fix(semantics): verify bounded production evidence and input domains

.github/workflows/full-public-smokes.yml

@@ -73,6 +73,9 @@ jobs:
       - name: Install smoke runtime dependencies
         run: python -m pip install --disable-pip-version-check "jsonschema>=4.23,<5"
 
+      - name: Install locked TypeScript parser for semantic production checks
+        run: npm ci --ignore-scripts
+
       - name: Preview full-public shard
         run: |
           python3 examples/run-smokes.py \

loopx/cli_commands/quota.py

@@ -1,4 +1,5 @@
 from __future__ import annotations
+from ..control_plane.quota.effective_action import EffectiveAction
 
 import argparse
 from collections.abc import Callable, Mapping
@@ -226,7 +227,7 @@ def _apply_requested_quota_action_selection_preflight(
     pending_selection_workspace_repair_qualified = (
         selection_binding == "pending_action_selection"
         and payload.get("workspace_repair_allowed") is True
-        and payload.get("effective_action") == "agent_workspace_repair"
+        and payload.get("effective_action") == EffectiveAction.AGENT_WORKSPACE_REPAIR.value
         and execution_obligation.get("kind") == "agent_workspace_repair"
         and execution_obligation.get("must_attempt_work") is True
         and agent_channel.get("must_attempt") is True
@@ -562,7 +563,7 @@ def handle_quota_command(
                         turn_instance_id=heartbeat_turn_id,
                     )
                     if (
-                        payload.get("effective_action") == "monitor_quiet_skip"
+                        payload.get("effective_action") == EffectiveAction.MONITOR_QUIET_SKIP.value
                         or existing_stall is not None
                     ):
                         poll = record_quota_monitor_poll(

loopx/cli_commands/quota_scheduler_followup.py

@@ -1,4 +1,5 @@
 from __future__ import annotations
+from ..control_plane.quota.effective_action import EffectiveAction
 
 import argparse
 from collections.abc import Callable, Mapping
@@ -181,7 +182,7 @@ def build_scheduler_followup_payload(
         turn_instance_id
         and receipt_todo_id is None
         and receipt_replan_id is not None
-        and before_decision.get("effective_action") == "heartbeat_settled_skip"
+        and before_decision.get("effective_action") == EffectiveAction.HEARTBEAT_SETTLED_SKIP.value
     ):
         return {
             "ok": True,

loopx/cli_commands/turn.py

@@ -1,4 +1,5 @@
 from __future__ import annotations
+from ..control_plane.quota.effective_action import EffectiveAction
 
 import argparse
 import json
@@ -163,7 +164,7 @@ def handle_turn_command(
             args.turn_command == "run-once"
             and args.host == "codex-cli"
             and not resume_requested
-            and turn_envelope.get("effective_action") != "governed_capability_intent"
+            and turn_envelope.get("effective_action") != EffectiveAction.GOVERNED_CAPABILITY_INTENT.value
         ):
             session_binding = codex_cli_session_binding(runtime_root, turn_envelope)
         payload = build_loopx_turn_plan(

loopx/control_plane/quota/decision_summary.py

@@ -1,12 +1,12 @@
 from __future__ import annotations
+from .effective_action import EffectiveAction
 
 from dataclasses import dataclass
 from typing import Any, TypedDict
 
 from ...state_projection import actions_are_projection_aligned
 from ..goals.contract_health import project_contract_health_for_goal
 from ..goals.goal_frontier import (
-    AUTONOMOUS_REPLAN_REQUIRED_MODE,
     autonomous_replan_decision_allowed,
     goal_frontier_is_terminal_no_followup,
 )
@@ -293,7 +293,7 @@ def resolve_quota_run_decision(
         normal_delivery_allowed = False
         recovery_delivery_allowed = False
         should_run = True
-        effective_action = AUTONOMOUS_REPLAN_REQUIRED_MODE
+        effective_action = EffectiveAction.AUTONOMOUS_REPLAN_REQUIRED.value
         reason = (
             "autonomous replan obligation is selected before monitor quiet "
             "or agent-scope wait classification"
@@ -318,7 +318,7 @@ def resolve_quota_run_decision(
         capability_repair_allowed = False
         workspace_repair_allowed = False
         should_run = False
-        effective_action = "terminal_no_followup"
+        effective_action = EffectiveAction.TERMINAL_NO_FOLLOWUP.value
         reason = (
             "validated closure evidence derives terminal no-follow-up from "
             "complete todo sources and an empty frontier; stop recurring "
@@ -327,15 +327,15 @@ def resolve_quota_run_decision(
 
