(the `scv` kind), `OpenAgents.RuntimeConfig`, and

`test/openagents/scv/deployments_test.exs`.

### OUTCOME-001 — An agent-authored claim is accepted only against the accepted-outcome contract

Status: Current

When an agent claims that work is complete, the claim counts as an accepted

outcome only when every part the contract names holds; anything less is a

typed non-accepted result, and human-only work stays outside the gate

entirely.

- **The issue is the canonical record, and it must be scoped.** A claim

  anchors to an issue that states its problem, scope, acceptance criteria,

  and success metrics. A claim against an issue missing any of those sections

  is `incomplete`, never accepted.

- **The attempt is bound, not implied.** Each execution attempt records the

  issue number, repository, authority, budget, and exact revision it

  produced. An attempt bound to a different issue or repository, an

  unadmitted verifier, or a violated producer-verifier separation policy is

  `unauthorized`.

- **Green must have been able to be red.** The claim records an admitted

  verifier, a falsifier, and a terminal result. A failed terminal result is

  `failed`, and a result carrying any of the five named false-green classes

  — `false_green_fixture_assert`, `false_green_api_mirror`,

  `false_green_mocked_seam`, `false_green_coverage_theater`,

  `false_green_round_up` — is `failed` even when the verifier reported green.

- **Every criterion names its evidence.** An accepted outcome explains which

  receipt satisfied each acceptance criterion, so the issue page can show the

  mapping; a criterion with no evidence makes the claim `incomplete`.

- **The public projection is content-free about private material.** A

  projection of an evaluation carries the result state, typed reasons,

  criterion names, and public receipt references only — never prompts, logs,

  private repository names, or private receipt references.

- **Human-only work is not gated.** Work by a human actor and repositories

  with agents disabled evaluate to `not_applicable` and remain fully usable.

The committed contract is `priv/api-contracts/accepted-outcome-v1.json`, and

`OpenAgents.AcceptedOutcome.validate/1` refuses a contract whose required

sections, attempt fields, false-green classes, or result states drift from

the code that enforces them.

Evidence: `OpenAgents.AcceptedOutcome`,

`priv/api-contracts/accepted-outcome-v1.json`,

`docs/accepted-outcome-contract.md`, and

`test/openagents/accepted_outcome_test.exs`.

## Interface and release

### VOICE-001 — Spoken identity is admitted before media

| WORK-001 | `test/openagents/work_job_test.exs`, `test/openagents/deep_work_tool_loop_test.exs` |

| SELF-EDIT-001 | `test/openagents/tools/repository_mutation_tools_test.exs`, `test/openagents/coding_job_test.exs` |

| SCV-001 | `test/openagents/scv/deployments_test.exs` |

| OUTCOME-001 | `test/openagents/accepted_outcome_test.exs` |

| VOICE-001 | `test/openagents/voice/config_test.exs` |

| VOICE-002 | `test/openagents_web/controllers/voice_call_controller_test.exs` |

| VOICE-003 | `test/openagents/voice_test.exs`, `test/openagents/voice_sessions_test.exs` |

## Issue template for this program

Every implementation issue should contain these sections:

Every implementation issue must contain the four sections the

accepted-outcome contract requires — problem, scope, acceptance criteria, and

success metrics — plus the supporting sections below. See

`accepted-outcome-contract.md` for how these sections gate agent-authored

completion claims.

```md

## Outcome

## Problem

Describe what a person or agent can do after this ships.

Describe the measured behavior that motivates the work and link to code,

tests, screenshots, or logs.

## Current behavior

## Scope

Describe the measured behavior and link to code, tests, screenshots, or logs.

State what this issue changes and what it leaves alone. Name the outcome a

person or agent can reach after this ships.

## Contract

- Include public and private repository behavior where relevant.

- Include unauthorized behavior and error results.

## Success metrics

State how you can measure that the outcome holds after it ships.

## Verification

List focused tests, `mix precommit`, CLI checks, browser checks, migration

## Definition of done

Agent-authored work uses the accepted-outcome contract in

`accepted-outcome-contract.md` as its definition of done: a completion claim

counts only when the scoped issue, bound attempt, admitted verifier,

recorded falsifier, terminal result, and per-criterion evidence all hold.

Contribution and review apply that same definition.

An issue is done only when all applicable conditions hold:

- The outcome and authority behavior have focused tests.

# Accepted-outcome contract

This document defines when work that an agent claims is complete counts as an

accepted outcome. It is the shared definition of done for contribution and

review, and it is falsifiable: every part of a claim can be checked, and a

claim that cannot be checked is not accepted.

The published contract lives at `priv/api-contracts/accepted-outcome-v1.json`.

`OpenAgents.AcceptedOutcome` evaluates claims against it, and

`test/openagents/accepted_outcome_test.exs` proves the accepted, failed,

incomplete, unauthorized, and private-evidence cases. The issue stays the

canonical work record; the contract only grades claims about it.

## The parts of a claim

An accepted outcome connects five things. Remove any one of them and the

claim is not accepted.

1. **A scoped issue.** The implementation issue states the requested outcome

   in four required sections: problem, scope, acceptance criteria, and

   success metrics. An issue without them cannot anchor an accepted outcome.

2. **A bound attempt.** Each execution attempt records the issue number, the

   repository, the authority it acted under, its budget, and the exact

   revision it produced. An attempt bound to a different issue or repository

   is unauthorized.

3. **Independent verification.** Evidence counts only when the verifier is

   admitted. When policy requires producer-verifier separation, the verifier

   must also be independent of the producer.

4. **A falsifier and a terminal result.** The claim records what observation

   would have proven it wrong and whether the verifier passed or failed, so

   every green result could have been red.

5. **Inspectable evidence.** Each acceptance criterion names the receipt that

   satisfied it, and the issue page can explain which evidence satisfied

   which criterion.

## Typed non-accepted results

A claim that falls short produces a typed result, never silence:

- `incomplete` — the claim is structurally short: a missing issue section, a

  missing attempt field, a missing verifier, falsifier, or terminal result,

  or an acceptance criterion with no evidence.

- `unauthorized` — the attempt is not bound to the issue and repository it

  changed, the verifier is not admitted, or required producer-verifier

  separation does not hold.

- `failed` — the verifier reported failure, or a false-green class is

  recorded against the result.

## False-green classes

Review and receipt data name five failure modes in which a green result does

not prove the outcome:

- `false_green_fixture_assert` — the test asserts on its own fixture rather

  than the behavior.

- `false_green_api_mirror` — the test restates the implementation instead of

  observing an outcome.

- `false_green_mocked_seam` — the mocked boundary is the behavior under test.

- `false_green_coverage_theater` — coverage numbers stand in for assertions.

- `false_green_round_up` — a partial result is reported as complete.

A result that names any of these classes is `failed` even when the verifier

reported green.

