fix: enforce evidence capability at review completion

references/assets/orchestration/contract/handoff-executor-result-v1.md

@@ -46,10 +46,22 @@ changes:
 
 validation:
   commands:
-    - command: "exact command"
+    - id: VAL-001
+      invariant_ids: [INV-001]
+      command: "exact command"
       result: passed | failed | skipped
       note: "Failure reason or skip reason only."
 
+evidence_closure:
+  result: passed | incapable | contradictory | stale | wrong_boundary | failed | missing | unexecuted
+  invariants:
+    - id: INV-001
+      boundary: unit | component | integration | runtime | ui_visual | performance | accessibility | inspection | other
+      freshness: current_task_batch
+      evidence_ids: [VAL-001]
+      closure_result: passed | incapable | contradictory | stale | wrong_boundary | failed | missing | unexecuted
+      repair_owner: null | task | plan | specification
+
 knowledge_disposition:
   action: none | update | supersede | reclassify
   reason: "Task-local post-validation evidence."
@@ -154,6 +166,7 @@ allocation_evidence:
 - For a task-scoped executor-result, `related.plan` and `related.task` are required and must equal the assigned task's `plan_id` and `id`. Nested `related.plan` and flat `related_plan` must resolve to exactly one identity. Missing, null, conflicting, or mismatched plan identity fails closed before `Completed` and before `build-review-package` produces a review package. The shared `validate-executor-result` helper owns this gate. Do not infer plan identity from a local task ID.
 - `changes.files` is required when files, symbols, artifacts, schemas, commands, or docs changed or were inspected as the task output.
 - `validation.commands` is required when any command, test, lint, inspection, or manual verification was run or intentionally skipped.
+- `evidence_closure` is required for a completed task whose compiled `evidence_capability.result` is `mapped`. Its invariant IDs, boundary, freshness, and evidence IDs must exactly match allocated task authority. Each referenced validation report carries the allocated `id` and `invariant_ids`; direct harness observation reuses those compiled identities. Only all-`passed` capable, current, correctly bounded evidence closes the task. Negative results fail closed and name the first repair owner: task for failed, stale, or unexecuted implementation evidence; plan for missing, wrong-boundary, or incapable allocation; specification for contradictory accepted authority. Executor-authored closure is corroboration and cannot replace harness observation or semantic review.
 - `knowledge_disposition` is required for every completed or partial meaningful move. It records task-local evidence only and does not authorize durable-knowledge retrieval or writes. A change action requires allocated `AUTH-NNN` aliases from the task's accepted decision authority, allocated source IDs, or exact paths already present in the compiled task scope; `none` requires an empty affected-authority list. Invented or unallocated AUTH aliases fail closed.
 - `contract_decoupling` is required when a task is marked contract-decoupled or depends on a common contract group.
 - `barrier` is required when a task is a barrier participant or convergence owner.

references/assets/orchestration/contract/plan-v1.md

@@ -35,6 +35,10 @@ allocated_skills:
     applies_when: [observable plan-wide condition]
     use_timing: planning|task_execution|review
     required_for: [why executors need this skill context]
+evidence_capability:
+  result: mapped | no_validation_bearing_obligation
+  reason: [non-empty reason]
+  invariants: [stable per-invariant capability entries allocated to task IDs with closure_result initialized to pending]
 ---
 
 # Implementation Plan: [Plan Goal]

references/assets/orchestration/contract/task-v1.md

@@ -66,6 +66,11 @@ validation:
     mechanism: named-harness-owned-mechanism
     proves: [claim]
     expected: passed
+evidence_capability:
+  result: mapped | no_validation_bearing_obligation
+  reason: [non-empty reason]
+  invariants:
+    - {id: INV-001, source_ids: [REQ-001, AC-001], invariant: string, boundary: unit | component | integration | runtime | ui_visual | performance | accessibility | inspection | other, other_mechanism: required-when-other, oracle: VAL-001, capability_reason: string, freshness: current_task_batch, task_id: task-001, evidence_ids: [VAL-001], closure_result: pending}
 ---
 
 # TASK-001: [Task Name]

references/assets/orchestration/workflow.md

@@ -118,6 +118,8 @@ Specification authoring materializes `impact_decisions` from bounded current-sta
 
