feat(agent-journal): add safe material file observations

docs/evaluations/agent-work-journal-v3-infrastructure-manifest.json

@@ -0,0 +1,144 @@
+{
+  "schemaVersion": 3,
+  "status": "pre-task-infrastructure",
+  "concreteTasksSelected": false,
+  "taskIds": [],
+  "promptDigests": [],
+  "categories": [
+    "automated-multi-file-continuation",
+    "material-dependency-revalidation",
+    "append-only-conflict-resolution"
+  ],
+  "model": "openai-codex/gpt-5.6-sol",
+  "reasoning": "high",
+  "runtime": {
+    "nodeVersion": "24.14.1",
+    "piCodingAgentVersion": "0.80.6",
+    "repositoryLockedExecutableRequired": true,
+    "darwinSandboxExecRequiredForUntrustedCommands": true
+  },
+  "readTolerance": 1,
+  "exactRunsPerCondition": 3,
+  "exactTotalTraces": 18,
+  "budgetPolicy": {
+    "taskAgentMaximumAssistantTurnsPerPhase": 12,
+    "taskAgentMaximumToolCallsPerPhase": 40,
+    "phaseWallTimeoutSeconds": 1800,
+    "ownerSimulatorMaximumAssistantTurns": 2,
+    "ownerSimulatorMaximumToolCalls": 8,
+    "ownerSimulatorWallTimeoutSeconds": 600,
+    "statusByteLimit": 4000,
+    "capsuleByteLimit": 4000,
+    "tokensReportedPostHoc": true,
+    "budgetExhaustionResult": "terminal_fail"
+  },
+  "attemptPolicy": {
+    "scheduleAndRunIdsPreRegistered": true,
+    "firstProviderRequestStartsAttempt": true,
+    "postRequestFailureResult": "terminal_fail_no_retry",
+    "preRequestInfrastructureRetries": 1,
+    "extraMissingDuplicateOrReplacementTraceResult": "terminal_fail"
+  },
+  "ownerProtocol": {
+    "fields": [
+      "objective",
+      "current_status",
+      "settled_decisions",
+      "evidence",
+      "open_questions",
+      "next_action",
+      "material_dependencies"
+    ],
+    "phaseAActions": ["status_create", "status_refresh", "status_correction"],
+    "phaseBActions": ["known_context_clarification", "resume_restatement"],
+    "eachActionRecorded": true,
+    "statusCreateAlwaysCountsAsAvoidableMaintenance": true
+  },
+  "materialCaseMatrix": {
+    "journalSafetyAssertionsOnly": true,
+    "baselineMustDetectAndRevalidateForTaskCorrectness": true,
+    "dependencyTaskPerRepetition": ["one_material_stale_or_missing", "one_unaffected_control"],
+    "conflictTaskPerRepetition": ["one_material_conflict", "one_unaffected_control"],
+    "falsePositiveUniverse": "all_declared_unaffected_controls"
+  },
+  "taskLifecycle": {
+    "antiTuningEmbargoStartsBeforeCandidateGeneration": true,
+    "maximumCandidateAttemptsPerCategory": 3,
+    "firstStructurallyValidCandidateMustFreeze": true,
+    "candidateRejectableBeforeAnyModelTrial": true,
+    "allowedCandidateRejections": [
+      "missing_bytes_or_digest",
+      "invalid_fixture",
+      "nondeterministic_mutation",
+      "broken_grader",
+      "category_mismatch",
+      "prior_task_reuse",
+      "unsupported_runner_requirement"
+    ],
+    "safeRejectionReceiptRequired": true,
+    "atomicThreeTaskFreezeRequired": true,
+    "frozenTasksOneShot": true
+  },
+  "quarantine": {
+    "twoIndependentImplementationsRequired": true,
+    "duplicateReconstructionRequired": true,
+    "duplicateMutationRequired": true,
+    "expectedHashesRequired": true,
+    "mutationPreconditionFailureRequired": true,
+    "positiveAndNegativeGraderChecksRequired": true,
+    "independentReceiptReviewRequired": true,
+    "proseOnlyMutationForbidden": true
+  },
+  "sandbox": {
+    "privateRootMode": "0700",
+    "sanitizedEnvironmentAllowlistRequired": true,
+    "ambientCredentialsForbidden": true,
+    "mutatorAndGraderNetworkDisabled": true,
+    "readOnlyInputsAndSingleWritableTrialRoot": true,
+    "commandsSpawnedWithoutShellConcatenation": true,
+    "resourceLimitsAndProcessTreeTerminationRequired": true
+  },
+  "productBoundary": {
+    "toolNames": ["journal_record", "journal_inspect", "journal_checkpoint", "journal_session"],
