the audited ADR-0184 trace facade).
+* `envelope.json` — the gold-audited serving envelope (what may be served as verified).
+* `scenarios.jsonl` — the committed System 1 proposal fixtures.
+* `expected/*.json` — pinned deterministic response artifacts (the screenshot/log
+  excerpts, and the replay reference).
+* `run_demo.py` — the local runner (double-run determinism + pin verification).
+
+Tests: `tests/test_claude_hybrid_verification_demo.py` proves the no-bypass
+properties (schema rejection, envelope fail-closure, tamper detection on the
+pool facade and on the question artifact, determinism, structural import
+allowlist, and the gold re-audit of every envelope entry).

demos/claude_hybrid_verification/__init__.py

@@ -0,0 +1,11 @@
+"""Claude-to-CORE hybrid verification demo (System 1 proposes, System 2 decides).
+
+A narrow, auditable proof path: a Claude/Fable-style System 1 proposal arrives as
+an MCP-shaped tool call; CORE's deterministic derivation lane re-derives, the
+verifier/pool — hardened by the demo's gold-audited serving envelope — keep
+sole acceptance authority, unsupported cases refuse or ask,
+and a deterministic replay/provenance trace proves every decision.
+
+See ``README.md`` in this directory for the boundary contract and the honesty
+ledger (what is real CORE, what is simulated, and what is NOT claimed).
+"""

demos/claude_hybrid_verification/envelope.json

@@ -0,0 +1,17 @@
+{
+  "_doc": "Demo serving envelope (ADR-0184 hybrid verification demo). The ONLY problems the demo may serve as verified: each entry was audited against its lane gold at pin time, and a live run must reproduce the pinned derivation trace byte-for-byte (derivation_trace_sha) before the answer is served. A pool commit without an authorized entry is refused (outside_demo_serving_envelope): measured on the 937-problem ADR-0184 equivalence corpus, 118 of the off-serving pool's 231 commits disagree with lane gold, so a bare pool commit is not a serving license. Adding an entry requires: lane gold provenance, a reviewed diff, and tests/test_claude_hybrid_verification_demo.py green (it re-audits every entry against the named lane file).",
+  "entries": {
+    "05c04e82e9d39fb57f1d9581e61968ff4410a65f999638b69145d9cadc76f4d6": {
+      "answer": 26.0,
+      "answer_unit": "dollars",
+      "derivation_trace_sha": "093816f1c077ad63e3e5c4648c5f721875b126bbba6aaa41173fa5c2643798ea",
+      "gold": {
+        "case_id": "gma-141",
+        "expected_answer": 26.0,
+        "expected_unit": "dollars",
+        "lane": "evals/gsm8k_math/public/v1/cases.jsonl"
+      },
+      "preview": "Sara has 32 dollars. Sara earns 15 dollars. She uses 21 dollars."
+    }
+  }
+}

demos/claude_hybrid_verification/expected/s1-verified-grounded-chain.json

@@ -0,0 +1,340 @@
+{
+  "answer": 26.0,
+  "answer_unit": "dollars",
+  "authority_path": [
+    "demos.claude_hybrid_verification.schema.validate_payload",
+    "generate.derivation.state.source.semantic_state_candidates",
+    "generate.derivation.pool.pooled_candidates",
+    "generate.derivation.verify.classify_derivation",
+    "generate.derivation.pool.resolve_pooled",
+    "generate.derivation.state.provenance.faithfulness_violations",
+    "evals.gsm8k_math.equivalence.trace.authority_violations",
+    "adr0184_pinned_corpus(evals/gsm8k_math/equivalence/v1)",
+    "demo_serving_envelope(envelope.json)"
+  ],
+  "question": null,
+  "refusal_reason": null,
+  "replay_equivalence_status": "equivalent_to_adr0184_pin",
+  "request_id": "demo-s1",
+  "status": "verified",
+  "surface": "26 dollars",
+  "tool": "core.semantic_derivation.verify",
+  "trace": {
+    "adr0184_pin": {
+      "corpus_sha": "58c2b219530e817e5eb4d0eda83b552767415139379b75b5aed1f76cb20ab5af",
+      "status": "equivalent_to_adr0184_pin"
+    },
+    "ask": {
+      "attempted": false,
+      "blocking_reason": null,
+      "content_hash": null,
+      "detail": "not_attempted",
+      "owner_organ": null,
+      "question": null,
+      "question_ref": null,
+      "served": false
+    },
+    "commit_law_violations": [],
+    "derivation": {
+      "classifications": [
+        "complete"
+      ],
+      "compose": {
+        "answer": 26.0,
+        "answer_unit": "dollars",
+        "derivation": {
+          "answer": 26.0,
+          "answer_unit": "dollars",
+          "start": [
+            32.0,
+            "dollars",
+            "32"
+          ],
+          "steps": [
+            [
+              "add",
+              15.0,
+              "dollars",
+              "15",
+              "earns",
+              false
+            ],
+            [
+              "subtract",
+              21.0,
+              "dollars",
+              "21",
+              "uses",
+              false
+            ]
+          ]
+        }
+      },
+      "pooled": [
+        {
+          "answer": 26.0,
+          "answer_unit": "dollars",
+          "start": [
+            32.0,
+            "dollars",
+            "32"
+          ],
+          "steps": [
+            [
+              "add",
+              15.0,
+              "dollars",
+              "15",
+              "earns",
+              false
+            ],
+            [
+              "subtract",
+              21.0,
+              "dollars",
+              "21",
+              "uses",
+              false
+            ]
+          ]
+        }
+      ],
+      "preview": "Sara has 32 dollars. Sara earns 15 dollars. She uses 21 dollars.",
+      "problem_sha": "05c04e82e9d39fb57f1d9581e61968ff4410a65f999638b69145d9cadc76f4d6",
+      "resolution": {
+        "answer": 26.0,
+        "answer_unit": "dollars",
+        "derivation": {
+          "answer": 26.0,
+          "answer_unit": "dollars",
+          "start": [
+            32.0,
+            "dollars",
+            "32"
+          ],
+          "steps": [
+            [
+              "add",
+              15.0,
+              "dollars",
+              "15",
+              "earns",
+              false
+            ],
+            [
+              "subtract",
+              21.0,
+              "dollars",
+              "21",
+              "uses",
+              false
+            ]
+          ]
+        }
+      },
+      "semantic": [
+        {
+          "answer": 26.0,
+          "answer_unit": "dollars",
+          "start": [
+            32.0,
+            "dollars",
+            "32"
+          ],
+          "steps": [
+            [
+              "add",
+              15.0,
+              "dollars",
+              "15",
+              "earns",
+              false
+            ],
+            [
+              "subtract",
+              21.0,
+              "dollars",
+              "21",
+              "uses",
+              false
+            ]
+          ]
+        },
+        {
+          "answer": 26.0,
+          "answer_unit": "dollars",
+          "start": [
+            32.0,
+            "dollars",
+            "32"
+          ],
+          "steps": [
+            [
+              "add",
+              15.0,
+              "dollars",
+              "15",
+              "earns",
+              false
+            ],
+            [
+              "subtract",
+              21.0,
+              "dollars",
+              "21",
+              "uses",
+              false
+            ]
+          ]
+        },
+        {
+          "answer": 26.0,
+          "answer_unit": "dollars",
+          "start": [
+            32.0,
+            "dollars",
+            "32"
+          ],
+          "steps": [
+            [
+              "add",
+              15.0,
+              "dollars",
+              "15",
+              "earns",
+              false
+            ],
+            [
+              "subtract",
+              21.0,
+              "dollars",
+              "21",
+              "uses",
+              false
+            ]
+          ]
+        }
+      ],
+      "worlds": [
+        [
+          [
+            "set",
+            "Sara",
+            "dollars",
+            32.0,
+            "dollars",
+            "32",
+            "set",
+            0
+          ],
+          [
+            "gain",
+            "Sara",
+            "dollars",
+            15.0,
+            "dollars",
+            "15",
+            "earns",
+            1
+          ],
+          [
+            "loss",
+            "Sara",
+            "dollars",
+            21.0,
+            "dollars",
+            "21",
+            "uses",
+            2
+          ]
+        ],
+        [
+          [
+            "set",
+            "Sara",
+            "dollars",
+            32.0,
+            "dollars",
+            "32",
+            "set",
+            0
+          ],
+          [
+            "gain",
+            "Sara",
+            "dollars",
+            15.0,
+            "dollars",
+            "15",
+            "earns",
+            1
+          ],
+          [
+            "loss",
+            "Sara",
+            "dollars",
+            21.0,
+            "dollars",
+            "21",
+            "uses",
+            2
+          ]
+        ],
+        [
+          [
+            "set",
+            "Sara",
+            "dollars",
+            32.0,
+            "dollars",
+            "32",
+            "set",
+            0
+          ],
+          [
+            "gain",
+            "Sara",
+            "dollars",
+            15.0,
+            "dollars",
+            "15",
+            "earns",
+            1
+          ],
+          [
+            "loss",
+            "Sara",
+            "dollars",
+            21.0,
+            "dollars",
+            "21",
+            "uses",
+            2
+          ]
+        ]
+      ],
+      "wrapper_equal": true
+    },
+    "derivation_trace_sha": "093816f1c077ad63e3e5c4648c5f721875b126bbba6aaa41173fa5c2643798ea",
+    "faithfulness_violations": []
+  },
+  "trace_hash": "c9b26b346d9539bd0e920c6114abfb15205e2535ee3887ba278de4a327b0b785",
+  "trace_summary": {
+    "ask": {
+      "attempted": false,
+      "detail": "not_attempted",
+      "served": false
+    },
+    "classifications": [
+      "complete"
+    ],
+    "commit_law_violations": 0,
+    "demo_envelope": "authorized",
+    "faithfulness_violations": 0,
+    "pool_committed": true,
+    "pooled_candidates": 1,
+    "problem_sha": "05c04e82e9d39fb57f1d9581e61968ff4410a65f999638b69145d9cadc76f4d6",
+    "semantic_candidates": 3,
+    "semantic_worlds": 3
+  }
+}