 Within existing Design Interrogation, specification authoring also records one `excellence_applicability` result after one compact pass: `no_material_opportunity` with an evidence-backed reason, or `material_opportunities` with proposals selected from task evidence and change shape rather than a universal checklist. Surface an option only when accepting or rejecting it could change a requirement, constraint, acceptance criterion, user-observable or contractual outcome, architectural boundary, measurable quality target, validation target, or declared boundary. Each proposal records user value, evidence, cost, risk, recommendation, and `accepted | rejected | deferred | not_material`; unanswered proposals become deferred. Only accepted proposals may project through stable IDs into authoritative requirements, constraints, interfaces, acceptance criteria, or validation targets. Other proposals remain traceable but excluded from planning, executor briefs, and acceptance obligations. The pass stops when further exploration could change none of those surfaces, records the reason, and ensures every surfaced proposal has a disposition. It does not add a lifecycle stage, force a recommendation, or make optional proposals blocking unless accepted projection is incomplete or an unresolved safety or authority conflict exists. The excellence-applicability view is compared by semantic convergence, while agent judgment owns opportunity materiality and recommendation quality.
 
+Planning allocates every accepted validation-bearing obligation or design decision to stable `evidence_capability` entries before execution. Each entry names `source_ids`, invariant, boundary, oracle, `capability_reason`, `freshness`, `task_id`, task-local `evidence_ids`, and initializes `closure_result: pending`; task briefs and review packages compile only the owning task's entries. A completed mapped task returns `evidence_closure` under the same INV/VAL identities. The harness observes those compiled validation items directly and closure fails on missing, incapable, contradictory, stale, wrong-boundary, failed, or unexecuted evidence, routing repair to the first owning task, plan, or specification. Executor-authored closure is corroboration, not independent proof. Use `no_validation_bearing_obligation + reason` only when no accepted validation-bearing obligation exists, never from a WOR-61 `none_relevant` impact result alone. Select the lightest capable boundary per invariant rather than imposing universal runtime, browser, visual, performance, or E2E proof. Mechanical helpers validate IDs, completeness, task ownership, provenance, and observed results; agents own semantic capability judgment.
+
 ## Lightweight development lane
 
 Use `dev-create-task-plan` for bounded mechanical work with stable decisions. After preflight and source grounding it invokes one bounded `ks-what-is-helpful` gateway, carries accepted authority or evidence-backed `none relevant`, writes one disposable plan under `.work-bundle/runtime/dev-plans/`, and creates no orchestration artifact tree. Its lightweight completion owner records an evidence-backed no-write result for `none`; for `update`, `supersede`, or `reclassify`, it invokes the approved keep-summarizing lifecycle and validates return evidence before completion. Escalate to full orchestration for unresolved architecture/API/data/workflow decisions, wide impact, multiple repositories, migration/deployment sequencing, unresolved durable-knowledge decisions, or parallel contract/barrier needs.

references/evals/orchestration/evals.json

@@ -492,6 +492,30 @@
       "prompt": "An excellence scan finds one adjacent idea that cannot change an accepted contract surface and another option whose acceptance could change a user-observable outcome and validation target.",
       "expected_output": "Omits the related-but-non-material adjacent idea or records it not_material, surfaces the outcome-changing option as a proposal because accepting or rejecting it could change a requirement, constraint, acceptance criterion, user-observable or contractual outcome, architectural boundary, measurable quality target, validation target, or declared boundary, and stops when further exploration can change none of those surfaces with the reason recorded.",
       "files": []
+    },
+    {
+      "id": 89,
+      "prompt": "Compile a task with an accepted invariant whose evidence-capability entry cites stable source IDs and a task-local validation oracle.",
+      "expected_output": "Compiles the task-local evidence_capability entry with invariant ID, source IDs, boundary, oracle, capability_reason, freshness, task owner, evidence IDs, and closure_result initialized to pending without executor retrieval.",
+      "files": []
+    },
+    {
+      "id": 90,
+      "prompt": "A greenfield task records WOR-61 none_relevant but still has an accepted validation-bearing requirement and claims no_validation_bearing_obligation.",
+      "expected_output": "Rejects the empty evidence-capability map because none_relevant impact does not prove absence of accepted validation-bearing obligations.",
+      "files": []
+    },
+    {
+      "id": 91,
+      "prompt": "A plan maps a presentation invariant to a unit oracle that cannot observe rendering, while a lighter capable visual inspection is available.",
+      "expected_output": "Rejects the incapable unit mapping and allocates the lightest capable evidence boundary for the named invariant; it does not impose a universal UI gate on unrelated invariants.",
+      "files": []
+    },
+    {
+      "id": 92,
+      "prompt": "A completed executor result reports a green command but omits allocated INV/VAL identities, or reports incapable, contradictory, stale, wrong-boundary, failed, or unexecuted evidence.",
+      "expected_output": "Blocks terminal closure, treats executor closure as corroboration rather than harness proof, and routes repair to the first owning task, plan, or specification while preserving optional task review and WOR-59 G9 separation.",
+      "files": []
     }
   ],
   "v4_evals": [

