release: prepare 0.3.0rc2 Phase 3 contract slice

.github/workflows/ci.yml

@@ -83,7 +83,7 @@ jobs:
 
       - name: Run test suite
         run: |
-          python -m coverage run -m unittest discover -s tests -t .
+          python -m coverage run -m pytest -q
           python -m coverage report
 
       - name: Chronicle migration tests

CHANGELOG.md

@@ -15,6 +15,10 @@ versioned schemas plus explicit migration notes for compatibility.
   installer state, Host diagnostics, repair, rollback, and uninstall.
 - Added checksummed release assets, SBOM/provenance generation, installer CI,
   GitHub Pages publication, and installation documentation.
+- Added the bounded Phase 3 contract-only local slice: published Execution,
+  Storage, Outcome, assurance, and Patch Promotion validation/replay contracts
+  with authority-bearing paths fail closed pending verified external facts and
+  RFC acceptance.
 
 See [release notes](docs/en/releases/0.3.0rc2.md).
 

README.md

@@ -10,8 +10,9 @@ canonical transition. Accepted events are written to a local, append-only
 Chronicle with chained SHA-256 Sigils and receipts.
 
 > Project status: `0.3.0rc2` release candidate. Phase 2 freezes the Codex
-> Plugin-first Instrumentarium while preserving host-neutral scientific
-> contracts.
+> Plugin-first Instrumentarium while Phase 3 adds a bounded contract-only,
+> fail-closed local slice; canonical authority and RFC acceptance remain
+> external prerequisites.
 
 ## Why Benchwork
 
@@ -408,7 +409,7 @@ examples/          Minimal research artifacts
 Run the test suite:
 
 ```bash
-python3 -m unittest discover -s tests -v
+python3 -m pytest -q
 ```
 
 Changes to canonical transitions should include tests for replay, schema
@@ -424,6 +425,7 @@ changes should preserve locale paths and follow
 - [Compatibility policy](docs/en/COMPATIBILITY.md)
 - [Release process](docs/en/RELEASE_PROCESS.md)
 - [M10 acceptance matrix](docs/en/M10_ACCEPTANCE.md)
+- [Phase 3 contract gate](docs/en/PHASE3_ACCEPTANCE.md)
 
 ## License
 

README.zh-CN.md

@@ -8,8 +8,9 @@ Benchwork 将科研活动转化为明确、可审查的状态。智能体和工
 提案，但只有确定性的 Athanor 内核能够接受规范状态迁移。获准事件写入本地
 追加式 Chronicle，并通过链式 SHA-256 Sigil 与 Receipt 留下记录。
 
-> 项目状态：`0.3.0rc1` 候选版本。Phase 2 已冻结 Codex Plugin-first
-> Instrumentarium，同时保留宿主中立的科研契约；稳定命名仍为 provisional。
+> 项目状态：`0.3.0rc2` 候选版本。Phase 2 已冻结 Codex Plugin-first
+> Instrumentarium；Phase 3 增加了范围受限、默认 fail-closed 的本地合同纵切，
+> 规范权威与 RFC 接受仍是外部前置条件。
 
 ## 为什么需要 Benchwork
 

docs/en/OPEN_DECISIONS.md

@@ -18,3 +18,17 @@ canonical: true
    `PIVOT` outcome automatically creates lineage.
 6. Define Provider leases, cancellation, result transport, and executor
    isolation before direct research verbs automatically execute Task Capsules.
+
+## Resolved decision record (2026-08-06)
+
+The user approved four synchronized Phase 3 decision packages. They are no
+longer open decisions; their canonical text is incorporated in the owning RFCs:
+
+1. OD22: RFC-0012 Heartbeat Collision Wire Closure HCW1–HCW10.
+2. OD23: RFC-0012 Initial State Reducer ISR1–ISR3.
+3. OD24: RFC-0013 namespace closure AC1 and RFC-0012 Result Authority Closure
+   AC2–AC4.
+4. OD25: RFC-0015 Observation projection clarification OP1–OP2.
+
+These decisions do not by themselves publish a runtime, authorize journal or
+storage mutation, accept a Result, or confer scientific authority.

