feat(anveros): enforce delivery V2 completion evidence

[jiaanpanda0523-netizen]

Bounded Fork Install Change — Phase A

• Base: cb69727dcdb440fd9401dedb812f76b03704dda7 (the generic typed-hook candidate).
• Head: 2b4e08a9d78284e1c89714dc0c47e4bae4020d63.
• Scope: AnverOS policy plugin only: strict production completion evidence and correct handling of a Gateway-owned verifier review run.
• Runtime: pinned on WIN5070 with reversible startup-path/config receipt.
• Live sandbox evidence: hermes-control-canaries/t_d850c35a recorded completion_blocked_policy for missing evidence, then permitted a structured sandbox-only receipt from an independent verifier-owned review run.

No new Task Bus, Scheduler, Router, Broker, Kanban, Policy Store, DB, or Dashboard.

[jiaanpanda0523-netizen]

INDEPENDENT READ-ONLY ARCHITECTURE REVIEW

Evidence scope: AnverOS NousResearch#109, NousResearch#116, rejected historical PR NousResearch#185, hermes-agent PR #1 and PR #2; exact PR heads/diffs/discussions; GitHub checks/workflow-run records; and persisted test/runtime claims. No local commands, tests, runtime probes, Gateway access, or implementation changes were performed.

PHASE_A_HEAD=2b4e08a9d78284e1c89714dc0c47e4bae4020d63
PHASE_B_HEAD=2eef619cccee002ed352cea89fe6c546ac6e5a9c

AUTHORITATIVE_STATE_BOUNDARY=PASS
PARALLEL_STATE_SYSTEM_CREATED=NO
PRODUCTION_COMPLETION_CONTRACT=FAIL
IMPLEMENTER_VERIFIER_SEPARATION=FAIL
ATOMIC_STATE_TRANSITION=FAIL
STALE_UPDATE_PROTECTION=FAIL
EXISTING_KANBAN_REUSE=PASS
BLOCKER_LOCALIZATION_DESIGN=PASS
UNCLAIMED_HANDOFF_DESIGN=FAIL
PR_BOUNDARIES=FAIL
PHASE_DEPENDENCY=FAIL
ROLLBACK_BOUNDARY=UNPROVEN

CODE_SUPPORTED_CLAIMS=

• PR feat(anveros): enforce delivery V2 completion evidence #1 places a typed before_kanban_task_complete veto on Hermes kanban_db.complete_task before its native status=done write. PR feat(anveros): add Delivery V2 native Kanban handoff #2 forces configured-plugin discovery on that path, and hook failure becomes a veto.
• No second queue, scheduler, database, board, or policy store is added. PR feat(anveros): add Delivery V2 native Kanban handoff #2 persists workflow_template_id/current_step_key on the existing task row and calls existing request_review, reassign_task/assign_task, dispatch-tick, completion, blocker, retry, and parent-dependency primitives.
• For an explicitly enrolled PRODUCTION_CHANGE, the policy requires receipt keys, SHA syntax/equality, an HTTPS URL, SUCCESS/PASS literals, a nonempty rollback string, and a verifier string different from the contract implementer.
• set_task_workflow_step makes its own step/event write transactional and compares a non-null expected step.
• Existing Hermes block_task behavior is card-local; dependency waits use existing parent gating. PR feat(anveros): add Delivery V2 native Kanban handoff #2 adds no parent-global stop transition.

RECEIPT_SUPPORTED_CLAIMS=

• GitHub proves PR feat(anveros): enforce delivery V2 completion evidence #1 head 2b4e08a..., base cb69727..., merged as 296748e...; PR feat(anveros): add Delivery V2 native Kanban handoff #2 head 2eef619..., base 2b4e08a..., merged as d08f1b3....
• GitHub reports no status checks and no pull-request workflow runs for either PR head or either merge commit.
• PR feat(anveros): add Delivery V2 native Kanban handoff #2 body says 41 focused/adjacent tests; its author comment says 42. The comment also records sandbox task IDs t_1d2588bd, t_073c4ede, and t_e3b0a89a. These are persisted author claims, not independently readable task-event/run receipts in the reviewed repository evidence.
• AnverOS fix(cli): consistent 80-column box and content truncation for all slash commands NousResearch/hermes-agent#109 later explicitly records that PR feat(anveros): enforce delivery V2 completion evidence #1/feat(anveros): add Delivery V2 native Kanban handoff #2 lineage needed correction through PR feat(anveros): add Delivery V2 native Kanban handoff #3 and later correction PRs. That admission is repository evidence against treating the original feat(anveros): add Delivery V2 native Kanban handoff #2 dependency as safe.
• PR toolset check exception handling + empty choices in context compressor NousResearch/hermes-agent#185 is correctly rejected historical evidence: its shell-command interception did not own the native completion transition.

