From b74796cd770c2577047d024ef95f6b563f88b8ae Mon Sep 17 00:00:00 2001
From: Aegis <Aegis@stackbilt.dev>
Date: Wed, 24 Jun 2026 16:22:36 -0500
Subject: [PATCH 01/13] fix(executor-router): add isDefault to ExecutorRoute
 interface

Contract ExecutorRouteShapeSchema declared isDefault as a valid field
but the ExecutorRoute interface omitted it, causing TS2353 on the
workers_ai route. Aligns interface with contract.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 web/src/kernel/executor-router.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/web/src/kernel/executor-router.ts b/web/src/kernel/executor-router.ts
index 95e3314..7db4665 100644
--- a/web/src/kernel/executor-router.ts
+++ b/web/src/kernel/executor-router.ts
@@ -27,6 +27,9 @@ export interface ExecutorRoute {
   // Cost classification: premium > standard > free.
   // Fallback invariant: fallback.tier ≤ this.tier (never upgrade cost on failure).
   tier: ExecutorTier;
+  // isDefault=true: the nominal default executor for the dispatch layer.
+  // Exactly one route may carry this flag (enforced by I5 in the contract).
+  isDefault?: true;
   // placeholder=true: executor is forward-declared but not yet wired.
   // Consumers must skip dispatch for placeholder routes.
   placeholder?: true;

From 244c6bd8c29ffe76c81d2067abcaf2f5594b0214 Mon Sep 17 00:00:00 2001
From: Aegis <Aegis@stackbilt.dev>
Date: Wed, 24 Jun 2026 16:22:45 -0500
Subject: [PATCH 02/13] fix(workers-ai): narrow Ai.run() overload cast to
 silence TS2769/TS2352

CF Workers AI's Ai.run() overload union is too wide for direct casts.
Wrap the call via an explicit function signature cast so TypeScript
resolves a single unambiguous overload, then cast the return to
AiChatResponse. Removes the previous as-Record<string,unknown> hack
that still leaked the intersection mismatch.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 web/src/workers-ai-chat.ts | 23 ++++++++---------------
 1 file changed, 8 insertions(+), 15 deletions(-)

diff --git a/web/src/workers-ai-chat.ts b/web/src/workers-ai-chat.ts
index 882ef18..4edca17 100755
--- a/web/src/workers-ai-chat.ts
+++ b/web/src/workers-ai-chat.ts
@@ -207,14 +207,10 @@ export async function executeWorkersAiChat(
 
   // Phase 1: Tool execution rounds (0 to TOOL_ROUNDS-1)
   for (let round = 0; round < TOOL_ROUNDS; round++) {
-    const result = await config.ai.run(config.model as Parameters<Ai['run']>[0], {
-      messages,
-      tools,
-      max_tokens: 4096,
-      temperature: 0.2,
-      top_p: 0.9,
-      frequency_penalty: 0.3,
-    } as Record<string, unknown>) as AiChatResponse;
+    const result = await (config.ai.run as (m: Parameters<Ai['run']>[0], i: unknown) => Promise<unknown>)(
+      config.model as Parameters<Ai['run']>[0],
+      { messages, tools, max_tokens: 4096, temperature: 0.2, top_p: 0.9, frequency_penalty: 0.3 },
+    ) as AiChatResponse;
 
     const usage = extractUsage(result);
     if (usage) {
@@ -300,13 +296,10 @@ export async function executeWorkersAiChat(
 
   let summaryText: string | undefined;
   try {
-    const summaryResult = await config.ai.run(config.model as Parameters<Ai['run']>[0], {
-      messages: condensed,
-      max_tokens: 4096,
-      temperature: 0.2,
-      top_p: 0.9,
-      frequency_penalty: 0.3,
-    } as Record<string, unknown>) as AiChatResponse;
+    const summaryResult = await (config.ai.run as (m: Parameters<Ai['run']>[0], i: unknown) => Promise<unknown>)(
+      config.model as Parameters<Ai['run']>[0],
+      { messages: condensed, max_tokens: 4096, temperature: 0.2, top_p: 0.9, frequency_penalty: 0.3 },
+    ) as AiChatResponse;
 
     const summaryUsage = extractUsage(summaryResult);
     if (summaryUsage) {

From 51a9036fc8c267228a04bed1588fbac554e7811f Mon Sep 17 00:00:00 2001
From: Aegis <Aegis@stackbilt.dev>
Date: Wed, 24 Jun 2026 16:22:55 -0500
Subject: [PATCH 03/13] fix(agenda): guard terminal states in resolveAgendaItem

The UPDATE had no status check, allowing done/dismissed items to be
re-resolved or re-dismissed. Contract declares both as terminal with no
outgoing transitions. Add AND status='active' to the WHERE clause and
throw when 0 rows are affected (item missing or already terminal).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 web/src/kernel/memory/agenda.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/web/src/kernel/memory/agenda.ts b/web/src/kernel/memory/agenda.ts
index 3261265..d6efcaf 100755
--- a/web/src/kernel/memory/agenda.ts
+++ b/web/src/kernel/memory/agenda.ts
@@ -125,9 +125,13 @@ export async function resolveAgendaItem(
   id: number,
   status: 'done' | 'dismissed',
 ): Promise<void> {
-  await db.prepare(
-    "UPDATE agent_agenda SET status = ?, resolved_at = datetime('now') WHERE id = ?"
+  // Contract: resolve/dismiss are only valid from 'active'. Terminal states have no outgoing transitions.
+  const result = await db.prepare(
+    "UPDATE agent_agenda SET status = ?, resolved_at = datetime('now') WHERE id = ? AND status = 'active'"
   ).bind(status, id).run();
+  if (result.meta.changes === 0) {
+    throw new Error(`Agenda item ${id} is not in 'active' state or does not exist`);
+  }
 }
 
 export const PROPOSED_ACTION_PREFIX = '[PROPOSED ACTION]';

From 2dd0eab43e075ad8106bc7870026916bb1fd5995 Mon Sep 17 00:00:00 2001
From: Aegis <Aegis@stackbilt.dev>
Date: Wed, 24 Jun 2026 16:23:03 -0500
Subject: [PATCH 04/13] =?UTF-8?q?test(agenda):=20OTDD=20contract=20tests?=
 =?UTF-8?q?=20=E2=80=94=20schema,=20state=20machine,=20invariants,=20autho?=
 =?UTF-8?q?rity?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

48 tests derived from agenda-item.contract.ts. Covers all schema field
constraints, all operation input schemas, valid/invalid state machine
transitions (done/dismissed as terminals), the resolved_has_timestamp
invariant, and authority rules per operation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 web/tests/agenda-item-contract.test.ts | 250 +++++++++++++++++++++++++
 1 file changed, 250 insertions(+)
 create mode 100644 web/tests/agenda-item-contract.test.ts

