fix(orchestration): complete WOR-112 native execution closure

references/assets/orchestration/contract/task-v1.md

@@ -150,7 +150,7 @@ A legacy 3-column `Command or inspection | Proves | Expected` row without YAML `
 - When `task_fit_check.result` is `repaired`, completion requires `review_mode: repair`, the native review envelope fields, and exactly one `previous_review`. The closed `repair_frontier` binds that predecessor's review ID, blocking finding IDs, previous and repaired target identities, affected boundaries, and frozen evidence identity. Whole review history is not embedded or reacquired.
 - Both the current and previous task-review records retain `required: true`, `reviewer_independent: true`, and `review_target_kind: task`; the adapter does not infer or overwrite those ownership facts. The accepted repaired target names the completed task and its `source_tree` plus `reviewed_head` must equal the helper-observed Git tree and head.
 - Material redesign or changed authority, scope, acceptance, decomposition, or validation allocation requires a fresh `initial` review with `review_reset` bound to the prior review, classified reason, and current target and evidence. The reviewer may reuse the same agent identity when judgment-capable and independent by authorship/repair/decision/deliberation participation and review provenance; identity rotation is not a freshness requirement.
-- Task and stage review results are first-class review-store records. Lifecycle admission takes only `{review_id, sha256}` plus the expected current target; it revalidates the native immutable reviewer-run receipt before exposing a verdict or selecting a finding. Bare output, receipt, or finding objects are non-authoritative.
+- Task and stage review results are first-class review-store records. Lifecycle admission takes only `{review_id, sha256}` plus the expected current target; it revalidates the provider-specific reviewer-run receipt before exposing a verdict or selecting a finding. Bare output, receipt, or finding objects are non-authoritative.
 - The task-review product candidate contains accepted product requirements/boundaries, exact product source/diff identity, normalized harness-owned validation observations, and unresolved product concerns. Handoff, knowledge disposition, reviewer history, and publication/status/archive bookkeeping remain controller-owned and are excluded from reviewer judgment. Controller/orchestration code remains product when allocated by the task.
 - A stored post-execution task repair review may recompute the compact accepted result while preserving its executor-result digest, validation evidence identities, owner, baseline, and knowledge disposition. This path performs no executor redispatch, replacement handoff, validation rerun, or review-history embedding.
 

references/assets/orchestration/workflow.md

@@ -103,7 +103,9 @@ retained for blocked/repair evidence, never sole acceptance. Accepted review req
 direct-source or reproducible-snapshot context and no unavailable claim-relevant
 evidence. Snapshot access additionally requires explicit snapshot artifact digests.
 The record describes evidence access; lifecycle acceptance additionally requires
-`reviewer_run: {run_id, sha256}` referencing a native `reviewer-process-receipt-v1`.
+`reviewer_run: {run_id, sha256}` referencing a provider-specific reviewer-run receipt:
+`reviewer-native-receipt-v1` for native host runs or
+`reviewer-process-receipt-v1` for legacy sandboxed process runs.
 Envelope validation alone (including historical records without that reference) is
 not lifecycle admission. The gate resolves the controller-owned store through
 `reviewer_runtime_root(workspace_root)` under `~/.work-bundle/reviewer-runtime/workspaces/`;
@@ -116,8 +118,11 @@ For task review it instead adds native `task_review_context`, binding the task t
 review mode/frontier or reset, reviewer identity/capability, execution identity, and
 evidence mode. Workspace creation admits it only when the source checkout is clean and
 its exact HEAD/tree still equal that task target.
-The current sandbox denies live source/control access, so its packet builder derives
-`evidence_mode`; requesting `direct_source` does not grant it. A mechanically complete
+The frozen packet builder derives `evidence_mode` from available evidence; requesting
+`direct_source` does not grant it. The legacy process sandbox denies live source/control
+access. The ordinary native host path consumes the same explicit frozen evidence,
+suppresses author transport and user configuration, disables tools, and rejects observed
+tool activity; native host read-only policy is not OS process isolation. A mechanically complete
 `stage-evidence-manifest-v1` yields `reproducible_snapshot`; missing evidence yields
 `packet_only`, which cannot grant acceptance, even with `unavailable_evidence: []`.
 The manifest binds stage/target identity, required locators, roles, artifact digests,
@@ -146,8 +151,9 @@ recomputing packet/receipt hashes cannot turn partial evidence into complete evi
 
 `stage_target_identity` computes the target from current source artifacts, and
 workspace creation checks it again. Complete stage evidence is checked before any
-reviewer process launch. Run the worker with `reviewer-process-run` using that runtime
-root. Specification and plan workers retain the stage-review contract; task and
+reviewer launch. Use `run_native_reviewer` for the ordinary plugin-independent native path;
+`reviewer-process-run` remains the legacy sandboxed process runner. Specification and
+plan workers retain the stage-review contract; task and
 integrated-implementation product workers return the compact `task_review` judgment
 defined by `dev-code-review`. The controller constructs the native envelope from frozen target, independence, and evidence context,
 then binds its canonical digest into the receipt. The controller then attaches the run
@@ -157,8 +163,11 @@ named-finding routing resolve only that stored reference and recheck its receipt
 current target; bare stdout, unattached receipts, and bare findings remain observations.
 