demos/claude_hybrid_verification/expected/s2-refused-disagreement.json

@@ -0,0 +1,132 @@
+{
+  "answer": null,
+  "answer_unit": null,
+  "authority_path": [
+    "demos.claude_hybrid_verification.schema.validate_payload",
+    "generate.derivation.state.source.semantic_state_candidates",
+    "generate.derivation.pool.pooled_candidates",
+    "generate.derivation.verify.classify_derivation",
+    "generate.derivation.pool.resolve_pooled",
+    "generate.derivation.state.provenance.faithfulness_violations",
+    "evals.gsm8k_math.equivalence.trace.authority_violations",
+    "adr0184_pinned_corpus(evals/gsm8k_math/equivalence/v1)",
+    "demo_serving_envelope(envelope.json)",
+    "core.comprehension_attempt.router.route_setup",
+    "core.epistemic_disclosure.limitation.assess_from_attempt"
+  ],
+  "question": null,
+  "refusal_reason": "candidate_disagreement",
+  "replay_equivalence_status": "equivalent_to_adr0184_pin",
+  "request_id": "demo-s2",
+  "status": "refused",
+  "surface": "CORE refuses to serve an answer: candidate_disagreement.",
+  "tool": "core.semantic_derivation.verify",
+  "trace": {
+    "adr0184_pin": {
+      "corpus_sha": "58c2b219530e817e5eb4d0eda83b552767415139379b75b5aed1f76cb20ab5af",
+      "status": "equivalent_to_adr0184_pin"
+    },
+    "ask": {
+      "attempted": true,
+      "blocking_reason": null,
+      "content_hash": null,
+      "detail": "no_ask_mapped_attempt",
+      "owner_organ": null,
+      "question": null,
+      "question_ref": null,
+      "served": false
+    },
+    "commit_law_violations": [],
+    "derivation": {
+      "classifications": [
+        "complete",
+        "complete"
+      ],
+      "compose": null,
+      "pooled": [
+        {
+          "answer": 24.0,
+          "answer_unit": "years",
+          "start": [
+            8.0,
+            "years",
+            "8"
+          ],
+          "steps": [
+            [
+              "multiply",
+              3.0,
+              "times",
+              "three",
+              "times",
+              false
+            ]
+          ]
+        },
+        {
+          "answer": 36.0,
+          "answer_unit": "years",
+          "start": [
+            8.0,
+            "years",
+            "8"
+          ],
+          "steps": [
+            [
+              "multiply",
+              3.0,
+              "times",
+              "three",
+              "times",
+              false
+            ],
+            [
+              "multiply",
+              0.5,
+              "",
+              "half",
+              "half",
+              true
+            ],
+            [
+              "multiply",
+              3.0,
+              "",
+              "three",
+              "times",
+              true
+            ]
+          ]
+        }
+      ],
+      "preview": "Tom\u2019s cat is 8 years old.  His rabbit is half the age of his cat",
+      "problem_sha": "001b8d49564428c71da082b214a3ae411fdc2a2ab7ee30701feb01dbbc5b26a2",
+      "resolution": null,
+      "semantic": [],
+      "worlds": [],
+      "wrapper_equal": true
+    },
+    "derivation_trace_sha": "7a507a346d45642c6a53a0a00c03c679ad503ef918176287ef0622dda389950e",
+    "faithfulness_violations": []
+  },
+  "trace_hash": "c73e264092bb69406c0fa4d44c258ef88c669c6a0a7830bd2dac9b53d851c92b",
+  "trace_summary": {
+    "ask": {
+      "attempted": true,
+      "detail": "no_ask_mapped_attempt",
+      "served": false
+    },
+    "classifications": [
+      "complete",
+      "complete"
+    ],
+    "commit_law_violations": 0,
+    "demo_envelope": "not_applicable",
+    "faithfulness_violations": 0,
+    "pool_committed": false,
+    "pooled_candidates": 2,
+    "problem_sha": "001b8d49564428c71da082b214a3ae411fdc2a2ab7ee30701feb01dbbc5b26a2",
+    "semantic_candidates": 0,
+    "semantic_worlds": 0
+  }
+}

demos/claude_hybrid_verification/expected/s3-ask-missing-total.json

@@ -0,0 +1,157 @@
+{
+  "answer": null,
+  "answer_unit": null,
+  "authority_path": [
+    "demos.claude_hybrid_verification.schema.validate_payload",
+    "generate.derivation.state.source.semantic_state_candidates",
+    "generate.derivation.pool.pooled_candidates",
+    "generate.derivation.verify.classify_derivation",
+    "generate.derivation.pool.resolve_pooled",
+    "generate.derivation.state.provenance.faithfulness_violations",
+    "evals.gsm8k_math.equivalence.trace.authority_violations",
+    "adr0184_pinned_corpus(evals/gsm8k_math/equivalence/v1)",
+    "demo_serving_envelope(envelope.json)",
+    "core.comprehension_attempt.router.route_setup",
+    "core.epistemic_disclosure.limitation.assess_from_attempt",
+    "core.epistemic_questions.delivery.emit_question",
+    "core.epistemic_disclosure.ask_handle.resolve_served_ask_handle",
+    "core.epistemic_disclosure.ask_acquisition.acquire_served_ask_candidate",
+    "core.epistemic_disclosure.ask_serving.evaluate_served_ask"
+  ],
+  "question": "To answer this, one more value is still needed \u2014 a whole-number count \u2014 that the problem does not state. What is it?",
+  "refusal_reason": null,
+  "replay_equivalence_status": "not_in_adr0184_corpus",
+  "request_id": "demo-s3",
+  "status": "ask",
+  "surface": "To answer this, one more value is still needed \u2014 a whole-number count \u2014 that the problem does not state. What is it?",
+  "tool": "core.semantic_derivation.verify",
+  "trace": {
+    "adr0184_pin": {
+      "corpus_sha": "58c2b219530e817e5eb4d0eda83b552767415139379b75b5aed1f76cb20ab5af",
+      "status": "not_in_adr0184_corpus"
+    },
+    "ask": {
+      "attempted": true,
+      "blocking_reason": "missing_total_count",
+      "content_hash": "f5f89caf473c040db84bb173dcb05459df661da67a5484aa428d239b3b06bee6",
+      "detail": "served",
+      "owner_organ": "r2_constraints",
+      "question": "To answer this, one more value is still needed \u2014 a whole-number count \u2014 that the problem does not state. What is it?",
+      "question_ref": "questions/f5f89caf473c040db84bb173dcb05459df661da67a5484aa428d239b3b06bee6.json",
+      "served": true
+    },
+    "commit_law_violations": [],
+    "derivation": {
+      "classifications": [
+        null,
+        "exempt",
+        "complete"
+      ],
+      "compose": null,
+      "pooled": [
+        {
+          "answer": 1500.0,
+          "answer_unit": "students",
+          "start": [
+            50.0,
+            "students",
+            "50"
+          ],
+          "steps": [
+            [
+              "multiply",
+              30.0,
+              "students",
+              "30",
+              "each",
+              false
+            ]
+          ]
+        },
+        {
+          "answer": 390000.0,
+          "answer_unit": "students",
+          "start": [
+            50.0,
+            "students",
+            "50"
+          ],
+          "steps": [
+            [
+              "multiply",
+              30.0,
+              "students",
+              "30",
+              "each",
+              false
+            ],
+            [
+              "multiply",
+              260.0,
+              "students",
+              "260",
+              "each",
+              false
+            ]
+          ]
+        },
+        {
+          "answer": 340.0,
+          "answer_unit": "students",
+          "start": [
+            50.0,
+            "students",
+            "50"
+          ],
+          "steps": [
+            [
+              "add",
+              30.0,
+              "students",
+              "30",
+              "total",
+              false
+            ],
+            [
+              "add",
+              260.0,
+              "students",
+              "260",
+              "total",
+              false
+            ]
+          ]
+        }
+      ],
+      "preview": "Each large bus holds 50 students and each small bus holds 30 stu",
+      "problem_sha": "6b6fba986355b30be9e548687f44ed69e987c94c1c97527197c1988ef984e1a0",
+      "resolution": null,
+      "semantic": [],
+      "worlds": [],
+      "wrapper_equal": true
+    },
+    "derivation_trace_sha": "368abca1932f3f61a566a5a4aae1d5f5dac61e525c7237595665eca5bd48b88d",
+    "faithfulness_violations": []
+  },
+  "trace_hash": "3c751beda82ca08cbafdc0932e0e868bc744507500b08dfd7f624dc017b5e5fc",
+  "trace_summary": {
+    "ask": {
+      "attempted": true,
+      "detail": "served",
+      "served": true
+    },
+    "classifications": [
+      null,
+      "exempt",
+      "complete"
+    ],
+    "commit_law_violations": 0,
+    "demo_envelope": "not_applicable",
+    "faithfulness_violations": 0,
+    "pool_committed": false,
+    "pooled_candidates": 3,
+    "problem_sha": "6b6fba986355b30be9e548687f44ed69e987c94c1c97527197c1988ef984e1a0",
+    "semantic_candidates": 0,
+    "semantic_worlds": 0
+  }
+}