diff --git a/web/tests/agenda-item-contract.test.ts b/web/tests/agenda-item-contract.test.ts
new file mode 100644
index 0000000..2d75b7a
--- /dev/null
+++ b/web/tests/agenda-item-contract.test.ts
@@ -0,0 +1,250 @@
+// Contract conformance tests for the AgendaItem bounded context.
+// Derived directly from src/contracts/agenda-item.contract.ts — the source of truth.
+// Fixtures are inline objects built from the contract schema; nothing is mocked.
+
+import { describe, it, expect } from 'vitest';
+import { AgendaItemContract } from '../src/contracts/agenda-item.contract.js';
+
+const { schema, operations, states, invariants, authority } = AgendaItemContract;
+
+// A fully-valid entity, used as a base for targeted mutations.
+const validEntity = {
+  id: 1,
+  item: 'Review Q3 compliance filing',
+  context: 'Upstream registry not yet updated',
+  priority: 'high' as const,
+  status: 'active' as const,
+  createdAt: '2026-06-24T10:00:00.000Z',
+  resolvedAt: null,
+  businessUnit: 'stackbilt',
+};
+
+describe('AgendaItem contract — metadata', () => {
+  it('is named AgendaItem and versioned', () => {
+    expect(AgendaItemContract.name).toBe('AgendaItem');
+    expect(AgendaItemContract.version).toBe('1.0.0');
+  });
+});
+
+describe('AgendaItem schema — entity validation', () => {
+  it('accepts a fully-valid entity', () => {
+    const parsed = schema.parse(validEntity);
+    expect(parsed.id).toBe(1);
+    expect(parsed.status).toBe('active');
+  });
+
+  // ── id: positive int ──────────────────────────────────────
+  it('rejects a non-positive id', () => {
+    expect(schema.safeParse({ ...validEntity, id: 0 }).success).toBe(false);
+    expect(schema.safeParse({ ...validEntity, id: -3 }).success).toBe(false);
+  });
+
+  it('rejects a non-integer id', () => {
+    expect(schema.safeParse({ ...validEntity, id: 1.5 }).success).toBe(false);
+  });
+
+  // ── item: min(1) ──────────────────────────────────────────
+  it('rejects an empty item string', () => {
+    expect(schema.safeParse({ ...validEntity, item: '' }).success).toBe(false);
+  });
+
+  it('accepts a single-character item', () => {
+    expect(schema.safeParse({ ...validEntity, item: 'x' }).success).toBe(true);
+  });
+
+  // ── context: nullable ─────────────────────────────────────
+  it('accepts a null context', () => {
+    expect(schema.safeParse({ ...validEntity, context: null }).success).toBe(true);
+  });
+
+  it('rejects a missing context (nullable, not optional)', () => {
+    const { context: _omit, ...withoutContext } = validEntity;
+    expect(schema.safeParse(withoutContext).success).toBe(false);
+  });
+
+  // ── priority: enum + default ──────────────────────────────
+  it('rejects an out-of-enum priority', () => {
+    expect(schema.safeParse({ ...validEntity, priority: 'urgent' }).success).toBe(false);
+  });
+
+  it('defaults priority to medium when omitted', () => {
+    const { priority: _omit, ...withoutPriority } = validEntity;
+    expect(schema.parse(withoutPriority).priority).toBe('medium');
+  });
+
+  // ── status: enum + default ────────────────────────────────
+  it('rejects an out-of-enum status', () => {
+    expect(schema.safeParse({ ...validEntity, status: 'archived' }).success).toBe(false);
+  });
+
+  it('defaults status to active when omitted', () => {
+    const { status: _omit, ...withoutStatus } = validEntity;
+    expect(schema.parse(withoutStatus).status).toBe('active');
+  });
+
+  // ── createdAt: datetime ───────────────────────────────────
+  it('rejects a non-ISO createdAt', () => {
+    expect(schema.safeParse({ ...validEntity, createdAt: '2026-06-24' }).success).toBe(false);
+  });
+
+  // ── resolvedAt: nullable datetime ─────────────────────────
+  it('accepts a null resolvedAt', () => {
+    expect(schema.safeParse({ ...validEntity, resolvedAt: null }).success).toBe(true);
+  });
+
+  it('rejects a non-ISO resolvedAt', () => {
+    expect(schema.safeParse({ ...validEntity, resolvedAt: 'yesterday' }).success).toBe(false);
+  });
+
+  // ── businessUnit: min(1) + default ────────────────────────
+  it('rejects an empty businessUnit', () => {
+    expect(schema.safeParse({ ...validEntity, businessUnit: '' }).success).toBe(false);
+  });
+
+  it('defaults businessUnit to stackbilt when omitted', () => {
+    const { businessUnit: _omit, ...withoutBu } = validEntity;
+    expect(schema.parse(withoutBu).businessUnit).toBe('stackbilt');
+  });
+});
+
+describe('AgendaItem operations — input validation', () => {
+  // ── add ───────────────────────────────────────────────────
+  it('add accepts minimal valid input (item only)', () => {
+    expect(operations.add.input.safeParse({ item: 'Do the thing' }).success).toBe(true);
+  });
+
+  it('add rejects an empty item', () => {
+    expect(operations.add.input.safeParse({ item: '' }).success).toBe(false);
+  });
+
+  it('add rejects an out-of-enum priority', () => {
+    expect(operations.add.input.safeParse({ item: 'x', priority: 'critical' }).success).toBe(false);
+  });
+
+  it('add rejects an empty businessUnit when provided', () => {
+    expect(operations.add.input.safeParse({ item: 'x', businessUnit: '' }).success).toBe(false);
+  });
+
+  // ── resolve / dismiss / escalate share the id-only input ──
+  for (const op of ['resolve', 'dismiss', 'escalate'] as const) {
+    it(`${op} accepts a positive integer id`, () => {
+      expect(operations[op].input.safeParse({ id: 42 }).success).toBe(true);
+    });
+
+    it(`${op} rejects a non-positive id`, () => {
+      expect(operations[op].input.safeParse({ id: 0 }).success).toBe(false);
+    });
+
+    it(`${op} rejects a missing id`, () => {
+      expect(operations[op].input.safeParse({}).success).toBe(false);
+    });
+  }
+});
+
+describe('AgendaItem operations — declared transitions & events', () => {
+  it('resolve declares active → done', () => {
+    expect(operations.resolve.transition).toEqual({ from: 'active', to: 'done' });
+    expect(operations.resolve.emits).toContain('agenda_item.resolved');
+  });
+
+  it('dismiss declares active → dismissed', () => {
+    expect(operations.dismiss.transition).toEqual({ from: 'active', to: 'dismissed' });
+    expect(operations.dismiss.emits).toContain('agenda_item.dismissed');
+  });
+
+  it('escalate declares no state transition', () => {
+    expect(operations.escalate.transition).toBeUndefined();
+    expect(operations.escalate.emits).toContain('agenda_item.escalated');
+  });
+
+  it('add emits agenda_item.added', () => {
+    expect(operations.add.emits).toContain('agenda_item.added');
+  });
+});
+
+describe('AgendaItem state machine', () => {
+  const transitions = states!.transitions;
+
+  it('starts in the active state', () => {
+    expect(states!.initial).toBe('active');
+    expect(states!.field).toBe('status');
+  });
+
+  // ── valid transitions ─────────────────────────────────────
+  it('allows active → done via resolve', () => {
+    expect(transitions.active.resolve).toBe('done');
+  });
+
+  it('allows active → dismissed via dismiss', () => {
+    expect(transitions.active.dismiss).toBe('dismissed');
+  });
+
+  // ── invalid transitions: terminal states ──────────────────
+  it('done is terminal — no resolve out of it', () => {
+    expect(transitions.done.resolve).toBeUndefined();
+  });
+
+  it('done is terminal — no dismiss out of it', () => {
+    expect(transitions.done.dismiss).toBeUndefined();
+  });
+
+  it('dismissed is terminal — no resolve out of it', () => {
+    expect(transitions.dismissed.resolve).toBeUndefined();
+  });
+
+  it('dismissed is terminal — no dismiss out of it', () => {
+    expect(transitions.dismissed.dismiss).toBeUndefined();
+  });
+
+  it('every declared state is reachable from the transition map', () => {
+    const targets = new Set<string>([states!.initial]);
+    for (const fromState of Object.values(transitions)) {
+      for (const to of Object.values(fromState)) {
+        if (to) targets.add(to);
+      }
+    }
+    expect(targets).toEqual(new Set(['active', 'done', 'dismissed']));
+  });
+});
+
+describe('AgendaItem invariants — resolved_has_timestamp', () => {
+  const inv = invariants!.find((i) => i.name === 'resolved_has_timestamp')!;
+
+  it('is declared and applies to resolve', () => {
+    expect(inv).toBeDefined();
+    expect(inv.appliesTo).toContain('resolve');
+  });
+
+  it('passes when a done item has a resolvedAt', () => {
+    const check = inv.check({ status: 'done', resolvedAt: '2026-06-24T11:00:00.000Z' });
+    expect(check).toBe(true);
+  });
+
+  it('triggers when a done item lacks a resolvedAt', () => {
+    const check = inv.check({ status: 'done', resolvedAt: null });
+    expect(typeof check).toBe('string');
+    expect(check).toBe('Done agenda item requires resolvedAt');
+  });
+
+  it('passes for non-done items regardless of resolvedAt', () => {
+    expect(inv.check({ status: 'active', resolvedAt: null })).toBe(true);
+    expect(inv.check({ status: 'dismissed', resolvedAt: null })).toBe(true);
+  });
+});
+
+describe('AgendaItem authority', () => {
+  it('add / resolve / dismiss are open to operator and system roles', () => {
+    for (const op of ['add', 'resolve', 'dismiss'] as const) {
+      const rule = authority[op];
+      expect(rule.requires).toBe('role');
+      expect((rule as { roles: string[] }).roles).toEqual(['operator', 'system']);
+    }
+  });
+
+  it('escalate is restricted to the system role', () => {
+    const rule = authority.escalate;
+    expect(rule.requires).toBe('role');
+    expect((rule as { roles: string[] }).roles).toEqual(['system']);
+    expect((rule as { roles: string[] }).roles).not.toContain('operator');
+  });
+});

From 0fd71684014b97d8b17542b970c382ce772fef30 Mon Sep 17 00:00:00 2001
From: Aegis <Aegis@stackbilt.dev>
Date: Wed, 24 Jun 2026 16:23:10 -0500
Subject: [PATCH 05/13] =?UTF-8?q?test(cc-task):=20OTDD=20contract=20tests?=
 =?UTF-8?q?=20=E2=80=94=20schema,=20state=20machine,=20invariants,=20autho?=
 =?UTF-8?q?rity?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

53 tests derived from cc-task.contract.ts. Covers all schema constraints,
operation inputs, multi-source cancel transition (pending|running→cancelled),
proposed_task_needs_approval and completed_has_timestamp invariants, and
authority rules.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 web/tests/cc-task-contract.test.ts | 284 +++++++++++++++++++++++++++++
 1 file changed, 284 insertions(+)
 create mode 100644 web/tests/cc-task-contract.test.ts

