fix(worker): bind governed evidence and terminal to WorkOrder

[thegeorgepu]

Follow-up to #49, closing the governed-evidence gap it identified and folding in #54's terminal/evidence mismatch.

Contract

This implements option 1 from getsimpledirect/vinci-gpu-control#295:

• WorkOrder remains the canonical governed-evidence identity.
• A registry-validated wo- WorkOrder id may be used as the evidence reference.
• WorkOrder existence and program binding remain evidence-server decisions. A 422 is recorded as an evidence failure; the worker does not self-assert that authority.
• No backlog identity is substituted, and /v1/evidence remains the only evidence ingress.
• Prose handoffs retain the original job_ / exp_ / bk_ namespace and cannot use ref: wo-... to bypass contract validation.

What changed

The worker resolves one evidence reference immediately after a digest handoff has passed registry fetch, record validation, digest recomputation, and order/spec binding. That exact value is then used for both:

1. the durable evidence POST (job_ref), and
2. a successful terminal finding (refs).

This fixes #54: a governed COMPLETED attempt no longer creates a durable evidence row while ending with an unreferenced status message. Failed, blocked, or unverified attempts remain status terminals and do not advertise a successful finding ref.

The bus and upload boundaries admit a bounded wo- syntax in addition to the legacy ledger refs. The test server independently requires the WorkOrder to exist in the registry and be bound to the configured program, so the positive path cannot pass merely because both client-side checks were widened.

The existing worker-unit directory remains registered in vinci/test/run.sh, including a zero-tests guard.

Controls and coverage

• Governed success: evidence job_ref, economics work_order_id, and completed terminal refs[0] are the exact same wo- WorkOrder id.
• Server boundary: missing and stale program bindings are rejected with 422 and become truthful UNVERIFIED status terminals.
• Runtime and evidence-service failures retain one WorkOrder-keyed diagnostic bundle where applicable without publishing a successful finding ref.
• Retry attempt 2 retains the WorkOrder identity and a distinct task/2 attempt label.
• Two runs under one WorkOrder create distinct bundles while sharing the canonical WorkOrder key.
• Replaying a completed bus page emits no duplicate evidence row or terminal.
• Public evidence metadata is checked not to disclose WorkOrder request or scope text.
• Mutation controls fail if raw wo- text is trusted, the POST gate is narrowed back to legacy refs, the terminal loses the resolved ref, or a backlog id is substituted.

Local validation:

• all 49 worker unit tests: 48 passed, 1 pre-existing packaging skip
• governed handoff integration: passed
• evidence credential/upload, lifecycle/restart, and all 41 lease/cancellation checks: passed
• npm run check: passed in full

The full offline harness also ran with live model smoke disabled. Every Worker group passed. Four unrelated host-startup/UI groups timed out under the aggregate Node 26 run; the Crew timeout moved between scenarios on an isolated rerun, while all preceding assertions passed. No code from those areas is changed here; natural CI is the authoritative clean-environment result.

Natural CI on candidate 94f4015f passed all five jobs: build/check/test, repository check, upstream suite, macOS sandbox, and offline Node 24.

Scope

The branch was merged once with current main (4c22def339c77fdd1be5843f3229cac793506d78) before its candidate push. It does not touch any path changed by draft PR #59.

Closes #54.

This update is AI-generated by Codex.

[thegeorgepu]

Independent review (Opus, fresh agent): GO-WITH-FIXES. Four findings; three taken in 3a72e43, one rejected on evidence.

Taken.

• F4 (real latent defect): the resolver fell through to the envelope ref when a contract id was present but not ledger-shaped. Since the summary takes contract-first unconditionally, that could file a bundle under a row the summary does not name. Now it returns null — refusal, not a plausible wrong row. Mutation control: removing the refusal fails both new unit tests.
• F1 (my unsupported claim): the comment asserted "real ids are bk_-shaped" as the load-bearing premise, with nothing behind it. Checked: ids are caller-supplied, every in-repo order registry uses wo-, live backlog rows are bk_. So this change may be inert in production today. That is now stated as a precondition in the code and in the PR body, replacing the assertion.
• F3: a governed attempt now POSTs where it never did, so a non-2xx downgrades COMPLETED to UNVERIFIED — previously only covered for prose. Added a governed evidencePostStatus = 500 case.

