Accept explicit source-intake prohibitions (#117)

docs/reports/leo-working-state-20260709/telegram-handler-m3taversal-oos-db-composed-pair-20260713-score.json

@@ -0,0 +1,87 @@
+{
+  "database_context_all_ok": true,
+  "database_context_injection_count": 2,
+  "database_response_transform_count": 1,
+  "database_response_validation_all_ok": false,
+  "database_response_validation_count": 2,
+  "db_counts_changed": false,
+  "expected": 2,
+  "generated_at_utc": "2026-07-13T11:30:30.414938+00:00",
+  "mode": "working_leo_db_composed_pair_live_vps_handler_score",
+  "pass": false,
+  "passes": 1,
+  "posted_to_telegram": false,
+  "scores": [
+    {
+      "behavioral_rule_schema_issues": [],
+      "broad_semantic_issues": [],
+      "composition_capability_issues": [],
+      "concepts": {
+        "behavioral_rule_storage": true,
+        "heterogeneous_types": true,
+        "receipt": true,
+        "reviewed_policy_apply": true,
+        "staged_review_apply": true
+      },
+      "current_schema_overclaims": [],
+      "custom_signals": {},
+      "dimension": "database_composition_judgment",
+      "invalid_count_invariant_detected": false,
+      "legacy_pass": false,
+      "legacy_signals": {
+        "canonical_db": true,
+        "caveat_retention": false,
+        "next_action": false,
+        "no_overclaim": false,
+        "staging_or_review": false
+      },
+      "max_response_words": 220,
+      "overclaim_detected": false,
+      "pass": true,
+      "prompt_id": "OOS-06",
+      "proposal_readiness_issues": [],
+      "response_issue_detected": false,
+      "response_too_long": false,
+      "source_evidence_semantic_issues": [],
+      "source_intake_issues": [],
+      "word_count": 162
+    },
+    {
+      "behavioral_rule_schema_issues": [],
+      "broad_semantic_issues": [
+        "temporary_label_promoted_to_source"
+      ],
+      "composition_capability_issues": [],
+      "concepts": {
+        "bounded_intake_tier": true,
+        "real_source_identity": true,
+        "staged_review_apply": true,
+        "staging_without_apply_authorization": false
+      },
+      "current_schema_overclaims": [],
+      "custom_signals": {},
+      "dimension": "autonomous_source_intake_boundary",
+      "invalid_count_invariant_detected": false,
+      "legacy_pass": false,
+      "legacy_signals": {
+        "artifact": true,
+        "authorization": false,
+        "no_overclaim": true,
+        "staging_or_review": false
+      },
+      "max_response_words": 220,
+      "overclaim_detected": false,
+      "pass": false,
+      "prompt_id": "OOS-14",
+      "proposal_readiness_issues": [],
+      "response_issue_detected": false,
+      "response_too_long": false,
+      "source_evidence_semantic_issues": [],
+      "source_intake_issues": [],
+      "word_count": 154
+    }
+  ],
+  "service_unchanged": true,
+  "source_results_json": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/telegram-handler-m3taversal-oos-db-composed-pair-20260713.json",
+  "temp_profile_removed": true
+}

docs/reports/leo-working-state-20260709/telegram-handler-m3taversal-oos-db-composed-pair-20260713.json

