claim-grounding: agent prose state-claims have no turn-end gate

[ahuimanu]

Observed

A live failure this session. I (the agent) asserted to the operator that
"OBPI-0.0.37-22 is attested-complete" by relaying the handoff document's prose,
BEFORE reading the ledger. The claim happened to be true — but only by luck,
confirmed after the fact at .gzkit/ledger.jsonl:9937
(obpi_receipt_emitted / receipt_event:"completed" / human_attestation:true).

General shape: an agent's conversational state-claims to the operator —
"OBPI-X is attested-complete", "the lock is held", "tests pass", "the tree is
clean" — are emitted as prose with NO mechanical gate verifying them against
Layer-1/Layer-2 truth. Correctness on this surface rests entirely on author
discipline (goodwill class). This is V.I.B.E.S. on the one surface the
governance does not cover.

Expected

Per the anti-vibing mantra (AGENTS.md § MAKE LLM STOCHASTIC VIBES INERT):
"gzkit's purpose is to make stochastic LLM vibing structurally inert."
Operative claim 1: "Governance is the steering and accountability surface for
agent-driven work, not overhead." A state-claim surface trustable only by
goodwill is exactly the surface the doctrine says should be structurally gated,
not left to discipline.

AGENTS.md § Never #7 already names the correct agent behavior ("Do not read
YAML frontmatter status: Completed as proof of completion — read the ledger")
— but it is prose-only; nothing fails closed when an agent skips it.

Canonical contradiction

ADR-0.0.70's Stop-hook proves the turn-end seam CAN hold a fail-closed gate,
but its scope does not reach this surface. Per
docs/design/adr/foundation/ADR-0.0.70-turn-end-feedback-and-correction-mining/obpis/OBPI-0.0.70-01-stop-hook-turn-end-feedback.md:83:
"The hook MUST scope checks to git-dirty *.py files only" — i.e. ruff lint.
That hook (a) checks lint state, not claim-vs-receipt; (b) fires AFTER the
agent's prose is already emitted (it can force a continue, never retract a
sentence already said); (c) fails open by design (:84). The last-turn vibe
touched no Python file and produced no lint finding — it sails straight past
this hook.

So the Stop seam is reachable by a mechanical gate (0.0.70 = existence proof),
but the conversational-claim surface is uncovered.

Class of failure

T1→T2 doctrine drift: a declared invariant (anti-vibing mantra; § Never #7)
with no mechanical fail-close — the same family as GHI #574 (resume
"advise-not-execute" gate is prose, not mechanized) and the canonical
#459/#460 sibling-cut class. Input family: ANY agent turn that emits a
present-tense state/completion claim about governance truth without a
co-present receipt.

Why this is hard (honest framing — do NOT overclaim a fix)

Deterministic claim-checking is not decidable the way ruff is. A stochastic
LLM judge policing a stochastic claimer just relocates the vibe (turtles). The
root cause is known; the FIX SHAPE is the open question and needs an operator
design conversation. Candidate shapes to investigate, root-cause-first:

• (a) Structured-claim discipline. Completion/state assertions must carry an
  inline receipt token (ledger event id / ARB receipt id / file:line) whose
  PRESENCE a Stop-hook regex can verify deterministically — gating form
  (claim-without-citation), not truth.
• (b) Telemetry-only turn-end sensor. Logs unbacked-claim patterns to feed
  the session-correction-mining ladder (ADR-0.0.70 OBPI-02). Pairs with
  GHI correction-mining: miner has no negative-signal run telemetry #614 (miner lacks negative-signal telemetry).

Scope hint (advisory, for routing)

• Estimated diff: larger / unknown — needs design conversation before sizing.
• Surfaces touched (candidate): src/gzkit/hooks/scripts/quality.py (Stop-hook
  template source), a new turn-end sensor, the ADR-0.0.70 OBPI-02 mining surface.
• In-flight vs. new feature: planned (new mechanization fence).

Campaign home

Phase E (ceremony/harness mechanization) — additive proof-mechanization,
sibling to E.4 (dispatch drift-guards) and E.5 (governance-friction drainage),
descendant of B.0 / ADR-0.0.70. Booked as campaign item E.6. The campaign
owns sequencing the true root-cause fix per the 2026-06-14 governance-friction
drainage amendment (file at the moment of discovery; discover root cause before
booking the fix-shape). Open-with-blocker, not a same-session destination:
the fix shape is genuinely a pending operator design conversation, not
dead-lettered.

Related

• ADR-0.0.70-turn-end-feedback-and-correction-mining (the Stop-seam existence proof)
• GHI gz-session-handoff: resume "advise-not-execute" gate is prose, not mechanized #574 — resume gate is prose, not mechanized (same T1→T2 class; sibling cut)
• GHI correction-mining: miner has no negative-signal run telemetry #614 — correction-miner lacks negative-signal telemetry (shape (b) feeds it)
• AGENTS.md § MAKE LLM STOCHASTIC VIBES INERT; § Never Resolve discovery-index contract gap in templates and briefs #5; § Never Add automated parity regression harness for governance surfaces #7;
  § Behavior Rules — Always Add automated parity regression harness for governance surfaces #7
• docs/governance/build-to-1.0-campaign-2026-06-10.md § Phase E

[ahuimanu]

Recurrence (2026-06-14) — and this time the relayed claim was would-be FALSE, not lucky-true

This session reproduced #620's exact failure on the handoff-resume surface. After a /clear, I relayed a handoff document's prose to the operator as established fact ("marks the completion," "registers it as done") before reading Layer-2. The operator named it ("You are VIBE CODING").

New evidence beyond the original filing: the original #620 instance was true-by-luck (the completion claim happened to be correct). This recurrence had a claim that was stale/false at read-time, so relaying it would have produced a wrong action, not just a harmless wrong sentence.

Handoff (.gzkit/handoffs/20260614T141050Z-OBPI-0.0.37-22-complete-skill-followup.md) asserted:

OBPI lock still held (release is step 1 above, now unblocked by this handoff).

1. Release the OBPI lock: uv run gz obpi lock release OBPI-0.0.37-22-… (now satisfiable — this handoff is the register entry).

Layer-2 check at read-time:

$ uv run gz obpi lock list
No active locks.

$ uv run gz obpi status OBPI-0.0.37-22-committed-rendition-store-deterministic-playback
  Runtime State: ATTESTED COMPLETED
  Completion: COMPLETE

The lock had already been released in a later session. Relaying "release the lock" as the next action would have acted on a false precondition (no lock to release). The completion claim in the same handoff verified TRUE — confirming #620's point that claims must be verified individually, never trusted as a block.

Interim mitigation landed (NOT the fix #620 calls for): gz-session-handoff v6.6.0 gains a prose Claim Verification Gate (RESUME step: claim-shape → gz check → tag VERIFIED / STALE / UNVERIFIABLE). Commit: fix(skill): add interim Claim Verification Gate to gz-session-handoff resume (GHI #620). This is advisory prose only — per #574, "2026-05-30 proved prose does not bind." It shrinks the surface (instructs the agent to check) but does not mechanically fail-close; the durable fix remains #620's open mechanical-gate question (Stop-hook / Mode-2 pre-execution gate), frozen behind #519.

Relationship: this is the resume-surface cut of #620's general claim-grounding class; sibling to #574 (same skill, authorization gate, also prose-not-mechanized).