## Visibility

Public projections of an evaluation carry only the result state, typed

reasons, criterion names, and receipt references that are public. They never

carry prompts, logs, private repository names, or private receipt references.

A criterion satisfied by private evidence appears publicly as satisfied by

private evidence, without the reference.

## Human-only work

The contract gates only agent-authored claims. Human-only work and

repositories with agents disabled evaluate to `not_applicable` and remain

fully usable; nothing about the issue workflow changes for them.

## Definition of done for agent work

An agent-authored change is done when its claim evaluates to `accepted`:

- The issue is scoped with problem, scope, acceptance criteria, and success

  metrics.

- The attempt binds the issue, repository, authority, budget, and exact

  revision.

- An admitted verifier — independent when policy requires separation —

  recorded a falsifier and passed.

- Every acceptance criterion names its inspectable receipt.

- No false-green class is recorded against the result.

Contribution and review use this same definition. Reviewers grade claims, not

prose: a report that sounds complete but fails a check above is a typed

non-accepted result, and the review states which one.

## Related records

- Issue-to-job and receipt linkage: `docs/2026-08-21-issues-projects-work-system-assessment.md`, Track E.

- Source episodes: `docs/episode-triage.md`, episodes 237, 251, 252, 259, and 264.

- Invariant: `INVARIANTS.md`, OUTCOME-001.

defmodule OpenAgents.AcceptedOutcome do

  @moduledoc """

  Evaluates agent-authored completion claims against the accepted-outcome

  contract (`priv/api-contracts/accepted-outcome-v1.json`).

  The contract connects the requested outcome (a scoped issue), execution

  authority (a bound attempt), the exact change (a revision), independent

  verification (an admitted verifier with a recorded falsifier), and terminal

  evidence (per-criterion receipts). The issue stays the canonical work

  record; this module only grades a claim about it.

  A claim that cannot satisfy the contract produces a typed non-accepted

  result — `:incomplete`, `:unauthorized`, or `:failed` — with the exact

  reasons, so every green result could have been red. Human-only work and

  repositories with agents disabled are outside the contract and return

  `:not_applicable`.

  """

  @contract_path "priv/api-contracts/accepted-outcome-v1.json"

  @required_issue_sections ~w(problem scope acceptance_criteria success_metrics)a

  @required_attempt_fields ~w(issue_number repository authority budget revision)a

  @terminal_results ~w(passed failed)a

  @false_green_classes ~w(

    false_green_fixture_assert

    false_green_api_mirror

    false_green_mocked_seam

    false_green_coverage_theater

    false_green_round_up

  )

  @non_accepted_types ~w(incomplete unauthorized failed)a

  @exemptions ~w(human_only_work agents_disabled_repository)a

  @doc "The decoded and validated public contract."

  def load do

    with {:ok, bytes} <- File.read(contract_file()),

         {:ok, contract} <- Jason.decode(bytes),

         :ok <- validate(contract) do

      {:ok, contract}

    end

  end

  @doc "The issue-template sections a scoped implementation issue must carry."

  def required_issue_sections, do: @required_issue_sections

  @doc "The fields that bind one execution attempt to its authorized change."

  def required_attempt_fields, do: @required_attempt_fields

  @doc "The five named false-green classes from episode 252."

  def false_green_classes, do: @false_green_classes

  @doc "The typed non-accepted result types."

  def non_accepted_types, do: @non_accepted_types

  @doc "Validates the committed contract document."

  def validate(%{

        "contract" => "openagents.accepted-outcome.v1",

        "version" => 1,

        "issue_template" => %{"required_sections" => sections},

        "attempt_binding" => %{"required_fields" => fields},

        "verification" => %{"terminal_results" => terminal_results},

        "false_green_classes" => false_greens,

        "result_states" => %{

          "non_accepted" => non_accepted,

          "not_applicable" => not_applicable

        },

        "visibility" => %{"public_projection_excludes" => excludes}

      }) do

    committed = [

      {sections, Enum.map(@required_issue_sections, &Atom.to_string/1)},

      {fields, Enum.map(@required_attempt_fields, &Atom.to_string/1)},

      {terminal_results, Enum.map(@terminal_results, &Atom.to_string/1)},