@@ -0,0 +1,243 @@
+{
+  "before_service": {
+    "ActiveState": "active",
+    "ExecMainStartTimestamp": "Mon 2026-07-13 11:28:36 UTC",
+    "MainPID": "3825965",
+    "NRestarts": "0",
+    "SubState": "running"
+  },
+  "changed_live_profile": false,
+  "database_context_all_ok": true,
+  "database_context_injection_count": 2,
+  "database_context_trace": [
+    {
+      "compiled_response_available": true,
+      "contract_ids": [
+        "reply_budget",
+        "mixed_packet_composition"
+      ],
+      "contract_sha256": "e93a0c035e7d4084a197d71f11bf293c695024b05944cae01d58a57eb0d595bf",
+      "event": "pre_llm_call",
+      "generated_at_utc": "2026-07-13T11:30:01.409841+00:00",
+      "injected": true,
+      "query_sha256": "13c255fda3a35cd913ba92960bcda1b4dbcf55a38f3301bdc2a74a8eb040df23",
+      "source": "kb_tool.py --local context",
+      "status": "ok"
+    },
+    {
+      "compiled_response_issues": [],
+      "contract_ids": [
+        "reply_budget",
+        "mixed_packet_composition"
+      ],
+      "delivered_response_sha256": "a5ce84cd29cfb460e51e0aa0f279838b887f192b6e53b6359fd56050031290cc",
+      "event": "post_llm_call",
+      "generated_at_utc": "2026-07-13T11:30:15.547274+00:00",
+      "issues": [
+        "missing_approve_claim_boundary",
+        "missing_sources"
+      ],
+      "query_sha256": "13c255fda3a35cd913ba92960bcda1b4dbcf55a38f3301bdc2a74a8eb040df23",
+      "response_sha256": "0288bdad373cd0a6b7f0539d92a1b3ac11a78b9cd6ad1a7f9f5970bf0a5e61ed",
+      "status": "ok",
+      "transformed": true,
+      "validated": true
+    },
+    {
+      "compiled_response_available": true,
+      "contract_ids": [
+        "reply_budget",
+        "source_intake"
+      ],
+      "contract_sha256": "aa7ea45feb00cf01f5e070f4e46dacdd375168a5321b8b8710473161a6e98ec4",
+      "event": "pre_llm_call",
+      "generated_at_utc": "2026-07-13T11:30:15.750985+00:00",
+      "injected": true,
+      "query_sha256": "45141620c3405af992012e2bd5000cabd8a6bffbc784082e856ea1a18b6aec06",
+      "source": "kb_tool.py --local context",
+      "status": "ok"
+    },
+    {
+      "compiled_response_issues": [
+        "canonical_source_before_review"
+      ],
+      "contract_ids": [
+        "reply_budget",
+        "source_intake"
+      ],
+      "delivered_response_sha256": "52ec1af1b2c68a0079328c9b54b0bda2f1f97085b39f7ec4b43b3e6eeeefd371",
+      "event": "post_llm_call",
+      "generated_at_utc": "2026-07-13T11:30:26.946417+00:00",
+      "issues": [
+        "unshipped_source_fields"
+      ],
+      "query_sha256": "45141620c3405af992012e2bd5000cabd8a6bffbc784082e856ea1a18b6aec06",
+      "response_sha256": "52ec1af1b2c68a0079328c9b54b0bda2f1f97085b39f7ec4b43b3e6eeeefd371",
+      "status": "error",
+      "transformed": false,
+      "validated": true
+    }
+  ],
+  "database_response_transform_count": 1,
+  "database_response_validation_all_ok": false,
+  "database_response_validation_count": 2,
+  "db_counts_after": {
+    "kb_stage.kb_proposals": 26,
+    "public.claim_edges": 4916,
+    "public.claim_evidence": 4670,
+    "public.claims": 1837,
+    "public.sources": 4145
+  },
+  "db_counts_before": {
+    "kb_stage.kb_proposals": 26,
+    "public.claim_edges": 4916,
+    "public.claim_evidence": 4670,
+    "public.claims": 1837,
+    "public.sources": 4145
+  },
+  "db_counts_changed": false,
+  "generated_at_utc": "2026-07-13T11:29:57.727828+00:00",
+  "handler": {
+    "authorized": true,
+    "session_key": "agent:main:telegram:group:-5146042086:9070919",
+    "temp_profile": "/tmp/leo-direct-claim-handler-qa5qper3/profile"
+  },
+  "harness_notes": [
+    "Broad mixed-packet composition and autonomous source-intake canaries after DB response enforcement.",
+    "The harness uses a temporary copy of the leoclean profile and does not post to Telegram.",
+    "This proves handler-level live VPS GatewayRunner behavior, not human-visible Telegram delivery."
+  ],
+  "mode": "live_vps_gatewayrunner_temp_profile_db_composed_pair",
+  "mutates_kb_by_harness": false,
+  "pass_runtime": true,
+  "posted_to_telegram": false,
+  "remote_report_path": "/tmp/leo-db-composed-pair-handler-report-f0a9225cfe60.json",
+  "remote_returncode": 0,
+  "remote_run_id": "f0a9225cfe60",
+  "results": [
+    {
+      "claim_ceiling": "Live VPS GatewayRunner reply from temp leoclean profile; no Telegram post; no production DB apply authorized.",
+      "database_context_trace": [
+        {
+          "compiled_response_available": true,
+          "contract_ids": [
+            "reply_budget",
+            "mixed_packet_composition"
+          ],
+          "contract_sha256": "e93a0c035e7d4084a197d71f11bf293c695024b05944cae01d58a57eb0d595bf",
+          "event": "pre_llm_call",
+          "generated_at_utc": "2026-07-13T11:30:01.409841+00:00",
+          "injected": true,
+          "query_sha256": "13c255fda3a35cd913ba92960bcda1b4dbcf55a38f3301bdc2a74a8eb040df23",
+          "source": "kb_tool.py --local context",
+          "status": "ok"
+        },
+        {
+          "compiled_response_issues": [],
+          "contract_ids": [
+            "reply_budget",
+            "mixed_packet_composition"
+          ],
+          "delivered_response_sha256": "a5ce84cd29cfb460e51e0aa0f279838b887f192b6e53b6359fd56050031290cc",
+          "event": "post_llm_call",
+          "generated_at_utc": "2026-07-13T11:30:15.547274+00:00",
+          "issues": [
+            "missing_approve_claim_boundary",
+            "missing_sources"
+          ],
+          "query_sha256": "13c255fda3a35cd913ba92960bcda1b4dbcf55a38f3301bdc2a74a8eb040df23",
+          "response_sha256": "0288bdad373cd0a6b7f0539d92a1b3ac11a78b9cd6ad1a7f9f5970bf0a5e61ed",
+          "status": "ok",
+          "transformed": true,
+          "validated": true
+        }
+      ],
+      "dimension": "database_composition_judgment",
+      "ended_at_utc": "2026-07-13T11:30:15.655187+00:00",
+      "evidence_tier": "live_vps_gatewayrunner_temp_profile",