diff --git a/web/tests/cc-task-contract.test.ts b/web/tests/cc-task-contract.test.ts
new file mode 100644
index 0000000..7f30f85
--- /dev/null
+++ b/web/tests/cc-task-contract.test.ts
@@ -0,0 +1,284 @@
+// Contract-level tests for the CCTask bounded context.
+// Validates the declarative contract artifact directly — schema constraints,
+// operation input schemas, the status state machine, and runtime invariants.
+// No mocks: fixtures are inline objects parsed through the contract itself.
+
+import { describe, it, expect } from 'vitest';
+import { CCTaskContract } from '../src/contracts/cc-task.contract.js';
+
+const { schema, operations, states, invariants } = CCTaskContract;
+
+// Minimal valid entity that satisfies every required field of the schema.
+function validEntity(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 't1',
+    title: 'Do the thing',
+    repo: 'aegis',
+    prompt: 'Make it so',
+    completionSignal: null,
+    dependsOn: null,
+    blockedBy: null,
+    allowedTools: null,
+    sessionId: null,
+    result: null,
+    error: null,
+    exitCode: null,
+    preflightJson: null,
+    failureKind: null,
+    autopsyJson: null,
+    createdAt: '2026-06-24T00:00:00.000Z',
+    startedAt: null,
+    completedAt: null,
+    branch: null,
+    prUrl: null,
+    utilityJson: null,
+    githubIssueRepo: null,
+    githubIssueNumber: null,
+    ...overrides,
+  };
+}
+
+function inv(name: string) {
+  const found = invariants?.find((i) => i.name === name);
+  if (!found) throw new Error(`invariant ${name} not found in contract`);
+  return found;
+}
+
+// ─── Schema field constraints ─────────────────────────────────
+
+describe('CCTask schema', () => {
+  it('parses a minimal valid entity and applies defaults', () => {
+    const parsed = schema.parse(validEntity());
+    expect(parsed.status).toBe('pending');
+    expect(parsed.priority).toBe(50);
+    expect(parsed.maxTurns).toBe(25);
+    expect(parsed.retryable).toBe(false);
+    expect(parsed.createdBy).toBe('operator');
+    expect(parsed.authority).toBe('operator');
+    expect(parsed.category).toBe('feature');
+    expect(parsed.businessUnit).toBe('stackbilt');
+  });
+
+  it.each(['id', 'title', 'repo', 'prompt'])('rejects empty %s', (field) => {
+    expect(() => schema.parse(validEntity({ [field]: '' }))).toThrow();
+  });
+
+  it('rejects a missing required field', () => {
+    const e = validEntity();
+    delete (e as Record<string, unknown>).repo;
+    expect(() => schema.parse(e)).toThrow();
+  });
+
+  it('accepts every TaskStatus enum value', () => {
+    for (const s of ['pending', 'running', 'completed', 'failed', 'cancelled']) {
+      expect(schema.parse(validEntity({ status: s })).status).toBe(s);
+    }
+  });
+
+  it('rejects an unknown status', () => {
+    expect(() => schema.parse(validEntity({ status: 'paused' }))).toThrow();
+  });
+
+  it('accepts every TaskAuthority enum value', () => {
+    for (const a of ['proposed', 'auto_safe', 'operator']) {
+      expect(schema.parse(validEntity({ authority: a })).authority).toBe(a);
+    }
+  });
+
+  it('rejects an unknown authority', () => {
+    expect(() => schema.parse(validEntity({ authority: 'admin' }))).toThrow();
+  });
+
+  it('accepts every TaskCategory enum value', () => {
+    for (const c of ['docs', 'tests', 'research', 'bugfix', 'feature', 'refactor', 'deploy']) {
+      expect(schema.parse(validEntity({ category: c })).category).toBe(c);
+    }
+  });
+
+  it('rejects an unknown category', () => {
+    expect(() => schema.parse(validEntity({ category: 'yolo' }))).toThrow();
+  });
+
+  it('accepts priority at both bounds', () => {
+    expect(schema.parse(validEntity({ priority: 0 })).priority).toBe(0);
+    expect(schema.parse(validEntity({ priority: 100 })).priority).toBe(100);
+  });
+
+  it.each([-1, 101])('rejects out-of-range priority %i', (p) => {
+    expect(() => schema.parse(validEntity({ priority: p }))).toThrow();
+  });
+
+  it('rejects a non-integer priority', () => {
+    expect(() => schema.parse(validEntity({ priority: 12.5 }))).toThrow();
+  });
+
+  it('rejects a non-positive maxTurns', () => {
+    expect(() => schema.parse(validEntity({ maxTurns: 0 }))).toThrow();
+  });
+
+  it('rejects a non-positive githubIssueNumber but accepts a positive one', () => {
+    expect(() => schema.parse(validEntity({ githubIssueNumber: 0 }))).toThrow();
+    expect(schema.parse(validEntity({ githubIssueNumber: 72 })).githubIssueNumber).toBe(72);
+  });
+
+  it('rejects a non-datetime createdAt', () => {
+    expect(() => schema.parse(validEntity({ createdAt: 'yesterday' }))).toThrow();
+  });
+
+  it('allows nullable timestamps but rejects malformed ones', () => {
+    expect(schema.parse(validEntity({ startedAt: null })).startedAt).toBeNull();
+    expect(() => schema.parse(validEntity({ startedAt: 'soon' }))).toThrow();
+  });
+});
+
+// ─── Operation input schemas ──────────────────────────────────
+
+describe('CCTask operation inputs', () => {
+  it('create accepts the minimal required input', () => {
+    const parsed = operations.create.input.parse({
+      id: 't1', title: 'T', repo: 'aegis', prompt: 'go',
+    });
+    expect(parsed.id).toBe('t1');
+  });
+
+  it('create rejects missing prompt', () => {
+    expect(() => operations.create.input.parse({
+      id: 't1', title: 'T', repo: 'aegis',
+    })).toThrow();
+  });
+
+  it('create rejects out-of-range priority', () => {
+    expect(() => operations.create.input.parse({
+      id: 't1', title: 'T', repo: 'aegis', prompt: 'go', priority: 200,
+    })).toThrow();
+  });
+
+  it('start requires a non-empty sessionId', () => {
+    expect(operations.start.input.parse({ id: 't1', sessionId: 's1' }).sessionId).toBe('s1');
+    expect(() => operations.start.input.parse({ id: 't1', sessionId: '' })).toThrow();
+    expect(() => operations.start.input.parse({ id: 't1' })).toThrow();
+  });
+
+  it('fail requires a non-empty error', () => {
+    expect(operations.fail.input.parse({ id: 't1', error: 'boom' }).error).toBe('boom');
+    expect(() => operations.fail.input.parse({ id: 't1', error: '' })).toThrow();
+    expect(() => operations.fail.input.parse({ id: 't1' })).toThrow();
+  });
+
+  it('complete accepts optional result/exitCode/prUrl', () => {
+    const parsed = operations.complete.input.parse({
+      id: 't1', result: 'done', exitCode: 0, prUrl: 'http://pr',
+    });
+    expect(parsed.exitCode).toBe(0);
+  });
+
+  it('cancel and approve require only an id', () => {
+    expect(operations.cancel.input.parse({ id: 't1' }).id).toBe('t1');
+    expect(operations.approve.input.parse({ id: 't1' }).id).toBe('t1');
+    expect(() => operations.cancel.input.parse({ id: '' })).toThrow();
+  });
+});
+
+// ─── State machine ────────────────────────────────────────────
+
+describe('CCTask state machine', () => {
+  const transitions = states!.transitions;
+
+  it('declares pending as the initial state', () => {
+    expect(states!.initial).toBe('pending');
+    expect(states!.field).toBe('status');
+  });
+
+  // Valid transitions, derived from contract.states.transitions.
+  it.each([
+    ['pending', 'start', 'running'],
+    ['pending', 'cancel', 'cancelled'],
+    ['running', 'complete', 'completed'],
+    ['running', 'fail', 'failed'],
+    ['running', 'cancel', 'cancelled'],
+  ])('allows %s --%s--> %s', (from, op, to) => {
+    expect(transitions[from][op]).toBe(to);
+  });
+
+  // Invalid transition attempts: operation not defined for that state.
+  it.each([
+    ['pending', 'complete'],
+    ['pending', 'fail'],
+    ['running', 'start'],
+    ['completed', 'start'],
+    ['completed', 'cancel'],
+    ['failed', 'complete'],
+    ['cancelled', 'start'],
+  ])('rejects %s --%s-->', (from, op) => {
+    expect(transitions[from][op]).toBeUndefined();
+  });
+
+  it('marks completed, failed, and cancelled as terminal', () => {
+    expect(transitions.completed).toEqual({});
+    expect(transitions.failed).toEqual({});
+    expect(transitions.cancelled).toEqual({});
+  });
+
+  it('cancel operation declares a multi-source transition', () => {
+    expect(operations.cancel.transition).toEqual({
+      from: ['pending', 'running'],
+      to: 'cancelled',
+    });
+  });
+
+  it('every operation transition agrees with the states map', () => {
+    for (const [op, def] of Object.entries(operations)) {
+      const t = def.transition;
+      if (!t) continue;
+      const froms = Array.isArray(t.from) ? t.from : [t.from];
+      for (const from of froms) {
+        expect(transitions[from][op]).toBe(t.to);
+      }
+    }
+  });
+});
+
+// ─── Invariants ───────────────────────────────────────────────
+
+describe('CCTask invariant: proposed_task_needs_approval', () => {
+  const check = inv('proposed_task_needs_approval').check;
+
+  it('applies to the start operation', () => {
+    expect(inv('proposed_task_needs_approval').appliesTo).toContain('start');
+  });
+
+  it('violates when a proposed task is set running', () => {
+    const result = check({ authority: 'proposed', status: 'running' });
+    expect(result).toBe('Proposed tasks require approval before execution');
+  });
+
+  it('passes when an operator task is set running', () => {
+    expect(check({ authority: 'operator', status: 'running' })).toBe(true);
+  });
+
+  it('passes when a proposed task is still pending', () => {
+    expect(check({ authority: 'proposed', status: 'pending' })).toBe(true);
+  });
+});
+
+describe('CCTask invariant: completed_has_timestamp', () => {
+  const check = inv('completed_has_timestamp').check;
+
+  it('applies to complete and fail operations', () => {
+    expect(inv('completed_has_timestamp').appliesTo).toEqual(
+      expect.arrayContaining(['complete', 'fail']),
+    );
+  });
+
+  it.each(['completed', 'failed'])('violates when %s has no completedAt', (status) => {
+    expect(check({ status, completedAt: null })).toBe('Terminal tasks require completedAt');
+  });
+
+  it.each(['completed', 'failed'])('passes when %s has a completedAt', (status) => {
+    expect(check({ status, completedAt: '2026-06-24T00:00:00.000Z' })).toBe(true);
+  });
+
+  it('passes for a running task with no completedAt', () => {
+    expect(check({ status: 'running', completedAt: null })).toBe(true);
+  });
+});

