feat: complete deterministic R0 fixture

.gitignore

@@ -5,6 +5,7 @@ coverage/
 *.vsix
 *.tsbuildinfo
 release/
+extension/.pureflow-runtime/
 .env
 .env.*
 !.env.example

docs/BUILD_LOG.md

@@ -2,6 +2,16 @@
 
 This is a concise chronological record of material implementation work and runtime evidence. It is not a substitute for Git history; it captures intent, verification, and blockers that a commit alone may not explain.
 
+## 2026-07-31 — R0 deterministic fixture accepted
+
+- Added the dependency-free `tenant-cache-key` fixture with fixed base, target, and mutated trees; controller-owned harness, oracle, mutation, and known repair; fixed SHA-1 Git identity, timestamps, branch, LF policy, and golden revisions/hashes.
+- Added a fixture factory that creates a standalone repository from an empty temp directory, proves base/target/mutation/repair behavior through the pinned runtime, and removes only its validated temp root while preserving the source repository snapshot.
+- Added an official Node `v22.17.0` artifact catalog and provisioner for Windows x64 and Linux x64. Download and executable hashes are pinned; the runtime is stored outside Git/VSIX payloads, rehashed on open, executes `--version`, and must not alias `process.execPath`.
+- Local Windows evidence: `npm run check` passed, all 27 extension tests passed, production build passed, and the VSIX packaged at 668 KB. Protected PR #10 run `30663623200` then passed `extension`, `extension-windows`, `contract`, `web`, and `jules-rnd-policy`; Linux and Windows both provisioned their pinned standalone runtime and reproduced the fixture behavior. R0 acceptance is complete.
+- Refreshed research on cognitive forcing, adaptive support, and AI productivity. Added agent near-miss replay, evidence escrow, decision-stage rotation, control reserve, and a deferred learned autonomy policy as falsifiable concepts. None is represented as implemented or effective.
+
+Evidence: `extension/test/fixture.test.ts`, `extension/src/twin/fixture-factory.ts`, `extension/src/twin/fixture-runtime.ts`, `extension/fixture-node-artifacts.json`, local command output on 2026-07-31, and protected GitHub Actions run `30663623200` on PR #10.
+
 ## 2026-07-26 — Control Pulse architecture and R0a foundation
 
 - Pivoted the random-function idea into semantic Recall Probes: randomness is allowed only inside a high-value seam set selected by blast radius, surprise, evidence, novelty, and future takeover value.

docs/PROJECT_STATE.md

@@ -1,8 +1,8 @@
 # Project State
 
-Last updated: 2026-07-26
+Last updated: 2026-07-31
 
-## Current branch milestone — R0a fixture foundation implemented
+## Current branch milestone — R0 deterministic substrate complete
 
 Branch `codex/shadow-cockpit-rnd` resets the product R&D thesis around **Dual-Control Development**.
 
