kernel: govern the M6 event pathway — t_hook firings stage governance_proposals (closes #53)

[MSD21091969]

HG URN: urn:moos:session:sam.kernel-proper

Summary

• The M6 event pathway no longer auto-applies react_template results ungoverned: event-fired t_hooks now stage an ADD-governance_proposal + firing_state pending→proposed pair — parity with the TIME sweep (Sam ruling t250-Q4, recorded 93c86ce; fp-fruits finding v).
• reactive.Firing + EvaluateDetailed add pass provenance (reactor | t_hook); Evaluate stays a thin wrapper (all call sites unchanged).
• Staging-pair builder stageHookProposalPair extracted from SweepOnce — parity by construction; sweep behavior byte-preserved (URN scheme, counter arithmetic, property set).
• Event staging: idempotency filter (firing_state ∈ {"", pending}), substituted proposed_envelope normalized to JSON-map form (CI-4 Go-value replay parity), per-firing URN discriminator -evt<seq>-n<i>, M8 gate pre-flight on the whole pair (fail-closed batch parity), PropertySpec injection + registry-less fallback.
• applyStagedLocked mirrors ApplyProgram's checks for kernel-internal staging (no ValidateMUTATE — the sweep path never calls it; requiring a rewrite_category would silently reject hooks carrying explicit firing_state and spam one duplicate proposal per trigger).

Why

runtime.go runReactive folded t_hook react_template results straight into state — skipping §M11/§M12, M8 gates, and the firing_state machine (F-a class). Ruling: govern it, unless a load-bearing fast path is demonstrated. Fleet inventory: zero live react_templates across all 5 reachable folds → the ruling's default branch; no allowlist machinery built (nothing to declare — a future consumer that needs the fast path is the change that declares it).

Watcher/reactor (WF17 Pass-1) keeps immediate apply — same F-a class, out of this ruling's scope; follow-up issue to be filed.

Adversarial review (pre-PR)

12-agent, 3-lens refute-verify workflow: 8 confirmed findings → 4 root defects, all folded:

1. ValidateMUTATE standard-path rejection for hooks with explicit firing_state → unbounded duplicate proposals (major)
2. M8 gate bypass on event staging vs sweep fail-closed (major)
3. Same-slug proposal-URN collision, loser dropped with no retry clock (minor)
4. Typed graph.Envelope live vs map[string]any replayed — CI-4 Go-value divergence (minor)

Validation

go test ./...   — all packages ok (fold, graph, hdc, kernel, operad, reactive, tday, transport)
go vet ./...    — clean

Live throwaway :8899 (real 4.0.1 ontology, registry mode), both hook shapes:

• additive (no firing_state authored): trigger → log +3 exact, template withheld, hook parks proposed, 2nd trigger +1 / still 1 proposal
• explicit-pending (defect-1 case): identical — staging lands via the standard fold path, no duplicate spam
• staged URN carries the -n discriminator: urn:moos:proposal:kernel.<slug>-t250-evt<seq>-n0

New tests: THookStagesProposal (rewrites the old fast-path test), THookExplicitPendingStages, THookGateBlocksStaging, THookSameSlugNoCollision, THookEventIdempotency.

Notes

• Approver leg (proposed→approved→applied) remains unimplemented for BOTH pathways — pre-existing, sweep.go's documented TODO; parity holds.
• Deploy note: merging ≠ deploying — the live fleet keeps its binary until Sam's restart word (3 merged PRs now pending deploy: operad: data-driven port colors + fail-closed §12.2 gate (closes #50) #51, fold: deterministic CreatedAt from persisted applied_at #54, kernel: re-home HDC drift annotation from WF11 to WF15 #55 + this).

Closes #53

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR changes the kernel’s M6 event-pathway handling of t_hook firings so they no longer immediately apply react_template results, and instead stage them as governed governance_proposal + firing_state transitions to match TIME sweep behavior.

Changes:

• Adds provenance-aware reactive evaluation (EvaluateDetailed) so the runtime can distinguish t_hook firings from watcher/reactor firings.
• Extracts and reuses a shared staging-pair builder (stageHookProposalPair) for both TIME sweep and event-pathway staging.
• Implements event-pathway staging in the runtime with idempotency filtering, M8 gate preflight on the whole pair, and replay-parity normalization of proposed_envelope, plus new tests for these behaviors.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
internal/reactive/engine.go	Introduces Firing and EvaluateDetailed to carry provenance (reactor vs t_hook) to the kernel.
internal/kernel/sweep.go	Extracts stageHookProposalPair so sweep staging and event staging share the same two-envelope shape.
internal/kernel/runtime.go	Routes reactive firings: stage t_hook firings as proposals; keep watcher/reactor immediate apply; adds staging helper paths.
internal/kernel/runtime_reactive_test.go	Replaces the prior fast-path test with governed staging tests (idempotency, gates, collisions, explicit pending).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.