Deterministic handoff currency, located+fresh eval output, orchestrator reconciliation (D13–D15)

[fazpu]

Problem

An inner_outer_eval layer can stall after the work is objectively done because the orchestrator is misled by its own durable state: a schema-valid but stale handoff, an advisory eval verdict hand-copied off-channel with no freshness marker, and no instruction to reconcile against live repo/CI state. Post-mortem: design/analysis/inner-outer-eval-nonconvergence-postmortem.md.

The fix — three substrate-determinism changes (opt-in, no new engine gate)

Activated only when a contract declares a typed, validated currency_outputs list; a contract without it is fully inert. Backward compatibility is waived per the operator.

• D13 / A1 (correctness, hard): _validate_v3_control rejects a terminal goal_met when the accepted handoff snapshot was not re-stamped by the completing attempt — independent of whether handoff_ref is cited (it is optional, so a citation-only check is bypassable). Rejection reuses the existing _reject_v2_control repair path.
• D13 / A2 (hygiene, soft): a successful handoff-owner finish that did not re-stamp emits a pure handoff_stale diagnostic + a protocol_failures repair note — no success flip, no cap, no counter, no overwrite. Gated on request.success so a crashed attempt never fails against the prior handoff.
• D13 same-revision re-stamp: relaxed by an exact field-level compare (_is_provenance_only_restamp) — producer is the current owner attempt, updated_at non-decreasing, every other field equal to the accepted snapshot — so a provenance-only re-stamp is legitimate while tamper detection is preserved.
• D14 (advisory eval, D11-safe): the engine never reads the eval file; it emits at most an eval_missing presence diagnostic. eval-banana (>=0.5.0, --result-out) writes the provenance-stamped eval_results.md by construction — no more off-channel hand-copy. check_runner_roles unchanged.
• D15 (load-bearing): exposes the session raw root in paths.json to the orchestration role only; the stock outer prompt gains reconcile-against-live-state + anti-over-polish + per-attempt re-stamp guidance, and drops the mandatory-final-eval sentence (D11). inner checks eval provenance before relying on a verdict.

Contract & stock set

CurrencyOutput model + validated currency_outputs on WorkflowSetContract (repo-relative confined unique paths; kind: handoff locked to the canonical handoff identity + declared handoff_owner). Stock inner_outer_eval declares it; the eval runner writes eval_results.md via eval-banana --result-out instead of hand-transcribing.

Design & validation

Binding design: design/designs/deterministic-handoff-and-eval-provenance.md; decisions D13–D15; two-round Codex+Grok design reviews and the implementation review archived under design/analysis/. Full suite green (471+ passed), pyright 0 errors, ruff clean. 21 new contract/behavior tests cover A1 cited/uncited rejection, no-snapshot rejection, re-stamp acceptance, opt-in inertness, A2 purity + cap isolation, non-owner non-diagnosis, crash gating, same-rev vs tamper (incl. timestamp regression), eval_missing, raw_root exposure, and contract validation.

Depends on eval-banana 0.5.0 (--result-out), now published; uv.lock pins it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EPYwF6cRYs2mfsfHF1hibc