@@ -13,9 +13,11 @@ Branch `codex/shadow-cockpit-rnd` resets the product R&D thesis around **Dual-Co
 - ADR-004 defines event-driven Control Pulses: agents keep working while a developer predicts, falsifies, chooses evidence, or defends one high-value seam. A bounded Side Coach may structure the answer but cannot create readiness evidence.
 - Research, alternative concepts, ADR, experiments, and an agent-executable vertical-slice plan are recorded in `prd.md` and `docs/v0.3/`.
 - R0a now implements RFC 8785 canonical JSON, domain-separated SHA-256, UTF-8 path ordering, tree/candidate/manifest hashes, the versioned fixture types, and fail-closed manifest validation. Ten R0a tests pass on this Windows checkout, bringing the extension suite to 23/23.
-- The deterministic Git fixture, fixture factory, pinned standalone Node artifact, `TrustedFixtureRunner`, `AgentDriver`, Chronicle, semantic extractor, Experience Compiler, Takeover Twin, Evidence Judge, Control Pulse runtime, readiness ledger, and v0.3 cockpit do not exist yet. R0 is therefore incomplete.
+- R0b now has a committed dependency-free `tenant-cache-key` fixture, deterministic Git factory, fixed base/target revisions and state-tree hashes, controller-owned mutation/repair/harness/oracle blobs, and a separately downloaded hash-pinned Node `v22.17.0` runtime. On this Windows checkout, base and target checks pass, the mutation fails the declared tenant-isolation check, the known repair returns the exact target tree to green, and cleanup preserves the source repository snapshot.
+- The full local Windows extension suite passes 27/27 with `npm run check`, build, and VSIX packaging. Protected PR #10 run `30663623200` independently reproduced the exact fixture/runtime behavior on Linux and Windows; all five required checks passed, so R0 acceptance is complete.
+- `TrustedFixtureRunner`, `AgentDriver`, Chronicle, semantic extractor, Experience Compiler, Takeover Twin, Evidence Judge, Control Pulse runtime, readiness ledger, and v0.3 cockpit do not exist yet.
 - No skill-retention or speed metric has been measured. Values in the PRD are predeclared R&D targets.
-- A new implementation audit found five R0 ambiguities: candidate-diff identity, pre-store fixture blobs, runtime identity, check IDs, and Git object format. The normative contract now closes them with structured diffs, catalog-owned blobs, standalone Node `v22.17.0`, declared test IDs, and SHA-1 Git initialization. This is implemented only at the R0a contract/hash layer.
+- A new implementation audit found five R0 ambiguities: candidate-diff identity, pre-store fixture blobs, runtime identity, check IDs, and Git object format. The normative contract closes them with structured diffs, catalog-owned blobs, standalone Node `v22.17.0`, declared test IDs, and SHA-1 Git initialization; R0a/R0b now implement and verify that complete substrate.
 - A guarded Jules dispatcher and PR policy are defined as a finite R0→R4 queue. They create at most one session after a successful preflight, stop after merged R4, remain inert unless dispatch is explicitly enabled, and keep plan approval on by default. Merges remain manual because the current project tests are not an independent immutable verifier. Full scheduled continuation still requires the dispatcher workflow to be reviewed into the default branch.
 - The R&D branch is published at `origin/codex/shadow-cockpit-rnd`. Its first Jules workflow run was correctly skipped because `JULES_RND_LOOP_ENABLED` is not enabled; no Jules session was created.
 - `Protect main` is active: PR, conversation resolution, strict `extension`/`contract`/`web` checks, up-to-date base, deletion protection, and force-push protection are enforced with zero required approvals for the sole owner.
@@ -131,8 +133,8 @@ No external input blocks the repository-owned fixture R0–R4.5 mechanism in `do
 
 ## Next ordered actions
 
-1. Finish R0b: commit the deterministic tenant-cache-key Git fixture/factory, provision the pinned standalone Node artifact, and prove identical revisions and tree hashes on Windows/Linux.
-2. Implement R1–R3 behind stable contracts: replay AgentDriver plus Chronicle, change-evidence extractor, and safe Takeover Twin lifecycle.
+1. Merge protected PR #10 into `codex/shadow-cockpit-rnd` after the final documentation commit repeats the five required checks.
+2. Implement R1–R3 behind stable contracts: replay AgentDriver plus Chronicle, change-evidence extractor, and safe Takeover Twin lifecycle. R1 should record whether real agent near-miss replay has enough observable checkpoint evidence to justify a versioned contract proposal.
 3. Integrate R4: one compiled recovery episode and deterministic Evidence Judge.
 4. Pass R4.5: one bounded, catalog-only Explain-to-Break Pulse with replay/error fail-closed tests.
 5. Run the 30-patch recovery-plus-probe technical corpus audit before expanding the product surface.

docs/v0.3/CONCEPTS.md

@@ -171,6 +171,58 @@ These are candidate experience formats, not commitments:
 - **Future-self handoff:** after a delay, present the developer's own project as an unfamiliar incident with the original generation transcript hidden.
 - **Real intervention credit:** if the developer's twin solution is better and passes the production evidence, allow it to replace the agent solution through a normal reviewed merge.
 