demos/claude_hybrid_verification/expected/s4-refused-outside-envelope.json

@@ -0,0 +1,262 @@
+{
+  "answer": null,
+  "answer_unit": null,
+  "authority_path": [
+    "demos.claude_hybrid_verification.schema.validate_payload",
+    "generate.derivation.state.source.semantic_state_candidates",
+    "generate.derivation.pool.pooled_candidates",
+    "generate.derivation.verify.classify_derivation",
+    "generate.derivation.pool.resolve_pooled",
+    "generate.derivation.state.provenance.faithfulness_violations",
+    "evals.gsm8k_math.equivalence.trace.authority_violations",
+    "adr0184_pinned_corpus(evals/gsm8k_math/equivalence/v1)",
+    "demo_serving_envelope(envelope.json)"
+  ],
+  "question": null,
+  "refusal_reason": "outside_demo_serving_envelope",
+  "replay_equivalence_status": "equivalent_to_adr0184_pin",
+  "request_id": "demo-s4",
+  "status": "refused",
+  "surface": "CORE refuses to serve an answer: outside_demo_serving_envelope.",
+  "tool": "core.semantic_derivation.verify",
+  "trace": {
+    "adr0184_pin": {
+      "corpus_sha": "58c2b219530e817e5eb4d0eda83b552767415139379b75b5aed1f76cb20ab5af",
+      "status": "equivalent_to_adr0184_pin"
+    },
+    "ask": {
+      "attempted": false,
+      "blocking_reason": null,
+      "content_hash": null,
+      "detail": "not_attempted",
+      "owner_organ": null,
+      "question": null,
+      "question_ref": null,
+      "served": false
+    },
+    "commit_law_violations": [],
+    "derivation": {
+      "classifications": [
+        "complete"
+      ],
+      "compose": {
+        "answer": 25.0,
+        "answer_unit": "toy",
+        "derivation": {
+          "answer": 25.0,
+          "answer_unit": "toy",
+          "start": [
+            17.0,
+            "toy",
+            "17"
+          ],
+          "steps": [
+            [
+              "add",
+              8.0,
+              "toy",
+              "8",
+              "more",
+              false
+            ]
+          ]
+        }
+      },
+      "pooled": [
+        {
+          "answer": 25.0,
+          "answer_unit": "toy",
+          "start": [
+            17.0,
+            "toy",
+            "17"
+          ],
+          "steps": [
+            [
+              "add",
+              8.0,
+              "toy",
+              "8",
+              "more",
+              false
+            ]
+          ]
+        }
+      ],
+      "preview": "Jack has 17 toy cars. His dad buys him 8 more. How many toy cars",
+      "problem_sha": "01012b9e7188752f5c7e1b5ba7b14c24efa8d4bb63b8657f6e8c4abff568d682",
+      "resolution": {
+        "answer": 25.0,
+        "answer_unit": "toy",
+        "derivation": {
+          "answer": 25.0,
+          "answer_unit": "toy",
+          "start": [
+            17.0,
+            "toy",
+            "17"
+          ],
+          "steps": [
+            [
+              "add",
+              8.0,
+              "toy",
+              "8",
+              "more",
+              false
+            ]
+          ]
+        }
+      },
+      "semantic": [
+        {
+          "answer": 25.0,
+          "answer_unit": "toy",
+          "start": [
+            17.0,
+            "toy",
+            "17"
+          ],
+          "steps": [
+            [
+              "add",
+              8.0,
+              "toy",
+              "8",
+              "more",
+              false
+            ]
+          ]
+        },
+        {
+          "answer": 25.0,
+          "answer_unit": "toy",
+          "start": [
+            17.0,
+            "toy",
+            "17"
+          ],
+          "steps": [
+            [
+              "add",
+              8.0,
+              "toy",
+              "8",
+              "more",
+              false
+            ]
+          ]
+        },
+        {
+          "answer": 25.0,
+          "answer_unit": "toy",
+          "start": [
+            17.0,
+            "toy",
+            "17"
+          ],
+          "steps": [
+            [
+              "add",
+              8.0,
+              "toy",
+              "8",
+              "more",
+              false
+            ]
+          ]
+        }
+      ],
+      "worlds": [
+        [
+          [
+            "set",
+            "Jack",
+            "toy",
+            17.0,
+            "toy",
+            "17",
+            "set",
+            0
+          ],
+          [
+            "gain",
+            "Jack",
+            "toy",
+            8.0,
+            "",
+            "8",
+            "more",
+            1
+          ]
+        ],
+        [
+          [
+            "set",
+            "Jack",
+            "toy",
+            17.0,
+            "toy",
+            "17",
+            "set",
+            0
+          ],
+          [
+            "gain",
+            "Jack",
+            "toy",
+            8.0,
+            "",
+            "8",
+            "more",
+            1
+          ]
+        ],
+        [
+          [
+            "set",
+            "Jack",
+            "toy",
+            17.0,
+            "toy",
+            "17",
+            "set",
+            0
+          ],
+          [
+            "gain",
+            "Jack",
+            "toy",
+            8.0,
+            "",
+            "8",
+            "more",
+            1
+          ]
+        ]
+      ],
+      "wrapper_equal": true
+    },
+    "derivation_trace_sha": "17eb9f1a0d9b46b6f26341257b533ec916cb530466994af8ebc23e18cdc29b2d",
+    "faithfulness_violations": []
+  },
+  "trace_hash": "48d5b24a135bb8556d8d8185a939f417b21aebeb2f6a135edda3d1473a5871c7",
+  "trace_summary": {
+    "ask": {
+      "attempted": false,
+      "detail": "not_attempted",
+      "served": false
+    },
+    "classifications": [
+      "complete"
+    ],
+    "commit_law_violations": 0,
+    "demo_envelope": "absent",
+    "faithfulness_violations": 0,
+    "pool_committed": true,
+    "pooled_candidates": 1,
+    "problem_sha": "01012b9e7188752f5c7e1b5ba7b14c24efa8d4bb63b8657f6e8c4abff568d682",
+    "semantic_candidates": 3,
+    "semantic_worlds": 3
+  }
+}

demos/claude_hybrid_verification/expected/s5-invalid-answer-smuggling.json

@@ -0,0 +1,22 @@
+{
+  "answer": null,
+  "answer_unit": null,
+  "authority_path": [
+    "demos.claude_hybrid_verification.schema.validate_payload"
+  ],
+  "question": null,
+  "refusal_reason": null,
+  "replay_equivalence_status": "not_evaluated",
+  "request_id": "demo-s5",
+  "status": "invalid",
+  "surface": "Invalid tool payload: unexpected property 'confidence' (additionalProperties is false; the proposer cannot smuggle answers, derivations, or directives); unexpected property 'proposed_answer' (additionalProperties is false; the proposer cannot smuggle answers, derivations, or directives)",
+  "tool": "core.semantic_derivation.verify",
+  "trace": null,
+  "trace_hash": "22748265a24cc919f95dff87e18aa3a00228d97417d0c39001631d9795c65be4",
+  "trace_summary": {
+    "validation_errors": [
+      "unexpected property 'confidence' (additionalProperties is false; the proposer cannot smuggle answers, derivations, or directives)",
+      "unexpected property 'proposed_answer' (additionalProperties is false; the proposer cannot smuggle answers, derivations, or directives)"
+    ]
+  }
+}