     if automation_prompt_upgrade_required and not terminal_no_followup:
         should_run = False
-        effective_action = "automation_prompt_upgrade_required"
+        effective_action = EffectiveAction.AUTOMATION_PROMPT_UPGRADE_REQUIRED.value
     elif inbox_reply_due:
         should_run = True
         normal_delivery_allowed = True
         recovery_delivery_allowed = False
         self_repair_allowed = False
         capability_repair_allowed = False
         workspace_repair_allowed = False
-        effective_action = "lark_inbox_reply_due"
+        effective_action = EffectiveAction.LARK_INBOX_REPLY_DUE.value
         reason = (
             "a direct Lark question, bot mention, or verified reply to the bot "
             "is pending reply"
@@ -347,7 +347,7 @@ def resolve_quota_run_decision(
         self_repair_allowed = False
         capability_repair_allowed = False
         workspace_repair_allowed = False
-        effective_action = "operator_inbox_material_review_due"
+        effective_action = EffectiveAction.OPERATOR_INBOX_MATERIAL_REVIEW_DUE.value
         reason = (
             "captured unaddressed operator-inbox material is pending bounded review"
         )
@@ -386,29 +386,29 @@ def quota_effective_action(
     quota: dict[str, Any],
 ) -> str:
     if normal_delivery_allowed:
-        return "normal_run"
+        return EffectiveAction.NORMAL_RUN.value
     if recovery_delivery_allowed:
-        return "outcome_floor_recovery"
+        return EffectiveAction.OUTCOME_FLOOR_RECOVERY.value
     if workspace_repair_allowed:
-        return "agent_workspace_repair"
+        return EffectiveAction.AGENT_WORKSPACE_REPAIR.value
     if self_repair_allowed:
         repair_action = (
             stall_self_repair.get("effective_action")
             if isinstance(stall_self_repair, dict)
             else None
         )
-        return str(repair_action or "control_plane_repair")
+        return str(repair_action or EffectiveAction.CONTROL_PLANE_REPAIR.value)
     if capability_repair_allowed:
-        return "capability_bridge_repair"
+        return EffectiveAction.CAPABILITY_BRIDGE_REPAIR.value
     if state == "operator_gate":
-        return "operator_gate_notify"
+        return EffectiveAction.OPERATOR_GATE_NOTIFY.value
     if state == "blocked_health":
-        return "blocked_health"
+        return EffectiveAction.BLOCKED_HEALTH.value
     if state == "throttled":
-        return "throttled_skip"
+        return EffectiveAction.THROTTLED_SKIP.value
     if state in {"focus_wait", "waiting"} or quota.get("focus_wait"):
-        return "blocked_wait"
-    return "quota_skip"
+        return EffectiveAction.BLOCKED_WAIT.value
+    return EffectiveAction.QUOTA_SKIP.value
 
 
 def _task_orchestration_effective_action(
@@ -424,18 +424,18 @@ def _task_orchestration_effective_action(
         and str(contract.get("execution_state") or "ready") == "ready"
         and should_run
         and normal_delivery_allowed
-        and effective_action == "normal_run"
+        and effective_action == EffectiveAction.NORMAL_RUN.value
     ):
         if contract.get("mode") == "adaptive":
             return (
-                "coordinate_task_bundle",
+                EffectiveAction.COORDINATE_TASK_BUNDLE.value,
                 (
                     "the task coordinator may use admitted child lanes before its "
                     "own worker-lane delivery"
                 ),
             )
         return (
-            "coordinate_task_bundle",
+            EffectiveAction.COORDINATE_TASK_BUNDLE.value,
             (
                 "the explicitly selected task coordinator must activate or resume "
                 "eligible peer lanes before doing its own worker-lane delivery"