From 64c262b49bc419f9449686ff95f998aa055d9d96 Mon Sep 17 00:00:00 2001
From: Aegis <Aegis@stackbilt.dev>
Date: Wed, 24 Jun 2026 16:23:22 -0500
Subject: [PATCH 06/13] =?UTF-8?q?test(goal):=20OTDD=20contract=20tests=20?=
 =?UTF-8?q?=E2=80=94=20schema,=20state=20machine,=20invariants,=20authorit?=
 =?UTF-8?q?y?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

65 tests derived from goal.contract.ts. Covers schema constraints,
all valid transitions including multi-source (active|paused→completed/failed),
terminal state enforcement, the completed_has_timestamp invariant, and
authority rules (terminal ops and recordRun are system-only).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 web/tests/goal-contract.test.ts | 304 ++++++++++++++++++++++++++++++++
 1 file changed, 304 insertions(+)
 create mode 100644 web/tests/goal-contract.test.ts

diff --git a/web/tests/goal-contract.test.ts b/web/tests/goal-contract.test.ts
new file mode 100644
index 0000000..a17a56c
--- /dev/null
+++ b/web/tests/goal-contract.test.ts
@@ -0,0 +1,304 @@
+// Contract-derived tests for the Goal bounded context.
+// Fixtures are derived directly from GoalContract — no mocks.
+// Source of truth: src/contracts/goal.contract.ts
+
+import { describe, it, expect } from 'vitest';
+import { GoalContract } from '../src/contracts/goal.contract.js';
+
+// ─── Helpers derived from the contract ───────────────────────
+
+const schema = GoalContract.schema;
+
+/** Minimal valid entity built from the contract's defaults + required fields. */
+function validGoal(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'goal-1',
+    title: 'Ship the thing',
+    description: null,
+    status: 'active',
+    authorityLevel: 'propose',
+    scheduleHours: 6,
+    createdAt: '2026-06-24T00:00:00.000Z',
+    lastRunAt: null,
+    nextRunAt: null,
+    completedAt: null,
+    runCount: 0,
+    contextJson: null,
+    businessUnit: 'stackbilt',
+    ...overrides,
+  };
+}
+
+/** Resolve the target state for an operation given the current state, per the contract. */
+function transitionTarget(from: string, operation: string): string | null | undefined {
+  return GoalContract.states?.transitions[from]?.[operation];
+}
+
+const invariant = (name: string) =>
+  GoalContract.invariants?.find((i) => i.name === name);
+
+// ─── Schema validation ───────────────────────────────────────
+
+describe('Goal schema', () => {
+  it('accepts a fully-specified valid entity', () => {
+    expect(schema.safeParse(validGoal()).success).toBe(true);
+  });
+
+  it('applies declared defaults for omitted optional fields', () => {
+    const parsed = schema.parse({
+      id: 'goal-1',
+      title: 'Ship it',
+      description: null,
+      createdAt: '2026-06-24T00:00:00.000Z',
+      lastRunAt: null,
+      nextRunAt: null,
+      completedAt: null,
+      contextJson: null,
+    });
+    expect(parsed.status).toBe('active');
+    expect(parsed.authorityLevel).toBe('propose');
+    expect(parsed.scheduleHours).toBe(6);
+    expect(parsed.runCount).toBe(0);
+    expect(parsed.businessUnit).toBe('stackbilt');
+  });
+
+  it('rejects an empty id', () => {
+    expect(schema.safeParse(validGoal({ id: '' })).success).toBe(false);
+  });
+
+  it('rejects an empty title', () => {
+    expect(schema.safeParse(validGoal({ title: '' })).success).toBe(false);
+  });
+
+  it('allows a null description but rejects a missing one', () => {
+    expect(schema.safeParse(validGoal({ description: null })).success).toBe(true);
+    const { description: _omit, ...withoutDescription } = validGoal();
+    expect(schema.safeParse(withoutDescription).success).toBe(false);
+  });
+
+  describe('scheduleHours', () => {
+    it('rejects zero (must be positive)', () => {
+      expect(schema.safeParse(validGoal({ scheduleHours: 0 })).success).toBe(false);
+    });
+    it('rejects negative values', () => {
+      expect(schema.safeParse(validGoal({ scheduleHours: -3 })).success).toBe(false);
+    });
+    it('rejects non-integer values', () => {
+      expect(schema.safeParse(validGoal({ scheduleHours: 1.5 })).success).toBe(false);
+    });
+    it('accepts a positive integer', () => {
+      expect(schema.safeParse(validGoal({ scheduleHours: 12 })).success).toBe(true);
+    });
+  });
+
+  describe('runCount', () => {
+    it('accepts zero (non-negative)', () => {
+      expect(schema.safeParse(validGoal({ runCount: 0 })).success).toBe(true);
+    });
+    it('rejects negative values', () => {
+      expect(schema.safeParse(validGoal({ runCount: -1 })).success).toBe(false);
+    });
+    it('rejects non-integer values', () => {
+      expect(schema.safeParse(validGoal({ runCount: 2.5 })).success).toBe(false);
+    });
+  });
+
+  describe('status enum', () => {
+    for (const status of ['active', 'paused', 'completed', 'failed']) {
+      it(`accepts "${status}"`, () => {
+        expect(schema.safeParse(validGoal({ status })).success).toBe(true);
+      });
+    }
+    it('rejects an unknown status', () => {
+      expect(schema.safeParse(validGoal({ status: 'archived' })).success).toBe(false);
+    });
+  });
+
+  describe('authorityLevel enum', () => {
+    for (const level of ['propose', 'auto_low', 'auto_high']) {
+      it(`accepts "${level}"`, () => {
+        expect(schema.safeParse(validGoal({ authorityLevel: level })).success).toBe(true);
+      });
+    }
+    it('rejects an unknown authority level', () => {
+      expect(schema.safeParse(validGoal({ authorityLevel: 'auto_full' })).success).toBe(false);
+    });
+  });
+
+  describe('datetime fields', () => {
+    it('rejects a non-ISO createdAt', () => {
+      expect(schema.safeParse(validGoal({ createdAt: '2026-06-24' })).success).toBe(false);
+    });
+    it('accepts a null completedAt', () => {
+      expect(schema.safeParse(validGoal({ completedAt: null })).success).toBe(true);
+    });
+    it('rejects a non-ISO completedAt', () => {
+      expect(schema.safeParse(validGoal({ completedAt: 'yesterday' })).success).toBe(false);
+    });
+  });
+
+  it('rejects an empty businessUnit', () => {
+    expect(schema.safeParse(validGoal({ businessUnit: '' })).success).toBe(false);
+  });
+});
+
+// ─── Operation input schemas ─────────────────────────────────
+
+describe('create operation input', () => {
+  const input = GoalContract.operations.create.input;
+
+  it('accepts minimal valid input (id + title)', () => {
+    expect(input.safeParse({ id: 'g1', title: 'Do a thing' }).success).toBe(true);
+  });
+
+  it('rejects missing title', () => {
+    expect(input.safeParse({ id: 'g1' }).success).toBe(false);
+  });
+
+  it('rejects empty id', () => {
+    expect(input.safeParse({ id: '', title: 'x' }).success).toBe(false);
+  });
+
+  it('rejects a non-positive scheduleHours', () => {
+    expect(input.safeParse({ id: 'g1', title: 'x', scheduleHours: 0 }).success).toBe(false);
+  });
+
+  it('rejects an invalid authorityLevel', () => {
+    expect(input.safeParse({ id: 'g1', title: 'x', authorityLevel: 'nope' }).success).toBe(false);
+  });
+});
+
+describe('lifecycle operation inputs require an id', () => {
+  for (const op of ['pause', 'resume', 'complete', 'fail', 'recordRun']) {
+    it(`${op} rejects empty id`, () => {
+      expect(GoalContract.operations[op].input.safeParse({ id: '' }).success).toBe(false);
+    });
+    it(`${op} accepts a valid id`, () => {
+      expect(GoalContract.operations[op].input.safeParse({ id: 'g1' }).success).toBe(true);
+    });
+  }
+
+  it('recordRun accepts an optional nextRunAt', () => {
+    const input = GoalContract.operations.recordRun.input;
+    expect(input.safeParse({ id: 'g1', nextRunAt: '2026-06-24T06:00:00.000Z' }).success).toBe(true);
+    expect(input.safeParse({ id: 'g1', nextRunAt: 'soon' }).success).toBe(false);
+  });
+});
+
+// ─── State machine ───────────────────────────────────────────
+
+describe('Goal state machine', () => {
+  it('starts in the active state', () => {
+    expect(GoalContract.states?.initial).toBe('active');
+  });
+
+  describe('valid transitions', () => {
+    const valid: Array<[string, string, string]> = [
+      ['active', 'pause', 'paused'],
+      ['active', 'complete', 'completed'],
+      ['active', 'fail', 'failed'],
+      ['paused', 'resume', 'active'],
+      ['paused', 'complete', 'completed'],
+      ['paused', 'fail', 'failed'],
+    ];
+    for (const [from, op, to] of valid) {
+      it(`${from} --${op}--> ${to}`, () => {
+        expect(transitionTarget(from, op)).toBe(to);
+      });
+    }
+  });
+
+  describe('invalid transitions', () => {
+    const invalid: Array<[string, string]> = [
+      ['active', 'resume'], // can only resume from paused
+      ['paused', 'pause'], // already paused
+      ['completed', 'resume'], // terminal
+      ['completed', 'pause'],
+      ['completed', 'complete'],
+      ['failed', 'resume'], // terminal
+      ['failed', 'complete'],
+    ];
+    for (const [from, op] of invalid) {
+      it(`${from} cannot ${op}`, () => {
+        expect(transitionTarget(from, op)).toBeUndefined();
+      });
+    }
+  });
+
+  it('completed is a terminal state (no outgoing transitions)', () => {
+    expect(GoalContract.states?.transitions.completed).toEqual({});
+  });
+
+  it('failed is a terminal state (no outgoing transitions)', () => {
+    expect(GoalContract.states?.transitions.failed).toEqual({});
+  });
+
+  describe('multi-source operations agree with the operation transition declarations', () => {
+    it('complete accepts both active and paused as sources', () => {
+      const t = GoalContract.operations.complete.transition;
+      expect(t?.from).toEqual(['active', 'paused']);
+      expect(t?.to).toBe('completed');
+      // every declared source must reach the declared target in the states map
+      for (const from of t!.from as string[]) {
+        expect(transitionTarget(from, 'complete')).toBe('completed');
+      }
+    });
+
+    it('fail accepts both active and paused as sources', () => {
+      const t = GoalContract.operations.fail.transition;
+      expect(t?.from).toEqual(['active', 'paused']);
+      expect(t?.to).toBe('failed');
+      for (const from of t!.from as string[]) {
+        expect(transitionTarget(from, 'fail')).toBe('failed');
+      }
+    });
+  });
+});
+
+// ─── Invariant: completed_has_timestamp ──────────────────────
+
+describe('invariant: completed_has_timestamp', () => {
+  const inv = invariant('completed_has_timestamp');
+
+  it('is declared and applies to the complete operation', () => {
+    expect(inv).toBeDefined();
+    expect(inv!.appliesTo).toContain('complete');
+  });
+
+  it('fails when a completed goal has no completedAt', () => {
+    const result = inv!.check(validGoal({ status: 'completed', completedAt: null }));
+    expect(result).toBe('Completed goal requires completedAt');
+  });
+
+  it('passes when a completed goal has a completedAt', () => {
+    const result = inv!.check(
+      validGoal({ status: 'completed', completedAt: '2026-06-24T00:00:00.000Z' }),
+    );
+    expect(result).toBe(true);
+  });
+
+  it('passes for non-completed goals regardless of completedAt', () => {
+    expect(inv!.check(validGoal({ status: 'active', completedAt: null }))).toBe(true);
+    expect(inv!.check(validGoal({ status: 'paused', completedAt: null }))).toBe(true);
+    expect(inv!.check(validGoal({ status: 'failed', completedAt: null }))).toBe(true);
+  });
+});
+
+// ─── Authority rules ─────────────────────────────────────────
+
+describe('Goal authority rules', () => {
+  it('restricts terminal transitions (complete/fail) and recordRun to system', () => {
+    for (const op of ['complete', 'fail', 'recordRun']) {
+      const auth = GoalContract.authority[op];
+      expect(auth).toEqual({ requires: 'role', roles: ['system'] });
+    }
+  });
+
+  it('allows operators and system to create, pause, and resume', () => {
+    for (const op of ['create', 'pause', 'resume']) {
+      const auth = GoalContract.authority[op] as { requires: string; roles: string[] };
+      expect(auth.requires).toBe('role');
+      expect(auth.roles).toEqual(['operator', 'system']);
+    }
+  });
+});