demos/claude_hybrid_verification/run_demo.py

@@ -0,0 +1,182 @@
+"""Run the Claude-to-CORE hybrid verification demo.
+
+Replays every committed System 1 fixture scenario through the
+``core.semantic_derivation.verify`` boundary, twice each through fresh output
+directories, and proves three things per scenario:
+
+1. **Determinism** — the two runs are byte-identical (canonical JSON).
+2. **Replay** — the response byte-matches the committed reference artifact under
+   ``expected/`` (the demo-local pin; the audit trail for any change is the
+   artifact diff, mirroring ``scripts/verify_semantic_equivalence.py``).
+3. **Authority** — the recorded status matches the scenario's expectation, so a
+   verifier/pool/envelope bypass cannot hide behind a green run.
+
+Usage:
+
+    UV_PROJECT_ENVIRONMENT=/tmp/core-hybrid-demo-uv uv run \
+        python demos/claude_hybrid_verification/run_demo.py
+    python demos/claude_hybrid_verification/run_demo.py --json
+    python demos/claude_hybrid_verification/run_demo.py --update-expected  # re-pin (reviewed diffs only)
+
+Exit code: non-zero on any determinism break, expected-artifact drift, or
+status mismatch.  ``--update-expected`` rewrites ``expected/*.json``; never use
+it to silence a failure you cannot explain.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import shutil
+import sys
+from pathlib import Path
+from typing import Any
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(REPO_ROOT))
+
+from demos.claude_hybrid_verification.verify_tool import (  # noqa: E402
+    TOOL_NAME,
+    load_tool_schema,
+    run_tool,
+)
+
+_HERE = Path(__file__).resolve().parent
+SCENARIOS_PATH = _HERE / "scenarios.jsonl"
+EXPECTED_DIR = _HERE / "expected"
+DEFAULT_OUT_DIR = _HERE / "out"
+
+
+def load_scenarios() -> list[dict[str, Any]]:
+    scenarios: list[dict[str, Any]] = []
+    with SCENARIOS_PATH.open(encoding="utf-8") as handle:
+        for line in handle:
+            line = line.strip()
+            if line:
+                scenarios.append(json.loads(line))
+    return scenarios
+
+
+def expected_path(scenario_id: str) -> Path:
+    return EXPECTED_DIR / f"{scenario_id}.json"
+
+
+def render_artifact(response: dict[str, Any]) -> str:
+    """Canonical committed-artifact encoding (diff-friendly, deterministic)."""
+    return json.dumps(response, sort_keys=True, indent=2) + "\n"
+
+
+def run_scenario(scenario: dict[str, Any], out_dir: Path) -> dict[str, Any]:
+    tool_call = scenario["system1"]["tool_call"]
+    if tool_call["name"] != TOOL_NAME:
+        raise ValueError(
+            f"scenario {scenario['scenario_id']!r} names tool {tool_call['name']!r}; "
+            f"this demo serves only {TOOL_NAME!r}"
+        )
+    run_a = run_tool(tool_call["arguments"], out_dir=out_dir / "run_a")
+    run_b = run_tool(tool_call["arguments"], out_dir=out_dir / "run_b")
+    if render_artifact(run_a) != render_artifact(run_b):
+        raise AssertionError(
+            f"scenario {scenario['scenario_id']!r}: two runs of identical arguments "
+            "diverged — determinism contract broken"
+        )
+    return run_a
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--out", type=Path, default=DEFAULT_OUT_DIR)
+    parser.add_argument("--json", action="store_true", help="machine-readable summary")
+    parser.add_argument(
+        "--update-expected",
+        action="store_true",
+        help="rewrite expected/*.json from live runs (the diff is the audit trail)",
+    )
+    args = parser.parse_args()
+
+    out_dir: Path = args.out
+    if out_dir.exists():
+        # Refuse to delete a directory this demo did not produce: only the
+        # default location or a directory carrying a prior run's summary.json
+        # marker is cleared.  (A user-supplied --out pointing at unrelated data
+        # must not be rm -rf'd.)
+        if out_dir.resolve() != DEFAULT_OUT_DIR.resolve() and not (
+            out_dir / "summary.json"
+        ).exists():
+            print(
+                f"refusing to clear {out_dir}: not the default out dir and no "
+                "summary.json marker from a prior demo run",
+                file=sys.stderr,
+            )
+            return 2
+        shutil.rmtree(out_dir)
+    out_dir.mkdir(parents=True)
+
+    # The tool definition the System 1 side is shown — recorded alongside results.
+    schema_doc = load_tool_schema()
+
+    results: list[dict[str, Any]] = []
+    all_passed = True
+    for scenario in load_scenarios():
+        scenario_id = scenario["scenario_id"]
+        scenario_dir = out_dir / scenario_id
+        scenario_dir.mkdir(parents=True, exist_ok=True)
+        response = run_scenario(scenario, scenario_dir)
+        artifact = render_artifact(response)
+        (scenario_dir / "response.json").write_text(artifact, encoding="utf-8")
+
+        problems: list[str] = []
+        if response["status"] != scenario["expected_status"]:
+            problems.append(
+                f"status {response['status']!r} != expected {scenario['expected_status']!r}"
+            )
+        ref = expected_path(scenario_id)
+        if args.update_expected:
+            EXPECTED_DIR.mkdir(exist_ok=True)
+            ref.write_text(artifact, encoding="utf-8")
+        elif not ref.exists():
+            problems.append("no committed expected artifact (run --update-expected and review)")
+        elif ref.read_text(encoding="utf-8") != artifact:
+            problems.append("response drifted from committed expected artifact")
+
+        all_passed &= not problems
+        results.append(
+            {
+                "scenario_id": scenario_id,
+                "status": response["status"],
+                "surface": response["surface"],
+                "trace_hash": response["trace_hash"],
+                "replay_equivalence_status": response["replay_equivalence_status"],
+                "passed": not problems,
+                "problems": problems,
+            }
+        )
+
+    summary = {
+        "tool": schema_doc["name"],
+        "scenarios": results,
+        "all_passed": all_passed,
+        "updated_expected": bool(args.update_expected),
+    }
+    summary_text = json.dumps(summary, sort_keys=True, indent=2) + "\n"
+    (out_dir / "summary.json").write_text(summary_text, encoding="utf-8")
+
+    if args.json:
+        print(summary_text, end="")
+    else:
+        for row in results:
+            mark = "PASS" if row["passed"] else "FAIL"
+            print(f"[{mark}] {row['scenario_id']}: {row['status']}")
+            print(f"       surface: {row['surface'][:96]}")
+            print(f"       trace_hash: {row['trace_hash'][:16]}…  "
+                  f"replay: {row['replay_equivalence_status']}")
+            for problem in row["problems"]:
+                print(f"       ✗ {problem}")
+        print(f"{sum(r['passed'] for r in results)}/{len(results)} scenarios passed "
+              f"-> {'OK' if all_passed else 'FAILED'}")
+
+    return 0 if all_passed else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

