feat(tape): add contract lineage enforcement

docs/architecture/proactive-multi-agent-orchestration/spec.md

@@ -5,7 +5,7 @@
 Active. DeepChat has one Subagent execution plane: durable live delegation through child Sessions.
 The unreleased QuickJS-based durable Workflow runtime is retired before merge.
 
-Last reviewed: 2026-08-04.
+Last reviewed: 2026-08-09.
 
 ## Decision
 
@@ -82,6 +82,12 @@ receives a bounded semantic Handoff plus a typed `resultRef` containing immutabl
 identity, content hash, byte/token size, and explicit truncation state. `read_result` pages the
 referenced answer without starting new model work.
 
+For contract-bearing turns, the parent also receives a bounded structured evaluation through
+`wait`, `inspect`, and `read_result`. Evaluation kind, Handoff format status, reason/evidence records,
+and the complete `evaluationRef` are projected outside child-authored text. Tape remains the
+historical source for the evaluation fact; live-delegation rows and mailbox events are the online
+projection consumed by the orchestration runtime.
+
 Child answers are untrusted evidence, not instructions. Every model-facing child result uses one
 shared orchestration envelope that:
 
@@ -98,6 +104,50 @@ to the model runtime. A malformed envelope is a host-contract failure and is rej
 falling back to raw child text. This structural validation preserves the trust boundary; it does not
 sanitize or reinterpret valid child payload text, which remains untrusted evidence.
 
+## Task And Execution Contracts
+
+Every new live-delegation turn freezes one immutable `TaskContract` containing task schema, stable
+task configuration, task description, and the harness Handoff-format/ceiling rules. The parent appends
+`contract/task_frozen` in the same transaction that creates the turn and stores the same canonical
+value plus a full Session/Tape/entry/hash reference on the turn projection.
+
+Before the first child provider dispatch, the child appends the same TaskContract by value to its
+own Tape. The inherited fact carries the complete parent `originRef`; it does not copy parent
+transcript context or require a child hot-path lookup into the parent Tape. Reset recovery
+re-anchors the hash-verified row projection into the new parent or child Tape incarnation before the
+next strict boundary. Initial delivery, restart resend, and repeated recovery are idempotent.
+
+Each contract-bearing DeepChat View embeds one immutable `ExecutionContract` with three structural
+groups:
+
+- `ceilings`: stable tool targets, effect policy, normalized workdir binding, and Subagent depth;
+- `dynamicControlSnapshot`: View-time permission, admission, and cancellation observations;
+- `provenance`: structured prompt sections and hashes for provider/model, generation config,
+  provider-visible tool definitions, internal execution policy, assembler, and TaskContract ref.
+
+The same ExecutionContract value follows the provider request, loop run, tool batch, dispatch guard,
+and schema-v5 ViewManifest. Contract-bearing DeepChat child Views fail closed before provider
+dispatch when the manifest or TaskContract binding cannot be persisted. Ordinary interactive chat
+and ACP compatibility continue to use schema-v4 manifests without ExecutionContract construction or
+dispatch enforcement.
+
+Terminal settlement validates the persisted complete child answer against the required level-two
+Markdown Handoff sections. It keeps execution and format status independent:
+
+```text
+executionStatus = completed | failed | cancelled | interrupted
+evaluationKind  = handoff_format
+formatStatus    = valid | invalid | indeterminate
+```
+
+A format-valid result only proves the required sections have non-empty bodies. It does not prove
+task completion, factual correctness, or parent acceptance. A generated answer with invalid format
+remains `completed` and returns the delegation to `idle`, allowing an explicit parent `follow_up`.
+Every contract-bearing terminal settlement atomically appends `contract/evaluated`, updates the turn
+and delegation projections, and emits the terminal mailbox event with the same canonical evaluation.
+If that transaction cannot complete, the turn remains recoverable rather than becoming terminal
+without an evaluation.
+
 ## Consent And Permissions
 
