feat(upstream): qualify reverified Fara and Evidence Bench native packets

data/contribution-workspaces/fork-bootstrap-proposal.json

@@ -3,7 +3,7 @@
   "state": "READ_ONLY_PROPOSAL_NOT_APPROVED",
   "destination_org": "opensiro-contributions",
   "source_registry": "data/contribution-workspaces/registry.json",
-  "source_registry_sha256": "ff91c1b0b961f134021291b89cdd0e6a52b4d57dcb26f4238edd9fc0a68dfca1",
+  "source_registry_sha256": "786365a1d9c8c9f611bb7c6c188393fac9ad91b9d3bcf952839e4b917e9e5708",
   "priority_snapshot": "data/fork-priorities/2026-11-08.json",
   "batch_size_max": 10,
   "counts": {
@@ -35,7 +35,7 @@
     {
       "id": "bootstrap-001",
       "state": "UNAPPROVED_REQUIRES_TRUSTED_PREFLIGHT",
-      "selection_sha256": "c9f7a324b1bf54053fff2a85963862b3b271e80ae6a7dee27b56b422d5e62069",
+      "selection_sha256": "1ff7ff9df10dfba2d8664a7c7cfe5ee5f7e2a33d6579b5f7f4f1b9553b732a2b",
       "source_count": 10,
       "has_collision_name_proposals": true,
       "selection": [
@@ -84,7 +84,7 @@
     {
       "id": "bootstrap-002",
       "state": "UNAPPROVED_REQUIRES_TRUSTED_PREFLIGHT",
-      "selection_sha256": "2e84240f54b1c9c949ba9f542c2e0a2b70a6856c3139f9343d67f05b2c030895",
+      "selection_sha256": "d120d63b36c045c2e5136936e22d2c634fd478ffdada5ed42d25e452d94c5fa7",
       "source_count": 10,
       "has_collision_name_proposals": true,
       "selection": [
@@ -133,7 +133,7 @@
     {
       "id": "bootstrap-003",
       "state": "UNAPPROVED_REQUIRES_TRUSTED_PREFLIGHT",
-      "selection_sha256": "a04cac89bc8c64c17a4ea003675c5052f187c71cdb5643f576013791c5532914",
+      "selection_sha256": "0daa4109db827bdd0aae2ab36de11858a980e5fc74aed4fe8d13783ab4eeebc6",
       "source_count": 10,
       "has_collision_name_proposals": false,
       "selection": [
@@ -182,7 +182,7 @@
     {
       "id": "bootstrap-004",
       "state": "UNAPPROVED_REQUIRES_TRUSTED_PREFLIGHT",
-      "selection_sha256": "adbd52fa31afa99bca06a97b0750d98ceaf0d7f3ea49d91cf767dbb109297e79",
+      "selection_sha256": "be2872a7c6931128c32590871ab30a00df3ca666e84a4f5f4b1a3ed66261a930",
       "source_count": 10,
       "has_collision_name_proposals": false,
       "selection": [
@@ -231,7 +231,7 @@
     {
       "id": "bootstrap-005",
       "state": "UNAPPROVED_REQUIRES_TRUSTED_PREFLIGHT",
-      "selection_sha256": "90186c90f9cc1dc8f60b0428602467eca49ecd043393272ea18f28023fa4b2a4",
+      "selection_sha256": "9cd1e015ff69b171b640e7a2a41caa3efbe2802c89d87e4d51104b8268a28597",
       "source_count": 10,
       "has_collision_name_proposals": false,
       "selection": [
@@ -280,7 +280,7 @@
     {
       "id": "bootstrap-006",
       "state": "UNAPPROVED_REQUIRES_TRUSTED_PREFLIGHT",
-      "selection_sha256": "bdd6ae6343113d2112f4bea753a773c5a3d2b01020bf07cdcce2c9f375b655d9",
+      "selection_sha256": "daf9573ca5d4d8c43029a68f781d3e52c1e8fb7db5ff3441fc52a5479e0e5d07",
       "source_count": 10,
       "has_collision_name_proposals": false,
       "selection": [
@@ -329,7 +329,7 @@
     {
       "id": "bootstrap-007",
       "state": "UNAPPROVED_REQUIRES_TRUSTED_PREFLIGHT",
-      "selection_sha256": "af52919731a2dded222a46a731c9ac74accf138da405f2ff826dd5501edc5ed9",
+      "selection_sha256": "b1b38584d19cd520e968ff7937607dc181e42cb4834cf642e57bc8660aa175b3",
       "source_count": 10,
       "has_collision_name_proposals": true,
       "selection": [
@@ -378,7 +378,7 @@
     {
       "id": "bootstrap-008",
       "state": "UNAPPROVED_REQUIRES_TRUSTED_PREFLIGHT",
-      "selection_sha256": "64f26d69de687ea36621b891fa54cda59bdb6bb56347b9ce53f6267ad15c9f91",
+      "selection_sha256": "46433d517ac4b085b724c7bc41d76632f3fd9a0817be12a03c43b1b099756130",
       "source_count": 10,
       "has_collision_name_proposals": false,
       "selection": [
@@ -427,7 +427,7 @@
     {
       "id": "bootstrap-009",
       "state": "UNAPPROVED_REQUIRES_TRUSTED_PREFLIGHT",
-      "selection_sha256": "27f7c59ce3225681c1bf4603101d166296fab6afbe47f6975376269d81ea1576",
+      "selection_sha256": "3a82a3e157d94befe2b47f1464dd770c268b710670c9306bfe0f6202d6b37f2c",
       "source_count": 1,
       "has_collision_name_proposals": false,
       "selection": [