demos/claude_hybrid_verification/scenarios.jsonl

@@ -0,0 +1,5 @@
+{"scenario_id": "s1-verified-grounded-chain", "title": "Verified: grounded accumulation chain inside the audited envelope", "system1": {"framing": "Claude/Fable-style System 1 proposal — static fixture payload; no model API was called and no network is used", "tool_call": {"name": "core.semantic_derivation.verify", "arguments": {"problem_text": "Sara has 32 dollars. Sara earns 15 dollars. She uses 21 dollars. How many dollars does Sara have left?", "domain_hint": "gsm8k_math", "request_id": "demo-s1", "return_trace": true}}}, "expected_status": "verified", "note": "Pool commits 26 dollars (gain+loss chain, every gate passes); the demo envelope authorizes it (gold-audited: evals/gsm8k_math/public/v1 case gma-141, expected 26)."}
+{"scenario_id": "s2-refused-disagreement", "title": "Refused: two self-verifying readings disagree, so CORE will not guess", "system1": {"framing": "Claude/Fable-style System 1 proposal — static fixture payload; no model API was called and no network is used", "tool_call": {"name": "core.semantic_derivation.verify", "arguments": {"problem_text": "Tom’s cat is 8 years old.  His rabbit is half the age of his cat.  His dog is three times as old as his rabbit.  How old is the dog?", "domain_hint": "gsm8k_math", "request_id": "demo-s2", "return_trace": true}}}, "expected_status": "refused", "note": "Two complete readings derive 24 and 36; both are wrong (gold 12, holdout case gsm8k-holdout-dev-v1-0005). The disagreement rule refuses BOTH — exactly the wrong=0 behavior the demo exists to show."}
+{"scenario_id": "s3-ask-missing-total", "title": "Ask: CORE asks for the missing datum instead of inventing it", "system1": {"framing": "Claude/Fable-style System 1 proposal — static fixture payload; no model API was called and no network is used", "tool_call": {"name": "core.semantic_derivation.verify", "arguments": {"problem_text": "Each large bus holds 50 students and each small bus holds 30 students. The buses carry 260 students in total. How many large buses are there?", "domain_hint": "gsm8k_math", "request_id": "demo-s3", "return_trace": true}}}, "expected_status": "ask", "note": "The pool refuses (an additive mis-read of 340 is blocked by a disagreeing rival reading); the R2 constraint organ identifies the missing total bus count (missing_total_count, evals/constraint_oracle/r2_gold.jsonl case r2-011-missing-total-count); the Q1 stack renders and serves a grounded question through the carried-handle seam."}
+{"scenario_id": "s4-refused-outside-envelope", "title": "Refused: a pool commit outside the audited envelope is not served", "system1": {"framing": "Claude/Fable-style System 1 proposal — static fixture payload; no model API was called and no network is used", "tool_call": {"name": "core.semantic_derivation.verify", "arguments": {"problem_text": "Jack has 17 toy cars. His dad buys him 8 more. How many toy cars does Jack have?", "domain_hint": "gsm8k_math", "request_id": "demo-s4", "return_trace": true}}}, "expected_status": "refused", "note": "The pool commits 25 (which happens to match gold: evals/gsm8k_math/practice/v1 case gsm8k-practice-v1-0022, answer 25), but this problem is deliberately NOT in the demo envelope — the demo still refuses, because the off-serving derivation lane is not a wrong=0 oracle over arbitrary text and an unaudited commit must not be served as verified. No false epistemic status."}
+{"scenario_id": "s5-invalid-answer-smuggling", "title": "Invalid: the proposer tries to smuggle an answer through the payload", "system1": {"framing": "Claude/Fable-style System 1 proposal — static fixture payload (deliberately malformed); no model API was called and no network is used", "tool_call": {"name": "core.semantic_derivation.verify", "arguments": {"problem_text": "Each large bus holds 50 students and each small bus holds 30 students. The buses carry 260 students in total. How many large buses are there?", "proposed_answer": 340, "confidence": "high", "request_id": "demo-s5"}}}, "expected_status": "invalid", "note": "additionalProperties is false: there is no field through which the proposer can assert an answer, a derivation, or an acceptance decision. The payload is rejected at the typed boundary and no derivation is executed."}

demos/claude_hybrid_verification/schema.py

@@ -0,0 +1,130 @@
+"""Typed validation of the MCP-shaped tool payload — the System 1/System 2 boundary.
+
+The proposer's entire contribution arrives as the ``arguments`` object of an
+MCP-shaped tool call.  This module validates it against ``tool_schema.json``
+**interpretively**: the constraint set (required keys, types, lengths, enum,
+pattern, ``additionalProperties: false``) is read from the committed schema file
+itself, so the executable boundary cannot silently drift from the documented one.
+
+Fail-closed and dependency-free: only the narrow JSON-Schema subset the tool
+schema actually uses is interpreted, and a schema feature outside that subset
+raises loudly at load time rather than being silently ignored.  Validation never
+executes any derivation — an invalid payload is rejected before CORE runs.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from functools import lru_cache
+from pathlib import Path
+from typing import Any, Final
+
+_HERE: Final[Path] = Path(__file__).resolve().parent
+TOOL_SCHEMA_PATH: Final[Path] = _HERE / "tool_schema.json"
+
+#: The JSON-Schema keywords this interpreter understands, per property spec.
+#: ``description``/``default`` are documentation-only.  Anything else in the
+#: committed schema is a contract this validator does not enforce -> loud error.
+_SUPPORTED_PROPERTY_KEYWORDS: Final[frozenset[str]] = frozenset(
+    {"type", "minLength", "maxLength", "enum", "pattern", "description", "default"}
+)
+_SUPPORTED_TYPES: Final[dict[str, type]] = {"string": str, "boolean": bool}
+
+
+#: The top-level inputSchema keywords this interpreter understands.  A top-level
+#: combinator (``allOf``, ``patternProperties``, ...) would be silently
+#: unenforced, so its presence is a loud error, same as an unknown property
+#: keyword.
+_SUPPORTED_SCHEMA_KEYWORDS: Final[frozenset[str]] = frozenset(
+    {"type", "properties", "required", "additionalProperties"}
+)
+
+
+@lru_cache(maxsize=1)
+def load_tool_schema() -> dict[str, Any]:
+    """The committed MCP-shaped tool definition.  Parsed once and cached: treat
+    the returned mapping as read-only (callers only read or compare it)."""
+    return json.loads(TOOL_SCHEMA_PATH.read_text(encoding="utf-8"))
+
+
+@lru_cache(maxsize=1)
+def _input_schema() -> dict[str, Any]:
+    schema = load_tool_schema()["inputSchema"]
+    if schema.get("type") != "object" or schema.get("additionalProperties") is not False:
+        raise ValueError(
+            "tool inputSchema must be a closed object "
+            "(type: object, additionalProperties: false) — the no-smuggling boundary"
+        )
+    unsupported_top = set(schema) - _SUPPORTED_SCHEMA_KEYWORDS
+    if unsupported_top:
+        raise ValueError(
+            f"inputSchema uses unsupported top-level keywords {sorted(unsupported_top)}; "
+            "extend the validator before extending the schema"
+        )
+    for name, spec in schema["properties"].items():
+        unsupported = set(spec) - _SUPPORTED_PROPERTY_KEYWORDS
+        if unsupported:
+            raise ValueError(
+                f"inputSchema property {name!r} uses unsupported keywords "
+                f"{sorted(unsupported)}; extend the validator before extending the schema"
+            )
+        if spec.get("type") not in _SUPPORTED_TYPES:
+            raise ValueError(f"inputSchema property {name!r} has unsupported type")
+    return schema
+
+
+def _clip(name: object) -> str:
+    """Bounded repr for echoing an unknown property name — untrusted caller text
+    must not round-trip unbounded into surfaces or artifacts."""
+    rendered = repr(name)
+    return rendered if len(rendered) <= 80 else rendered[:79] + "…"
+
+
+def validate_payload(arguments: Any) -> tuple[str, ...]:
+    """Every way ``arguments`` violates the tool's input schema — empty iff valid.
+
+    Deterministic order (sorted unknown keys first, then schema-declaration
+    order), so the same bad payload always yields the same error surface.
+    """
+    schema = _input_schema()
+    if not isinstance(arguments, dict):
+        return (f"arguments must be a JSON object, got {type(arguments).__name__}",)
+
+    errors: list[str] = []
+    properties: dict[str, Any] = schema["properties"]
+
+    for unknown in sorted(str(key) for key in set(arguments) - set(properties)):
+        errors.append(
+            f"unexpected property {_clip(unknown)} (additionalProperties is false; "
+            "the proposer cannot smuggle answers, derivations, or directives)"
+        )
+
+    for required in schema["required"]:
+        if required not in arguments:
+            errors.append(f"missing required property {required!r}")
+
+    for name, spec in properties.items():
+        if name not in arguments:
+            continue
+        value = arguments[name]
+        expected = _SUPPORTED_TYPES[spec["type"]]
+        # bool is an int subclass; an exact-type check keeps booleans out of
+        # string seats and vice versa.
+        if type(value) is not expected:
+            errors.append(f"property {name!r} must be {spec['type']}")
+            continue
+        if isinstance(value, str):
+            if "minLength" in spec and len(value) < spec["minLength"]:
+                errors.append(f"property {name!r} shorter than {spec['minLength']}")
+            if "maxLength" in spec and len(value) > spec["maxLength"]:
+                errors.append(f"property {name!r} longer than {spec['maxLength']}")
+            if "enum" in spec and value not in spec["enum"]:
+                errors.append(f"property {name!r} must be one of {spec['enum']}")
+            if "pattern" in spec and re.fullmatch(spec["pattern"], value) is None:
+                errors.append(f"property {name!r} does not match {spec['pattern']!r}")
+
+    return tuple(errors)
+
+
+__all__ = ["TOOL_SCHEMA_PATH", "load_tool_schema", "validate_payload"]

