feat: judgment posture, verified write windows, observer merge (0.0.44)

[okisdev]

summary

fusion's gates were enforcing two different kinds of rule at the same strength. whether a dispatched package was collected, verified and settled is mechanically checkable, so it stays hard. how wide the work should be and where the writing should happen depend on semantics a counter cannot see, and they were being coerced anyway. this release demotes that second half to advice and adds the telemetry to catch the next miscalibration.

the evidence, measured over the last 80 sessions rather than asserted:

• 651 assistant authored fleet-decline: justification lines against 40 actual /fusion:ultra convenings, a 16 to 1 override rate on a rule labelled a default
• 106 of 150 observed dispatch waves (71 percent) were width one, so the three package threshold describes a minority shape while taxing every turn
• a live catch: the guard hard denied a Write for a 60 line throwaway repro with "Dispatch an Agent or Task before another main-loop write", so the orchestrator dispatched Codex to author a file it deleted six minutes later. the inline relief only existed for zero dispatch sessions, which left a session with seventeen dispatches less latitude than one with none

what changed:

• a passing verification reopens the main loop write window, so demonstrating that inline work is sound buys the same latitude as handing it off. the recognizer covers the common test, lint, typecheck and check runners across node, python, rust, go, jvm, ruby, php and swift toolchains, and takes a project specific addition through FUSION_VERIFICATION_PATTERN. the reset touches write accounting only, so wave width and narrow wave telemetry stay honest
• the inline relief is measured per window instead of per session and no longer requires a session with zero dispatches
• the write deny states what is unverified instead of commanding a dispatch, and its lane hint names fusion:claude-worker instead of the fusion:fast-worker seat retired in 0.0.43
• the fleet stops being an ambient default. the prompt hook no longer injects a reminder into every turn and fires only once the guard has observed repeated width one waves, and narrow width owes no justification
• a posture dial makes the old floors an explicit opt in: /fusion:config set-posture <judgment|strict>, with FUSION_POSTURE overriding for one session. strict preserves the previous behavior byte for byte for long unattended runs
• the rules replace the micro step gate (one file, twenty lines, spent on first edit) with an inline work gate sized by coherence: one change that a single same turn verification command covers, reopening every time that verification passes. accumulation triggers narrow to unverified accumulation, a failed verification and a repeated symptom
• /fusion:stats gains a coercion ledger reporting fleet declines against fleet shaped waves, verification resets, unverified accumulations and the posture mix

two defects found along the way:

• the fusion:claude-worker agent frontmatter has not parsed since 0.0.43. its unquoted description carried claude-fallback: <reason>, which a yaml plain scalar cannot hold, so the whole block was dropped at load and the agent ran without its model pin, turn budget or disallowedTools: Agent restriction
• the grok token usage observer was registered as its own monitor but never emitted a line, so the slot only ever spoke to say it had stopped. it now runs as a library inside fusion's monitor process, isolated at the call site so it cannot skip a codex announcement or kill the interval

breaking changes

• the default posture is judgment, so the fleet reminder no longer fires on every prompt and a passing verification reopens the write window. /fusion:config set-posture strict restores the previous behavior
• the two fusion monitor slots collapse into one named engine-jobs, described as codex job completions and peer engine token observations
• GROK_JOBS_OBSERVER_INTERVAL_MS is retired with the observer daemon; the grok observation now follows CODEX_JOBS_MONITOR_INTERVAL_MS. GROK_JOBS_OBSERVER_UNAVAILABLE_TTL_MS is unchanged

test plan

already verified

• npm test -> 1056 tests, 1055 pass, 0 fail, 1 pre-existing skip
• claude plugin validate on plugins/codex, plugins/grok, plugins/fusion and the marketplace root -> all four pass, including the claude-worker frontmatter that failed before this branch
• node plugins/fusion/scripts/generate-rules-manifest.mjs -> manifest regenerated, 35 hashes
• the ps dependent codex monitor tests were rerun outside the peer sandbox -> 51/51 green

reviewer should verify

• refresh the installed plugin caches, restart the session, then run /fusion:smoke before real delegated work
• /fusion:config show reports posture judgment with source default; set-posture strict then set-posture judgment round trips and show --json carries both value and source
• make five main loop edits, run the repo's verification command, confirm a sixth edit is allowed, and confirm /fusion:stats shows the verification reset in the coercion ledger
• the session monitor list shows one engine-jobs entry rather than two grok entries, and a terminal grok job still lands in token-usage.jsonl and model-audit.jsonl

notes

• none of this takes effect in a running session until the installed marketplace caches refresh and the session restarts, since hooks and rules load from the cache rather than the repo
• the fleet half of the old directive survives where it was right: a goal that genuinely decomposes into three or more independently verifiable packages still fans out, usage volume still never shrinks a fleet the work calls for, and dispatching independent packages one per turn instead of together is still the defect worth catching