From db7282827130db67988ebd6a80362c112e998a6b Mon Sep 17 00:00:00 2001
From: Aegis <Aegis@stackbilt.dev>
Date: Wed, 24 Jun 2026 16:23:29 -0500
Subject: [PATCH 07/13] test(executor-router): OTDD I1/I2 violation path tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

4 tests filling the only gaps in executor-router-semantic.test.ts: the
negative cases for I1 (anthropic routes must have a fallback) and I2
(free-tier routes are terminal). I3–I6 violation paths were already
covered. All six invariants now have both happy and violation coverage.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 web/tests/executor-router-contract.test.ts | 56 ++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 web/tests/executor-router-contract.test.ts

diff --git a/web/tests/executor-router-contract.test.ts b/web/tests/executor-router-contract.test.ts
new file mode 100644
index 0000000..a5045e6
--- /dev/null
+++ b/web/tests/executor-router-contract.test.ts
@@ -0,0 +1,56 @@
+import { describe, it, expect } from 'vitest';
+import { EXECUTOR_ROUTES } from '../src/kernel/executor-router.js';
+import {
+  PROVIDER_REQUIRES_FALLBACK,
+  TIER_IS_TERMINAL,
+} from '../src/kernel/executor-router.contract.js';
+
+// ─── Contract-Derived Invariant Suite ─────────────────────────
+// Complements executor-router-semantic.test.ts. Adds the violation-path
+// coverage for I1 (anthropic requires fallback) and I2 (free-tier terminal),
+// which the semantic suite only checks on the happy path against the live table.
+
+describe('executor-router contract invariants', () => {
+  // ── I1: anthropic-provider routes require a fallback ──────────
+  describe('I1: anthropic routes require a fallback', () => {
+    it('every anthropic route in the live table defines a fallback', () => {
+      const anthropicRoutes = Object.entries(EXECUTOR_ROUTES).filter(
+        ([, r]) => PROVIDER_REQUIRES_FALLBACK[r.provider],
+      );
+      expect(anthropicRoutes.length).toBeGreaterThan(0);
+      for (const [name, route] of anthropicRoutes) {
+        expect(route.fallback, `anthropic route '${name}' must define a fallback`).toBeDefined();
+      }
+    });
+
+    it('detects an anthropic route missing its required fallback', () => {
+      // A route guard derived from the contract map: any provider flagged in
+      // PROVIDER_REQUIRES_FALLBACK with no fallback is a violation.
+      const offending = { provider: 'anthropic' as const, tier: 'premium' as const };
+      const isViolation =
+        PROVIDER_REQUIRES_FALLBACK[offending.provider] &&
+        (offending as { fallback?: string }).fallback === undefined;
+      expect(isViolation).toBe(true);
+    });
+  });
+
+  // ── I2: free-tier routes are terminal ────────────────────────
+  describe('I2: free-tier routes are terminal', () => {
+    it('every free-tier route in the live table has no fallback', () => {
+      const freeRoutes = Object.entries(EXECUTOR_ROUTES).filter(
+        ([, r]) => TIER_IS_TERMINAL[r.tier],
+      );
+      expect(freeRoutes.length).toBeGreaterThan(0);
+      for (const [name, route] of freeRoutes) {
+        expect(route.fallback, `free-tier route '${name}' must be terminal`).toBeUndefined();
+      }
+    });
+
+    it('detects a free-tier route that defines a fallback', () => {
+      const offending = { tier: 'free' as const, fallback: 'gpt_oss' };
+      const isViolation =
+        Boolean(TIER_IS_TERMINAL[offending.tier]) && offending.fallback !== undefined;
+      expect(isViolation).toBe(true);
+    });
+  });
+});

From 742a875bd16064f86127e8aeccae49c9d5700366 Mon Sep 17 00:00:00 2001
From: Aegis <Aegis@stackbilt.dev>
Date: Wed, 24 Jun 2026 16:23:36 -0500
Subject: [PATCH 08/13] =?UTF-8?q?test(memory):=20OTDD=20contract=20tests?=
 =?UTF-8?q?=20=E2=80=94=20CRIX=20pipeline,=20invariants,=20authority?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

33 tests derived from memory-entry.contract.ts. Covers CRIX validation
pipeline transitions (candidate→validated→expert→canonical), refute
terminal edges, refuted_entry_not_canonical and high_confidence_for_canonical
invariants (including 0.9 boundary), terminal stage enforcement, and
authority rules.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 web/tests/memory-entry-contract.test.ts | 227 ++++++++++++++++++++++++
 1 file changed, 227 insertions(+)
 create mode 100644 web/tests/memory-entry-contract.test.ts

