fix(learning): qualify trust-graph evidence and expose incomplete scans

.claude/CLAUDE.md

@@ -8,12 +8,12 @@ Hypatia is the neurosymbolic CI/CD intelligence layer for the hyperpolymath ecos
 > against the tree on 2026-08-07. If you change the shape of the system, re-measure
 > (`ls lib/**/*.ex | wc -l`, `grep -c "export fn" ffi/zig/src/main.zig`, the child list in
 > `lib/application.ex`) rather than editing a number by eye. Known-stale claims and the
-> full audit live in `docs/DEBT-REGISTER.md`.
+> full audit live in `docs/DEBT-REGISTER.adoc`.
 
 ## Architecture
 
 ```
-Hypatia                       # 142 Elixir modules total (`shopt -s globstar; ls lib/**/*.ex | wc -l`)
+Hypatia                       # 149 Elixir source files under lib/ (recursive tree count, 2026-11-04)
 ├── Elixir pipeline          # core: pattern analysis, dispatch, learning
 ├── Merge orchestration       # 12 modules — leases, ledger, ticker (largest subsystem)
 ├── Kin subsystem             # 6 modules — contingency, arbiter, gate, watchdog
@@ -152,7 +152,8 @@ OutcomeTracker.record_outcome()         -- Feedback loop
 | `sequence_model.ex` | Sequence | Sequential dispatch modelling |
 | `blackboard.ex` | ETS | Shared board all 8 networks read/write, six phases |
 | `coordinator.ex` | GenServer | Orchestrates all 8 networks over the blackboard |
-| `persistence.ex` | — | Warm-restart state for all 8 networks |
+| `persistence.ex` | — | Matching source snapshots; ESN/LSM summaries; trust rebuilt |
+| `source_store.ex` | — | Captured root identity and explicit lifecycle refusal |
 | `rebalancer.ex` | — | Training-data rebalancing, strategies A/B/C |
 | `prover_recommender.ex` | — | Recommends a prover for a proof obligation |
 
@@ -162,7 +163,7 @@ OutcomeTracker.record_outcome()         -- Feedback loop
 |--------|---------|
 | `training_pipeline.ex` | ESN/RBF training from real verisim-data outcomes + pattern vectors |
 
-Training pipeline reads outcomes/*.jsonl for ESN (confidence time series) and patterns/registry.json for RBF (8-D feature vectors). Coordinator's `:force_cycle` triggers training automatically.
+Training pipeline reads outcomes/*.jsonl for ESN (confidence time series) and patterns/registry.json for RBF (8-D feature vectors). `Coordinator.force_cycle/0` admits a source-bound queued request; `:ok` does not claim completed training. Status and health calls refuse mismatched or blocked lifecycles. See `docs/architecture/neural-source-lifecycle.adoc` for the return contracts and qualification boundary.
 
 ### Idris2 ABI (src/Hypatia/ABI/)
 
@@ -297,7 +298,7 @@ into redoing finished work.
 9. **Zig FFI is ungated** — 18 exports and 16 connectors, no `zig build` in any workflow.
 
 The full evidence-backed audit, including CI/CD, licence, proof and metadata debt, is
-`docs/DEBT-REGISTER.md`. Read it before trusting any count in an older document.
+`docs/DEBT-REGISTER.adoc`. Read it before trusting any count in an older document.