+    "materialFileObservationWithinJournalRecord": true,
+    "callerSuppliedFileProvenanceMustBeRecomputed": true,
+    "predecessorCutoverIncluded": false
+  },
+  "provenance": {
+    "canonicalSerialization": "RFC8785-JCS",
+    "digest": "SHA-256",
+    "separateInfrastructureAcceptanceReceiptRequired": true,
+    "separateFrozenTaskSetReceiptRequired": true,
+    "bindRepositoryCommitAndTree": true,
+    "bindContractManifestRunnerScorerNormalizerValidatorOwnerProtocolGate": true,
+    "bindScheduleAttemptsRawDerivedRecomputationCleanup": true
+  },
+  "historicalEvidenceGuard": {
+    "docs/evaluations/agent-work-journal-v1.md": "cb4e88d65ecba49bd12669c03c8a865641b1538516dca1e056258ebbca0bdbe1",
+    "docs/evaluations/agent-work-journal-v1-results.json": "ff6f8b1389e0667ca410fd6d544247901ebc2955aaa1a6fa1a47404d00e0315b",
+    "docs/plans/2026-07-12-001-feat-agent-work-journal-plan.md": "d74dee96690d5f125ee53001b182100209587c4e207173272c86d604e5206748",
+    "docs/evaluations/agent-work-journal-v2.md": "939f479276af7038b2d1512d71d0bdd822b7ed7b56f95cd4632cb089603c63f2",
+    "docs/evaluations/agent-work-journal-v2-results.json": "1f0aafc726bab5c6482a56cc187d588c51d7081c3e2dfef7af3ad42cc23e0f7c",
+    "docs/evaluations/agent-work-journal-v2-infrastructure-manifest.json": "bad596b7909c3b85aa6cafec7dd893516384eb1f157e44fe33e709c22a1e4e34",
+    "docs/plans/2026-07-12-002-feat-agent-work-journal-v2-redesign-plan.md": "c67417dca8747a1310f6419ef2f51b4a6173985d1390c8415fe5c25d07fda141"
+  },
+  "priorTaskNovelty": {
+    "v1SemanticDenylist": [
+      "partial_multi_file_investigation",
+      "material_dependency_change",
+      "settled_competing_alternative"
+    ],
+    "v2SafeTaskDigestsFromHistoricalResultRequired": true,
+    "independentSemanticNoveltyReviewRequired": true
+  },
+  "privacy": {
+    "rawPromptsCommitted": false,
+    "fixtureSourceCommitted": false,
+    "graderSourceCommitted": false,
+    "mutationSourceCommitted": false,
+    "rawToolPayloadsCommitted": false,
+    "rawModelMessagesCommitted": false,
+    "absolutePrivatePathsCommitted": false,
+    "privateEvidenceDeletedAfterFinalGateAndRecomputation": true
+  }
+}

docs/evaluations/agent-work-journal-v3-results.json

@@ -0,0 +1,45 @@
+{
+  "schemaVersion": 3,
+  "status": "FAIL",
+  "failureStage": "infrastructure-acceptance",
+  "releaseAuthorized": false,
+  "productOutcome": "not-adjudicated",
+  "concreteTasksSelected": false,
+  "infrastructureAccepted": false,
+  "gateEvaluated": false,
+  "validTraceCount": 0,
+  "repositorySnapshot": "f33ed7cbfddbeee0251bab0b56f33c8af1ccf830",
+  "preTaskManifest": {
+    "digest": "5d328c49382539ff117f1de8dcf6ed99139a1a5f200394be65c2b3de91649ac7",
+    "taskIds": [],
+    "promptDigests": []
+  },
+  "completedUnits": [
+    "v3_contract",
+    "material_file_observation"
+  ],
+  "blockers": [
+    "real_two_condition_two_phase_capsule_only_provenance_not_proven",
+    "byte_complete_independent_quarantine_not_accepted",
+    "sandbox_and_attempt_provenance_not_accepted",
+    "raw_to_derived_scorer_chain_not_accepted"
+  ],
+  "selectedTaskIds": [],
+  "runIds": [],
+  "scenarioMedians": null,
+  "gateClauses": {
+    "taskCorrectness": "NOT_EVALUATED",
+    "repositoryReadParity": "NOT_EVALUATED",
+    "ownerMaintenance": "NOT_EVALUATED",
+    "noRestatementParity": "NOT_EVALUATED",
+    "materialSafety": "NOT_EVALUATED",
+    "evidenceIntegrity": "FAIL"
+  },
+  "privateEvidenceCleanup": {
+    "syntheticWorktreesDeleted": true,
+    "syntheticSessionsAndTracesDeleted": true,
+    "heldOutEvidenceCreated": false
+  },
+  "predecessorCutoverPerformed": false,
+  "terminalDecision": "stop-before-held-out-selection"
+}

docs/evaluations/agent-work-journal-v3.md

@@ -0,0 +1,98 @@
+# Agent Work Journal V3 Evaluation Contract
+
+Status: **terminal infrastructure FAIL; held-out selection never occurred and product outcome is not adjudicated**.