docs/en/PHASE3_ACCEPTANCE.md

@@ -0,0 +1,18 @@
+# Phase 3 contract gate
+
+Run the repeatable Phase 3 evidence gate from the repository root:
+
+```bash
+.venv/bin/python scripts/ci/check-phase3-contracts.py
+```
+
+It verifies the published Schema family, RFC-0012 execution and storage
+contract validators, RFC-0015 Job Outcome validator, local durable
+start/observe/cancel/restart flow, and the MCP boundary that rejects generic
+execution authority.
+
+The gate is intentionally contract-only.  A passing run is evidence for the
+local reference slice; it does not claim a complete RFC-0012 Journal replayer,
+RFC-0013 Storage backend, RFC-0015 Result acceptance, remote Worker support,
+or scientific authority.  Those remain the Phase 3 release-exit work named in
+the [roadmap](ROADMAP.md#phase-3--sanctum-04).

docs/en/PHASE3_BLOCKER_REGISTER.md

@@ -0,0 +1,42 @@
+# Phase 3 blocker register
+
+This register records implementation boundaries found by local independent
+review. It is not an authority grant, RFC acceptance record, or a substitute
+for a complete Chronicle/Storage replay.
+
+## Active blockers
+
+| Area | Why the installed local comparator must fail closed | Required before a local reducer/comparator may be installed |
+| --- | --- | --- |
+| RFC-0012 retry scheduling and readiness | The published Event payload has opaque terminal-reason, backoff, queue, deadline, and freshness values. The repository has neither an immutable Specification resolver nor a non-forgeable resolver Receipt/authorization result. A self-Sigiled “resolution” record would let a caller authorize `ACTIVE -> RETRY_WAIT -> QUEUED`. | A resolver-owned, verified eligibility and readiness result; exact Specification and terminal/settlement/assurance bindings; persistent eligibility binding for the State; and a continuous prefix test through the next Attempt allocation. |
+| RFC-0013 quota-pressure transitions | Quota counters are independent projected entities, but the current closed Storage State does not retain their per-counter revisions. Reusing the Journal sequence would produce invalid entity-revision algebra. | An approved State/Schema evolution that persists independent quota-counter revisions, plus exact `observed_at`/clock semantics and pressure transition tests. |
+| RFC-0013 transfer preparation | `transfer.prepared` would create a Transfer request, Attempt, Reservation, and quota effects. Current records contain bare authorization/fence/policy/backend references, Reservation has no verified issuer result, and State lacks quota-counter revisions. Treating their self-Sigils as admission authority would permit caller-controlled state transitions. | Verified authorization, lease/fence, backend, policy, and reservation-issuance inputs; an approved quota-revision State evolution; and a continuous prepare-to-terminal transfer replay with exact quota accounting. |
+| RFC-0013 retention-policy registration | The installed replay accepts only locally closed `ACTIVE` PROJECT and already-projected exact Reference Set branches. BLOB scope still needs a replayed Blob lifecycle and PROGRAM needs a verified program-to-project resolver. Initialization cannot yet be encoded: RFC-0013 requires a migration-protection policy but does not provide its fixed ID, complete field values, or authorization-Sigil derivation, so accepting any guessed two-policy set would be unsafe. | A canonical migration-protection policy identity/full-field/authorization definition (or an accepted resolver contract), then initialization-policy reducers plus exact activation checks; a replayed Blob scope relation; a verified PROGRAM resolver; and fixtures covering every scope and the two initialization registrations. |
+| RFC-0013 canonical-reference release | Local facts can close self-Sigils and a Head advance, but cannot prove that a Chronicle suffix contains no binding Event. | An authoritative full Chronicle replay/adaptor or an externally verified absence authority. The public reducer remains fail closed. |
+| Full RFC-0013 Storage replay | The prefix dispatcher still deliberately rejects transfer, replica, materialization, quarantine, retention, GC, and disposition Events without their authoritative immutable-record and backend facts. | Reducers and supplied-facts comparators for each Event family, followed by retained-output, quarantine, and recovery prefix fixtures. |
+| RFC-0014 Patch MCP and Host-native application | The four Patch tool names and closed schemas are published, but the MCP server intentionally registers no Patch module. Implementing a route without the Promotion Journal, authenticated human confirmation, Storage/Chronicle authority, and the reference atomic-CAS adapter would expose a misleading mutation surface. | A complete Promotion Coordinator and Journal replayer; verified confirmation and Athanor/Storage boundaries; the `FULL_TREE_ATOMIC_CAS` reference adapter with durable evidence/recovery; then four exact MCP routes with their success/error contracts. |
+
+## Local review record
+
+The following local reviews were performed in the active project session. They
+are advisory implementation review evidence only; no source was disclosed to
+an external reviewer.
+
+| Scope | Disposition | Evidence |
+| --- | --- | --- |
+| Result acceptance, Outcome and assurance-Claim local closures | Findings were fixed before the corresponding commits; the installed paths retain fail-closed authority boundaries. | `ab5ed53`, `c64b377`; focused suite and full test baseline in the exit audit. |
+| Lease fencing and retained multi-Attempt selection | A stale-lease/fence-regression finding was fixed before merge. | `d4fa717`; final-floor guards and replay tests. |
+| Canonical-reference commit/release local facts | Closure, quota-settlement, and release-absence findings were resolved by retaining fail-closed release behavior where authority is missing. | `9f1b605`, `f74cc66`; Storage contract tests. |
+| Proposed retry and quota-pressure reducers | Rejected, not merged: their initial forms would have treated caller-controlled inputs as authority or violated independent entity revisions. | No implementation commit; blockers above describe the required design inputs. |
+
+## Verification baseline
+
+Run from the repository root:
+
+```bash
+.venv/bin/python -m pytest -q
+PYTHONPATH=src .venv/bin/python scripts/ci/check-phase3-contracts.py
+```
+
+These commands establish only the contract-only local slice. They do not
+accept any RFC, establish backend truth, or grant Athanor/Chronicle authority.