loopx/control_plane/quota/effective_action.py

@@ -0,0 +1,51 @@
+"""Canonical value domain for the decision-slot effective action.
+
+The Turn Envelope still carries a string for wire compatibility. This enum is
+the owner of the finite value domain; callers may serialize ``.value`` while
+the semantic drift smoke checks that new decision values are deliberate.
+"""
+
+from __future__ import annotations
+
+from enum import Enum
+
+
+class EffectiveAction(str, Enum):
+    AGENT_MONITOR_ONLY = "agent_monitor_only"
+    AGENT_WORKSPACE_REPAIR = "agent_workspace_repair"
+    AUTOMATION_PROMPT_UPGRADE_REQUIRED = "automation_prompt_upgrade_required"
+    AUTONOMOUS_REPLAN_REQUIRED = "autonomous_replan_required"
+    BLOCK_REPLAY = "block_replay"
+    BOUNDARY_PROJECTION_REPAIR = "boundary_projection_repair"
+    CAPABILITY_BRIDGE_REPAIR = "capability_bridge_repair"
+    CONTROL_PLANE_HEALTH_REPAIR = "control_plane_health_repair"
+    CONTROL_PLANE_PROJECTION_REPAIR = "control_plane_projection_repair"
+    COORDINATE_TASK_BUNDLE = "coordinate_task_bundle"
+    EXTERNAL_EVIDENCE_OBSERVE = "external_evidence_observe"
+    GOVERNED_CAPABILITY_INTENT = "governed_capability_intent"
+    HEARTBEAT_RECEIPT_WRITE_FAILED = "heartbeat_receipt_write_failed"
+    HEARTBEAT_SETTLED_SKIP = "heartbeat_settled_skip"
+    LARK_INBOX_REPLY_DUE = "lark_inbox_reply_due"
+    MONITOR_DUE = "monitor_due"
+    MONITOR_QUIET_SKIP = "monitor_quiet_skip"
+    NORMAL_RUN = "normal_run"
+    OBSERVE_REPLAY = "observe_replay"
+    OPERATOR_GATE = "operator_gate"
+    OPERATOR_INBOX_MATERIAL_REVIEW_DUE = "operator_inbox_material_review_due"
+    OUTCOME_FLOOR_RECOVERY = "outcome_floor_recovery"
+    PEER_COORDINATION_BLOCKED = "peer_coordination_blocked"
+    QUOTA_ACTION_SELECTION_DEFERRED = "quota_action_selection_deferred"
+    QUOTA_ACTION_SELECTION_REJECTED = "quota_action_selection_rejected"
+    QUOTA_SKIP = "quota_skip"
+    RUNTIME_USER_GATE_PROJECTION_REPAIR = "runtime_user_gate_projection_repair"
+    SCOPED_USER_GATE_FALLBACK = "scoped_user_gate_fallback"
+    SKIP = "skip"
+    STATE_PROJECTION_GAP_REPAIR = "state_projection_gap_repair"
+    TERMINAL_NO_FOLLOWUP = "terminal_no_followup"
+    TODO_DECISION_SCOPE_PROJECTION_REPAIR = "todo_decision_scope_projection_repair"
+    UNSETTLED_HOST_TURN_RECOVERY = "unsettled_host_turn_recovery"
+    BLOCKED_HEALTH = "blocked_health"
+    BLOCKED_WAIT = "blocked_wait"
+    CONTROL_PLANE_REPAIR = "control_plane_repair"
+    OPERATOR_GATE_NOTIFY = "operator_gate_notify"
+    THROTTLED_SKIP = "throttled_skip"

loopx/control_plane/quota/heartbeat_receipt.py

@@ -1,4 +1,5 @@
 from __future__ import annotations
+from .effective_action import EffectiveAction
 
 import json
 from collections.abc import Mapping
@@ -462,7 +463,7 @@ def fail_heartbeat_receipt(
             "ok": False,
             "decision": "skip",
             "should_run": False,
-            "effective_action": "heartbeat_receipt_write_failed",
+            "effective_action": EffectiveAction.HEARTBEAT_RECEIPT_WRITE_FAILED.value,
             "state": "blocked_health",
             "waiting_on": "codex",
             "reason": reason,

loopx/control_plane/quota/host_poll_receipts.py

@@ -12,6 +12,7 @@
 """
 
 from __future__ import annotations
+from .effective_action import EffectiveAction
 
 import json
 import os
@@ -72,7 +73,7 @@ def record_host_poll_receipt(
     terminal_state = frontier.get("terminal_state") if isinstance(frontier, dict) else None
     terminal = bool(
         decision.get("should_run") is False
-        and decision.get("effective_action") == "terminal_no_followup"
+        and decision.get("effective_action") == EffectiveAction.TERMINAL_NO_FOLLOWUP.value
         and isinstance(terminal_state, dict)
         and terminal_state.get("kind") == "no_followup"
     )

loopx/control_plane/quota/live_decision.py

@@ -1,4 +1,5 @@
 from __future__ import annotations
+from .effective_action import EffectiveAction
 