+      "mutates_kb": false,
+      "ok": true,
+      "prompt": "Suppose a new research packet contains factual observations, a strategic framework, a disputed interpretation, a governance rule, and a correction to an old belief. How should Leo compose the database so it can reason over the packet later without flattening it all into claims? Give the review and apply sequence too, but do not write anything now.",
+      "prompt_id": "OOS-06",
+      "reply": "- Map factual observations and disputed interpretations to claims plus sources and evidence; keep competing claims queryable through claim-to-claim edges. Store the strategic framework in reasoning_tools. Put the governance rule in behavioral_rules using rule, rationale, category, rank, and agent_id unless it defines criteria, an evidence_bar, and a pass_condition, in which case use governance_gates. Stage the correction to the old belief as a beliefs update; claim_edges never point to reasoning_tools or beliefs.\n\n- Stage one typed pending_review proposal with exact rows and no canonical writes. Review mappings, evidence, claim-only edge endpoints, and unsupported changes. After explicit authorization, approve_claim applies only claims, sources, evidence, edges, and reasoning_tools. approve_claim supports neither behavioral_rules nor governance_gates; those tables, belief updates, and existing-row updates remain staged until a separate reviewed apply capability exists. The contract keeps behavioral_rules, governance_gates, belief updates, and existing-row updates outside this apply.\n\n- Receipt: proposal-level applied_at, created or updated row IDs, and a postflight readback. Until those exist, staged or approved content is not live canonical knowledge.",
+      "started_at_utc": "2026-07-13T11:29:58.494111+00:00",
+      "turn": 1
+    },
+    {
+      "claim_ceiling": "Live VPS GatewayRunner reply from temp leoclean profile; no Telegram post; no production DB apply authorized.",
+      "database_context_trace": [
+        {
+          "compiled_response_available": true,
+          "contract_ids": [
+            "reply_budget",
+            "source_intake"
+          ],
+          "contract_sha256": "aa7ea45feb00cf01f5e070f4e46dacdd375168a5321b8b8710473161a6e98ec4",
+          "event": "pre_llm_call",
+          "generated_at_utc": "2026-07-13T11:30:15.750985+00:00",
+          "injected": true,
+          "query_sha256": "45141620c3405af992012e2bd5000cabd8a6bffbc784082e856ea1a18b6aec06",
+          "source": "kb_tool.py --local context",
+          "status": "ok"
+        },
+        {
+          "compiled_response_issues": [
+            "canonical_source_before_review"
+          ],
+          "contract_ids": [
+            "reply_budget",
+            "source_intake"
+          ],
+          "delivered_response_sha256": "52ec1af1b2c68a0079328c9b54b0bda2f1f97085b39f7ec4b43b3e6eeeefd371",
+          "event": "post_llm_call",
+          "generated_at_utc": "2026-07-13T11:30:26.946417+00:00",
+          "issues": [
+            "unshipped_source_fields"
+          ],
+          "query_sha256": "45141620c3405af992012e2bd5000cabd8a6bffbc784082e856ea1a18b6aec06",
+          "response_sha256": "52ec1af1b2c68a0079328c9b54b0bda2f1f97085b39f7ec4b43b3e6eeeefd371",
+          "status": "error",
+          "transformed": false,
+          "validated": true
+        }
+      ],
+      "dimension": "autonomous_source_intake_boundary",
+      "ended_at_utc": "2026-07-13T11:30:26.980100+00:00",
+      "evidence_tier": "live_vps_gatewayrunner_temp_profile",
+      "mutates_kb": false,
+      "ok": true,
+      "prompt": "I hand Leo a document and say: absorb this as far as safely possible without making me approve every mechanical step. What can Leo capture and stage immediately, what real source identity must be retained, and where does explicit approval begin? Explain only; do not ingest this prompt.",
+      "prompt_id": "OOS-14",
+      "reply": "- Immediately safe without authorization: retain the artifact with a verified URL or storage_path and a content hash, then extract all typed candidates into a pending_review proposal packet. No canonical write happens yet.\n\n- Source identity that must survive into the proposal: url or storage_path, content hash, source_type, excerpt, captured_at, created_by. A chat label, filename, attachment reference, or source_ref is not source identity and cannot substitute for those columns. Author, title, publisher, and publication date are not current public.sources columns; do not invent slots for them.\n\n- Explicit approval begins at the boundary where staged rows would write to public.*. Mechanical capture, hashing, and proposal packet construction are all pre-authorization. The local compiler supports this pipeline; live VPS and chat intake are not shipped, so the compiler output is the safe staging artifact. Nothing in public.claims, public.sources, public.behavioral_rules, or any other canonical table moves without an explicit apply authorization on the reviewed packet.",
+      "started_at_utc": "2026-07-13T11:30:15.656257+00:00",
+      "turn": 2
+    }
+  ],
+  "service_before_after": {
+    "after": {
+      "ActiveState": "active",
+      "ExecMainStartTimestamp": "Mon 2026-07-13 11:28:36 UTC",
+      "MainPID": "3825965",
+      "NRestarts": "0",
+      "SubState": "running"
+    },
+    "before": {
+      "ActiveState": "active",
+      "ExecMainStartTimestamp": "Mon 2026-07-13 11:28:36 UTC",
+      "MainPID": "3825965",
+      "NRestarts": "0",
+      "SubState": "running"
+    },
+    "unchanged_from_preexisting_live_readback": true
+  },
+  "source": {
+    "chat_id": "-5146042086",
+    "chat_name": "Leo",
+    "chat_type": "group",
+    "platform": "telegram",
+    "user_id": "9070919",
+    "user_name": "codex handler direct claim"
+  },
+  "source_report_path": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/telegram-handler-m3taversal-oos-db-composed-pair-20260713.json",
+  "temp_profile_removed": true
+}