 Host enforcement, not prompt wording, owns delegation consent.
@@ -115,6 +165,13 @@ Host enforcement, not prompt wording, owns delegation consent.
   same composition to catalog construction and execution-time MCP dispatch, and a missing parent
   or unreadable child policy fails closed. Assignment, catalog, and execution use one pure authority
   composer; each boundary supplies every persisted and configured parent/child source it owns.
+- Tool dispatch additionally computes a typed meet between the exact View's frozen ceilings and
+  current runtime authority. Tool sets intersect, numeric maxima use `min`, effect classes choose the
+  more restrictive value, and the current normalized Session workdir must exactly match the frozen
+  View workdir. This workdir binding rejects stale Views after a directory change; it is not
+  argument-level path authorization or a filesystem sandbox. Frozen ceilings cannot expand within
+  a View; permission mode and other dynamic controls use the current runtime value and may tighten
+  or relax according to their existing host contract.
 - Tool-catalog context records the immutable Session kind. A successfully identified regular
   Session may bypass Subagent composition until that context is cleared, but an unknown or known
   Subagent identity that can no longer be resolved fails closed. Execution checks current authority
@@ -133,7 +190,7 @@ Host enforcement, not prompt wording, owns delegation consent.
 Generation settings and safety state have different lifetimes:
 
 - model and generation settings are frozen when each child turn starts;
-- permission mode, workspace authority, Session deletion, and capability revocation are checked
+- permission mode, workdir identity, Session deletion, and capability revocation are checked
   continuously and take effect for active work;
 - the host revalidates safety before authorization, immediately before tool dispatch, and before a
   suspended child resumes; a permission change between authorization and dispatch fails closed;
@@ -173,6 +230,11 @@ Compatibility handling for malformed or oversized unreleased rows must otherwise
 of repeatedly rolling back on the same data. Character-count validation must not claim to enforce a
 byte limit.
 
+A follow-up is a new turn with a newly frozen TaskContract. Its task configuration cites the prior
+`evaluationRef` from the same parent Session; it does not mutate the previous contract, replay the
+previous Run identity, or reinterpret a format-valid child claim as trusted. Cross-Session
+predecessor references fail canonical contract validation.
+
 Child-to-parent terminal events are a durable cursor stream and remain available until their parent
 Session is deleted. Only already-consumed parent-to-child messages may be compacted without a
 persisted reader cursor; an arbitrary row-count window must not discard unread completion events.
@@ -201,6 +263,12 @@ Databases that ran the feature branch may already record version 63. Version 64
 decommission migration that removes Workflow artifacts and preserves monotonic schema history. The
 code must never lower the latest schema version below a version already observed by those databases.
 
+Version 65 adds nullable, bounded TaskContract, parent/child reference, and evaluation projection
+columns to `live_delegation_turns`. Version 66 adds the bounded evaluation value/reference projection
+to `live_delegation_events`, so a parent mailbox consumer receives the same Handoff format status
+without querying Tape. Existing rows remain valid with null contract/evaluation fields; historical terminal
+turns are not assigned fabricated evaluations.
+
 Schema version numbers are monotonic high-water marks. Upgrade paths record intentionally empty
 versions so abandoned numbers cannot be reused later. Database import and encryption migration use
 the same dependency-aware table-copy planner, including trigger-enforced dependencies that SQLite
@@ -227,7 +295,14 @@ Workflow panels, saved Workflow commands, launch approvals, and `/workflow` are
 