 
 ## Code Style
 

.github/workflows/actions.lock

@@ -15,7 +15,6 @@ workflows:
         - 'actions/upload-artifact@v7.0.2'
         - 'dtolnay/rust-toolchain@v1'
         - 'taiki-e/install-action@v2.88.0'
-    '.github/workflows/cicd-squabbler.yml': []
     '.github/workflows/ci-health-sweep.yml':
         - 'actions/checkout@v7.0.1'
         - 'step-security/harden-runner@v2.22.3'
@@ -30,6 +29,7 @@ workflows:
         - 'haskell-actions/setup@v2.12.1'
         - 'swatinem/rust-cache@v2.9.3'
         - 'taiki-e/install-action@v2.88.0'
+    '.github/workflows/cicd-squabbler.yml': []
     '.github/workflows/clusterfuzzlite.yml':
         - 'actions/checkout@v7.0.1'
         - 'google/clusterfuzzlite@v1'
@@ -49,12 +49,12 @@ workflows:
         - 'actions/upload-artifact@v7.0.2'
         - 'step-security/harden-runner@v2.22.3'
     '.github/workflows/governance.yml':
-        - 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85'
+        - 'metadatastician/standards@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12'
     '.github/workflows/hypatia-remediation-sweep.yml':
         - 'actions/upload-artifact@v7.0.2'
         - 'step-security/harden-runner@v2.22.3'
     '.github/workflows/hypatia-scan.yml':
-        - 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85'
+        - 'metadatastician/standards@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12'
     '.github/workflows/inbox-steward-intake.yml':
         - 'actions/checkout@v7.0.1'
         - 'step-security/harden-runner@v2.22.3'
@@ -68,7 +68,7 @@ workflows:
         - 'actions/upload-artifact@v7.0.2'
         - 'erlef/setup-beam@v1.24.1'
     '.github/workflows/mirror.yml':
-        - 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85'
+        - 'metadatastician/standards@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12'
     '.github/workflows/pages.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/deploy-pages@v5.0.1'
@@ -108,10 +108,9 @@ workflows:
         - 'dtolnay/rust-toolchain@v1'
         - 'swatinem/rust-cache@v2.9.3'
     '.github/workflows/scorecard.yml':
-        - 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85'
+        - 'metadatastician/standards@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12'
     '.github/workflows/secret-scanner.yml':
-        - 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85'
-    '.github/workflows/standards-integration.yml': []
+        - 'metadatastician/standards@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12'
     '.github/workflows/security-policy.yml':
         - 'actions/cache@v6.1.0'
         - 'actions/checkout@v7.0.1'
@@ -122,6 +121,7 @@ workflows:
         - 'gitleaks/gitleaks-action@v3.0.0'
         - 'taiki-e/install-action@v2.88.0'
         - 'trufflesecurity/trufflehog@v3.99.7'
+    '.github/workflows/standards-integration.yml': []
     '.github/workflows/tests.yml':
         - 'actions/cache@v6.1.0'
         - 'actions/checkout@v7.0.1'
@@ -373,9 +373,9 @@ dependencies:
         commit: 'sha1-e384daf6167a7a7567642d6a62060106244d2413'
         owner_id: 6759885
         repo_id: 1352485172
-    'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85':
-        ref: '1725bebd3773ea25627479f813283abf1c497a85'
-        commit: 'sha1-1725bebd3773ea25627479f813283abf1c497a85'
+    'metadatastician/standards@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12':
+        ref: 'a797d308c0517d4e2d21cc7f1cb08d41f82b1a12'
+        commit: 'sha1-a797d308c0517d4e2d21cc7f1cb08d41f82b1a12'
         owner_id: 297579217
         repo_id: 1116521501
         uses:

.github/workflows/escript-soundness.yml

@@ -177,7 +177,11 @@ jobs:
         run: |
           set -euo pipefail
           mkdir -p "$HOME/.local/bin"
-          curl -fsSL -o "$HOME/.local/bin/nickel" \
+          curl --fail --silent --show-error --location \
+            --proto '=https' --proto-redir '=https' \
+            --connect-timeout 20 --max-time 60 \
+            --retry 3 --retry-delay 2 --retry-max-time 180 \
+            -o "$HOME/.local/bin/nickel" \
             "https://github.com/tweag/nickel/releases/download/${NICKEL_VERSION}/nickel-x86_64-linux"
           echo "${NICKEL_SHA256}  $HOME/.local/bin/nickel" | sha256sum -c -
           chmod +x "$HOME/.local/bin/nickel"

.github/workflows/governance.yml

@@ -16,17 +16,11 @@ permissions:
 
 jobs:
   governance:
-    # Standards pin (immutable, do not float): 1725beb… is the first
-    # standards revision whose actions allowlist contains
-    # `metadatastician/standards/.github/workflows/*@*` and whose mirror
-    # reusable gates SSH-host verification on the key being configured.
-    # The previous pin (333b06a…) lacked that pattern, so Allowlist
-    # Preflight failed on the five canon reusables themselves — a
-    # pinned-policy mismatch (category 3), not five genuine findings.
-    # Bump all five standards callers + actions.lock together; see
-    # docs/consumers/standards-governance.adoc and
-    # test/standards-integration-test.sh.
-    uses: metadatastician/standards/.github/workflows/governance-reusable.yml@1725bebd3773ea25627479f813283abf1c497a85
+    # Published standards PR #1394 includes the two exact ClusterFuzzLite
+    # action paths already admitted by live policy. All five callers share
+    # this immutable authority; actions.lock is generated by the official
+    # recovery runner, never patched by hand.