 import shlex
 from collections.abc import Callable, Mapping, Sequence
@@ -191,7 +192,7 @@ def _apply_pending_capability_intent_precedence(
             "decision": "run",
             "should_run": True,
             "state": "eligible",
-            "effective_action": "governed_capability_intent",
+            "effective_action": EffectiveAction.GOVERNED_CAPABILITY_INTENT.value,
             "actionable_by_codex": True,
             "normal_delivery_allowed": False,
             "recovery_delivery_allowed": False,

loopx/control_plane/quota/projection_repair.py

@@ -1,4 +1,5 @@
 from __future__ import annotations
+from .effective_action import EffectiveAction
 
 import fnmatch
 from typing import Any
@@ -108,7 +109,7 @@ def build_state_projection_gap_repair_hint(
         "source": "quota.should-run",
         "trigger": "state_projection_gap",
         "recommended_mode": "repair_state_projection_gap",
-        "effective_action": "state_projection_gap_repair",
+        "effective_action": EffectiveAction.STATE_PROJECTION_GAP_REPAIR.value,
         "allowed": True,
         "notify": "DONT_NOTIFY",
         "reason": (
@@ -204,7 +205,7 @@ def build_boundary_projection_repair_hint(
         "source": "quota.should-run",
         "trigger": "required_write_scope_missing_from_goal_boundary",
         "recommended_mode": "repair_boundary_projection",
-        "effective_action": "boundary_projection_repair",
+        "effective_action": EffectiveAction.BOUNDARY_PROJECTION_REPAIR.value,
         "blocked_action_scope": "boundary_projection",
         "allowed": True,
         "notify": "DONT_NOTIFY",

loopx/control_plane/quota/settlement_cli.py

@@ -1,6 +1,7 @@
 """CLI rollout helpers for heartbeat settlement identity and receipt wiring."""
 
 from __future__ import annotations
+from .effective_action import EffectiveAction
 
 import argparse
 from collections.abc import Mapping
@@ -193,7 +194,7 @@ def quota_rollout_settlement_binding(
     packet is only a diagnostic fallback when no concrete Todo is selected.
     """
 
-    if payload.get("effective_action") == "unsettled_host_turn_recovery":
+    if payload.get("effective_action") == EffectiveAction.UNSETTLED_HOST_TURN_RECOVERY.value:
         # This Turn only repairs the preceding Turn's closeout.  A concurrently
         # projected Todo or autonomous replan belongs to the post-recovery
         # decision and must not become this receipt's settlement identity.

loopx/control_plane/quota/settlement_precedence.py

@@ -1,4 +1,5 @@
 from __future__ import annotations
+from .effective_action import EffectiveAction
 
 from typing import Any, Protocol
 
@@ -77,7 +78,7 @@ def apply_settled_replay_route_precedence(
     route.capability_repair_allowed = False
     route.workspace_repair_allowed = False
     route.should_run = False
-    route.effective_action = "heartbeat_settled_skip"
+    route.effective_action = EffectiveAction.HEARTBEAT_SETTLED_SKIP.value
     route.reason = HEARTBEAT_SETTLED_REPLAY_REASON
     route.replan_decision_allowed = False
     route.receipt_bound_replan_decision = False
@@ -127,7 +128,7 @@ def apply_settled_replay_payload_precedence(
             "self_repair_allowed": False,
             "capability_repair_allowed": False,
             "workspace_repair_allowed": False,
-            "effective_action": "heartbeat_settled_skip",
+            "effective_action": EffectiveAction.HEARTBEAT_SETTLED_SKIP.value,
             "actionable_by_codex": False,
             "reason": reason,
             "requires_user_action": False,

loopx/control_plane/quota/should_run.py

@@ -1,4 +1,5 @@
 from __future__ import annotations
+from .effective_action import EffectiveAction
 
 from collections.abc import Callable, Mapping
 from pathlib import Path
@@ -173,7 +174,7 @@ def build_quota_paused_should_run_payload(
     }
     execution_obligation = _execution_obligation(
         should_run=False,
-        effective_action="quota_skip",
+        effective_action=EffectiveAction.QUOTA_SKIP.value,
         heartbeat_recommendation=heartbeat_recommendation,
     )
     payload: dict[str, Any] = {
@@ -188,7 +189,7 @@ def build_quota_paused_should_run_payload(
         "self_repair_allowed": False,
         "capability_repair_allowed": False,
         "workspace_repair_allowed": False,
-        "effective_action": "quota_skip",
+        "effective_action": EffectiveAction.QUOTA_SKIP.value,
         "actionable_by_codex": False,
         "reason": reason,
         "quota": quota,