LIVE_RUNTIME_UNPROVEN=

• The claimed WIN5070 pin/Gateway SHA, loaded plugin set, and rollback startup configuration were not independently inspectable under this read-only repository review.
• The claimed 41/42 test executions and all named Kanban task histories are not backed here by CI runs, attached logs, exported DB/event receipts, or an independent verifier comment.
• No non-sandbox production deployment, destination probe, exact deployed-revision observation, or rollback canary is established. The PR comment explicitly says SANDBOX_ONLY_NOT_PRODUCTION.
• Blocker localization is code-supported design, but the claimed live reroute/failure behavior remains runtime-unproven.

BLOCKING_CODE_DEFECTS=

1. Untrusted transition identity: delivery_v2_transition accepts actor as a model-supplied tool argument. It is not derived from the active Hermes profile, task assignee, current run, or claim. A caller can claim another role and advance role-owned states.
2. Non-atomic composite transition: transition_delivery_state commits current_step_key first, then performs request_review or reassign_task in separate transactions, ignores their boolean result, and still returns success. The durable step can therefore advance while status/assignee/run handoff fails.
3. Initial stale-write bypass: when the task row has current_step_key=NULL and state is taken from delivery_v2.state in the body, expected_current_step_key=None disables the CAS check. Concurrent first transitions are not protected.
4. Completion TOCTOU and split terminal write: the policy snapshot is evaluated before the native completion transaction; the final UPDATE does not guard current_step_key, contract revision, assignee, or expected verifier run. PRODUCTION_VERIFY can change after approval but before status=done. current_step_key=DONE is then written later by a best-effort post-commit observer, so native done and workflow DONE are not one atomic transition.
5. Evidence contract is opt-in and syntactic: no delivery_v2 contract returns allow, NON_PRODUCTION_DELIVERABLE bypasses production checks, and the accepted receipt values are self-asserted strings. The tests demonstrate acceptance with an example.invalid destination, synthetic SHA, “sandbox probe,” and “git revert ”; the gate does not establish that a merge/deployment/probe/evidence artifact exists.
6. The 30-minute handoff uses task.created_at, not time entered ready, assignment age, last claim attempt, or a durable reroute deadline. An old card newly returned to ready can reroute immediately; there is no one-shot handoff marker, and assignment success is not checked.
7. Phase separation/dependency is not safe in these two PRs: feat(anveros): add Delivery V2 native Kanban handoff #2 contains the configured-plugin discovery repair needed to prevent feat(anveros): enforce delivery V2 completion evidence #1’s worker-first completion bypass, and feat(anveros): add Delivery V2 native Kanban handoff #2 targeted feat(anveros): enforce delivery V2 completion evidence #1’s feature branch/head rather than the merged Phase A revision. The later fix(cli): consistent 80-column box and content truncation for all slash commands NousResearch/hermes-agent#109 lineage-correction receipt confirms this defect.

NON_BLOCKING_IMPROVEMENTS=

• Use one authoritative workflow state after admission; do not retain delivery_v2.state as an operational fallback once current_step_key is initialized.
• Persist structured evidence references/hashes and verifier run/session provenance, not only PASS/SUCCESS strings.
• Make transition failure results explicit and add negative tests for request_review/reassign failure, observer failure, parent reopen, archived/done cards, and stale run/assignee changes.
• Remove or wire currently unused role/state configuration such as PLATFORM_FIXER if it has no authoritative transition responsibility.

LIVE_CANARIES_STILL_REQUIRED=

• After code correction: two concurrent first transitions from NULL; stale-step and stale-run attempts; injected request_review/reassign failure; policy-approved completion racing ROLLBACK; and post-completion observer failure.
• A real 30-minute unclaimed window based on durable ready/assignment timing, plus requeue and fallback-chain cases.
• Worker-side first completion with plugin discovery; missing/malformed/fabricated receipt negatives; completion by wrong assignee/profile/run; and an independently claimed verifier run.
• Exact merged/deployed revision at a real authorized production destination, production acceptance evidence, local blocker isolation, pin verification, and rollback to the previous Hermes revision with independently reread receipts.

VERDICT=REQUEST_CODE_CHANGES