fix(qa): the receipt's cash-anchor obligation derives from the executed plan, and a fabricated decline fails (closes #677)

[atomchung]

Summary

A light-tier weekly_review's executed plan legitimately carries input.cash_anchor.status == "not_applicable" (reason light_tier), but ROUTE_CONTRACTS["weekly_review"]["cash_anchor"] demanded exactly one cash_anchor_checked event unconditionally, with no tier branch. The only way such a session could pass verify was a fabricated declined event asserting a question that was never asked — the exact dishonesty this tool exists to prevent (#230).

Per the maintainer disposition on #677:

• cash_anchor_checked is required only when the executed Review Plan says the route had a cash-anchor opportunity.
• input.cash_anchor.status == "not_applicable" means zero cash-anchor events is the honest trace.
• The verifier inspects the archived plan fact rather than applying one unconditional route-level boolean.
• A trace with not_applicable plus a provided/declined event is contradictory and must fail.

What changed

• skills/fomo-kernel/tools/ux_receipt.py: start gains an optional --cash-anchor-status (choices: anchored/partial/absent/not_applicable), transcribed from the plan's input.cash_anchor.status the same way route itself already is — a declared, archived fact on the trace, not something this tool re-derives. verify_rows reads it from the trace's own declaration row instead of branching on the route alone: not_applicable requires zero cash_anchor_checked events and fails closed, naming a contradiction, if one exists anyway. Omitting the flag preserves the original unconditional reading (exactly one event required), so every receipt written before this field existed still verifies unchanged. A new CASH_ANCHOR_STATUSES constant mirrors the engine's real enum, and the value is validated unconditionally (like every other declared enum) so a hand-built or hand-edited trace with a garbage value fails the same way an unsupported route does.
• skills/fomo-kernel/references/ux-receipt.md: documents the new flag on start, expands the cash-anchor section to state the full obligation model (structural False on snapshot_review/test_drive vs. the new per-trace narrowing on first_review/weekly_review), and updates the verify summary paragraph accordingly.
• tests/test_interaction_trajectory.py: adds a light_tier_weekly_rows() fixture and eight new tests (see Proofs below), inserted alongside the existing "Cash anchor ([feat·design] Pre-review data-sanity check: confirm cash anchor (and flag known-incomplete data) before the motive questions #357)" test section.

Scope is deliberately narrow: verifier/receipt semantics only. No change to engine/review.py's _cash_anchor_status, card rendering, or any runtime/product behavior — a light-tier weekly review still asks nothing and shows nothing different than before. references/data-contract.md, references/interaction-delivery.md, and docs/qa-runbook.md gate 3 were all checked against the mirrored-surfaces row and found already accurate for this fact (see report in the issue thread / session notes); none needed edits.

Proofs (from the disposition)

1. A complete synthetic light-tier weekly_review trace verifies with no cash event — test_light_tier_weekly_review_verifies_with_no_cash_event, exercising the exact shape the issue reproduced with (opener, question, both card stages, rule choice, findings, owner verdict) under --require-owner-verdict --require-findings. A companion test (test_first_review_with_declared_not_applicable_status_also_verifies_with_no_cash_event) confirms the mechanism isn't special-cased to one route.
2. A non-light plan that owed the check still fails when the event is absent — test_non_light_plan_still_requires_the_cash_anchor_event_when_absent, declaring anchored/partial/absent and confirming the original "exactly one" requirement is untouched.
3. A light plan carrying a fabricated decline fails, contradiction named — test_light_tier_weekly_review_with_fabricated_decline_fails.
4. Mutation proof (cp backup/restore, __pycache__ cleared, mutated tree import-checked before each run):
   • Restoring the unconditional route-level requirement (deleting the not_applicable branch entirely) reddens 3 tests, including proof 1's own test:

     errors returned by verify_rows under MUTATION 1:
      - weekly_review must record exactly one cash_anchor_checked event
     

   • Dropping only the contradiction check (keeping the zero-events branch as a no-op pass) reddens exactly proof 3's test, with zero collateral:

     1 of 137 tests failed under MUTATION 2:
      - test_light_tier_weekly_review_with_fabricated_decline_fails :: []
     

     (verify_rows returns [] for the fabricated-decline trace — it would have verified.)
5. Full offline suite green: PASS: all 49 suites passed. (python3 tests/run_all.py), both before and after a clean rebase onto latest origin/main.

Test plan

• python3 tests/run_all.py — 49/49 suites pass
• python3 tests/test_interaction_trajectory.py — 137/137 tests pass (130 pre-existing + 7 new)
• python3 qa/tests/test_skill_commands.py — 16/16 pass (doc/CLI drift checks, including the replay of every documented ux_receipt.py command)
• Mutation 1 (restore unconditional requirement) reddens proof 1's test
• Mutation 2 (drop contradiction check) reddens proof 3's test, nothing else
• Re-verified issue [defect] A light-tier weekly_review cannot produce a receipt that is both honest and verifiable — the plan says the cash anchor is not applicable, the route contract demands one anyway #677 open and no competing PR immediately before pushing

🤖 Generated with Claude Code