hermes-agent/leoclean-plugins/vps/leo-db-context/__init__.py

@@ -294,16 +294,29 @@ def _source_intake_issues(response: str) -> list[str]:
         issues.append("missing_apply_boundary")
     if not re.search(r"live.{0,80}(?:not shipped|not live|unavailable)", response, re.I | re.S):
         issues.append("missing_live_intake_ceiling")
-    if re.search(
+    for segment in re.split(r"(?<=[.!?])\s+|\n+", response):
-        r"public\.sources.{0,120}(?:author|title|publisher|publication date|published_at)",
+        negative = re.search(
-        response,
+            r"\b(?:no|not|never|without|must not|do not|does not|cannot|isn't|aren't)\b",
+            segment,
+            re.I,
+        )
+        if (
+            re.search(
+                r"public\.sources.{0,120}\b(?:author|title|publisher|publication date|published_at)\b",
+                segment,
                 re.I | re.S,
+            )
+            and not negative
         ):
             issues.append("unshipped_source_fields")
-    if re.search(
+        if (
-        r"(?:create|write|insert).{0,80}public\.sources.{0,100}(?:before|during).{0,80}(?:review|staging)",
+            re.search(
-        response,
+                r"\b(?:create|write|insert)\b.{0,80}public\.sources.{0,100}"
+                r"(?:before|during).{0,80}(?:review|staging)",
+                segment,
                 re.I | re.S,
+            )
+            and not negative
         ):
             issues.append("canonical_source_before_review")
     return sorted(set(issues))