demos/claude_hybrid_verification/tool_schema.json

@@ -0,0 +1,76 @@
+{
+  "name": "core.semantic_derivation.verify",
+  "title": "CORE semantic derivation verifier (deterministic System 2)",
+  "description": "Submit one bounded natural-language arithmetic word problem to CORE's deterministic derivation lane. CORE re-derives the answer itself from the problem text (ADR-0184 semantic-state worlds -> replay -> candidate pool -> self-verification gates) and returns verified | refused | ask | invalid plus a deterministic, replayable trace. The caller proposes a problem; it cannot propose an answer, a derivation, or an acceptance decision -- the input schema has no field through which any of those could travel, and unknown fields are rejected. This schema is MCP-shaped for perimeter compatibility (ADR-0140, proposed: ecosystem protocols stay at the perimeter); it is a local demo contract, not a production MCP server.",
+  "inputSchema": {
+    "type": "object",
+    "properties": {
+      "problem_text": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 2000,
+        "description": "The bounded reasoning task, verbatim natural language. This is the ONLY semantic content the proposer contributes."
+      },
+      "domain_hint": {
+        "type": "string",
+        "enum": ["gsm8k_math"],
+        "description": "Optional advisory routing hint. Grants no authority and changes no acceptance decision."
+      },
+      "request_id": {
+        "type": "string",
+        "pattern": "^[A-Za-z0-9._-]{1,64}$",
+        "description": "Optional caller-chosen correlation id, echoed verbatim in the response."
+      },
+      "return_trace": {
+        "type": "boolean",
+        "default": true,
+        "description": "When false, the full trace body is omitted from the response; trace_hash is still computed over the full trace envelope."
+      }
+    },
+    "required": ["problem_text"],
+    "additionalProperties": false
+  },
+  "outputSchema": {
+    "type": "object",
+    "properties": {
+      "tool": { "const": "core.semantic_derivation.verify" },
+      "request_id": { "type": ["string", "null"] },
+      "status": {
+        "type": "string",
+        "enum": ["verified", "refused", "ask", "invalid"],
+        "description": "verified: CORE's pool committed AND the demo serving envelope authorizes it. refused: fail-closed, with a typed reason. ask: CORE asks for the one missing datum (Q1 epistemic-disclosure stack). invalid: the payload failed typed validation; nothing was executed."
+      },
+      "surface": { "type": "string" },
+      "answer": { "type": ["number", "null"] },
+      "answer_unit": { "type": ["string", "null"] },
+      "refusal_reason": { "type": ["string", "null"] },
+      "question": { "type": ["string", "null"] },
+      "authority_path": {
+        "type": "array",
+        "items": { "type": "string" },
+        "description": "The CORE authorities consulted, in order. The proposer appears nowhere in this list."
+      },
+      "replay_equivalence_status": {
+        "type": "string",
+        "enum": [
+          "equivalent_to_adr0184_pin",
+          "drift_from_adr0184_pin",
+          "not_in_adr0184_corpus",
+          "not_evaluated"
+        ]
+      },
+      "trace_summary": { "type": "object" },
+      "trace": { "type": ["object", "null"] },
+      "trace_hash": {
+        "type": "string",
+        "description": "SHA-256 over the canonical JSON of this response with trace included and trace_hash excluded."
+      }
+    },
+    "required": ["tool", "status", "surface", "authority_path", "trace_hash"]
+  },
+  "x_demo_notes": {
+    "posture": "MCP-shaped local demo contract; proof of a boundary, not a polished product and not production MCP.",
+    "system1": "The caller is a Claude/Fable-style System 1 proposer. Demo invocations use clearly-labeled static fixture payloads; no model API is called and no network is used.",
+    "guarantee_language": "Bounded transition / verification guarantee over the audited demo envelope; no absolute safety guarantee is claimed."
+  }
+}