data/contribution-workspaces/registry.json

@@ -17,10 +17,10 @@
     "dated_fork_readbacks": 17,
     "same_named_ref_matches_at_readback": 10,
     "technical_packet_states": {
-      "EXPLICIT_PATCH_HASH_MATCHED": 16,
+      "EXPLICIT_PATCH_HASH_MATCHED": 18,
       "LOCAL_MULTI_PATCH_SELECTION_REQUIRED": 1,
       "LOCAL_SINGLE_PATCH_UNREVIEWED": 33,
-      "NO_LOCAL_PACKET_OR_PR_ONLY_HANDOFF": 4
+      "NO_LOCAL_PACKET_OR_PR_ONLY_HANDOFF": 2
     }
   },
   "execution": {
@@ -2377,13 +2377,16 @@
           "stage": "AWAITING_EXTERNAL",
           "origin": "ASSESSMENT_DERIVED",
           "handoff_url": "https://github.com/opensiro/upstream/pull/120",
-          "patch_path": null,
-          "patch_sha256": null,
+          "patch_path": "pilots/evidence-bench/retrieval-error-admission.patch",
+          "patch_sha256": "0974cdefa228cfdf37e1b750144e01c269c8f2dee6d9aa8ea01e86dd79b23646",
           "test_patch_path": null,
           "technical_packet": {
-            "state": "NO_LOCAL_PACKET_OR_PR_ONLY_HANDOFF",
+            "state": "EXPLICIT_PATCH_HASH_MATCHED",
             "pilot": null,
-            "explicit_patch": null,
+            "explicit_patch": {
+              "path": "pilots/evidence-bench/retrieval-error-admission.patch",
+              "sha256": "0974cdefa228cfdf37e1b750144e01c269c8f2dee6d9aa8ea01e86dd79b23646"
+            },
             "explicit_test_patch": null
           }
         }
@@ -2870,13 +2873,16 @@
           "stage": "AWAITING_EXTERNAL",
           "origin": "ASSESSMENT_DERIVED",
           "handoff_url": "https://github.com/opensiro/upstream/pull/121",
-          "patch_path": null,
-          "patch_sha256": null,
+          "patch_path": "pilots/fara/resume-task-identity.patch",
+          "patch_sha256": "fce42386bd6b1cf1ea0fed6c22a206589239cdeeb37f53cfaa48eb027da9002e",
           "test_patch_path": null,
           "technical_packet": {
-            "state": "NO_LOCAL_PACKET_OR_PR_ONLY_HANDOFF",
+            "state": "EXPLICIT_PATCH_HASH_MATCHED",
             "pilot": null,
-            "explicit_patch": null,
+            "explicit_patch": {
+              "path": "pilots/fara/resume-task-identity.patch",
+              "sha256": "fce42386bd6b1cf1ea0fed6c22a206589239cdeeb37f53cfaa48eb027da9002e"
+            },
             "explicit_test_patch": null
           }
         }

