feat: stabilize WOR-105 legacy WorkBundle

[Ldsystem]

Summary

• Stabilize the legacy WorkBundle review, evidence/provenance, lifecycle, deferred-remote and semantic-capability surfaces for WOR-105.
• Consolidate deterministic validation reuse into the existing evidence model, with conservative source identity, semantic check/environment identity, fresh structural checks and platform separation.
• Package native adversarial evaluation 012 and a canonical accumulating local/CI release gate, including full Git history for frozen provenance checks.

PR review revisions

Addressed the review comment in commit d86a31aa64f10721a7b232eeec0d25537f08fd2f:

• Reserve observations per complete identity; execute outside the shared store lock and publish under it. Independent identities run concurrently, identical identities remain single-flight, and failed execution does not strand an unpublished ID.
• Enforce current-target reviews at specification verification, plan execution/binding/observation, and final completion/archive. Resolve actual specification, aggregate plan/member/specification identities and clean final source tree; reject stale records and embedded-status bypasses.
• Restrict reviewer capability to standard | judgment in runtime and schema.
• Reconcile direct-source, reproducible-snapshot and packet-only evidence modes. Constrained/packet-only evidence cannot authorize stage acceptance.
• Apply existing typed-relation traversal with real light/standard/deep depth bounds and trusted-node filtering.

Reviewer-run provenance repair

Addressed the follow-up comment in 143e6503545932ef0c7c6932104788e1477a1b65:

• Native lifecycle acceptance now requires compact reviewer_run: {run_id, sha256} provenance, not a self-authored accepted envelope alone.
• The native publisher binds the exact worker-produced review, current packet/source target, controller-selected reviewer identity/capability and sandbox boundary.
• The gate verifies immutable receipt, packet, profile and event evidence; rejects failed, missing, altered, stale or mismatched proof; and checks known author/repair execution IDs for overlap.
• Run-scoped proof survives workspace cleanup. Stale packet bytes cannot be relabelled with a fresh target identity.
• Full provenance remains runtime-side. WOR-108 bounded context projection and mandatory task ownership remain excluded.

Current candidate validation

Commit: 143e6503545932ef0c7c6932104788e1477a1b65
Tree: aab10e1ca25ab6dd16b37aecf30c00674428916f

• Five affected local modules: 375 passed in 63.35s, before final targeted integrity refinements.
• Final review/runner rerun: 80 passed in 1.54s, including a real macOS sandboxed reviewer process whose receipt advances the lifecycle after cleanup.
• Workflow unit fixtures stub only the process boundary; their native receipt publication and lifecycle verification remain exercised.
• git diff --check passed. Tracked patch and new fixture checksums matched the tested handoff before committing.
• No manual CI dispatch or duplicate full release-gate run. Push-triggered CI must be checked against this new commit; predecessor CI does not establish this candidate's acceptance.

Previous revision validation

Commit: d86a31aa64f10721a7b232eeec0d25537f08fd2f
Tree: 67db7f468cd01c859c12ef2501a0587c4a7e24a7

• Five affected local modules: 337 passed in 49.05s, before the final recovery/containment/spec-dependency refinements.
• Final affected-module rerun after those refinements: 65 passed in 0.82s (review, provenance and capability modules, including JSON Schema checks).
• git diff --check passed. The committed patch matched the tested handoff checksum exactly.
• Legacy archive unit tests isolate their downstream knowledge/evidence boundary; separate lifecycle tests exercise real stage admission and stale/current source transitions.
• No manual CI dispatch or full release-gate rerun was performed for this revision. Any push-triggered checks must be evaluated against this new commit; prior green CI is not evidence for it.

Historical baseline validation

The following results belong only to predecessor 79e2258d8bd975bc644b72435d35870793ac5eed, tree 2fc261d90f3f0dc90dd27a1bc91a5bb2e6a9ec9d:

• Native adversarial replay: 12/12 passed twice with identical results.
• Current and fresh tracked-only checkouts: 37/37 test modules plus skill validation passed with identical complete summaries.
• Handoff validation reused native observations in 0.43 seconds.
• GitHub Ubuntu/macOS CI passed: https://github.com/Ldsystem/work-bundle/actions/runs/33966547125.

Review and boundaries

Contributor review is requested before merge. No auto-merge is enabled. Integrated release review, governed knowledge closure and the migration handoff remain pending; this PR does not claim the entire WOR-105 workflow complete.