diff --git a/web/tests/memory-entry-contract.test.ts b/web/tests/memory-entry-contract.test.ts
new file mode 100644
index 0000000..2d9ebfe
--- /dev/null
+++ b/web/tests/memory-entry-contract.test.ts
@@ -0,0 +1,227 @@
+// Contract-derived fixture tests for the MemoryEntry bounded context.
+// These exercise the contract object itself — its schema constraints, the
+// CRIX validation state machine, and the declared invariants — independent
+// of the runtime CRIX engine in insights.ts. No DB, no mocks.
+
+import { describe, it, expect } from 'vitest';
+import { MemoryEntryContract } from '../src/contracts/memory-entry.contract.js';
+
+const { schema, operations, states, invariants } = MemoryEntryContract;
+
+function invariant(name: string) {
+  const inv = invariants?.find((i) => i.name === name);
+  if (!inv) throw new Error(`invariant ${name} not found in contract`);
+  return inv;
+}
+
+// ─── Schema constraints ──────────────────────────────────────────
+
+describe('MemoryEntry schema', () => {
+  const base = {
+    id: 1,
+    topic: 'aegis',
+    fact: 'a meaningful fact',
+    source: 'test',
+    createdAt: '2026-06-24T00:00:00.000Z',
+    updatedAt: '2026-06-24T00:00:00.000Z',
+    expiresAt: null,
+    validUntil: null,
+    supersededBy: null,
+    lastRecalledAt: null,
+    validators: null,
+  };
+
+  it('applies declared defaults (factHash, confidence, strength, validationStage)', () => {
+    const parsed = schema.parse(base);
+    expect(parsed.factHash).toBe('');
+    expect(parsed.confidence).toBe(0.8);
+    expect(parsed.strength).toBe(1);
+    expect(parsed.validationStage).toBe('candidate');
+  });
+
+  it('accepts confidence at the 0 and 1 boundaries', () => {
+    expect(schema.parse({ ...base, confidence: 0 }).confidence).toBe(0);
+    expect(schema.parse({ ...base, confidence: 1 }).confidence).toBe(1);
+  });
+
+  it('rejects confidence below 0 or above 1', () => {
+    expect(() => schema.parse({ ...base, confidence: -0.01 })).toThrow();
+    expect(() => schema.parse({ ...base, confidence: 1.01 })).toThrow();
+  });
+
+  it('rejects empty topic, fact, or source', () => {
+    expect(() => schema.parse({ ...base, topic: '' })).toThrow();
+    expect(() => schema.parse({ ...base, fact: '' })).toThrow();
+    expect(() => schema.parse({ ...base, source: '' })).toThrow();
+  });
+
+  it('rejects non-positive or non-integer id', () => {
+    expect(() => schema.parse({ ...base, id: 0 })).toThrow();
+    expect(() => schema.parse({ ...base, id: -1 })).toThrow();
+    expect(() => schema.parse({ ...base, id: 1.5 })).toThrow();
+  });
+
+  it('rejects negative strength but accepts zero', () => {
+    expect(schema.parse({ ...base, strength: 0 }).strength).toBe(0);
+    expect(() => schema.parse({ ...base, strength: -1 })).toThrow();
+  });
+
+  it('constrains validationStage to the known enum', () => {
+    for (const stage of ['candidate', 'validated', 'expert', 'canonical', 'refuted']) {
+      expect(schema.parse({ ...base, validationStage: stage }).validationStage).toBe(stage);
+    }
+    expect(() => schema.parse({ ...base, validationStage: 'unknown' })).toThrow();
+  });
+
+  it('rejects non-datetime createdAt/updatedAt', () => {
+    expect(() => schema.parse({ ...base, createdAt: 'not-a-date' })).toThrow();
+  });
+});
+
+// ─── CRIX state machine: valid transitions ───────────────────────
+
+describe('CRIX validation pipeline — valid transitions', () => {
+  it('starts at candidate', () => {
+    expect(states?.initial).toBe('candidate');
+  });
+
+  it('candidate → validated via validate', () => {
+    expect(states?.transitions.candidate.validate).toBe('validated');
+  });
+
+  it('validated → expert via promoteToExpert', () => {
+    expect(states?.transitions.validated.promoteToExpert).toBe('expert');
+  });
+
+  it('expert → canonical via promoteToCanonical', () => {
+    expect(states?.transitions.expert.promoteToCanonical).toBe('canonical');
+  });
+
+  it('candidate → refuted via refute', () => {
+    expect(states?.transitions.candidate.refute).toBe('refuted');
+  });
+
+  it('validated → refuted via refute', () => {
+    expect(states?.transitions.validated.refute).toBe('refuted');
+  });
+
+  it('expert → refuted via refute', () => {
+    expect(states?.transitions.expert.refute).toBe('refuted');
+  });
+
+  it('operation transition declarations agree with the state map', () => {
+    expect(operations.validate.transition).toEqual({ from: 'candidate', to: 'validated' });
+    expect(operations.promoteToExpert.transition).toEqual({ from: 'validated', to: 'expert' });
+    expect(operations.promoteToCanonical.transition).toEqual({ from: 'expert', to: 'canonical' });
+    expect(operations.refute.transition).toEqual({
+      from: ['candidate', 'validated', 'expert'],
+      to: 'refuted',
+    });
+  });
+});
+
+// ─── CRIX state machine: terminal stages & invalid transitions ───
+
+describe('CRIX validation pipeline — terminal stages & invalid transitions', () => {
+  it('canonical is terminal (no outgoing transitions)', () => {
+    expect(states?.transitions.canonical).toEqual({});
+  });
+
+  it('refuted is terminal (no outgoing transitions)', () => {
+    expect(states?.transitions.refuted).toEqual({});
+  });
+
+  it('canonical cannot be refuted (no refute edge from canonical)', () => {
+    expect(states?.transitions.canonical.refute).toBeUndefined();
+    expect(operations.refute.transition?.from).not.toContain('canonical');
+  });
+
+  it('candidate cannot be promoted directly to canonical (no such edge)', () => {
+    expect(states?.transitions.candidate.promoteToCanonical).toBeUndefined();
+    // The only edge into canonical originates from expert.
+    expect(operations.promoteToCanonical.transition?.from).toBe('expert');
+  });
+
+  it('candidate cannot skip to expert', () => {
+    expect(states?.transitions.candidate.promoteToExpert).toBeUndefined();
+  });
+});
+
+// ─── Invariant: refuted_entry_not_canonical ──────────────────────
+
+describe("invariant refuted_entry_not_canonical", () => {
+  const check = invariant('refuted_entry_not_canonical').check;
+
+  it('applies to the refute operation', () => {
+    expect(invariant('refuted_entry_not_canonical').appliesTo).toEqual(['refute']);
+  });
+
+  it('fails when a canonical entry is checked against refute', () => {
+    const result = check({ validationStage: 'canonical' });
+    expect(typeof result).toBe('string');
+    expect(result).toContain('cannot transition to refuted');
+  });
+
+  it('passes for non-canonical stages', () => {
+    for (const stage of ['candidate', 'validated', 'expert']) {
+      expect(check({ validationStage: stage })).toBe(true);
+    }
+  });
+});
+
+// ─── Invariant: high_confidence_for_canonical ────────────────────
+
+describe('invariant high_confidence_for_canonical', () => {
+  const check = invariant('high_confidence_for_canonical').check;
+
+  it('applies to the promoteToCanonical operation', () => {
+    expect(invariant('high_confidence_for_canonical').appliesTo).toEqual(['promoteToCanonical']);
+  });
+
+  it('fails a canonical entity with confidence 0.5', () => {
+    const result = check({ validationStage: 'canonical', confidence: 0.5 });
+    expect(typeof result).toBe('string');
+    expect(result).toContain('confidence >= 0.9');
+  });
+
+  it('passes a canonical entity with confidence 0.95', () => {
+    expect(check({ validationStage: 'canonical', confidence: 0.95 })).toBe(true);
+  });
+
+  it('passes a canonical entity exactly at the 0.9 boundary', () => {
+    expect(check({ validationStage: 'canonical', confidence: 0.9 })).toBe(true);
+  });
+
+  it('ignores confidence for non-canonical stages', () => {
+    expect(check({ validationStage: 'expert', confidence: 0.1 })).toBe(true);
+    expect(check({ validationStage: 'candidate', confidence: 0 })).toBe(true);
+  });
+
+  it('treats missing confidence on a canonical entry as failing', () => {
+    const result = check({ validationStage: 'canonical' });
+    expect(typeof result).toBe('string');
+  });
+});
+
+// ─── Authority rules ─────────────────────────────────────────────
+
+describe('MemoryEntry authority', () => {
+  const authority = MemoryEntryContract.authority;
+
+  it('allows operator and system to record and refute', () => {
+    expect(authority.record).toEqual({ requires: 'role', roles: ['operator', 'system'] });
+    expect(authority.refute).toEqual({ requires: 'role', roles: ['operator', 'system'] });
+  });
+
+  it('restricts pipeline promotions to system only', () => {
+    for (const op of ['validate', 'promoteToExpert', 'promoteToCanonical', 'recall', 'expire']) {
+      expect(authority[op]).toEqual({ requires: 'role', roles: ['system'] });
+    }
+  });
+
+  it('never grants an operation a public/authenticated requirement', () => {
+    for (const rule of Object.values(authority)) {
+      expect(rule.requires).toBe('role');
+    }
+  });
+});

From c04c41d4f84642b5df65a0376ef46d59d986f2a8 Mon Sep 17 00:00:00 2001
From: Aegis <Aegis@stackbilt.dev>
Date: Wed, 24 Jun 2026 16:23:44 -0500
Subject: [PATCH 09/13] chore(governance): record charter audit event (score
 50/100)

Appends the audit telemetry entry from the OTDD baseline governance
check. Trailer coverage at 0% is the primary drag; pattern definitions
and policy docs are at full score.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .charter/telemetry/events.ndjson | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.charter/telemetry/events.ndjson b/.charter/telemetry/events.ndjson
index 0822617..3ffca48 100644
--- a/.charter/telemetry/events.ndjson
+++ b/.charter/telemetry/events.ndjson
@@ -1,2 +1,3 @@
 {"version":1,"timestamp":"2026-03-23T08:16:04.910Z","commandPath":"bootstrap","flags":["--yes","--preset","--ci"],"format":"text","ciMode":true,"durationMs":1913,"exitCode":0,"success":true}
 {"version":1,"timestamp":"2026-03-23T12:30:47.732Z","commandPath":"adf.populate","flags":[],"format":"text","ciMode":false,"durationMs":87,"exitCode":0,"success":true}
+{"version":1,"timestamp":"2026-06-24T20:59:33.766Z","commandPath":"audit","flags":[],"format":"text","ciMode":false,"durationMs":1896,"exitCode":0,"success":true}