demos/claude_hybrid_verification/verify_tool.py

@@ -0,0 +1,501 @@
+"""The System 2 side of the boundary: typed payload in, audited decision out.
+
+This module is deliberately unable to commit an answer on its own:
+
+* It imports **nothing from ``generate.*``** — the derivation lane is consulted
+  exclusively through the ADR-0184 S4b audited trace facade
+  (:mod:`evals.gsm8k_math.equivalence.trace`), whose ``problem_trace`` runs the
+  real semantic-state worlds -> replay -> pool -> verifier pipeline and returns
+  pure data.  The demo cannot construct a ``Resolution``, call the pool, or touch
+  a composer; it can only read what the authorities decided.
+* ``status == "verified"`` requires ALL of: the pool committed a resolution; the
+  trace passes the commit-law audit (:func:`authority_violations`) and the
+  world-faithfulness audit (:func:`replay_faithfulness_report`); the problem is in
+  the committed, gold-audited **demo serving envelope** (``envelope.json``); and
+  the live derivation trace byte-matches the envelope's pinned reference.  A pool
+  commit outside that envelope is REFUSED — the off-serving derivation lane is
+  not a wrong=0 oracle over arbitrary text (measured: 118 of its 231 commits on
+  the 937-problem ADR-0184 corpus disagree with lane gold), and serving such a
+  commit would be a false epistemic status.  Fail-closed beats impressive.
+* The ASK leg never fabricates a question: a pool refusal (no committed
+  resolution) is routed through the real organs (``route_setup`` ->
+  ``assess_from_attempt``) and a question exists only
+  if the Q1-D producer (:func:`emit_question`) renders one under its wrong=0
+  grounding guards; it is then served only through the carried-handle seam
+  (:mod:`core.epistemic_disclosure.ask_handle`), whose content-hash verification
+  and artifact policy stay sole authority over the served text.
+
+The ASK serving gate is dark by default repo-wide; this demo enables it ONLY via
+its own local config object (:data:`DEMO_ASK_SERVING_CONFIG`), never by touching
+``core.config``.  Trust boundary: ``problem_text`` is untrusted text and is
+handed only to organs built for raw problem text; the question handle is
+constructed here (demo-scoped plumbing) from the producer's own content-addressed
+output, never parsed from caller input.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+from dataclasses import dataclass
+from functools import lru_cache
+from pathlib import Path
+from typing import Any, Final
+
+from core.comprehension_attempt.router import route_setup
+from core.epistemic_disclosure.ask_acquisition import acquire_served_ask_candidate
+from core.epistemic_disclosure.ask_handle import (
+    AskArtifactHandle,
+    resolve_served_ask_handle,
+)
+from core.epistemic_disclosure.limitation import LimitationAssessment, assess_from_attempt
+from core.epistemic_questions.delivery import emit_question
+from core.epistemic_questions.serving_gate import ask_serving_enabled
+from evals.gsm8k_math.equivalence.trace import (
+    authority_violations,
+    load_expected_traces,
+    load_manifest,
+    problem_trace,
+    replay_faithfulness_report,
+    trace_line,
+)
+
+from demos.claude_hybrid_verification.schema import load_tool_schema, validate_payload
+
+_HERE: Final[Path] = Path(__file__).resolve().parent
+ENVELOPE_PATH: Final[Path] = _HERE / "envelope.json"
+
+TOOL_NAME: Final[str] = "core.semantic_derivation.verify"
+
+#: Stable authority-path tokens — the module-qualified deciders, in consulted
+#: order, listed ONLY when actually consulted (an unconsulted authority in this
+#: list would itself be a false epistemic label).  The proposer appears nowhere
+#: in this list; that absence is the demo's thesis.
+_AUTHORITIES_DERIVATION: Final[tuple[str, ...]] = (
+    "demos.claude_hybrid_verification.schema.validate_payload",
+    "generate.derivation.state.source.semantic_state_candidates",
+    "generate.derivation.pool.pooled_candidates",
+    "generate.derivation.verify.classify_derivation",
+    "generate.derivation.pool.resolve_pooled",
+    "generate.derivation.state.provenance.faithfulness_violations",
+    "evals.gsm8k_math.equivalence.trace.authority_violations",
+    "adr0184_pinned_corpus(evals/gsm8k_math/equivalence/v1)",
+    "demo_serving_envelope(envelope.json)",
+)
+#: The ASK pipeline in stage order; :func:`_attempt_ask` reports the prefix it
+#: actually reached, so a gate-dark or no-ask refusal never names organs that
+#: were not consulted.
+_AUTHORITIES_ASK: Final[tuple[str, ...]] = (
+    "core.comprehension_attempt.router.route_setup",
+    "core.epistemic_disclosure.limitation.assess_from_attempt",
+    "core.epistemic_questions.delivery.emit_question",
+    "core.epistemic_disclosure.ask_handle.resolve_served_ask_handle",
+    "core.epistemic_disclosure.ask_acquisition.acquire_served_ask_candidate",
+    "core.epistemic_disclosure.ask_serving.evaluate_served_ask",
+)
+
+
+@dataclass(frozen=True, slots=True)
+class DemoAskServingConfig:
+    """Demo-local ASK gate config.  The runtime-wide default stays dark; enabling
+    here affects only seam calls this demo makes with this object."""
+
+    ask_serving_enabled: bool = True
+
+
+DEMO_ASK_SERVING_CONFIG: Final[DemoAskServingConfig] = DemoAskServingConfig()
+
+
+@dataclass(frozen=True, slots=True)
+class AskOutcome:
+    """What the ASK leg did, as inert trace data.  ``authorities`` is the prefix
+    of :data:`_AUTHORITIES_ASK` that was actually consulted before the leg
+    resolved — never the whole pipeline by default."""
+
+    attempted: bool
+    served: bool
+    detail: str
+    authorities: tuple[str, ...] = ()
+    question: str | None = None
+    blocking_reason: str | None = None
+    owner_organ: str | None = None
+    question_ref: str | None = None  # out_dir-relative, deterministic
+    content_hash: str | None = None
+
+    def to_trace_dict(self) -> dict[str, Any]:
+        return {
+            "attempted": self.attempted,
+            "served": self.served,
+            "detail": self.detail,
+            "question": self.question,
+            "blocking_reason": self.blocking_reason,
+            "owner_organ": self.owner_organ,
+            "question_ref": self.question_ref,
+            "content_hash": self.content_hash,
+        }
+
+
+_ASK_NOT_ATTEMPTED: Final[AskOutcome] = AskOutcome(
+    attempted=False, served=False, detail="not_attempted"
+)
+
+
+def _envelope() -> dict[str, Any]:
+    """The committed serving envelope, re-read per call (a fresh object every
+    time, so no shared-mutable cache can be poisoned in-process; the file is one
+    entry and the cost is negligible)."""
+    return json.loads(ENVELOPE_PATH.read_text(encoding="utf-8"))
+
+
+@lru_cache(maxsize=1)
+def _adr0184_pinned_by_sha() -> dict[str, dict[str, Any]]:
+    """The 937-problem ADR-0184 pinned traces by sha.  Cached as immutable per
+    the repo's caching doctrine: the mapping never escapes this module and is
+    only ever compared against, never handed out or mutated."""
+    return {str(t["problem_sha"]): t for t in load_expected_traces()}
+
+
+def _adr0184_pin_status(trace: dict[str, Any]) -> str:
+    pinned = _adr0184_pinned_by_sha().get(str(trace["problem_sha"]))
+    if pinned is None:
+        return "not_in_adr0184_corpus"
+    return "equivalent_to_adr0184_pin" if pinned == trace else "drift_from_adr0184_pin"
+
+
+def _derivation_trace_sha(trace: dict[str, Any]) -> str:
+    return hashlib.sha256(trace_line(trace).encode("utf-8")).hexdigest()
+
+
+def _format_quantity(value: float, unit: str) -> str:
+    magnitude = str(int(value)) if float(value).is_integer() else str(value)
+    return f"{magnitude} {unit}".strip()
+
+
+def _refusal_reason(trace: dict[str, Any]) -> str:
+    """A typed diagnostic label for a pool refusal, derived from trace data only.
+
+    This mirrors the *documented* refusal order of ``resolve_pooled`` for display;
+    it is never an authority — the demo asserts ``resolution is null`` before any
+    refused status, so a mislabel here can rename a refusal but never mint a
+    commit.  Reasons the pool enforces before pooling (e.g. the prior-state
+    question-scope guard) land in the fail-closed catch-all.
+    """
+    pooled = trace["pooled"] or []
+    classifications = trace["classifications"] or []
+    classified = [
+        (candidate, kind)
+        for candidate, kind in zip(pooled, classifications)
+        if kind is not None
+    ]
+    if not pooled:
+        return "no_candidate_readings"
+    if not classified:
+        return "no_self_verifying_reading"
+    answers = {round(float(candidate["answer"]), 9) for candidate, _ in classified}
+    if len(answers) > 1:
+        return "candidate_disagreement"
+    if all(kind != "complete" for _, kind in classified):
+        return "exempt_only_readings"
+    return "pool_policy_refusal"
+
+
+def _single_ask_assessment(problem_text: str) -> tuple[LimitationAssessment | None, str]:
+    """The unique ask-mapped limitation for a refused problem, or why there is none.
+
+    Fail-closed plumbing, not policy: zero ask-mapped organ attempts means the
+    refusal stands; more than one means the demo refuses to pick (no 'best
+    question' heuristic).  All question policy stays downstream in Q1-C/Q1-D and
+    the serving adapter.
+    """
+    assessments = [
+        assessment
+        for attempt in route_setup(problem_text).attempts
+        if (assessment := assess_from_attempt(attempt)) is not None
+        and assessment.resolution_action == "ask_question"
+    ]
+    if not assessments:
+        return None, "no_ask_mapped_attempt"
+    if len(assessments) > 1:
+        return None, "multiple_ask_mapped_attempts"
+    return assessments[0], "single"
+
+
+def _attempt_ask(
+    problem_text: str,
+    *,
+    out_dir: Path,
+    ask_config: Any,
+    fallback_surface: str,
+) -> AskOutcome:
+    """Route a pool refusal through the real ASK stack.  Gate-first: while the
+    config's gate is dark this performs no organ calls and no filesystem writes,
+    mirroring the seam's side-effect-free dark-gate law.  ``authorities`` records
+    exactly the pipeline prefix reached, so the response never names an
+    unconsulted organ."""
+    if not ask_serving_enabled(ask_config):
+        return AskOutcome(attempted=True, served=False, detail="gate_disabled")
+
+    assessment, why = _single_ask_assessment(problem_text)
+    if assessment is None:
+        return AskOutcome(
+            attempted=True, served=False, detail=why, authorities=_AUTHORITIES_ASK[:2]
+        )
+
+    artifact_path = emit_question(assessment, root=out_dir / "questions")
+    if artifact_path is None:
+        # D2 guard: unrenderable asks fall back to the standing disposition —
+        # never a contentless question.
+        return AskOutcome(
+            attempted=True,
+            served=False,
+            detail="question_unrenderable_fell_back",
+            authorities=_AUTHORITIES_ASK[:3],
+            blocking_reason=assessment.blocking_reason,
+            owner_organ=assessment.owner_organ,
+        )
+
+    handle = AskArtifactHandle(
+        question_path=str(artifact_path), content_hash=artifact_path.stem
+    )
+    resolution = resolve_served_ask_handle(ask_config, handle)
+    if not resolution.resolved:
+        return AskOutcome(
+            attempted=True,
+            served=False,
+            detail=f"handle_not_resolved:{resolution.reason}",
+            authorities=_AUTHORITIES_ASK[:4],
+            blocking_reason=assessment.blocking_reason,
+            owner_organ=assessment.owner_organ,
+            question_ref=f"questions/{artifact_path.name}",
+            content_hash=artifact_path.stem,
+        )
+    decision = acquire_served_ask_candidate(
+        ask_config,
+        fallback_surface=fallback_surface,
+        contemplation_result=resolution.candidate,
+    ).decision
+    return AskOutcome(
+        attempted=True,
+        served=decision.served,
+        detail="served" if decision.served else "not_served_by_adapter",
+        authorities=_AUTHORITIES_ASK,
+        question=decision.surface if decision.served else None,
+        blocking_reason=assessment.blocking_reason,
+        owner_organ=assessment.owner_organ,
+        question_ref=f"questions/{artifact_path.name}",
+        content_hash=artifact_path.stem,
+    )
+
+
+def _canonical(payload: dict[str, Any]) -> str:
+    return json.dumps(payload, sort_keys=True, separators=(",", ":"))
+
+
+def _echoable_request_id(arguments: Any) -> str | None:
+    """A request id is echoed only if it satisfies the schema pattern — the
+    invalid path must not reflect arbitrary caller text into the response."""
+    request_id = arguments.get("request_id") if isinstance(arguments, dict) else None
+    if not isinstance(request_id, str):
+        return None
+    pattern = load_tool_schema()["inputSchema"]["properties"]["request_id"]["pattern"]
+    return request_id if re.fullmatch(pattern, request_id) else None
+
+
+def _invalid_response(arguments: Any, errors: tuple[str, ...]) -> dict[str, Any]:
+    response: dict[str, Any] = {
+        "tool": TOOL_NAME,
+        "request_id": _echoable_request_id(arguments),
+        "status": "invalid",
+        "surface": "Invalid tool payload: " + "; ".join(errors),
+        "answer": None,
+        "answer_unit": None,
+        "refusal_reason": None,
+        "question": None,
+        "authority_path": [_AUTHORITIES_DERIVATION[0]],
+        "replay_equivalence_status": "not_evaluated",
+        "trace_summary": {"validation_errors": list(errors)},
+        "trace": None,
+    }
+    response["trace_hash"] = hashlib.sha256(_canonical(response).encode()).hexdigest()
+    return response
+
+
+@dataclass(frozen=True, slots=True)
+class _Decision:
+    """The decided outcome of one executed derivation, as inert data."""
+
+    status: str
+    surface: str
+    answer: float | None = None
+    answer_unit: str | None = None
+    refusal_reason: str | None = None
+    question: str | None = None
+    ask: AskOutcome = _ASK_NOT_ATTEMPTED
+
+
+def _refused(reason: str, ask: AskOutcome = _ASK_NOT_ATTEMPTED) -> _Decision:
+    return _Decision(
+        status="refused",
+        surface=f"CORE refuses to serve an answer: {reason}.",
+        refusal_reason=reason,
+        ask=ask,
+    )
+
+
+def _decide(
+    trace: dict[str, Any],
+    *,
+    envelope_entry: dict[str, Any] | None,
+    derivation_sha: str,
+    pin_status: str,
+    commit_law_violations: list[str],
+    faithfulness: list[str],
+    problem_text: str,
+    out_dir: Path,
+    ask_config: Any,
+) -> _Decision:
+    """Map the audited trace to verified / refused / ask — fail-closed at every
+    fork.  An internal audit trip refuses outright (never serve, never ask); a
+    commit serves only under envelope authorization with no pinned-corpus drift;
+    a pool refusal may upgrade to ASK only through the real Q1 stack."""
+    if commit_law_violations or faithfulness:
+        return _refused(
+            "authority_violation_detected"
+            if commit_law_violations
+            else "provenance_violation_detected"
+        )
+
+    resolution = trace["resolution"]
+    if resolution is not None:
+        envelope_status = _envelope_status(envelope_entry, resolution, derivation_sha)
+        if envelope_status == "authorized" and pin_status != "drift_from_adr0184_pin":
+            answer = float(resolution["answer"])
+            answer_unit = str(resolution["answer_unit"])
+            return _Decision(
+                status="verified",
+                surface=_format_quantity(answer, answer_unit),
+                answer=answer,
+                answer_unit=answer_unit,
+            )
+        return _refused(
+            "outside_demo_serving_envelope"
+            if envelope_status == "absent"
+            else "replay_drift_from_pinned_reference"
+        )
+
+    refusal = _refused(_refusal_reason(trace))
+    ask = _attempt_ask(
+        problem_text,
+        out_dir=out_dir,
+        ask_config=ask_config,
+        fallback_surface=refusal.surface,
+    )
+    if ask.served and ask.question is not None:
+        return _Decision(status="ask", surface=ask.question, question=ask.question, ask=ask)
+    return _refused(refusal.refusal_reason or "pool_policy_refusal", ask=ask)
+
+
+def run_tool(
+    arguments: Any,
+    *,
+    out_dir: Path,
+    ask_config: Any = DEMO_ASK_SERVING_CONFIG,
+) -> dict[str, Any]:
+    """Execute one ``core.semantic_derivation.verify`` call.  Deterministic: the
+    same arguments always produce a byte-identical response (``out_dir`` is used
+    only for the content-addressed question artifact of the ASK leg)."""
+    errors = validate_payload(arguments)
+    if errors:
+        return _invalid_response(arguments, errors)
+
+    problem_text: str = arguments["problem_text"]
+    trace = problem_trace(problem_text)
+    derivation_sha = _derivation_trace_sha(trace)
+    commit_law_violations = list(authority_violations(trace))
+    faithfulness = list(replay_faithfulness_report(problem_text))
+    pin_status = _adr0184_pin_status(trace)
+    resolution = trace["resolution"]
+    envelope_entry = _envelope()["entries"].get(str(trace["problem_sha"]))
+
+    decision = _decide(
+        trace,
+        envelope_entry=envelope_entry,
+        derivation_sha=derivation_sha,
+        pin_status=pin_status,
+        commit_law_violations=commit_law_violations,
+        faithfulness=faithfulness,
+        problem_text=problem_text,
+        out_dir=out_dir,
+        ask_config=ask_config,
+    )
+    ask = decision.ask
+
+    response: dict[str, Any] = {
+        "tool": TOOL_NAME,
+        "request_id": arguments.get("request_id"),
+        "status": decision.status,
+        "surface": decision.surface,
+        "answer": decision.answer,
+        "answer_unit": decision.answer_unit,
+        "refusal_reason": decision.refusal_reason,
+        "question": decision.question,
+        "authority_path": [*_AUTHORITIES_DERIVATION, *ask.authorities],
+        "replay_equivalence_status": pin_status,
+        "trace_summary": {
+            "problem_sha": trace["problem_sha"],
+            "semantic_worlds": len(trace["worlds"]),
+            "semantic_candidates": len(trace["semantic"]),
+            "pooled_candidates": len(trace["pooled"]),
+            "classifications": trace["classifications"],
+            "pool_committed": resolution is not None,
+            "commit_law_violations": len(commit_law_violations),
+            "faithfulness_violations": len(faithfulness),
+            "demo_envelope": _envelope_status(envelope_entry, resolution, derivation_sha),
+            "ask": {"attempted": ask.attempted, "served": ask.served, "detail": ask.detail},
+        },
+        "trace": {
+            "derivation": trace,
+            "derivation_trace_sha": derivation_sha,
+            "commit_law_violations": commit_law_violations,
+            "faithfulness_violations": faithfulness,
+            "adr0184_pin": {
+                "status": pin_status,
+                "corpus_sha": load_manifest()["corpus_sha"],
+            },
+            "ask": ask.to_trace_dict(),
+        },
+    }
+    response["trace_hash"] = hashlib.sha256(_canonical(response).encode()).hexdigest()
+    if arguments.get("return_trace", True) is False:
+        response["trace"] = None
+    return response
+
+
+def _envelope_status(
+    envelope_entry: dict[str, Any] | None,
+    resolution: dict[str, Any] | None,
+    derivation_sha: str,
+) -> str:
+    """Whether the committed demo envelope authorizes serving this commit."""
+    if resolution is None:
+        return "not_applicable"
+    if envelope_entry is None:
+        return "absent"
+    if (
+        envelope_entry["derivation_trace_sha"] == derivation_sha
+        and round(float(envelope_entry["answer"]), 9) == round(float(resolution["answer"]), 9)
+        and envelope_entry["answer_unit"] == resolution["answer_unit"]
+    ):
+        return "authorized"
+    return "pinned_reference_mismatch"
+
+
+__all__ = [
+    "DEMO_ASK_SERVING_CONFIG",
+    "DemoAskServingConfig",
+    "ENVELOPE_PATH",
+    "TOOL_NAME",
+    "load_tool_schema",
+    "run_tool",
+]