Rejected, with evidence. F2 said the server drops economics_summary, that work_order_economics_events does not exist, and that "CCM work item A is unimplemented". That reads a checkout 44 commits behind origin/main. On origin/main the table appears 18 times in storage.py and ECONOMICS_ACCEPTED 4 times in app.py (#288, merged as cb53af1d), and the deployed dev box reports git_sha cb53af1d and serves GET /v1/economics/work-orders/{id}. The reviewer's line numbers do not exist on main. Flagging the mechanism rather than the mistake: a review run against a stale local checkout produces confident, specific, wrong findings, and this repo has several checkouts tens of commits behind.

F5 (the postFinal asymmetry) was already documented as a deliberate boundary above, with #54 filed.

Suites after the fixes: 48 worker unit tests, 8 worker integration files, all green.

[thegeorgepu]

🔴 Upstream finding: this PR is inert by construction, not "inert until the issuer changes". Filed as getsimpledirect/vinci-gpu-control#295.

Measured, not inferred:

server-derived governed work order id: wo-g1-n1     (work_graph.py:150, hard-coded)
evidence job_ref prefixes accepted:    ('job_','exp_','bk_')   (app.py:1865)
would POST /v1/evidence accept it?     False        -> 422

Every WorkGraph-issued work order id is wo-{graph_id}-{node_id}. The evidence endpoint refuses any job_ref outside job_/exp_/bk_. The two namespaces are disjoint, so a governed attempt can never file evidence under its own work order id, and this PR's contract-first branch can never fire for a WorkGraph-issued order. The CCM Wave-1 gate is unreachable on the governed path for that reason alone, independent of #48.

I wrote both halves of that collision — the protocol keys the economics identity on work_order_id and the ingress keys acceptance on the evidence job_ref — and did not check that the namespaces intersect. #295 lays out three options and picks none.

What still stands in this PR, and why I think it is worth keeping open rather than closing:

• The failure direction is now refusal, not misfiling, which is correct regardless of which namespace wins.
• The worker-unit CI registration is independent of all of this: 48 tests that had never executed in CI now do.
• The prose/ledger-ref path is unaffected and tested.

Also fixed here (thanks to projects-7f): worker-fixture.mjs filtered evidence.refs, a key the worker never sends, so the 422 branch was dead and rejectedPosts.length === 0 could not fail. The fake accepted any job_ref. That is why this PR's own integration test could not have caught #295 — it would have passed with a wo- ref that production refuses. The fake now applies the server's rule:

bk_ccm7  -> 200
wo-g1-n1 -> 422   (matches the real server)

Correction to a claim made in review, checked with a positive control: trace.py joins agent_message_refs to messages, but it never reads the evidence table at all (grep -c evidence trace.py = 0; control agent_message_refs = 1). So no consumer joins evidence rows to bus posts by ref, and the postFinal asymmetry in #54 remains an omission rather than a broken join. The real gap it names — a governed COMPLETED writes no agent_message_refs row, so a ref-keyed trace shows no terminal message — is identical before and after this PR.

[thegeorgepu]

Head is 16eab17. Two commits past the reviewed 9493b555, both in the test fake.

worker-fixture.mjs now mirrors every /v1/evidence refusal, not just the ref prefix. projects-7f found the residual in my first fidelity fix: dropping undefined/null before testing meant an absent job_ref produced an empty invalid-list and was accepted. The real server refuses more than the prefix — job_ref, sha256, uri, kind, produced_at must each be a non-blank string, checked before the prefix — so absent is invalid, not nothing-to-check.

valid bk_        -> 200
wo- ref          -> 422
absent job_ref   -> 422
null job_ref     -> 422
blank job_ref    -> 422
missing sha256   -> 422

All 8 worker integration files pass. Note for anyone re-issuing a sha-pinned verdict over this range: unlike the previous range, this change refuses strictly more, so it could in principle fail a test that previously passed. It did not, but that is a measurement rather than a property.

Review status: GO from projects-7f, re-issued at 9493b555 after reading the diff rather than accepting my claim that nothing material changed. Independence: that lane built none of this.

Merge is not mine. The open question is not "is #53 correct" — it is — but "should a correct fix land on a path that cannot execute", which is vinci-gpu-control#295 and George's call.