docs/en/PHASE3_EXIT_AUDIT.md

@@ -0,0 +1,47 @@
+# Phase 3 exit audit
+
+This document records the release-exit evidence required by the Phase 3
+roadmap. It is an audit aid, not an RFC acceptance record and not a claim of
+runtime or scientific authority.
+
+| Exit requirement | Current evidence | Status |
+| --- | --- | --- |
+| Five accepted RFCs | RFC-0011 through RFC-0015 remain `draft`. | Blocked by explicit RFC acceptance. |
+| Executable Schemas and examples | `scripts/ci/check-schemas.py` validates 214 published Schemas; Phase 3 fixtures are checked by the contract suite, including Promotion Journal revision algebra, abandonment-record closure, and adapter-generation consistency. | Present. |
+| Threat-model review | [Independent local trust-boundary review](PHASE3_THREAT_MODEL_REVIEW.md) found no P1/P2 in the bounded implementation slice. It explicitly leaves external authority and RFC acceptance open. | Partial retained review evidence. |
+| Conformance suite | `scripts/ci/check-phase3-contracts.py` validates the contract-only local slice. It deliberately does not establish full conformance. | Partial. |
+| Local reference vertical slice | Local `benchwork-local-*/0.1` storage and execution primitives retain bounded operational evidence. RFC-0012 replay preserves multi-Attempt history, fresh retry-allocation identities, lease-fence monotonicity, Result acceptance local closure, and supplied-facts assurance-Claim closure. RFC-0013 replay projects exact supplied provenance-policy registrations and active-Store retention-policy registrations with locally closed PROJECT or already-projected Reference Set scope. Retry scheduling/readiness, initialization retention policies, BLOB/PROGRAM retention scopes, and complete Storage replay remain unavailable; all authority-bearing paths fail closed. | Partial. |
+| Local runtime lifecycle demonstrations | `tests/test_execution.py` exercises lease-expired negative terminalization, cancellation, duplicate terminal delivery rejection, stale observation cursors, and restart recovery across queued and terminal Jobs. | Present for the bounded `benchwork-local-execution/0.1` runtime only. |
+
+## Verified baseline
+
+The current repeatable baseline is:
+
+```bash
+.venv/bin/python -m pytest -q
+PYTHONPATH=src .venv/bin/python scripts/ci/check-phase3-contracts.py
+```
+
+It is evidence for contract integrity and the bounded local slice only. It
+does not change the ownership rules in the RFCs: Athanor remains the only
+canonical authority, and the Executor cannot promote a Worker result into a
+scientific fact.
+
+## Remaining implementation order
+
+1. Install RFC-0012 retry scheduling and readiness with the missing supplied
+   Specification, terminal-event, deadline, and freshness facts; then
+   demonstrate a terminal Attempt through scheduling, readiness, new
+   allocation, and restart replay.
+2. Install the required RFC-0013 Storage reducers and prove retained output,
+   quarantine, and recovery projections from a complete Storage prefix.
+3. Extend the existing supplied-facts Result and assurance-Claim comparators
+   only to consume their remaining externally verified resolver results. A
+   `CLAIMED` outcome already cannot be established by an opaque Sigil alone in
+   the installed replay path.
+4. Resolve the authority and State-evolution prerequisites in the
+   [Phase 3 blocker register](PHASE3_BLOCKER_REGISTER.md), then run the
+   expanded conformance suite and retain the required formal threat-model
+   review evidence beyond the bounded local review.
+5. Request explicit acceptance for each RFC. This repository forbids sealing
+   an RFC without that confirmation.

