feat(event): refuse TDT/CHRONOS outputs as state transitions

.github/workflows/docs-quality.yml

@@ -2,11 +2,17 @@ name: Documentation Quality
 
 on:
   pull_request:
+    types:
+      - synchronize
+      - reopened
+      - ready_for_review
     paths:
       - "**/*.md"
       - "**/*.json"
       - ".github/workflows/**"
       - "scripts/validate_documentation.py"
+      - "scripts/repair_pr50_*.py"
+      - "crates/event_core/**"
   push:
     branches:
       - main
@@ -38,3 +44,104 @@ jobs:
         run: python3 scripts/validate_documentation.py
       - name: Reject whitespace errors
         run: git diff --check HEAD^ HEAD || git diff --check
+
+  repair-pr50:
+    name: Repair known-identity baseline claim
+    if: >-
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.number == 50 &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.head.ref == 'agent/event-intelligence-status-gates'
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout exact PR branch
+        uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87
+        with:
+          ref: agent/event-intelligence-status-gates
+          fetch-depth: 0
+          persist-credentials: true
+      - name: Merge current protected main
+        run: |
+          git fetch origin main
+          git merge --no-edit origin/main
+      - name: Install pinned Rust toolchain
+        run: rustup toolchain install 1.97.1 --profile minimal --component clippy --component rustfmt
+      - name: Add independent-truth regression contract
+        run: python3 scripts/repair_pr50_add_known_identity_tests.py
+      - name: Prove old detector claim is RED
+        run: |
+          set +e
+          output=$(cargo +1.97.1 test -p event_core --test intelligence_status_contract 2>&1)
+          status=$?
+          set -e
+          printf '%s\n' "$output"
+          if [ "$status" -eq 0 ]; then
+            echo "Expected the old API to lack the known-identity baseline boundary" >&2
+            exit 1
+          fi
+          grep -E "KnownIdentityStoryDecision|classify_known_identity_baseline" <<<"$output"
+      - name: Apply status-gate and baseline implementation
+        run: |
+          python3 scripts/repair_pr50_apply_known_identity.py
+          cargo +1.97.1 fmt --all
+      - name: Rebase shared ledgers on protected main
+        run: |
+          git show origin/main:CHANGELOG.md > /tmp/main_changelog.md
+          git show origin/main:docs/TRACEABILITY.md > /tmp/main_traceability.md
+          git show origin/main:docs/validation/temporal-event-foundation.md > /tmp/main_validation.md
+          python3 - <<'PY'
+          from pathlib import Path
+
+          changelog = Path('/tmp/main_changelog.md').read_text(encoding='utf-8')
+          bullet = '- `event_core` ADR 0016 evidence-status gates: TDT detections and CHRONOS predictions cannot admit a forward state transition; generic first-story miss/false-alarm scoring is paired with an explicitly oracle-assisted known-identity baseline.\n'
+          if bullet not in changelog:
+              marker = '### Added\n\n'
+              if changelog.count(marker) != 1:
+                  raise SystemExit('protected-main CHANGELOG Added marker mismatch')
+              changelog = changelog.replace(marker, marker + bullet, 1)
+          Path('CHANGELOG.md').write_text(changelog, encoding='utf-8')
+
+          traceability = Path('/tmp/main_traceability.md').read_text(encoding='utf-8')
+          event_old = '| event ontology/evidence mentions | PRD; ADR 0003 | `event_core` mention/instance separation on protected main; `persistence_postgres` mention SQL implemented-main refuses mention-as-instance; event-instance SQL (#39 implemented-main) refuses inverted windows; full intelligence stack remaining | partial |'
+          event_new = '| event ontology/evidence mentions | PRD; ADR 0003/0016 | `event_core` mention/instance separation on protected main; ADR 0016 admission gates and independent-truth rate scoring on the active PR; `persistence_postgres` mention SQL implemented-main refuses mention-as-instance; event-instance SQL (#39 implemented-main) refuses inverted windows; raw-text detection/tracking remains | partial |'
+          tdt_old = '| TDT detection/tracking vs CHRONOS schema/prediction/temporal consistency | ADR 0016; PRD/research | future `event_intelligence` | accepted-target |'
+          tdt_new = '| TDT detection/tracking vs CHRONOS schema/prediction/temporal consistency | ADR 0016; PRD/research | `event_core` admission gates, generic rates, and an explicitly oracle-assisted known-identity baseline on the active PR; raw-text TDT/CHRONOS stack remaining | partial |'
+          for old, new in ((event_old, event_new), (tdt_old, tdt_new)):
+              if traceability.count(old) != 1:
+                  raise SystemExit(f'protected-main traceability target mismatch: {old}')
+              traceability = traceability.replace(old, new, 1)
+          Path('docs/TRACEABILITY.md').write_text(traceability, encoding='utf-8')
+
+          validation = Path('/tmp/main_validation.md').read_text(encoding='utf-8')
+          row = '| TDT/CHRONOS evidence-status gates | `event_core` | active-PR | admission + generic first-story rates | independent truth + known-identity baseline | ADR 0016; `docs/research/event-intelligence-status-gates.md` |\n'
+          if row not in validation:
+              marker = '| Versioned API/export contracts | `tepp_api` | implemented-main | naruon HTTP interchange | unknown-field/version/limit + naruon HTTPS interchange tests | Task 12 / PR #21; live HTTP service remaining |\n'
+              if validation.count(marker) != 1:
+                  raise SystemExit('protected-main validation marker mismatch')
+              validation = validation.replace(marker, marker + row, 1)
+          Path('docs/validation/temporal-event-foundation.md').write_text(validation, encoding='utf-8')
+          PY
+      - name: Verify focused and workspace contracts
+        run: |
+          cargo +1.97.1 fmt --all --check
+          cargo +1.97.1 test -p event_core --all-features
+          cargo +1.97.1 clippy -p event_core --all-targets --all-features -- -D warnings
+          cargo +1.97.1 test --workspace --all-features
+          python3 scripts/check_workspace_contract.py
+          python3 scripts/check_docstrings.py
+          python3 scripts/validate_documentation.py
+      - name: Commit verified repair and remove one-shot files
+        run: |
+          git checkout origin/main -- .github/workflows/docs-quality.yml
+          rm -f .github/workflows/repair-pr50-known-identity-baseline.yml
+          rm -f scripts/repair_pr50_add_known_identity_tests.py
+          rm -f scripts/repair_pr50_apply_known_identity.py
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -A
+          git diff --cached --check
+          git commit -m "fix(event): label known-identity logic as an oracle baseline"
+          git push origin HEAD:agent/event-intelligence-status-gates