      {false_greens, @false_green_classes},

      {non_accepted, Enum.map(@non_accepted_types, &Atom.to_string/1)},

      {not_applicable, Enum.map(@exemptions, &Atom.to_string/1)}

    ]

    if Enum.all?(committed, fn {document, code} -> document == code end) and

         is_list(excludes) and excludes != [] do

      :ok

    else

      {:error, :contract_divergence}

    end

  end

  def validate(_contract), do: {:error, :invalid_contract}

  @doc """

  Evaluates one completion claim.

  Returns one of:

    * `{:not_applicable, exemption}` — human-only work or a repository with

      agents disabled; the contract does not gate it.

    * `{:accepted, outcome}` — every acceptance criterion names its evidence,

      the attempt binds the exact revision, and an admitted verifier passed

      against a recorded falsifier. `outcome.criteria` explains which evidence

      satisfied each criterion.

    * `{:not_accepted, type, reasons}` — a typed refusal: `:incomplete` for a

      structurally incomplete claim, `:unauthorized` for a claim outside its

      granted authority or verifier admission, `:failed` for a failed verifier

      result or a named false-green class.

  """

  def evaluate(claim) when is_map(claim) do

    with :applicable <- applicability(claim),

         [] <- incomplete_reasons(claim),

         [] <- unauthorized_reasons(claim),

         [] <- failed_reasons(claim) do

      {:accepted, outcome(claim)}

    else

      {:not_applicable, exemption} -> {:not_applicable, exemption}

      [{type, _detail} | _rest] = reasons -> {:not_accepted, type, Keyword.values(reasons)}

    end

  end

  @doc """

  The bounded public projection of an evaluation result.

  The projection carries only result state, typed reasons, criterion names,

  and receipt references whose visibility is `:public`. It never carries

  prompts, logs, private repository names, or private receipt references, so

  a public issue page can explain the result without leaking evidence.

  """

  def public_projection({:not_applicable, exemption}) do

    %{state: :not_applicable, exemption: exemption}

  end

  def public_projection({:not_accepted, type, reasons}) do

    %{state: :not_accepted, type: type, reasons: reasons}

  end

  def public_projection({:accepted, outcome}) do

    %{

      state: :accepted,

      issue_number: outcome.issue_number,

      revision: outcome.revision,

      criteria:

        Enum.map(outcome.criteria, fn item ->

          case item.visibility do

            :public -> %{criterion: item.criterion, evidence: item.receipt}

            _restricted -> %{criterion: item.criterion, evidence: :private}

          end

        end)

    }

  end

  defp applicability(claim) do

    cond do

      claim[:actor] != :agent -> {:not_applicable, :human_only_work}

      claim[:agents_enabled] != true -> {:not_applicable, :agents_disabled_repository}

      true -> :applicable

    end

  end

  defp incomplete_reasons(claim) do

    issue = claim[:issue] || %{}

    attempt = claim[:attempt] || %{}

    verification = claim[:verification] || %{}

    missing_sections =

      for section <- @required_issue_sections,

          blank?(get_in(issue, [:sections, section])),

          do: {:incomplete, {:missing_issue_section, section}}

    missing_fields =

      for field <- @required_attempt_fields,

          blank?(attempt[field]),

          do: {:incomplete, {:missing_attempt_field, field}}

    missing_records =

      [

        {blank?(verification[:verifier]), :missing_verifier},

        {blank?(verification[:falsifier]), :missing_falsifier},

        {verification[:terminal_result] not in @terminal_results, :missing_terminal_result}

      ]

      |> Enum.filter(&elem(&1, 0))

      |> Enum.map(fn {_missing, reason} -> {:incomplete, reason} end)

    unevidenced =

      for criterion <- acceptance_criteria(issue),

          not Enum.any?(

            evidence(claim),

            &(&1[:criterion] == criterion and present?(&1[:receipt]))

          ),

          do: {:incomplete, {:unevidenced_criterion, criterion}}

    missing_sections ++ missing_fields ++ missing_records ++ unevidenced

  end

  defp unauthorized_reasons(claim) do

    issue = claim[:issue] || %{}

    attempt = claim[:attempt] || %{}

    verification = claim[:verification] || %{}

    verifier = verification[:verifier] || %{}

    [

      {attempt[:issue_number] != issue[:number] or attempt[:repository] != issue[:repository],