docs/en/PHASE3_RFC_ACCEPTANCE_PACKET.md

@@ -0,0 +1,36 @@
+# Phase 3 RFC acceptance packet
+
+This packet prepares a human acceptance review; it does not accept, seal, or
+change the status of any RFC. Each RFC remains `draft` until the project owner
+explicitly accepts it.
+
+## Shared review boundary
+
+The current baseline is 214 published Schemas, the contract-only Phase 3 gate,
+and the bounded `benchwork-local-*/0.1` runtime. The reproducible commands
+are in the [exit audit](PHASE3_EXIT_AUDIT.md#verified-baseline). Those checks
+do not prove a complete RFC-0012 Journal replayer, a complete RFC-0013 Storage
+backend, canonical Result acceptance, or scientific authority. The exact gaps
+are maintained in the [blocker register](PHASE3_BLOCKER_REGISTER.md).
+
+## Per-RFC acceptance checklist
+
+| RFC | Evidence ready for review | Acceptance blocker |
+| --- | --- | --- |
+| RFC-0011 — Sanctum Execution Model | Published Schema family, bounded local runtime lifecycle tests, fail-closed MCP/runtime boundaries, and a [retained independent local trust-boundary review](PHASE3_THREAT_MODEL_REVIEW.md). | Formal RFC acceptance and the external authority evidence remain pending. |
+| RFC-0012 — Job, Lease, and Worker Protocol | Execution State/Journal schemas; Job Outcome contracts; multi-Attempt, lease-fence, terminalization, assurance-Claim, cancellation, expiry, duplicate-delivery, and restart tests. | Retry scheduling/readiness still lacks externally verified Specification, deadline, freshness, and resolver facts; complete Storage/Result authority replay is also unavailable. |
+| RFC-0013 — Artifact Storage Model | Storage schemas; initialization, activation, recovery, message rejection, failed legacy-protection, Reference Set, canonical-reference, provenance-policy registration, and active-Store retention-policy registration for locally closed PROJECT/Reference Set scopes. | Transfer lifecycle, quota revisions, full retention initialization details (including the unspecified migration-policy identity), BLOB/PROGRAM scopes, full backend replay, and authoritative Chronicle absence are incomplete. |
+| RFC-0014 — Patch Promotion Protocol | Published Patch schemas and contract tests for journal, bundle, checkpoint, mutation intent, target guard, attempt, outcome, recovery record, revision algebra, abandonment disposition closure, and the retained [local trust-boundary review](PHASE3_THREAT_MODEL_REVIEW.md). | The four RFC Patch MCP routes and their authority-bearing implementation are not yet published; final cross-RFC replay/Storage evidence and reference Host-native adapter evidence are also required before the Phase 3 release gate can be asserted. |
+| RFC-0015 — Experiment Executor API | Typed request/Outcome schemas; strict Result v2 local closure; supplied-facts acceptance comparator; Result/Observation contract tests. | Comparator intentionally does not grant canonical acceptance; it still requires externally verified Chronicle/Storage/Outcome facts. |
+
+## Required human decision
+
+For each RFC, the reviewer must make one explicit choice:
+
+1. accept the exact draft and its documented boundaries;
+2. request named changes; or
+3. defer acceptance pending named evidence.
+
+No blanket Phase 3 approval changes five `draft` RFCs into accepted documents.
+Any acceptance record must identify the exact RFC, version, reviewed commit,
+reviewer, time, and rationale.