+## July 2026 mechanism refresh
+
+The next concepts change where the experience comes from and what the human controls. They are not extra quiz formats.
+
+### Agent near-miss replay
+
+Prefer an agent's real failed hypothesis, red test, rollback, or abandoned implementation branch over a synthetic mutation when the Chronicle contains one. PureFlow rewinds to the first observable divergence, escrows the later repair, and asks the developer to choose evidence and recover the checkpoint.
+
+This is more project-authentic than a generic seeded bug and makes routine agent self-repair produce operator practice as a second output. It also reduces mutation-pattern gaming. The risk is selection bias: clean first-pass runs produce no near miss, and a failed agent path may be irrelevant rather than instructive. Synthetic change-derived mutations remain the fallback.
+
+**Status:** promote to an R1 Chronicle and R7 corpus hypothesis. Adding intermediate checkpoint revisions requires a versioned Chronicle contract change before implementation.
+
+### Evidence escrow
+
+The controller stores the successful trace, repair, and decisive observation but initially exposes only the symptom and a bounded evidence index. The developer requests the next test, log, trace, symbol, or counterfactual. Assistance progressively reveals evidence, not a prose solution.
+
+This restores the information-acquisition and diagnosis stages that agent explanations normally collapse. Requested evidence becomes observable behavior for later calibration; merely opening a diff does not.
+
+**Status:** promote as the default interaction policy for recovery episodes after the protected judge exists. It must never hide production incident evidence or block normal delivery.
+
+### Decision-stage rotation
+
+Automation can remove information acquisition, analysis, option selection, and implementation separately. Rather than repeatedly testing code recall, the scheduler rotates the irreducible human action across those stages: choose evidence, rank causes, select a lever, predict a consequence, or direct a cold agent.
+
+**Status:** test as an episode-family factor. Rotation occurs only inside eligible high-value seams and does not guarantee equal quotas.
+
+### Control reserve
+
+Expose a local forecast of which project boundaries have fresh recovery and transfer evidence, which are stale, and which have never been exercised. This is closer to an aircraft's operational envelope than a developer score: it answers “where could I plausibly take over?” and always shows the underlying attempts, age, assistance, and uncertainty.
+
+**Status:** naming and visualization hypothesis for R5/R6. It cannot exist before the corpus gate and must not collapse evidence into a global number.
+
+### Learned autonomy policy
+
+A later router could learn when to offer no intervention, evidence escrow, a recovery twin, live steering, or a delayed transfer task while jointly optimizing software throughput, human attention, opt-out, and later takeover. Current adaptive-support research shows that optimizing immediate accuracy and optimizing learning are not interchangeable.
+
+**Status:** defer until after a longitudinal pilot. R0–R8 use an inspectable deterministic policy; engagement alone is never the reward.
+
+## Refined priority
+
+The preferred episode-source order is now:
+
+```text
+real agent near miss
+→ real unresolved design fork
+→ change-derived counterfactual
+→ intent-derived mutation
+→ no episode when evidence is weak
+```
+
+This is a meaningful constraint: PureFlow should sometimes produce nothing rather than manufacture an easy question. The common interaction is evidence escrow plus executable recovery; a random function explanation remains only an experiment baseline.
+
 ## Naming decision
 
 Avoid `Shadow Workspace`; Cursor already uses it for an AI validation environment.

docs/v0.3/README.md

@@ -19,7 +19,7 @@ PureFlow v0.3 asks whether an AI IDE can keep autonomous coding fast while behav
 ## Current truth
 
 - The released v0.1 VSCodium IDE exists and remains the runtime baseline.
-- The v0.3 Dual-Control product runtime is not implemented. R0a now contains only canonical hashing and fail-closed fixture-contract validation.
+- The v0.3 Dual-Control product runtime is not implemented. R0 is complete: R0a provides canonical hashing and fail-closed fixture-contract validation, while R0b provides the deterministic fixture, standalone hash-pinned runtime, external oracle, mutation, and exact repair. Protected PR #10 run `30663623200` reproduced the golden behavior on Linux and Windows.
 - No retention, takeover, productivity, or usability target has been measured.
 - The first valid build is one test-backed vertical slice, not a full Cursor clone.
 - R0–R4 may execute only finite, repository-owned fixture states. Arbitrary participant or corpus code remains blocked until ADR-003 selects and runtime-verifies a real sandbox backend.

docs/v0.3/RESEARCH.md

@@ -16,7 +16,7 @@ Product pages establish what a tool claims or documents, not that it improves le
 