data/contribution-workspaces/selected-packets.json

@@ -0,0 +1,21 @@
+{
+  "schema_version": 1,
+  "selections": [
+    {
+      "source": "kstawiski/evidence-gated-scientific-agent",
+      "candidate_id": "evidence-bench-native-evidence-admission",
+      "source_sha": "85b396a824dfad6ec0880cbe07d86d3e24920ae8",
+      "patch_path": "pilots/evidence-bench/retrieval-error-admission.patch",
+      "patch_sha256": "0974cdefa228cfdf37e1b750144e01c269c8f2dee6d9aa8ea01e86dd79b23646",
+      "receipt": "reports/2026-11-12-native-packet-requalification-wave-01.md"
+    },
+    {
+      "source": "microsoft/fara",
+      "candidate_id": "fara-native-checkpoint-integrity",
+      "source_sha": "a675d6d61c41c47ae87bacefeab22caad18e3e84",
+      "patch_path": "pilots/fara/resume-task-identity.patch",
+      "patch_sha256": "fce42386bd6b1cf1ea0fed6c22a206589239cdeeb37f53cfaa48eb027da9002e",
+      "receipt": "reports/2026-11-12-native-packet-requalification-wave-01.md"
+    }
+  ]
+}

docs/CONTINUOUS_WORKING_FORK_PIPELINE.md

@@ -54,6 +54,18 @@ dated mapping remains `DATED_MAPPING_REQUIRES_LIVE_READBACK`, requires a
 fresh provider preflight before writes, and does not attest that a branch
 contains a tested contribution.
 
+## Additive selection of historical native packets
+
+For a historically frozen screening handoff with an exact native fix held only
+in a prior source-only draft, revalidate the original and record the selected
+source identity, assessed SHA, patch path/hash, and dated RED/GREEN receipt in
+data/contribution-workspaces/selected-packets.json. Never rewrite a frozen
+screening manifest. Regenerate the source/workspace registry and check integrity.
+
+This promotes only the technical-packet state to EXPLICIT_PATCH_HASH_MATCHED.
+It does not grant GitHub write permission, prove full source-native tests,
+waive a first-party legal gate, or demonstrate maintainer adoption.
+
 ## Single-cycle state and authority
 
 1. **Intake:** reserve one source identity (`owner/repo`); resolve it against

pilots/CATALOG.md

@@ -7,7 +7,7 @@ fitness, fork existence, PR publication, maintainer acceptance, or VSM grades.
 See [experiment contract](EXPERIMENT_CONTRACT.md) and
 [working-fork pipeline](../docs/CONTINUOUS_WORKING_FORK_PIPELINE.md).
 
-**Coverage:** 73 indexed pilot directories · 242 files. The frozen baseline protects 66 historical directories and their files; 7 directories were added later.
+**Coverage:** 75 indexed pilot directories · 244 files. The frozen baseline protects 66 historical directories and their files; 9 directories were added later.
 
 Each row links its preferred entry file. Read the actual receipt and governing
 batch/PR before attributing positive results or current status.
@@ -78,6 +78,13 @@ batch/PR before attributing positive results or current status.
 | `workflow-one` | [Open](workflow-one/CONTRIBUTION_HANDOFF.md) | patch: 1, handoff: 1 |
 | `yoagent-file-alias-s2` | [Open](yoagent-file-alias-s2/CONTRIBUTION_HANDOFF.md) | patch: 3, handoff: 1, receipt: 2, other: 1 |
 
+## Patches with other technical evidence (2)
+
+| Pilot | Entry point | Artifacts |
+| --- | --- | --- |
+| `evidence-bench` | [Open](evidence-bench/retrieval-error-admission.patch) | patch: 1 |
+| `fara` | [Open](fara/resume-task-identity.patch) | patch: 1 |
+
 ## Screened or blocked hypotheses without a patch (16)
 