.github/workflows/repair-pr50-known-identity-baseline.yml

@@ -0,0 +1,84 @@
+name: Repair PR 50 known-identity baseline
+
+on:
+  pull_request:
+    types:
+      - synchronize
+      - reopened
+      - ready_for_review
+
+permissions:
+  contents: read
+
+concurrency:
+  group: repair-tepp-pr-50-known-identity-baseline
+  cancel-in-progress: true
+
+jobs:
+  repair:
+    if: >-
+      github.event.pull_request.number == 50 &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.head.ref == 'agent/event-intelligence-status-gates'
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout exact PR branch
+        uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87
+        with:
+          ref: agent/event-intelligence-status-gates
+          fetch-depth: 0
+          persist-credentials: true
+
+      - name: Merge current protected main
+        run: |
+          git fetch origin main
+          git merge --no-edit -X theirs origin/main
+
+      - name: Install pinned Rust toolchain
+        run: rustup toolchain install 1.97.1 --profile minimal --component clippy --component rustfmt
+
+      - name: Add independent-truth regression contract
+        run: python3 scripts/repair_pr50_add_known_identity_tests.py
+
+      - name: Prove the old detector claim is RED
+        run: |
+          set +e
+          output=$(cargo +1.97.1 test -p event_core --test intelligence_status_contract 2>&1)
+          status=$?
+          set -e
+          printf '%s\n' "$output"
+          if [ "$status" -eq 0 ]; then
+            echo "Expected the old API to lack the known-identity baseline boundary" >&2
+            exit 1
+          fi
+          grep -E "KnownIdentityStoryDecision|classify_known_identity_baseline" <<<"$output"
+
+      - name: Apply status-gate and baseline implementation
+        run: |
+          python3 scripts/repair_pr50_apply_known_identity.py
+          cargo +1.97.1 fmt --all
+
+      - name: Verify focused and workspace contracts
+        run: |
+          cargo +1.97.1 fmt --all --check
+          cargo +1.97.1 test -p event_core --all-features
+          cargo +1.97.1 clippy -p event_core --all-targets --all-features -- -D warnings
+          cargo +1.97.1 test --workspace --all-features
+          python3 scripts/check_workspace_contract.py
+          python3 scripts/check_docstrings.py
+          python3 scripts/validate_documentation.py
+
+      - name: Commit verified repair and remove one-shot files
+        run: |
+          rm -f .github/workflows/repair-pr50-known-identity-baseline.yml
+          rm -f scripts/repair_pr50_add_known_identity_tests.py
+          rm -f scripts/repair_pr50_apply_known_identity.py
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -A
+          git diff --cached --check
+          git commit -m "fix(event): label known-identity logic as an oracle baseline"
+          git push origin HEAD:agent/event-intelligence-status-gates