 - Direct ACP Sessions and child Sessions cannot enable proactive collaboration.
 - Existing released Sessions default to `explicit`; intent is never inferred from disabled tools.
-- Existing feature-branch databases migrate forward through version 64.
+- Existing feature-branch databases migrate forward through version 66; pre-contract rows remain
+  readable with nullable projections.
+- ViewManifest schemas 1-4 remain readable. Contract-bearing DeepChat child schema-v5 manifests bind
+  one ExecutionContract to the exact request and fail closed on a missing or conflicting binding;
+  ordinary interactive chat and ACP continue to write schema 4 without an ExecutionContract.
+- Legacy active turns freeze an explicit `legacy_recovery` contract before continuation. Historical
+  terminal turns remain unevaluated; a contract-bearing terminal turn without an evaluation is
+  invalid and remains recoverable.
 - Historical `subagent_orchestrator` transcript blocks remain renderable but cannot start the old
   in-memory batch executor. The legacy name remains reserved only as a renderer trust tombstone.
 - Generic MCP tools remain reachable unless their names collide with an active native tool or an
@@ -242,8 +317,8 @@ Workflow panels, saved Workflow commands, launch approvals, and `/workflow` are
    all generation settings.
 2. `deepchat_subagents` is the only model-facing Subagent execution tool.
 3. No QuickJS, Workflow runtime, saved Workflow, Workflow route/event, or Workflow UI surface ships.
-4. Schema version 64 removes Workflow triggers and tables without regressing released or
-   feature-branch databases.
+4. Schema version 64 removes Workflow triggers and tables, and versions 65-66 add nullable bounded
+   contract/evaluation projections without regressing released or feature-branch databases.
 5. Explicit policy requires host confirmation for `spawn` and `follow_up`; proactive policy is
    standing authorization for those operations.
 6. Child tool permissions remain governed by ordinary permission mode and live safety state.
@@ -258,6 +333,15 @@ Workflow panels, saved Workflow commands, launch approvals, and `/workflow` are
     compatible.
 12. Reasoning controls remain available whenever the selected model supports them, independently
     of proactive-collaboration availability.
+13. Every new delegation turn freezes a parent TaskContract, and the child durably inherits the
+    same value before provider dispatch without reading the parent Tape on its hot path.
+14. Every contract-bearing DeepChat child View carries one schema-v5 ExecutionContract and enforces
+    the typed meet of its frozen ceilings with current runtime authority.
+15. Every contract-bearing terminal settlement atomically persists one evaluation fact, turn and
+    delegation projections, and mailbox event; execution status remains independent from Handoff
+    format status.
+16. `wait`, `inspect`, and `read_result` expose bounded structured evaluation metadata outside
+    untrusted child text.
 
 ## Non-Goals
 
@@ -270,6 +354,8 @@ Workflow panels, saved Workflow commands, launch approvals, and `/workflow` are
 - Making direct ACP backends participate in DeepChat-owned local orchestration.
 - Treating Tape as the mutable scheduler or promising exactly-once side effects.
 - Adding a batch/fan-out DSL before ordinary multi-call spawning proves insufficient.
+- Automatically repairing, retrying, or overriding a parked result in V1.
+- Treating ReplaySlice or a contract hash as a second online authority.
 