demos/claude_tool_authority/.gitignore

@@ -0,0 +1 @@
+out/

demos/claude_tool_authority/README.md

@@ -0,0 +1,86 @@
+# Frontier-Proposer-to-CORE Tool Authority Demo
+
+This demo proves one narrow boundary:
+
+```text
+A model-style proposer suggests a digital action.
+CORE alone decides authorized | ask | refused | invalid.
+The output is a deterministic authority artifact.
+Nothing executes.
+```
+
+## What this proves
+
+* A proposer can submit an MCP-shaped action request without gaining execution authority.
+* CORE alone derives the final authority status.
+* CORE ignores any proposer-supplied trace hash and regenerates its own deterministic trace hash.
+* Invalid payloads fail at the typed boundary before authority evaluation.
+* An `authorized` result emits only an inert `licensed_action` record, not an execution path.
+
+## What this does not prove
+
+* It is not a production MCP server.
+* It does not send email, run shell commands, call a network, or invoke a model API.
+* It does not prove runtime integration, serving integration, or embodied authority.
+* It does not claim broader safety than the local deterministic envelope encoded here.
+
+## Why no real side effects are executed
+
+The authority substrate never dispatches tools.  `authority.py` validates a closed
+payload, evaluates local policy, and returns JSON only.  Even when a proposal is
+authorized, the returned `licensed_action` is an inert description with
+`effect: "inert_license_only"`.  No file write, email send, shell execution,
+network access, subprocess launch, `eval`, or `exec` path exists in the demo.
+
+## Why this is MCP-shaped, not production MCP
+
+The payload is structured like a tool invocation so future proposer lanes can
+hand the same kind of typed request to CORE.  This remains a local demo
+contract: no server transport, session handling, production adapter, or real
+side-effecting tool substrate is present.
+
+## Relation to #687
+
+#687 proved the earlier reasoning boundary:
+
+```text
+System 1-style proposal
+-> CORE deterministic System 2 verification/refusal/ask/invalid
+-> audited envelope
+-> deterministic trace artifacts
+-> no proposer execution authority
+```
+
+This demo advances the same doctrine one layer outward:
+
+```text
+model-style proposer
+-> proposes digital actions
+-> CORE authorizes/refuses/asks/invalidates
+-> inert licensed action artifact only when authorized
+-> no proposer authority and no execution path
+```
+
+It therefore proves digital tool/action authority before any embodied-authority simulation.
+
+## The four scenarios
+
+* `authorized-low-risk-local-action`: low-risk local note request inside the envelope.
+* `ask-required-action`: external email draft request without explicit confirmation.
+* `refused-outside-envelope-action`: shell command proposal refused as an unauthorized tool.
+* `invalid-smuggling-attempt`: proposer tries to smuggle `licensed_action` and authorization state.
+
+## Honesty ledger
+
+* Real: closed schema validation, local authority evaluation, deterministic trace hashing, expected artifact pinning, double-run determinism.
+* Simulated: the proposer side is static fixture data standing in for a model-style proposer.
+* Not claimed: production MCP, runtime authority integration, external side effects, or any broader guarantee than this fail-closed local envelope.
+
+## Example commands
+
+```bash
+python demos/claude_tool_authority/run_demo.py
+python demos/claude_tool_authority/run_demo.py --json
+python demos/claude_tool_authority/run_demo.py --update-expected
+pytest -q tests/test_claude_tool_authority_demo.py
+```