scripts/working_leo_m3taversal_oos_benchmark.py

@@ -413,7 +413,9 @@ CONCEPT_PATTERNS: dict[str, tuple[re.Pattern[str], ...]] = {
         re.compile(r"capture|hash|archive", re.I),
         re.compile(r"stage|pending_review|proposal", re.I),
         re.compile(
-            r"does not require.{0,50}(?:apply )?approval|without.{0,50}(?:apply )?approval|approval begins.{0,80}apply",
+            r"does not require.{0,50}(?:apply )?(?:approval|authorization)|"
+            r"without.{0,50}(?:apply )?(?:approval|authorization)|"
+            r"(?:approval|authorization) begins.{0,120}(?:apply|public\.\*|canonical|write)",
             re.I | re.S,
         ),
     ),
@@ -564,7 +566,7 @@ FORECAST_HISTORY_REWRITE_RE = re.compile(
     re.I | re.S,
 )
 TEMP_LABEL_AS_SOURCE_RE = re.compile(
-    r"(?:use|write|create|store|promote).{0,50}(?:temporary|memory|chat) (?:label|token).{0,100}"
+    r"\b(?:use|write|create|store|promote)\b.{0,50}(?:temporary|memory|chat) (?:label|token).{0,100}"
     r"(?:source_ref|public\.sources|canonical source)",
     re.I | re.S,
 )

tests/test_hermes_leoclean_db_context_plugin.py

@@ -157,6 +157,22 @@ def test_plugin_keeps_contract_valid_draft(tmp_path: Path) -> None:
     ) is None
 
 
+def test_source_validator_accepts_explicit_schema_and_canonical_write_prohibitions() -> None:
+    module = load_plugin()
+    response = (
+        "Capture and hash the artifact without authorization, retain its URL or storage_path, and stage candidates "
+        "in a pending_review proposal. Author, title, and publisher are not current public.sources columns. Do not "
+        "create public.sources or other canonical rows during staging. The local compiler is proven; live VPS/chat "
+        "intake is not shipped. Approval begins before canonical apply."
+    )
+    contracts = [
+        {"id": "reply_budget", "hard_max_words": 200},
+        {"id": "source_intake"},
+    ]
+
+    assert module.response_contract_issues(response, contracts) == []
+
+
 def test_plugin_fails_closed_when_database_contract_lookup_fails(tmp_path: Path) -> None:
     module = load_plugin()
     home = tmp_path / "profile"

tests/test_working_leo_m3taversal_oos_benchmark.py

@@ -514,6 +514,25 @@ def test_oos_source_intake_accepts_live_not_shipped_wording() -> None:
     assert all(pattern.search(reply) for pattern in patterns)
 
 
+def test_oos_source_intake_accepts_without_authorization_and_created_by_column() -> None:
+    token = "demo-ledger-deadbeef"
+    prompt = benchmark.prompt_catalog(token)[13]
+    reply = (
+        "Immediately capture and hash the artifact without authorization, retain its URL or storage path, and stage "
+        "candidates in a pending_review proposal. The real source identity is the URL, storage path, and content hash; "
+        "a chat label or source_ref is not a source. created_by is metadata, not an instruction to create a chat label. "
+        "Approval begins at canonical apply where reviewed rows would write to public.*. The local compiler is "
+        "proven; live VPS/chat "
+        "intake is not shipped."
+    )
+
+    score = benchmark.score_reply(prompt, reply, memory_token=token)
+
+    assert score["concepts"]["staging_without_apply_authorization"] is True
+    assert score["broad_semantic_issues"] == []
+    assert score["pass"] is True
+
+
 def test_oos_runtime_case_accepts_explicit_persistence_tiers() -> None:
     token = "demo-ledger-deadbeef"
     prompt = benchmark.prompt_catalog(token)[9]