 | Pilot | Entry point | Artifacts |

pilots/catalog.json

@@ -4,14 +4,14 @@
   "meaning": "FILE_INVENTORY_ONLY_NO_SUCCESS_OR_EXTERNAL_PUBLICATION_CLAIM",
   "generated_from": "pilots/ direct subdirectories and their preserved files",
   "counts": {
-    "pilot_directories": 73,
-    "artifact_files": 242,
+    "pilot_directories": 75,
+    "artifact_files": 244,
     "historical_directories": 66,
-    "new_directories": 7,
+    "new_directories": 9,
     "by_kind": {
       "EXPERIMENT_SERIES": 4,
       "PATCH_HANDOFF": 52,
-      "PATCH_EVIDENCE": 0,
+      "PATCH_EVIDENCE": 2,
       "SCREEN_ONLY": 16,
       "OTHER_EVIDENCE": 1
     }
@@ -343,6 +343,18 @@
         "candidate-episode-snapshot.patch"
       ]
     },
+    {
+      "id": "evidence-bench",
+      "path": "pilots/evidence-bench",
+      "kind": "PATCH_EVIDENCE",
+      "start_here": "pilots/evidence-bench/retrieval-error-admission.patch",
+      "artifact_counts": {
+        "patch": 1
+      },
+      "files": [
+        "retrieval-error-admission.patch"
+      ]
+    },
     {
       "id": "evidenceloom",
       "path": "pilots/evidenceloom",
@@ -357,6 +369,18 @@
         "unicode-spaced-numeric-scale.patch"
       ]
     },
+    {
+      "id": "fara",
+      "path": "pilots/fara",
+      "kind": "PATCH_EVIDENCE",
+      "start_here": "pilots/fara/resume-task-identity.patch",
+      "artifact_counts": {
+        "patch": 1
+      },
+      "files": [
+        "resume-task-identity.patch"
+      ]
+    },
     {
       "id": "forgedock",
       "path": "pilots/forgedock",

pilots/evidence-bench/retrieval-error-admission.patch

@@ -0,0 +1,82 @@
+diff --git a/scientific_agent/policy.py b/scientific_agent/policy.py
+index a6a57d0..d21cdbf 100644
+--- a/scientific_agent/policy.py
++++ b/scientific_agent/policy.py
+@@ -373,13 +373,13 @@ class ToolPolicy:
+             self.chrome_ready = True
+         encoded = json.dumps(result, sort_keys=True, default=str).encode("utf-8")
+         reported_error = result.get("error") if isinstance(result, dict) else None
+-        if (
+-            not reported_error
+-            and isinstance(result, dict)
+-            and result.get("status")
+-            in {"failed", "timed_out", "cancelled", "policy_denied"}
+-        ):
+-            reported_error = str(result["status"]).upper()
++        if not reported_error and isinstance(result, dict):
++            status = result.get("status")
++            if isinstance(status, str) and status.strip().lower() in {
++                "error", "failed", "failure", "timed_out", "timeout",
++                "cancelled", "canceled", "policy_denied",
++            }:
++                reported_error = status.strip().upper()
+         if not reported_error and len(encoded) > MAX_RESULT_ARTIFACT_BYTES:
+             reported_error = "RESULT_TOO_LARGE"
+         artifact_error: str | None = None
+diff --git a/tests/test_policy.py b/tests/test_policy.py
+index f4178b4..c86b023 100644
+--- a/tests/test_policy.py
++++ b/tests/test_policy.py
+@@ -229,3 +229,52 @@ def test_cumulative_model_observation_budget_compacts_later_results(
+     assert second["result_compacted"] is True
+     assert "result_preview" not in second
+     assert Path(second["full_result_artifact"]).is_file()
++
++def test_error_status_does_not_create_retrieval_evidence(tmp_path):
++    gate = policy(tmp_path, preserve_evidence=True)
++
++    class Tool:
++        name = "query-docs"
++
++    # Error status without a separate "error" property previously counted as
++    # a successful retrieval and donated the URL in the failure message.
++    result = gate.after_tool(
++        tool=Tool(),
++        args={"query": "citation"},
++        tool_context=None,
++        tool_response={
++            "status": "error",
++            "message": "Fetch failed: https://1.1.1.1/research-paper",
++        },
++    )
++    assert result is None
++    evidence = gate.retrieval_evidence()
++    assert evidence.successful_calls == 0
++    assert evidence.urls == []
++    assert evidence.tools == []
++    assert evidence.artifacts == []
++    ledger_events = [
++        json.loads(line)
++        for line in (tmp_path / "events.jsonl").read_text().splitlines()
++    ]
++    assert ledger_events[-1]["reported_error"] == "ERROR"
++
++
++def test_success_status_still_records_retrieval(tmp_path):
++    gate = policy(tmp_path, preserve_evidence=True)
++
++    class Tool:
++        name = "query-docs"
++
++    gate.after_tool(
++        tool=Tool(),
++        args={"query": "valid"},
++        tool_context=None,
++        tool_response={
++            "status": "success",
++            "content": "Supported: https://1.1.1.1/research-paper",
++        },
++    )
++    evidence = gate.retrieval_evidence()
++    assert evidence.successful_calls == 1
++    assert evidence.urls == ["https://1.1.1.1/research-paper"]