Native stage admission requires fresh matching semantic-identity records; historical raw-checksum/bootstrap records are not automatically promoted. Final admission fails closed for dirty or ambiguous source candidates. Stage credit now requires native reviewer-run provenance in addition to evidence-access disclosures. The controller/runtime store remains a trusted OS boundary, not a cryptographic defense against a compromised same-user host; undeclared author/repair identities are not inferred.

WOR-108 mandatory subagent ownership and initial-versus-repair frontier work remain excluded. No work-bundle-mcp, WOR-66, WOR-79 or WOR-107 execution is authorized by this change.

[Ldsystem]

Reviewed current head 79e2258d8bd975bc644b72435d35870793ac5eed against the current WOR-105/WOR-106 authority, the WOR-98 stage-review contract they incorporate, and the later boundary we have already moved to WOR-108. Exact-head CI run 33966547125 is green.

Overall direction is materially better than the historical flow. In particular, the evaluator freeze/completion split, precise invalidation, execution-binding ownership, reviewer sandbox, stage telemetry, canonical accumulating bin/work-bundle-ci, and the new validation-evidence reuse model all move in the intended direction. The evidence reuse implementation also correctly does not key on the handoff summary alone: it keeps structural/binding/scope checks on every validation call and makes expensive observation reuse depend on source/check/environment identity. Task review also remains task-owned rather than becoming universal.

I would not yet treat this head as the accepted WOR-105 native baseline, though. I see three blocking issues:

1. Completion-provenance reuse currently serializes independent validation work. ManagedProvenanceStore is shared under the control root, and reuse_observation() holds its exclusive fcntl lock while execute() runs the expensive validation subprocess. Two different task/observation identities therefore cannot validate concurrently; worse, a validation command that re-enters a WorkBundle operation needing the same store can block behind the parent that is waiting for it. This conflicts with WOR-105/WOR-106's explicit requirement to preserve planner-proven contract-decoupled parallel execution. The lock should protect reservation/publication, not the whole observation. Suggested shape: reserve an identity under the global lock -> release -> execute -> reacquire -> publish; same-identity requests wait/reuse the reservation, different identities proceed concurrently. Please add a fixture proving different observation identities can execute concurrently while the existing same-identity dedupe still executes once.

2. I can find the stage-review contract/validator, but not the native lifecycle gate that consumes it. In this PR diff, validate_stage_reviews() is defined and exercised by tests, but I do not find it wired into specification verified, plan execution eligibility, or final acceptance/archive transitions; specs.py is unchanged and the changed plans.py path is binding release, not stage-review enforcement. Also, validate_stage_reviews() counts accepted + is_stale:false records without being given the current target identities, while only the single-review validator can compare against current_target_identity. Unless there is another gate I missed, this leaves staleness partly self-declared and means the exact-target stage review can still be bypassed. WOR-98/WOR-105 require those transitions to fail closed without the current accepted review. The lifecycle gate should resolve the actual current spec/plan/final-tree identity and validate the review against it at the transition itself.

3. Stage reviewer capability is not closed. review_runtime.validate_stage_review() accepts any non-empty reviewer.capability, and the JSON schema does the same. WOR-98's accepted contract requires a capable stage reviewer (standard | judgment in the current authority). As written, mechanical or an arbitrary string can satisfy an accepted stage review. Please close this to the accepted enum/minimum and add a negative fixture proving an incapable/arbitrary capability cannot grant stage credit.

Two secondary reconciliation items are worth resolving while touching this area:

• WOR-98's evidence-access model distinguishes direct_source | reproducible_snapshot | packet_only, with packet-only unable to masquerade as accepting direct evidence. The PR currently models evidence.mode: direct | constrained_direct plus context_origin: direct_source | carried_summary. If this is an intentional renamed/equivalent contract, document the mapping and prove a packet-only/constrained reviewer cannot obtain acceptance beyond its evidence capability; otherwise preserve the accepted modes explicitly.
• execution_context.project_capability_neighborhood() validates depth: light|standard|deep, but the function currently ranks required neighbors/intent matches and truncates by max_nodes; it does not call the typed relation traversal already implemented in capability_index.traverse_capabilities(). The current tests prove bounded retrieval/provenance, not that depth changes traversal. If the accepted WOR-105 semantic-neighborhood behavior expects relational expansion here, wire it or make depth non-authoritative rather than a dead control.