 ## Reconsideration Triggers
 

docs/architecture/tape-contract-lineage/plan.md

@@ -0,0 +1,115 @@
+# Tape Contract Lineage Implementation Plan
+
+## 1. Establish Canonical Contract Domains
+
+- Add shared, bounded schemas for prompt-section provenance, TaskContract, TaskContract references,
+  ExecutionContract, and Handoff format evaluation.
+- Add main-process canonical builders and versioned hashes using the existing canonical JSON helper.
+- Define stable tool target identity and typed ceiling comparison without importing runtime services
+  into the domain layer.
+- Add focused domain tests for canonical ordering, hash exclusion rules, bounds, typed meet, and
+  evaluation invariants.
+
+## 2. Make Prompt Assembly Constructive
+
+- Introduce a structured prompt assembly result while retaining the existing string-returning helper
+  as a compatibility wrapper for narrow callers and tests.
+- Give each system-prompt contribution a stable kind, source reference, inclusion state, content
+  hash, and bounded degradation list.
+- Expose AGENTS.md cache provenance, including fresh, cached, deferred, missing, and read-error
+  states, without copying AGENTS.md into the manifest.
+- Record pinned-skill load omissions and tooling/environment construction failures as provenance.
+- Thread the structured result through BasePromptAssembler, turn setup, compaction rebuild, and loop
+  recovery without changing the provider-visible prompt text.
+
+## 3. Build And Persist ExecutionContract At View
+
+- Construct one immutable ExecutionContract after final provider messages, tools, model identity,
+  token budget, runtime settings, and TaskContract context are known.
+- Store the value on the request/run path; do not add a per-Session latest-contract cache.
+- Upgrade contract-bearing DeepChat child ViewManifest writes to schema 5 and the next hash version
+  while preserving v1-v4 readers and schema-v4 writes for ordinary interactive chat and ACP.
+- Include full ExecutionContract content in `view/assembled`; reference the TaskContract by durable
+  local/origin identity where present.
+- Keep ordinary interactive writes fail-open and make contract-bearing DeepChat child View writes
+  fail closed before provider request admission.
+
+## 4. Enforce The Frozen View Ceiling
+
+- Carry ExecutionContract identity through the exact logical round and tool batch that consumed the
+  provider response.
+- Persist a bounded View binding on paused permission actions, retain the exact value in the live
+  batch projection, and recover it from a hash-verified v5 manifest only after runtime loss.
+- Validate stable tool target, reviewed effect class, exact normalized View workdir binding, and
+  nesting ceiling before crossing ToolService dispatch.
+- Retain existing live permission, workdir identity, deletion, and Subagent-authority checks as the
+  current runtime side of the meet; do not represent the workdir binding as argument-level path
+  authorization.
+- Reject stale, missing, or mismatched contract identity for contract-bearing child dispatch.
+- Add tests for mid-run revocation, permission relaxation, tool-catalog expansion, workdir change,
+  transient provider retry, and multiple logical rounds.
+
+## 5. Add Strict Contract Tape Capabilities
+
+- Reserve `contract/*` in the generic Tape writer.
+- Add a contract writer/reader with canonical payload conflict checking and transaction-aware append.
+- Expose complete Tape identity for contract references without making repositories query concrete
+  Tape tables.
+- Keep ExecutionJournalService's independent-transaction prohibition unchanged.
+- Add architecture guards that permit contract persistence only through its application capability.
+
+## 6. Persist TaskContract Runtime Projection
+
+- Add a forward-only database migration for nullable TaskContract value/reference, inherited
+  reference, and evaluation value/reference columns on `live_delegation_turns`.
+- Extend shared orchestration schemas with nullable projections for historical compatibility.
+- Build a TaskContract from the parent request, resolved slot, stable target, default or configured
+  Handoff format, and optional predecessor evaluation.
+- Coordinate parent contract append and initial/follow-up turn creation in one MainDatabase
+  transaction.
+- Keep a canonical runtime projection on the turn so restart and parent Tape reset do not erase the
+  in-flight task semantics.
+- Re-anchor the same hash-verified canonical projection into a new parent Tape incarnation before a
+  strict operation and atomically update only its runtime reference.
+
+## 7. Inherit TaskContract Into Child Tape
+
+- Append the canonical value to the child Tape with complete origin identity before marking the
+  Handoff deliverable.
+- Persist the child-local reference on the turn projection and make repeated recovery idempotent.
+- Re-inherit the same hash-verified projection after a child Tape reset before another provider
+  request can start.
+- Expose the active child TaskContract context to prompt/View assembly through a narrow read port.
+- Reconcile legacy active turns by freezing an explicitly degraded compatibility contract before
+  continuation.
+- Fail closed on origin hash conflict, child-local content conflict, or missing contract projection.
+
+## 8. Evaluate And Atomically Settle
+
+- Parse the persisted complete child answer, not its bounded Handoff projection.
+- Implement required-section evaluation with the existing fence-aware Markdown rules.
+- Create `valid`, `invalid`, or `indeterminate` Handoff format evaluation with bounded evidence and
+  reason codes; do not represent it as task success or parent acceptance.
+- Replace terminal fallback paths that can commit without evaluation.
+- Commit evaluation fact, evaluation projection, execution status, delegation projection, and
+  mailbox event in one transaction.
+- Preserve `executionStatus=completed`, `formatStatus=invalid`, and `delegationStatus=idle` for
+  format-invalid but successfully generated results.
+
+## 9. Surface Evaluation To The Parent
+
+- Add evaluation summary/reference to turn inspection, wait event projection, and result pages.
+- Keep evaluation metadata outside the untrusted child text in the child-result envelope.
+- Include predecessor evaluation identity when a parent starts a follow-up turn.
+- Do not add automatic repair, retry, override, or a new persisted parked status.
+
+## 10. Documentation And Validation
+
+- Update the maintained proactive multi-Agent specification and `tape-system.md` write-discipline,
+  ViewManifest, lineage, and evaluation sections.
+- Add migration tests from pre-contract schema versions and fresh-install schema tests.
+- Run focused prompt, ViewManifest, Tape, dispatch, orchestration repository/service, and integration
+  suites after their owning slices.
+- Before each commit, review the staged diff for hidden side effects, compatibility, edge cases,
+  performance, security, naming, test gaps, and maintenance cost; fix findings before committing.
+- Before handoff, run format, i18n, lint, Node/web typecheck, and the relevant main-process suites.