 The lifecycle gate verifies review ID, exact result/target/profile, successful
-completion, sandbox/network/write boundary, and immutable packet/profile/event
-digests. Run-scoped evidence remains available after workspace cleanup; full traces
+completion, the provider-specific execution boundary, and immutable packet/profile/event
+digests. Native receipts bind the executable, request, actual host run identity, sanitized
+context, read-only policy, and absence of observed tool activity. Legacy process receipts
+bind the sandbox, denied network, and scratch-only write boundary. Run-scoped evidence
+remains available after workspace cleanup; full traces
 are never embedded into the stage envelope. Missing, altered, failed, mutable, or
 mismatched provenance cannot grant acceptance. Known execution IDs are obtained
 from artifact `execution_id`, `author_execution_id(s)`, `repair_execution_id(s)` and
@@ -271,6 +280,8 @@ accepted manifests into a live source inventory.
 
 Final review aggregates accepted task dispositions from execution and task-review evidence. Any accepted `update`, `supersede`, or `reclassify` promotes durable closure to `required` even when the specification's upstream Knowledge Base Update state was `not-needed`; accepted `none` does not. Rejected task dispositions do not trigger closure. Archive is allowed only after required optional reviews are accepted, declared plan-level/integration acceptance is recorded, validation and handoffs are coherent, barriers converged, the resulting Knowledge Base Update disposition is `completed` or `not-needed`, approved `ks-*` return evidence exists when required, and allowed commit/CodeGraph/metadata/archive/index mechanics complete or are explicitly inapplicable. Missing review verdicts are not a blocker when no task set `acceptance_review.required: true`.
 
+Knowledge closure gates final completion and archive; it never precedes specification, plan, task, or integrated-implementation review.
+
 Only approved keep-summarizing owners write durable knowledge. Final orchestration review owns approved persistence delegation and may invoke that owner, then validate returned paths or an evidence-backed no-write result; executors and orchestration itself must not write knowledge directly.
 
 Specification authoring materializes `impact_decisions` from bounded current-state evidence about the requested surface, upstream/downstream relations, validation surfaces, and relevant dirty work. A relation is material only when its disposition could change a requirement, constraint, acceptance criterion, user-observable or contractual outcome, architectural boundary, measurable quality target, validation target, or declared boundary. Each material relation is `accepted | excluded | blocking`: accepted relations use `projects_to` for stable specification IDs, excluded relations require evidence, and blocking relations prevent verification. Stop when further exploration could change none of those surfaces and record the reason; a greenfield result may use `none_relevant` only with the searched boundary, reason, and `stopping_reason`. Targeted Git history, prior work artifacts, execution evidence, or durable knowledge is an escalation for contradiction, unresolved ownership, material regression/causality, or suspected governing legacy decisions—not mandatory full-history archaeology or broad knowledge retrieval. This impact-decision view is compared by semantic convergence; repository traversal remains owned by specification authoring.

rules/orchestration/orch-review-completion.md

@@ -17,7 +17,7 @@ Keep final review focused on whether the WorkBundle workflow completed correctly
 ## Must
 
 - Confirm each required task review judged the accepted product requirements/boundaries, exact product source/diff, normalized validation observations, and unresolved product concerns before accepting the task.
-- Admit a task-or-stage verdict or route a finding only from its immutable review-store reference after native reviewer-run receipt and exact current-target validation. Treat bare reviewer output, unattached receipts, and bare findings as observations only.
+- Admit a task-or-stage verdict or route a finding only from its immutable review-store reference after provider-specific reviewer-run receipt and exact current-target validation. Treat bare reviewer output, unattached receipts, and bare findings as observations only.
 - Keep product review candidates limited to accepted product requirements/boundaries, exact source/diff identity, harness-owned normalized observations, and unresolved product concerns. Handoff, knowledge, reviewer-history, and publication/archive bookkeeping remain controller audit concerns and cannot become review inputs. Controller/orchestration code remains reviewable product when allocated by the task.
 - On reviewer infrastructure or provider failure, preserve the immutable candidate and repair the first broken preparation/provider owner. A still-independent capable reviewer may be reused; infrastructure failure does not itself require identity rotation, source change, validation rerun, or another product review after a completed judgment.
 - For a finding-scoped repair review under unchanged authority, carry exactly the previous finding/evidence frontier and review only the repaired identity and affected boundaries. Reset to an initial frontier only after a material authority, scope, acceptance, decomposition, or validation-allocation change.
@@ -28,6 +28,7 @@ Keep final review focused on whether the WorkBundle workflow completed correctly
 - Keep this pre-closure oracle-capability check distinct from `RuntimeVerificationClassificationV1`. WOR-59 G9 remains the unchanged post-execution classifier and may use this map only as evidence when triggered. Mechanical helpers validate IDs, completeness, provenance, and observed results; agents own semantic capability judgment and must not impose a universal browser, E2E, production, or runtime gate.
 - Missing `acceptance_review.verdict` blocks only a task that explicitly required independent review. Do not require universal task-review evidence.
 - Keep approved `ks-*` persistence delegation review-owned; executor disposition evidence never authorizes knowledge retrieval or writes.
+- Knowledge closure gates final completion and archive; it never precedes specification, plan, task, or integrated-implementation review.
 
 - Audit spec, plan, phase, task, handoff, and required optional-review status coherence.
 - Require fresh planned validation evidence and an `accept` task-review verdict wherever review is explicitly required.