+
+## Product claim
+
+V3 evaluates automatically maintained trustworthy status with correctness parity, bounded exploration cost, less avoidable owner maintenance, and perfect handling of planted material stale/conflict cases.
+
+## Immutable history
+
+V1 and V2 plans, contracts, manifests, and results are historical evidence and must not change. Their tasks, prompts, rubrics, fixtures, mutations, and traces cannot be reused. Both predecessor packages remain active.
+
+## Task lifecycle
+
+- **Candidate:** private, unexposed to any model trial, and rejectable only for enumerated structural defects.
+- **Frozen:** independently quarantine-validated, atomically included in the three-task set, immutable, exposed, one-shot, and non-replaceable.
+
+The anti-tuning embargo starts before any candidate is generated or viewed. Generate at most three candidates per category in a precommitted order; the first structurally valid candidate must freeze. Allowed candidate rejection reasons are missing bytes/digests, invalid fixture, non-deterministic mutation, broken positive/negative grader, category mismatch, prior-task reuse, or unsupported runner requirement. Every rejection has an ordered safe receipt. Model outcomes are never an allowed rejection reason.
+
+## Quarantine contract
+
+Each candidate contains exact bytes or content-addressed references for both prompts, rubric, fixture, hidden graders, executable deterministic mutation, mutation inputs, expected pre/post hashes, phase boundaries, unsafe-continuation rule, material cases, and runner budgets. Prose-only mutation instructions are invalid.
+
+Before freeze, two independently implemented validators reconstruct, mutate, run golden passing/failing implementations, and compare canonical receipts. They verify identical trees and expected hashes, prove mutation precondition failure, check every digest, and confirm category novelty against the V1 semantic denylist and V2 safe digests. All three tasks then freeze atomically under one task-set digest bound to the independently accepted infrastructure receipt.
+
+## Real trial contract
+
+- Categories: `automated-multi-file-continuation`, `material-dependency-revalidation`, `append-only-conflict-resolution`.
+- Exactly three baseline and three journal traces per category: exactly 18 total; extra, missing, duplicate, or replaced traces fail.
+- Detached worktree and distinct phase-A/phase-B processes per condition.
+- Same task prompts, rubric, snapshot, model, reasoning, pause point, turn/tool/wall budgets across conditions.
+- Baseline phase A generates the seven-field owner status through the same model; baseline B starts fresh with only that status.
+- Journal B reopens the actual phase-A session/store, clears prior transcript from model context, and receives only the runtime-generated capsule as continuation context.
+- Status and capsule are each at most 4,000 UTF-8 bytes.
+- Native traces from both phases remain private until the final gate and independent recomputation attest the result.
+- All 18 run IDs and interleaved schedule are preregistered before launch. A provider request starts an attempt. Any post-request crash, timeout, budget/provenance failure is terminal with no retry; one mechanically proven pre-provider infrastructure retry is allowed and recorded.
+
+## Intervention taxonomy
+
+Avoidable maintenance:
+- `status_create`
+- `status_refresh`
+- `status_correction`
+- `known_context_clarification`
+- `resume_restatement`
+
+Necessary safety:
+- `material_stale_resolution`
+- `material_conflict_resolution`
+- `binding_ambiguity_resolution`
+- `credential_exclusion_resolution`
+
+Necessary safety never counts as avoidable maintenance. Unknown kinds fail closed.