       :attempt_not_bound_to_issue},

      {verifier[:admitted] != true, :verifier_not_admitted},

      {verification[:separation_required] == true and

         verifier[:independent_of_producer] != true, :verifier_not_independent}

    ]

    |> Enum.filter(&elem(&1, 0))

    |> Enum.map(fn {_failed, reason} -> {:unauthorized, reason} end)

  end

  defp failed_reasons(claim) do

    verification = claim[:verification] || %{}

    named_classes = Enum.filter(List.wrap(verification[:false_green_classes]), &present?/1)

    [

      {verification[:terminal_result] == :failed, :verifier_failed},

      {named_classes != [], {:false_green, named_classes}}

    ]

    |> Enum.filter(&elem(&1, 0))

    |> Enum.map(fn {_failed, reason} -> {:failed, reason} end)

  end

  defp outcome(claim) do

    issue = claim[:issue]

    verification = claim[:verification]

    %{

      issue_number: issue[:number],

      repository: issue[:repository],

      revision: claim[:attempt][:revision],

      verifier: verification[:verifier][:id],

      falsifier: verification[:falsifier],

      criteria:

        for criterion <- acceptance_criteria(issue) do

          item = Enum.find(evidence(claim), &(&1[:criterion] == criterion))

          %{criterion: criterion, receipt: item[:receipt], visibility: item[:visibility]}

        end

    }

  end

  defp acceptance_criteria(issue), do: List.wrap(get_in(issue, [:sections, :acceptance_criteria]))

  defp evidence(claim), do: List.wrap(claim[:evidence])

  defp blank?(value), do: not present?(value)

  defp present?(value) when is_binary(value), do: String.trim(value) != ""

  defp present?(value) when is_map(value), do: map_size(value) > 0

  defp present?(value) when is_list(value), do: value != []

  defp present?(value), do: not is_nil(value)

  defp contract_file, do: Application.app_dir(:openagents, @contract_path)

end

{

  "contract": "openagents.accepted-outcome.v1",

  "version": 1,

  "published_at": "2026-08-23",

  "summary": "When an agent claims that work is complete, the claim counts as an accepted outcome only when a scoped issue, a bound execution attempt, an admitted verifier result, a recorded falsifier, and inspectable evidence all hold. Anything less produces a typed non-accepted result. The issue remains the canonical work record.",

  "issue_template": {

    "required_sections": [

      "problem",

      "scope",

      "acceptance_criteria",

      "success_metrics"

    ]

  },

  "attempt_binding": {

    "required_fields": [

      "issue_number",

      "repository",

      "authority",

      "budget",

      "revision"

    ]

  },

  "verification": {

    "required_records": [

      "verifier",

      "falsifier",

      "terminal_result"

    ],

    "terminal_results": [

      "passed",

      "failed"

    ],

    "verifier_admission": "Evidence counts only when the verifier is admitted.",

    "producer_verifier_separation": "When policy requires producer-verifier separation, the verifier must be independent of the producer."

  },

  "false_green_classes": [

    "false_green_fixture_assert",

    "false_green_api_mirror",

    "false_green_mocked_seam",

    "false_green_coverage_theater",

    "false_green_round_up"

  ],

  "result_states": {

    "accepted": "Every acceptance criterion names the evidence that satisfied it, the verifier passed against a recorded falsifier, and the attempt binds the exact revision.",

    "non_accepted": [

      "incomplete",

      "unauthorized",

      "failed"

    ],

    "not_applicable": [

      "human_only_work",

      "agents_disabled_repository"

    ]

  },

  "visibility": {

    "public_projection_excludes": [

      "prompts",

      "logs",

      "private_repositories",

      "private_receipts"

    ]

  }

}

defmodule OpenAgents.AcceptedOutcomeTest do

  use ExUnit.Case, async: true

  alias OpenAgents.AcceptedOutcome

  @criteria [

    "The command exits zero on the fixture repository.",

    "An unauthorized caller receives a typed refusal."

  ]

  defp claim(overrides \\ %{}) do

    Map.merge(

      %{

        actor: :agent,

        agents_enabled: true,

        issue: %{

          number: 66,

          repository: "OpenAgentsInc/openagents.com",

          sections: %{

            problem: "Agent reports can sound complete without proof.",

            scope: "Grade completion claims; keep the issue canonical.",

            acceptance_criteria: @criteria,

            success_metrics: ["Zero false-completion incidents."]

          }

        },