docs/en/PHASE3_THREAT_MODEL_REVIEW.md

@@ -0,0 +1,58 @@
+# Phase 3 local threat-boundary review
+
+## Status and scope
+
+This is an independent local implementation review conducted against commit
+`7ea893b`. It is retained Phase 3 evidence only. It is not an RFC acceptance
+decision, an Athanor Receipt, or proof of any external Storage, Chronicle,
+Ward, approval, or Worker authority.
+
+The review examined the RFC-0011 and RFC-0013 trust boundaries in:
+
+- `src/benchwork/execution.py`
+- `src/benchwork/execution_contracts.py`
+- `src/benchwork/artifact_storage_contracts.py`
+- `src/benchwork/patch_promotion_contracts.py`
+- MCP registration/runtime code, Phase 3 documents, and relevant tests
+
+## Conclusion
+
+No P1 or P2 finding was identified. The installed local slice does not treat
+a self-Sigil, a caller-supplied fact, a Worker result, or a local comparator as
+external authorization. Unresolved authority-bearing paths remain fail closed.
+
+## Reviewed boundaries
+
+| Boundary | Review conclusion |
+| --- | --- |
+| MCP tool surface | Only the fixed read, task, canon, and experiment modules are registered. The local `benchwork_start_job` helper is not published as an MCP tool. |
+| Worker and local execution | `execution.py` is bounded operational code: it does not interpret arbitrary commands or append Chronicle records. Its trusted-local terminal hook does not make the resulting outcome acceptance-eligible. |
+| Self-Sigil and supplied facts | Result v2 and supplied-facts helpers perform local deterministic closure only; they do not resolve Chronicle, Storage, Ward, approval, or acceptance authority. |
+| Storage and Chronicle | Uninstalled Storage events fail closed. Canonical release requires an authoritative suffix-absence proof, while Storage replay/runtime authority functions reject in the contract-only slice. |
+| Patch promotion | The contract validates wire and supplied facts only; its runtime-authority entry point rejects. |
+| Status documents | The blocker register and acceptance packet consistently describe the local slice as non-authoritative and leave unresolved paths fail closed. |
+
+## Reproduction evidence
+
+The reviewer ran the following checks in `/Users/momo/benchwork-phase3-recovery`:
+
+```bash
+git status --short && git rev-parse --short HEAD
+PYTHONPATH=src .venv/bin/python scripts/ci/check-phase3-contracts.py
+```
+
+The worktree was clean at `7ea893b`; the gate validated 214 published Schemas,
+ran 182 tests, and reported Ruff clean for its checked source set.
+
+## Residual assumptions
+
+- `ExecutionService.record_terminal` is a trusted local-adapter hook. It is
+  not MCP-exposed and cannot make an outcome acceptance-eligible, but its
+  safety still depends on the host process boundary.
+- A local contract gate cannot establish authoritative Chronicle suffixes,
+  Storage backend state, or Ward/Registry/approval facts. Those prerequisites
+  remain explicitly outside this review and must be supplied by their owning
+  authoritative systems.
+
+These residual items keep the RFC acceptance gate open; they are not evidence
+that the bounded local implementation crosses those boundaries.