From 273e25512d59396b2c00d1e9fd61dceea51da75c Mon Sep 17 00:00:00 2001
From: Aegis <Aegis@stackbilt.dev>
Date: Wed, 24 Jun 2026 16:25:53 -0500
Subject: [PATCH 10/13] docs: document OTDD contract ontology and update
 changelog
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- CHANGELOG.md: add Unreleased entry for OTDD test suites and three bug
  fixes (executor-router interface, workers-ai cast, agenda terminal guard)
- docs/architecture.md: add Contract Ontology section documenting all six
  .contract.ts files, their invariants, and the OTDD approach; notes #75
  for runtime enforcement wiring
- CONTRIBUTING.md: add OTDD section explaining how to write contract tests
  (schema, state machine, invariants, authority — no mocks)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 CHANGELOG.md         | 10 ++++++++++
 CONTRIBUTING.md      | 14 ++++++++++++++
 docs/architecture.md | 23 +++++++++++++++++++++++
 3 files changed, 47 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 77e51c2..61b9eac 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## Unreleased
+
+### Added
+- OTDD contract test suites for all five bounded contexts — AgendaItem (48 tests), CCTask (53 tests), Goal (65 tests), ExecutorRouter I1/I2 violation paths (4 tests), and MemoryEntry/CRIX pipeline (33 tests). Tests are derived directly from `.contract.ts` schema, state machine, invariant, and authority declarations with no mocks.
+
+### Fixed
+- `executor-router.ts` — added `isDefault?: true` to `ExecutorRoute` interface to match `ExecutorRouteShapeSchema` in the contract; removes TS2353 on the `workers_ai` route.
+- `workers-ai-chat.ts` — narrowed `Ai.run()` overload cast via explicit function-signature cast to resolve TS2769/TS2352; removes the `as Record<string, unknown>` workaround that leaked the intersection mismatch.
+- `kernel/memory/agenda.ts` — `resolveAgendaItem` now adds `AND status = 'active'` to its UPDATE and throws when 0 rows are affected, enforcing the contract's terminal-state invariant for `done` and `dismissed`.
+
 ## 0.8.0 (2026-06-02)
 
 ### Added
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3ee763a..66e118e 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -162,6 +162,20 @@ interface Env extends CoreEnv {
 - `.dev.vars`, `.env` — secrets
 - Account IDs, API tokens, or internal URLs
 
+## Contract tests (OTDD)
+
+Domain contracts live in `web/src/contracts/*.contract.ts`. Each contract is the authoritative source of truth for its bounded context — schema, operations, state machine, invariants, and authority rules.
+
+When adding or modifying a contract, also update (or create) the corresponding `web/tests/*-contract.test.ts` file to cover:
+
+- **Schema constraints** — one passing and one failing fixture per field constraint
+- **Operation inputs** — valid and invalid inputs per operation
+- **State machine** — every valid transition, every invalid attempt on terminal states, multi-source transitions
+- **Invariants** — both the happy path and the violation path for each named invariant
+- **Authority** — assert which roles are permitted and excluded per operation
+
+Derive all fixtures directly from the contract — no mocks, no D1. Import the contract object and call `.schema.parse()`, `.operations.*.input.parse()`, `.states.transitions`, and `.invariants[].check()` directly.
+
 ## Pull Requests
 
 1. Fork the repo and create a feature branch from `main`
diff --git a/docs/architecture.md b/docs/architecture.md
index 5d8c1ec..5e3eab7 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -134,6 +134,29 @@ AEGIS exposes its capabilities via the [Model Context Protocol](https://modelcon
 - **MCP Server** — Other AI tools can call AEGIS tools (memory, agenda, goals, chat)
 - **MCP Client** — AEGIS can call external MCP services (configured via service bindings)
 
+## Contract ontology
+
+AEGIS uses a formal domain ontology defined in `web/src/contracts/`. Each `.contract.ts` file is the authoritative source of truth for a bounded context — its schema, operations, state machine, invariants, and authority rules. Tests are derived directly from these contracts (OTDD — Ontology-Driven Test Development).
+
+| Contract | Domain | Key invariants |
+|---|---|---|
+| `agenda-item.contract.ts` | AgendaItem | `resolved_has_timestamp` — done items require `resolvedAt` |
+| `cc-task.contract.ts` | CCTask | `proposed_task_needs_approval`, `completed_has_timestamp` |
+| `goal.contract.ts` | Goal | `completed_has_timestamp` — completed goals require `completedAt` |
+| `memory-entry.contract.ts` | MemoryEntry (CRIX) | `refuted_entry_not_canonical`, `high_confidence_for_canonical` (≥0.9) |
+| `executor-router.contract.ts` | ExecutorRouter | I1–I6: fallback coverage, tier ordering, single default, acyclic DAG |
+| `issue-68.contract.ts` | WasmGraph (blueprint) | Snapshot invariants for BFS spreading activation — impl pending |
+
+Contracts define:
+- **Schema** — Zod shapes for the entity and all operation inputs
+- **Operations** — named mutations with input schema, output, and emitted events
+- **State machine** — field, initial state, and allowed transitions per state
+- **Invariants** — named `check()` predicates scoped to specific operations via `appliesTo`
+- **Authority** — which roles may invoke each operation
+- **Surfaces** — API route shapes and D1 table/index declarations
+
+> **Note**: Contract invariant `check()` functions are currently specification-only. Runtime enforcement wiring (calling invariants before D1 writes) is tracked in aegis-oss#75.
+
 ## Key design decisions
 
 **Edge-native**: Everything runs in V8 isolates on Cloudflare's edge. No containers, no servers, no cold starts beyond single-digit milliseconds.

From e7879b209752024aec122064879e4e4c28a67d0d Mon Sep 17 00:00:00 2001
From: Aegis <Aegis@stackbilt.dev>
Date: Fri, 26 Jun 2026 03:44:25 -0500
Subject: [PATCH 11/13] chore: ignore .agent-memory/ directories

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index f95872c..ba19b3a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,3 +12,4 @@ C:*
 node_modules/
 .pnpm-store/
 __pycache__/
+.agent-memory/

From ae138f0e12155d6f89bed3eace1e6ebbe03009e9 Mon Sep 17 00:00:00 2001
From: Aegis <Aegis@stackbilt.dev>
Date: Fri, 26 Jun 2026 04:02:45 -0500
Subject: [PATCH 12/13] =?UTF-8?q?fix(review):=20address=20PR=20#76=20findi?=
 =?UTF-8?q?ngs=20=E2=80=94=20dispatch,=20tool=20handler,=20ai-chat=20dedup?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Remove undeclared groq → workers_ai fallback from EXECUTOR_ROUTES (dispatch
  never reads route.fallback; false resilience signal removed; wiring tracked
  in #75)
- Guard placeholder routes in dispatch default branch before EXECUTOR_FNS lookup
  so cerebras_mid/reasoning produce a clear error rather than 'Unknown executor'
- Catch resolveAgendaItem throw in handleInProcessTool's resolve_agenda_item
  branch so an already-resolved item returns an error string to the model
  instead of killing the tool-call loop
- Isolate resolveAgendaItem in agenda-triage into its own try/catch so a DB
  failure after a successful createIssue doesn't leave the item active and
  trigger duplicate issue creation on the next cycle
- Add two missing tests for resolveAgendaItem: AND status='active' SQL guard
  and throw-on-changes=0 coverage
- Extract duplicated Ai.run() overload cast into callAiRun() helper

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 web/src/claude-tools/index.ts                   |  6 +++++-
 web/src/kernel/dispatch.ts                      |  3 +++
 web/src/kernel/executor-router.ts               |  4 ++--
 .../kernel/scheduled/dreaming/agenda-triage.ts  |  9 ++++++++-
 web/src/workers-ai-chat.ts                      | 17 +++++++++++++----
 web/tests/memory.test.ts                        | 13 +++++++++++++
 6 files changed, 44 insertions(+), 8 deletions(-)

diff --git a/web/src/claude-tools/index.ts b/web/src/claude-tools/index.ts
index 81a34d4..0d9a386 100755
--- a/web/src/claude-tools/index.ts
+++ b/web/src/claude-tools/index.ts
@@ -278,7 +278,11 @@ export async function handleInProcessTool(
   }
   if (name === 'resolve_agenda_item') {
     const i = input as { id: number; status: 'done' | 'dismissed' };
-    await resolveAgendaItem(db, i.id, i.status);
+    try {
+      await resolveAgendaItem(db, i.id, i.status);
+    } catch (err) {
+      return `Error: ${err instanceof Error ? err.message : String(err)}`;
+    }
     return `Resolved agenda item #${i.id} as ${i.status}`;
   }
   if (name === 'lookup_cc_session') {
diff --git a/web/src/kernel/dispatch.ts b/web/src/kernel/dispatch.ts
index 04787e8..ee395f8 100755
--- a/web/src/kernel/dispatch.ts
+++ b/web/src/kernel/dispatch.ts
@@ -25,6 +25,7 @@ import {
   buildMcpRegistry,
   EXECUTOR_FNS,
 } from './executors/index.js';
+import { getExecutorRoute, type LLMExecutor } from './executor-router.js';
 // ─── Edge Environment ────────────────────────────────────────
 