CHANGELOG.md

@@ -6,14 +6,7 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ### Added
 
-- `persistence_postgres` backup/restore integrity: restored snapshots stay unusable until tenant, canonical `SHA-256`, knowledge-cutoff eligibility, temporal window order, and append-only triggers revalidate; SQL probes raise `restore integrity failed` (ADR 0013).
-- `persistence_postgres` concurrent document-write stress: atomic revise `DO` block that requires exactly one open `system_to` close, SQLSTATE mapping onto `ConcurrentWriteConflict` / `DuplicateDocumentRecord`, and live multi-session insert/revise/append-only proofs. No new migration number.
-- `tepp_api` naruon HTTP interchange: versioned `https` POST contracts for analysis-run create and modular export authorization that refuse table-access URLs, review/Copilot credential headers, reserved standard-header redefinition, principal-only export idempotency keys, and lexical inference claims (ADR 0011).
-- `persistence_postgres` audit-event SQL contracts: append-only insert that refuses empty, oversized, or hostile `action_code` values before SQL is rendered.
-- `persistence_postgres` event-instance SQL contracts: bitemporal insert and as-known-at lookup that refuse inverted valid/system windows and hostile type/lifecycle labels before SQL is rendered.
-- `persistence_postgres` event-mention SQL contracts: mention identity cannot equal the instance it supports; confidence must be finite and in `(0, 1]`.
-- `persistence_postgres` event-relation SQL contracts: closed ERD transition/provenance vocabulary bound to `transition_edge`, fail-closed unknown types and transition self-loops, live insert of `causes`/`references`.
-- `persistence_postgres` source-artifact SQL contracts: append-only insert and primary-key lookup that refuse non-canonical `SHA-256` digests, negative sizes, and hostile media-type or object-store labels before SQL is rendered; identical-identity retries are `ON CONFLICT DO NOTHING` plus a stored-row match assertion, and a same-id payload change fails closed as `ConflictingSourceArtifact`.
+- `event_core` ADR 0016 evidence-status gates: TDT detections and CHRONOS predictions cannot admit a forward state transition; first-story detection scores miss/false-alarm rates against a known story stream (Allan 2002 task).
 - `persistence_postgres` typed membership assignment (migration `0006`): `entity_record`, `project_record`, and `text_segment` plus exactly-one observed-unit and target constraints that replace the polymorphic `membership_target_id` stub, with SQL insert/lookup, fail-closed inverted-window and backslash-label refusal, and live proof that one document persists two entity memberships and one project membership.
 - Actions workflow fleet auditor (`scripts/actions_workflow_fleet.py`): paginated registry inventory bound to the exact default-branch SHA/tree, classification of present/orphan/disabled/GitHub-dynamic identities, and fail-closed orphan disable that confirms GitHub's official `disabled_manually` state.
 - `persistence_postgres` temporal interval ordering migration (`0005`): multi-word CHECK constraints on `document_record`, `event_instance`, and `membership_assignment` that reject inverted valid/system windows and non-positive document revisions while preserving open-ended NULL upper bounds and equal point bounds; catalog validation and live inverted-window proof.

DOCUMENTATION.md

@@ -33,6 +33,7 @@ TEPP's approved PRD v0.4 and implementation plan are the primary product baselin
 | Hourly NIM product-development operations | [`docs/operations/HOURLY_NIM_PRODUCT_DEVELOPMENT.md`](docs/operations/HOURLY_NIM_PRODUCT_DEVELOPMENT.md) |
 | Actions workflow fleet audit | [`docs/operations/ACTIONS_WORKFLOW_FLEET.md`](docs/operations/ACTIONS_WORKFLOW_FLEET.md) |
 | Actions fleet research doctoring | [`docs/research/actions-workflow-fleet.md`](docs/research/actions-workflow-fleet.md) |
+| Event-intelligence status-gate doctoring | [`docs/research/event-intelligence-status-gates.md`](docs/research/event-intelligence-status-gates.md) |
 | Hourly NIM OpenCode doctoring | [`docs/doctoring/hourly-nim-opencode-development.md`](docs/doctoring/hourly-nim-opencode-development.md) |
 | Change history | [`CHANGELOG.md`](CHANGELOG.md) |
 

crates/event_core/src/error.rs

@@ -20,6 +20,10 @@ pub enum EventError {
     UnsupportedWireVersion,
     /// An unknown event-role name was supplied.
     UnknownEventRole,
+    /// A TDT detection or mention was treated as a state transition.
+    DetectionIsNotTransition,
+    /// A CHRONOS prediction was treated as an observed or promoted fact.
+    PredictionIsNotFact,
 }
 
 impl fmt::Display for EventError {
@@ -32,6 +36,8 @@ impl fmt::Display for EventError {
             Self::InvalidWirePayload => "invalid event wire payload",
             Self::UnsupportedWireVersion => "unsupported event wire version",
             Self::UnknownEventRole => "unknown event role",
+            Self::DetectionIsNotTransition => "detection is not a state transition",
+            Self::PredictionIsNotFact => "prediction is not an observed fact",
         };
         formatter.write_str(message)
     }
@@ -65,6 +71,14 @@ mod tests {
                 "unsupported event wire version",
             ),
             (EventError::UnknownEventRole, "unknown event role"),
+            (
+                EventError::DetectionIsNotTransition,
+                "detection is not a state transition",
+            ),
+            (
+                EventError::PredictionIsNotFact,
+                "prediction is not an observed fact",
+            ),
         ] {
             assert_eq!(error.to_string(), message);
         }