+    uses: metadatastician/standards/.github/workflows/governance-reusable.yml@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12
     # Scanner pin: hypatia scans itself with its own main branch. On a PR that
     # is the base commit; on push, schedule or dispatch it is the commit being
     # run. It is never the PR head, so a PR cannot weaken the rules that gate

.github/workflows/hypatia-scan.yml

@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   hypatia:
-    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@1725bebd3773ea25627479f813283abf1c497a85
+    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12
     # Scanner pin: hypatia's own main branch, never the PR head. See governance.yml.
     with:
       hypatia-ref: ${{ github.event.pull_request.base.sha || github.sha }}

.github/workflows/mirror.yml

@@ -41,7 +41,7 @@ permissions:
 
 jobs:
   mirror:
-    uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@1725bebd3773ea25627479f813283abf1c497a85
+    uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12
     # Only the seven forge keys the callee declares (standards#1108 §6b).
     secrets:
       GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}

.github/workflows/scorecard.yml

@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@1725bebd3773ea25627479f813283abf1c497a85
+    uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12
     permissions:
       actions: read
       contents: read

.github/workflows/secret-scanner.yml

@@ -22,4 +22,4 @@ jobs:
       contents: read
       pull-requests: write
       actions: read
-    uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@1725bebd3773ea25627479f813283abf1c497a85
+    uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12

.github/workflows/tests.yml

@@ -110,7 +110,20 @@ jobs:
 
       - name: E0 outcome chain and cross-repo evidence regression (Elixir)
         run: |
-          mix test test/outcome_tracker_test.exs test/cross_repo_learning_test.exs
+          mix test --trace \
+            test/outcome_tracker_test.exs \
+            test/cross_repo_learning_test.exs \
+            test/outcome_tracker_runtime_store_test.exs \
+            test/merge_orchestration/sensor_test.exs \
+            test/merge_orchestration/loop_test.exs \
+            test/learning_runtime_store_test.exs \
+            test/neural_source_store_lifecycle_test.exs \
+            test/merge_orchestration/strategist_test.exs \
+            test/merge_orchestration/dispatcher_test.exs \
+            test/merge_orchestration/baton_emitter_test.exs \
+            test/merge_orchestration/kin_competence_test.exs \
+            test/merge_orchestration/merge_orchestrate_task_test.exs \
+            test/workflow_hardening_test.exs
 
       - name: Run E2E test suite
         run: bash tests/e2e.sh

.machine_readable/descriptiles/PLAYBOOK.a2ml

@@ -54,7 +54,8 @@ steps = [
 [maintenance-operations]
 baseline-audit = "mix test && cargo test && just validate"
 hard-pass-gate = "mix test 0 failures (233 :verisim_data excluded by design)"
-neural-retrain = "GenServer.call(Hypatia.Neural.Coordinator, :force_cycle)"
+neural-retrain = "Hypatia.Neural.Coordinator.force_cycle() — :ok means queued; inspect Coordinator.status() for source refusal and cycle completion"
+neural-source-lifecycle = "docs/architecture/neural-source-lifecycle.adoc — an observed data-root change requires an explicit decision and fresh matching cohort; no automatic relabel/restart"
 scan-estate = "just scan (runs panic-attack assail across estate, writes to verisim-data)"
 dispatch-run = "just dispatch (runs dispatch-runner.sh against pending.jsonl)"
 crg-check = "Review STATE.a2ml [project-context] crg-grade vs crg-grade-target"

.machine_readable/descriptiles/STATE.a2ml

@@ -298,3 +298,13 @@ actions = [
 #             Benchmarks confirmed real in fixer/benches/hypatia_bench.rs (7 benches, not stubs).
 # 2026-04-03: Added 3 new rules: WF013 (permissions typo detection), GS007 (stale branch detection),
 #             SD013 (gitignore path-scope detection). 279 lines of new rule code, 13 tests.
+
+[neural-source-lifecycle]
+status = "authored-pending-hosted-qualification"
+checkpoint-date = "2026-11-04"
+contract = "docs/architecture/neural-source-lifecycle.adoc"
+source-identity = "expanded configured data-root pathname; not content authentication"
+new-regression-source = "test/neural_source_store_lifecycle_test.exs"
+authored-new-test-functions = 22
+qualification = "No execution receipt for this new lifecycle candidate. Existing runtime-path test receipts do not qualify it. Exact-source compile, focused and normal full gates remain required."
+authority = "No automatic restart, dispatch, or deployment promotion from a source refusal."