I am deliberately not asking this PR to absorb WOR-108's post-WOR-105 work: mandatory subagent task ownership / prefer_subagent retirement and the fully native initial-vs-repair review-frontier closure remain the next gate before WOR-107. Those should stay sequenced rather than being silently pulled into this release.

Once the three blocking items above are closed, this looks much closer to the baseline WOR-105 was intended to freeze: stronger evidence identity with less redundant execution, exact ownership, stage-level independent review, and preserved parallelism rather than added orchestration serialization.

[Ldsystem]

Re-review of current head d86a31aa64f10721a7b232eeec0d25537f08fd2f against WOR-105/WOR-106/WOR-98 and the agreed WOR-108 boundary.

The prior three blocking findings are now closed in the implementation, not just in prose:

• Observation reuse is identity-local single-flight: the expensive execution occurs outside the shared provenance-store lock, with explicit tests proving different identities execute concurrently, same identity executes once, epoch revocation blocks publication, and failed execution releases the reservation.
• Stage review is now wired into actual lifecycle transitions: specification verification/archive, plan execution/binding/observation, and final plan completion/archive resolve the current semantic target/source identity and fail closed on stale/missing reviews. The batch validator also requires caller-supplied current identities.
• Reviewer capability is closed to standard | judgment; packet/constrained evidence cannot grant acceptance; reproducible-snapshot/direct-source modes are reconciled; capability projection now uses the typed relation traversal with tested depth behavior.

The exact new-head PR CI run 33971029169 also completed successfully on d86a31aa..., so the previous CI evidence gap is closed.

I see one remaining native-review integrity blocker before I would treat this as the accepted WOR-105 baseline:

Stage-review acceptance is still self-attested rather than bound to reviewer execution provenance

reviewer_workspace.py now produces strong process/workspace receipts (reviewer-process-receipt-v1, sandbox profile digest, packet digest, event-log digest, cleanup receipt), but stage-review-v1 does not carry or bind to that reviewer-run provenance. review_runtime._require_current_review() accepts a matching stage-review envelope solely through validate_stage_review() and current target identity. Therefore a hand-authored JSON record declaring agent_id, standard|judgment, authorship:none, repair_participation:none, direct_source, etc. can satisfy the native lifecycle gate without proving that a separate isolated reviewer actually ran.

That is weaker than WOR-98/WOR-106's accepted requirement that the three stage gates use a fresh capable independent worker and that reviewer isolation become native/capability-enforced rather than advisory.

Suggested smallest fix: bind an accepting stage review to an immutable reviewer execution receipt (or equivalent native run identity) and validate at the lifecycle gate that:

1. the receipt's review_id matches the stage review;
2. its packet/source target identity matches the reviewed target;
3. the reviewer run completed under the accepted reviewer isolation/evidence-access boundary;
4. the run identity is distinct from the author/repair execution identity where those are known;
5. stale/missing/mismatched reviewer-run provenance blocks acceptance.

A compact receipt reference/digest is enough; do not inject the full reviewer event/history payload into the stage-review envelope.

Please add a negative fixture showing that a syntactically valid, manually authored accepted stage-review record with no capable reviewer-run provenance cannot advance the lifecycle, plus a positive fixture where the bound reviewer receipt does.

Separately, I agree the richer WOR-105 evidence/provenance model creates a real context-weight risk, but I do not think this PR should absorb that optimization. I added a bounded compiled context and evidence projection section to WOR-108: semantic authority stays lossless, while duplicated requirement/evidence text, full provenance histories, capability trees, raw traces and successful observation payloads remain runtime-side and are projected to subagents/reviewers as compact exact references. That keeps this PR focused on finishing WOR-105 native correctness rather than mixing in the next orchestration-efficiency gate.

With the reviewer-run provenance binding closed, I would consider the earlier PR findings resolved and the WOR-105 implementation materially ready for its remaining integrated release review / knowledge closure sequence.

[Ldsystem]

Re-review of current head 143e6503545932ef0c7c6932104788e1477a1b65 against WOR-105/WOR-106/WOR-98 and the agreed WOR-108 boundary.