+
+## Frozen owner protocol
+
+Baseline status contains exactly these seven sections: objective, current status, settled decisions, evidence, open questions, next action, and material dependencies. Phase A permits only `status_create`, `status_refresh`, and `status_correction`; phase B permits only `known_context_clarification` and `resume_restatement`. Every action is recorded, and `status_create` always counts as avoidable owner maintenance. The canonical protocol digest is bound into every parity receipt.
+
+## Frozen gate
+
+All clauses must pass:
+
+1. Journal median task score is at least baseline median in every scenario, with no journal material-correctness failure.
+2. Journal median normalized repository reads are no more than baseline median plus 1 in every scenario.
+3. Journal median avoidable maintenance is lower than baseline in at least 2 of 3 scenarios.
+4. Journal strict-majority no-restatement outcome is no worse than baseline in every scenario.
+5. Journal traces must handle every planted positive material case before unsafe continuation: affected support is withheld, durable history remains unchanged, resolution appends new evidence/state, and the required safety intervention is recorded. Baseline must detect and revalidate mutations for task correctness but has no journal-history assertion. Every dependency/conflict repetition includes one unaffected control; any safety notice/intervention on a declared control is a false positive and fails.
+6. Every quarantine, parity, budget, trace, provenance, recomputation, and retention receipt validates.
+
+Failure records FAIL and stops. Pass records only cutover eligibility. Neither outcome performs cutover.
+
+## Enforceable budgets
+
+- Model: `openai-codex/gpt-5.6-sol`.
+- Reasoning: `high`.
+- Task agent per phase: at most 12 assistant turns, 40 tool calls, and 1,800 wall-clock seconds.
+- Owner simulator: at most 2 assistant turns, 8 tool calls, and 600 wall-clock seconds.
+- Exhaustion is terminal FAIL. Retries and parallel calls count toward the same observed budget.
+- Baseline status and journal capsule: at most 4,000 UTF-8 bytes each.
+- Token usage is reported post hoc, not used as an enforced gate unless termination can precede violation.
+
+## Safe evidence and retention
+
+Committed evidence contains only opaque IDs, categories, SHA-256 digests, normalized counts, typed outcomes, medians, safe provenance, cleanup receipts, and the final decision. It never contains prompts, fixture/grader/mutation source, raw model messages, reasoning, tool arguments/results, credentials, or absolute private paths.
+
+Private roots are canonical owner-controlled mode-0700 directories. Mutators and graders run without shell concatenation in a disposable sandbox with sanitized allowlisted environment, no ambient credentials/network, read-only inputs, one writable trial root, resource limits, and process-tree termination. The model/provider runner receives only the separately required provider connectivity; tool subprocesses remain sandboxed.
+
+Use RFC 8785 JCS and SHA-256 receipts binding repository commit/tree, contract, manifest, runtime, owner protocol, runner, normalizer, scorer, validators, gate, frozen schedule/task set, every attempt/raw/derived trace, final result, recomputation, and cleanup. Apply and independently attest the complete gate before deletion. Then verify cleanup and write the terminal result/cleanup receipt. Rejected candidates, crashes, timeouts, partial trials, and recomputation failures follow the same bounded recovery state machine; failed recomputation preserves encrypted/private evidence for manual adjudication rather than claiming cleanup.
+
+## Pre-task boundary
+
+[`agent-work-journal-v3-infrastructure-manifest.json`](./agent-work-journal-v3-infrastructure-manifest.json) is the immutable pre-task candidate. Until U1–U5 pass independent acceptance, it must retain empty task and prompt arrays and `concreteTasksSelected: false`. U5 writes a separate immutable infrastructure-acceptance receipt. U6 writes a separate immutable frozen-task-set receipt; neither mutates the pre-task manifest.
+
+## Terminal infrastructure outcome
+
+U1 froze the V3 contract and U2 added safe service-computed material file observations without adding a fifth tool. U3/U4 synthetic infrastructure passed unit tests but failed independent acceptance: the real four-process smoke could not prove provider-bound capsule-only continuation, and independent reviews rejected the quarantine independence, sandbox/attempt provenance, and raw-to-derived scorer chain. All candidate U3/U4 code was discarded rather than weakening the contract.
+
+No selector was launched, no held-out task or prompt was created, and no product trial ran. V3 therefore fails closed at infrastructure acceptance with product performance not adjudicated. Synthetic worktrees, sessions, stores, and traces were deleted. Safe terminal evidence is recorded in [`agent-work-journal-v3-results.json`](./agent-work-journal-v3-results.json). Both predecessors remain active and cutover remains unauthorized.