 export interface EdgeEnv {
@@ -367,6 +368,8 @@ async function probeAndExecute(
           result = await executeTarotScript(intent, env);
           break;
         default: {
+          const route = getExecutorRoute(plan.executor as LLMExecutor);
+          if (route?.placeholder) throw new Error(`Executor '${plan.executor}' is a placeholder and cannot be dispatched`);
           const fn = EXECUTOR_FNS[plan.executor as Executor];
           if (!fn) throw new Error(`Unknown executor: ${plan.executor}`);
           result = await fn(intent, env);
diff --git a/web/src/kernel/executor-router.ts b/web/src/kernel/executor-router.ts
index 7db4665..1ed0821 100644
--- a/web/src/kernel/executor-router.ts
+++ b/web/src/kernel/executor-router.ts
@@ -90,8 +90,8 @@ export const EXECUTOR_ROUTES: Record<LLMExecutor, ExecutorRoute> = {
     // groqResponseModel = 8B (llama-3.1-8b-instant) — fast/cheap for greetings.
     // Intentionally NOT groqModel (70B). See executors/groq.ts:12.
     model: (env) => env.groqResponseModel,
-    // Falls back to CF Workers AI (free tier) on Groq API failure.
-    fallback: 'workers_ai',
+    // No fallback declared: dispatch does not yet read route.fallback at runtime.
+    // Wiring groq → workers_ai fallback is tracked in aegis-oss#75.
   },
   cerebras_mid: {
     provider: 'cerebras',
diff --git a/web/src/kernel/scheduled/dreaming/agenda-triage.ts b/web/src/kernel/scheduled/dreaming/agenda-triage.ts
index 988dc88..a5b239f 100644
--- a/web/src/kernel/scheduled/dreaming/agenda-triage.ts
+++ b/web/src/kernel/scheduled/dreaming/agenda-triage.ts
@@ -92,7 +92,14 @@ export async function triageAgendaToIssues(env: EdgeEnv): Promise<number> {
         `${item.body ?? ''}\n\n---\n_Promoted from AEGIS agenda item #${item.id} by dreaming triage._`,
         labels,
       );
-      await resolveAgendaItem(env.db, item.id, 'done');
+
+      // Resolve separately so a DB hiccup after a successful createIssue doesn't
+      // leave the item active (and cause a duplicate issue on the next cycle).
+      try {
+        await resolveAgendaItem(env.db, item.id, 'done');
+      } catch (resolveErr) {
+        console.warn(`[dreaming:triage] Issue created but failed to resolve agenda #${item.id}:`, resolveErr instanceof Error ? resolveErr.message : String(resolveErr));
+      }
 
       const projectIdRow = await env.db.prepare(
         "SELECT received_at FROM web_events WHERE event_id = 'board_project_id'"
diff --git a/web/src/workers-ai-chat.ts b/web/src/workers-ai-chat.ts
index 4edca17..0da41fc 100755
--- a/web/src/workers-ai-chat.ts
+++ b/web/src/workers-ai-chat.ts
@@ -160,6 +160,15 @@ export function toOpenAiTools(anthropicTools: unknown[]): OpenAiFunctionTool[] {
 
 const GPT_OSS_RATES = { input: 0.35, output: 0.75 }; // $/MTok
 
+// Ai.run() overloads can't be unified when the model string is dynamic.
+// Cast to a loose signature once here; callers re-assert the return as AiChatResponse.
+function callAiRun(ai: Ai, model: string, input: unknown): Promise<unknown> {
+  return (ai.run as (m: Parameters<Ai['run']>[0], i: unknown) => Promise<unknown>)(
+    model as Parameters<Ai['run']>[0],
+    input,
+  );
+}
+
 // ─── Main executor ──────────────────────────────────────────
 
 const MAX_TOOL_ROUNDS = 10;
@@ -207,8 +216,8 @@ export async function executeWorkersAiChat(
 
   // Phase 1: Tool execution rounds (0 to TOOL_ROUNDS-1)
   for (let round = 0; round < TOOL_ROUNDS; round++) {
-    const result = await (config.ai.run as (m: Parameters<Ai['run']>[0], i: unknown) => Promise<unknown>)(
-      config.model as Parameters<Ai['run']>[0],
+    const result = await callAiRun(
+      config.ai, config.model,
       { messages, tools, max_tokens: 4096, temperature: 0.2, top_p: 0.9, frequency_penalty: 0.3 },
     ) as AiChatResponse;
 
@@ -296,8 +305,8 @@ export async function executeWorkersAiChat(
 
   let summaryText: string | undefined;
   try {
-    const summaryResult = await (config.ai.run as (m: Parameters<Ai['run']>[0], i: unknown) => Promise<unknown>)(
-      config.model as Parameters<Ai['run']>[0],
+    const summaryResult = await callAiRun(
+      config.ai, config.model,
       { messages: condensed, max_tokens: 4096, temperature: 0.2, top_p: 0.9, frequency_penalty: 0.3 },
     ) as AiChatResponse;
 
diff --git a/web/tests/memory.test.ts b/web/tests/memory.test.ts
index 678620e..ade31c5 100755
--- a/web/tests/memory.test.ts
+++ b/web/tests/memory.test.ts
@@ -1777,11 +1777,24 @@ describe('agenda.ts', () => {
       expect(db._queries[0].bindings[1]).toBe(42);
     });
 
+    it('guards against terminal-state transitions via AND status = active', async () => {
+      const db = createMockDb({ runMeta: [{ changes: 1 }] });
+      await resolveAgendaItem(db, 42, 'done');
+      expect(db._queries[0].sql).toContain("AND status = 'active'");
+    });
+
     it('accepts dismissed status', async () => {
       const db = createMockDb({ runMeta: [{ changes: 1 }] });
       await resolveAgendaItem(db, 42, 'dismissed');
       expect(db._queries[0].bindings[0]).toBe('dismissed');
     });
+
+    it('throws when item is not active or does not exist (changes === 0)', async () => {
+      const db = createMockDb({ runMeta: [{ changes: 0 }] });
+      await expect(resolveAgendaItem(db, 42, 'done')).rejects.toThrow(
+        "Agenda item 42 is not in 'active' state or does not exist",
+      );
+    });
   });
 
   // ─── getActiveAgendaItems ─────────────────────────────────

From d004881171628fe8154de1227e8a5f5d5ee7045b Mon Sep 17 00:00:00 2001
From: Aegis <Aegis@stackbilt.dev>
Date: Fri, 26 Jun 2026 04:45:17 -0500
Subject: [PATCH 13/13] fix(review): harden triage dedup guard and dispatch
 placeholder check

agenda-triage: inner catch now attempts dismiss as a fallback sentinel
when resolveAgendaItem('done') fails after a successful createIssue,
preventing the item from staying active and generating a duplicate
GitHub issue on the next cron cycle.

dispatch: hoist placeholder guard before the switch so any future named
case for a placeholder executor cannot silently bypass the check.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 web/src/kernel/dispatch.ts                         | 5 +++--
 web/src/kernel/scheduled/dreaming/agenda-triage.ts | 7 ++++++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/web/src/kernel/dispatch.ts b/web/src/kernel/dispatch.ts
index ee395f8..6042881 100755
--- a/web/src/kernel/dispatch.ts
+++ b/web/src/kernel/dispatch.ts
@@ -347,6 +347,9 @@ async function probeAndExecute(
       }
     } else {
       // Non-streaming or non-Claude executors
+      // Placeholder guard runs before the switch so named cases can't bypass it.
+      const route = getExecutorRoute(plan.executor as LLMExecutor);
+      if (route?.placeholder) throw new Error(`Executor '${plan.executor}' is a placeholder and cannot be dispatched`);
       switch (plan.executor) {
         case 'claude':
         case 'claude_opus': {
@@ -368,8 +371,6 @@ async function probeAndExecute(
           result = await executeTarotScript(intent, env);
           break;
         default: {
-          const route = getExecutorRoute(plan.executor as LLMExecutor);
-          if (route?.placeholder) throw new Error(`Executor '${plan.executor}' is a placeholder and cannot be dispatched`);
           const fn = EXECUTOR_FNS[plan.executor as Executor];
           if (!fn) throw new Error(`Unknown executor: ${plan.executor}`);
           result = await fn(intent, env);
diff --git a/web/src/kernel/scheduled/dreaming/agenda-triage.ts b/web/src/kernel/scheduled/dreaming/agenda-triage.ts
index a5b239f..8e41de4 100644
--- a/web/src/kernel/scheduled/dreaming/agenda-triage.ts
+++ b/web/src/kernel/scheduled/dreaming/agenda-triage.ts
@@ -98,7 +98,12 @@ export async function triageAgendaToIssues(env: EdgeEnv): Promise<number> {
       try {
         await resolveAgendaItem(env.db, item.id, 'done');
       } catch (resolveErr) {
-        console.warn(`[dreaming:triage] Issue created but failed to resolve agenda #${item.id}:`, resolveErr instanceof Error ? resolveErr.message : String(resolveErr));
+        console.error(`[dreaming:triage] Issue #${number} created but resolve failed for agenda #${item.id}; attempting dismiss to prevent duplicate:`, resolveErr instanceof Error ? resolveErr.message : String(resolveErr));
+        try {
+          await resolveAgendaItem(env.db, item.id, 'dismissed');
+        } catch {
+          console.error(`[dreaming:triage] Agenda #${item.id} could not be resolved or dismissed after issue creation — item will remain active and may generate a duplicate next cycle`);
+        }
       }
 
       const projectIdRow = await env.db.prepare(