The prior reviewer-run provenance blocker is now substantially closed. Lifecycle admission no longer trusts an accepted stage envelope by itself: reviewer_run is bound to an immutable reviewer-process-receipt-v1, the exact worker-emitted review result, packet digest, sandbox profile, event log, target identity, controller-selected reviewer identity/capability, evidence mode, and known author/repair execution IDs. Missing, mutable, mismatched, stale, failed, or overlapping provenance is covered by negative fixtures. The retained packet/profile/event evidence surviving workspace cleanup is also the right shape: compact reference in the stage envelope, detailed proof runtime-side.

I do see one remaining load-bearing evidence-capability blocker in the repaired review boundary:

A receipt now proves that a reviewer process ran, but not that the process actually had the evidence access claimed by the accepted stage review

build_direct_evidence_packet() copies only explicitly named artifacts into the reviewer workspace, and the sandbox intentionally denies the reviewer path access back to the live source/control roots. Search is also limited to artifacts already copied into the packet. That means this runtime behaves like a bounded packet/reproducible snapshot unless the controller constructs a mechanically complete source snapshot.

However, stage_review_context.evidence_mode may be set to direct_source, and lifecycle acceptance verifies only that the worker output repeats that controller-selected mode. It does not verify that the packet actually contains the evidence needed to support that mode or the stage-specific claim. The current fixture makes the gap concrete: bind_review_receipt() builds a packet containing only the stage target artifact (artifacts=[target_locator]), yet it can produce an accepted plan or integrated-implementation review receipt. For a plan review, the reviewer does not receive the linked specification contents/plan member set it is supposed to falsify; for an integrated review, it can receive no implementation source/diff at all even though the target identity includes a source tree.

That is weaker than WOR-98's evidence-access contract: packet-only evidence cannot masquerade as accepting direct-source review when it cannot establish source completeness, exact diff/source identity, or claim-relevant validation capability.

Suggested smallest correction:

1. Derive the review evidence mode from the controller-built evidence package, not from reviewer/controller declaration alone.
2. For direct_source, provide a mechanically complete read-only source/search capability tied to the exact reviewed tree; otherwise classify the package as reproducible_snapshot or packet_only.
3. For reproducible_snapshot, bind a manifest/digest proving the snapshot contents correspond to the exact target identity and include the stage-required authority surface.
4. Make the stage gate verify a compact stage evidence manifest appropriate to the target kind, for example:
   • specification: exact spec plus accepted authority/source evidence needed by its Truth Basis;
   • plan: exact root plan + all phase/task members + linked verified specification(s);
   • integrated implementation: exact reviewed source tree/diff or complete read-only snapshot + accepted plan/spec + claim-relevant validation evidence.
5. The worker output must not be able to upgrade packet_only/partial evidence into direct_source merely by declaring unavailable_evidence: [].

Please add at least these fixtures:

• negative: a plan/integrated review packet containing only the target plan artifact, labelled direct_source, cannot grant lifecycle acceptance;
• positive: a mechanically complete stage evidence manifest/snapshot for the exact target can grant acceptance;
• negative: removing one required linked spec/plan member/source manifest entry invalidates the evidence capability even if the reviewer receipt/result/target digests otherwise match.

I am treating this as part of the current PR, not WOR-108: it is review correctness/evidence capability, whereas WOR-108's context work is about projecting the same accepted evidence more compactly after correctness is established.

Exact-head CI run 33973210503 for 143e6503... is currently still running, so I am not using predecessor green CI as evidence for this head yet.

Aside from this evidence-access completeness issue, the receipt-binding repair is a meaningful improvement and resolves the previous self-attestation defect.

[Ldsystem]

Follow-up on the exact-head release result: CI run 33973210503 for 143e6503545932ef0c7c6932104788e1477a1b65 has now completed failed on both Ubuntu and macOS.

The canonical runner is doing the intended complete diagnosis: 36/37 isolated test modules pass and skill validation passes; the only failing module is tests/test_workspace_migration.py (7 failures, 13 passes on Ubuntu).

This does not look like a workspace-migration product defect. The first-broken cause is the new global test fixture in tests/conftest.py:

@pytest.fixture(autouse=True)
def isolated_reviewer_receipt_store(tmp_path, monkeypatch):
    monkeypatch.syspath_prepend(... / "scripts/orchestration")
    monkeypatch.setattr("review_runtime.reviewer_runtime_root", ...)