 ### Landscape method
 
-The public-product review was run on 2026-07-25 and refreshed on 2026-07-26. It used official documentation or first-party product pages where available. Search families included:
+The public-product review was run on 2026-07-25, refreshed on 2026-07-26, and received a mechanism-focused research refresh on 2026-07-31. It used official documentation or first-party product pages where available. Search families included:
 
 ```text
 AI coding IDE developer skill retention
@@ -113,6 +113,22 @@ A 2026 controlled experiment with 86 Python programmers, [“Programmers Are Poo
 
 The study concerns generated postconditions rather than full agent patches, so it does not directly validate PureFlow. It does falsify the assumption that another plausible explanation is a sufficient review or teaching mechanism. Control Pulses therefore end in executable evidence, not model agreement.
 
+### Cognitive forcing reduces overreliance but can damage the experience
+
+Buçinca, Malaya, and Gajos compared three cognitive-forcing designs with simple explanation interfaces and a no-AI baseline in [an experiment with 199 participants](https://www.eecs.harvard.edu/~kgajos/papers/2021/bucinca2021trust.shtml). The forcing designs reduced overreliance on incorrect AI advice, but participants rated the most effective interventions least favorably, and benefits varied with motivation for effortful thinking.
+
+This is a warning against a compulsory checkpoint after every agent action. PureFlow should spend a user-selected attention budget only at causally important seams, let production continue, and measure voluntary return rather than assuming that more friction is better.
+
+### Adaptive support is a separate optimization problem
+
+A 2026 TOCHI paper, [“Offline Reinforcement Learning for Adaptive Support in AI-Assisted Decision-Making”](https://discovery.ucl.ac.uk/id/eprint/10226721/), learned support policies across two experiments with 316 and 964 participants. Accuracy-optimized policies improved joint decision accuracy; learning-optimized policies improved learning only at times. The authors explicitly treat task performance and human skill improvement as different objectives.
+
+The direct implication is architectural: the future Autonomy Router must not optimize clicks, completion, or software throughput alone. A learned policy is a later possibility only after PureFlow has enough behavioral and delayed-transfer data, a predeclared multi-objective loss, and an interpretable deterministic baseline. R0–R8 keep the router transparent and rule-based.
+
+### Throughput is real value worth preserving
+
+Three randomized field experiments covering 4,867 developers reported a noisy but combined [26.08% increase in completed tasks](https://doi.org/10.1287/mnsc.2025.00535) from access to AI code-completion assistance, with larger adoption and gains among less experienced developers. Code completion is not an autonomous swarm, and completed tasks are not a skill measure. The result still supports treating automation speed as product value rather than deliberately removing the tool developers now rely on.
+
 ## 4. Current product landscape
 
 ### Mainstream AI coding systems

extension/.vscodeignore

@@ -6,4 +6,4 @@ tsconfig.json
 esbuild.mjs
 **/*.map
 node_modules/**
-
+.pureflow-runtime/**

extension/fixture-node-artifacts.json

@@ -0,0 +1,20 @@
+{
+  "schemaVersion": 1,
+  "version": "v22.17.0",
+  "artifacts": {
+    "linux-x64": {
+      "url": "https://nodejs.org/dist/v22.17.0/node-v22.17.0-linux-x64.tar.xz",
+      "downloadSha256": "325c0f1261e0c61bcae369a1274028e9cfb7ab7949c05512c5b1e630f7e80e12",
+      "executableSha256": "8071ae0fca095a272ad698a90c7061801a86fb6392ddb81e922b68a91a4374b9",
+      "format": "tar-xz",
+      "entry": "node-v22.17.0-linux-x64/bin/node"
+    },
+    "win32-x64": {
+      "url": "https://nodejs.org/dist/v22.17.0/win-x64/node.exe",
+      "downloadSha256": "39d45b5933f339d3ebdebd76474893dab5d7da1038920f65cf5bbcf0f20f3636",
+      "executableSha256": "39d45b5933f339d3ebdebd76474893dab5d7da1038920f65cf5bbcf0f20f3636",
+      "format": "binary",
+      "entry": null
+    }
+  }
+}

extension/package.json

@@ -258,7 +258,8 @@
     "build": "node esbuild.mjs",
     "watch": "node esbuild.mjs --watch",
     "check": "tsc --noEmit",
-    "test": "vitest run",
+    "fixture:runtime": "node scripts/provision-fixture-node.mjs",
+    "test": "npm run fixture:runtime && vitest run",
     "package": "npm run build && vsce package --no-dependencies"
   },
   "dependencies": {