rules/orchestration/orch-review-completion.md

@@ -18,6 +18,10 @@ Keep final review focused on whether the WorkBundle workflow completed correctly
 
 - Confirm each required task review compared the accepted Truth Basis, implementation, test oracle, and task-local knowledge disposition before accepting the task.
 - Check that declared completion evidence corresponds to the compiled Truth Basis, source IDs, expected delta, and remaining AUTH constraints.
+- Before archive or completion, confirm every accepted validation-bearing invariant has a compiled `evidence_capability` entry and capable, current, correctly bounded harness-observed evidence under its allocated INV/VAL identities. Treat incapable green, contradiction, staleness, wrong-boundary, failure, missing, or unexecuted evidence as negative acceptance evidence, not closure.
+- Use `no_validation_bearing_obligation + reason` only when no accepted validation-bearing obligation or design decision exists. Do not infer an empty evidence-capability map from a WOR-61 `none_relevant` impact result.
+- Route first-owner repair for this pre-closure oracle-capability check: task repair for failed, stale, or unexecuted implementation evidence; plan repair for missing, wrong-boundary, or incapable allocation; specification repair for contradictory accepted authority.
+- Keep this pre-closure oracle-capability check distinct from `RuntimeVerificationClassificationV1`. WOR-59 G9 remains the unchanged post-execution classifier and may use this map only as evidence when triggered. Mechanical helpers validate IDs, completeness, provenance, and observed results; agents own semantic capability judgment and must not impose a universal browser, E2E, production, or runtime gate.
 - Missing `acceptance_review.verdict` blocks only a task that explicitly required independent review. Do not require universal task-review evidence.
 - Keep approved `ks-*` persistence delegation review-owned; executor disposition evidence never authorizes knowledge retrieval or writes.
 
@@ -49,13 +53,19 @@ Keep final review focused on whether the WorkBundle workflow completed correctly
 - Do not substitute project-file inspection for accepted task-review evidence on tasks that explicitly required review.
 - Do not create a repair specification for every failed review gate.
 - Do not archive while required knowledge, validation, review, repository, or workspace evidence is unresolved.
+- Do not close an invariant on a green oracle that cannot observe it or that contradicts accepted authority.
+- Do not treat WOR-59 G9 classification as this pre-closure oracle-capability check, or replace G9 with it.
+- Do not infer an empty evidence-capability map from a WOR-61 `none_relevant` impact result.
+- Do not impose a universal browser, E2E, production, or runtime gate.
 - Do not directly write durable knowledge from orchestration.
 
 ## Validation
 
 - Confirm every completed review-required task has fresh validation, a valid executor-result handoff, and `accept` review evidence.
 - Confirm missing `acceptance_review.verdict` is not a blocker unless the task explicitly required review.
 - Confirm declared completion evidence matches the compiled Truth Basis, source IDs, and AUTH constraints.
+- Confirm every mapped invariant has capable, current, correctly bounded harness-observed evidence under its allocated INV/VAL identities, or a typed first-owner repair route; confirm `no_validation_bearing_obligation` is not inferred from WOR-61 `none_relevant`.
+- Confirm this pre-closure oracle-capability check remains distinct from `RuntimeVerificationClassificationV1` and that WOR-59 G9 remains the unchanged post-execution classifier.
 - Confirm blocker routing names the owning resume path instead of restarting the lifecycle.
 - Confirm finalization and archive occur only after knowledge disposition and deterministic gates resolve.