That syspath_prepend applies to every test, including workspace migration. migration.py later lazily imports project -> bootstrap_config, and bootstrap_config.py does a top-level from core import .... Because scripts/orchestration has been globally prepended for the test, Python resolves core to scripts/orchestration/core.py instead of scripts/work-bundle/core.py, producing:

ImportError: cannot import name 'GLOBAL_BOOTSTRAP_FILE_NAME' from 'core' (.../scripts/orchestration/core.py)

The later migration failures are cascading from that namespace collision (WB_MIGRATION_FAILED, member state remains not-started, expected final-verification error is masked).

Please repair the test/runtime import isolation, not migration behavior. The reviewer receipt store fixture should not alter global module resolution for unrelated tests. Prefer importing/loading review_runtime in a collision-safe way and monkeypatching the already-resolved module, or scope any orchestration path manipulation only to reviewer tests. Avoid leaving scripts/orchestration ahead of scripts/work-bundle for arbitrary lazy imports.

Add a regression proving that reviewer-receipt test setup cannot change unrelated WorkBundle module resolution, e.g.:

1. activate the reviewer receipt fixture/setup;
2. import/use workspace migration -> project -> bootstrap_config;
3. assert the WorkBundle core symbols resolve correctly;
4. keep tests/test_workspace_migration.py green as a complete isolated module.

This CI blocker is separate from the evidence-access completeness blocker in my preceding review comment. Both should be resolved before treating this head as the accepted WOR-105 baseline.

[Ldsystem]

Re-review of current head c3b0908fcd31ae9c4de18b3ca2851bba84b572f4 against WOR-105/WOR-106, the incorporated WOR-98 stage-review contract, and the agreed WOR-108 boundary.

The two blockers from my previous review are now closed, and I do not see a new blocking implementation defect in this repair.

1. Stage evidence completeness is now mechanically derived rather than self-claimed. The reviewer packet no longer gains direct_source capability because the caller labels it that way. stage_evidence_requirements() derives the required closure; build_direct_evidence_packet() reduces incomplete packets to packet_only and only grants reproducible_snapshot when the manifest is complete. Plan review now binds the root, plan members, verified linked specifications and carried authority. Integrated review additionally binds the complete clean committed source tree plus task validation evidence and native completion provenance where present. Lifecycle admission re-derives the required membership and verifies the immutable packet/manifest rather than trusting its old completeness claim.

   The new negative coverage is appropriate: target-only packets cannot masquerade as direct source, linked specs must be verified, every declared integrated validation check needs evidence, and removing target/plan-member/spec/source-tree/validation-evidence entries and recomputing packet/receipt hashes still fails admission. This closes the evidence-boundary problem I raised in the previous review.

2. The CI import-namespace regression is closed at the right layer. The autouse reviewer-receipt fixture no longer prepends scripts/orchestration globally. The shared compact artifact parser/resolver moved into core-independent artifact_inputs.py, reviewer_workspace loads review_runtime with a temporary path and explicit module-collision guard, and the WorkBundle dispatcher now reaches that runtime through the reviewer-workspace loader. The added migration/import-isolation fixtures directly exercise the failure class that produced the earlier GLOBAL_BOOTSTRAP_FILE_NAME collision rather than changing migration semantics to satisfy CI.

3. The earlier reviewer-run provenance repair remains intact. Accepting stage credit is still bound to the immutable reviewer-process receipt, exact worker output, target identity, controller-selected reviewer capability/identity, sandbox profile, packet/event evidence, and known author/repair execution separation. The new evidence manifest strengthens that receipt instead of replacing it with a second review/evidence model.

4. Exact current PR CI is green. Push-triggered run 33976755226 completed successfully for both deterministic-ubuntu-latest and deterministic-macos-latest. The canonical gate reports all 37/37 isolated test modules passed and skill validation passed; importantly, tests/test_workspace_migration.py is green again.

The full-tree reproducible snapshot is intentionally evidence-side and can be heavy; I would still keep prompt/context projection, semantic deduplication, lazy evidence expansion, repair-frontier packaging, and subagent ownership in WOR-108 as already recorded rather than reopening this PR for optimization.

Current review verdict: the blocking code findings I raised on PR #33 are resolved. From this review perspective, the implementation is ready to proceed through WOR-105's remaining integrated stage review, governed knowledge closure, final release identity/freeze, and migration-impact handoff. Those lifecycle steps should establish the accepted WOR-105 baseline; this comment is not a substitute for them, and WOR-108 remains the next post-WOR-105 gate before WOR-107.