        attempt: %{

          issue_number: 66,

          repository: "OpenAgentsInc/openagents.com",

          authority: %{token_scope: "forge:write"},

          budget: %{tool_calls: 32},

          revision: "8c4f2b1a9d3e"

        },

        verification: %{

          verifier: %{id: "ci-gate", admitted: true, independent_of_producer: true},

          separation_required: true,

          falsifier: "The fixture run fails when the fix is reverted.",

          terminal_result: :passed,

          false_green_classes: []

        },

        evidence: [

          %{criterion: Enum.at(@criteria, 0), receipt: "receipt:gate:41", visibility: :public},

          %{criterion: Enum.at(@criteria, 1), receipt: "receipt:test:87", visibility: :private}

        ]

      },

      overrides

    )

  end

  test "the committed contract is valid and matches the code" do

    assert {:ok, contract} = AcceptedOutcome.load()

    assert contract["false_green_classes"] == AcceptedOutcome.false_green_classes()

    divergent = put_in(contract, ["result_states", "non_accepted"], ["failed"])

    assert {:error, :contract_divergence} = AcceptedOutcome.validate(divergent)

    assert {:error, :invalid_contract} = AcceptedOutcome.validate(%{"contract" => "other"})

  end

  test "a complete, bound, verified claim is accepted and explains each criterion" do

    assert {:accepted, outcome} = AcceptedOutcome.evaluate(claim())

    assert outcome.issue_number == 66

    assert outcome.revision == "8c4f2b1a9d3e"

    assert outcome.verifier == "ci-gate"

    assert outcome.falsifier =~ "reverted"

    assert Enum.map(outcome.criteria, & &1.criterion) == @criteria

    assert Enum.all?(outcome.criteria, &(&1.receipt != nil))

  end

  test "a failed verifier result produces a typed failed result" do

    failed = claim(%{verification: %{claim().verification | terminal_result: :failed}})

    assert {:not_accepted, :failed, [:verifier_failed]} = AcceptedOutcome.evaluate(failed)

  end

  test "a named false-green class fails even when the verifier reported green" do

    verification = %{claim().verification | false_green_classes: ["false_green_mocked_seam"]}

    assert {:not_accepted, :failed, [{:false_green, ["false_green_mocked_seam"]}]} =

             AcceptedOutcome.evaluate(claim(%{verification: verification}))

  end

  test "a structurally incomplete claim produces a typed incomplete result" do

    base = claim()

    unscoped =

      claim(%{issue: put_in(base.issue, [:sections, :success_metrics], [])})

    assert {:not_accepted, :incomplete, [{:missing_issue_section, :success_metrics}]} =

             AcceptedOutcome.evaluate(unscoped)

    no_revision = claim(%{attempt: %{base.attempt | revision: nil}})

    assert {:not_accepted, :incomplete, [{:missing_attempt_field, :revision}]} =

             AcceptedOutcome.evaluate(no_revision)

    no_falsifier = claim(%{verification: %{base.verification | falsifier: "  "}})

    assert {:not_accepted, :incomplete, [:missing_falsifier]} =

             AcceptedOutcome.evaluate(no_falsifier)

    unevidenced = claim(%{evidence: [hd(base.evidence)]})

    assert {:not_accepted, :incomplete, [{:unevidenced_criterion, criterion}]} =

             AcceptedOutcome.evaluate(unevidenced)

    assert criterion == Enum.at(@criteria, 1)

  end

  test "an unbound or unadmitted attempt produces a typed unauthorized result" do

    base = claim()

    unbound = claim(%{attempt: %{base.attempt | issue_number: 67}})

    assert {:not_accepted, :unauthorized, [:attempt_not_bound_to_issue]} =

             AcceptedOutcome.evaluate(unbound)

    verifier = %{base.verification.verifier | admitted: false}

    assert {:not_accepted, :unauthorized, [:verifier_not_admitted]} =

             AcceptedOutcome.evaluate(

               claim(%{verification: %{base.verification | verifier: verifier}})

             )

    dependent = %{base.verification.verifier | independent_of_producer: false}

    assert {:not_accepted, :unauthorized, [:verifier_not_independent]} =

             AcceptedOutcome.evaluate(

               claim(%{verification: %{base.verification | verifier: dependent}})

             )

  end

  test "producer-verifier separation is required only when policy requires it" do

    base = claim()

    dependent = %{base.verification.verifier | independent_of_producer: false}

    verification = %{base.verification | verifier: dependent, separation_required: false}

    assert {:accepted, _outcome} = AcceptedOutcome.evaluate(claim(%{verification: verification}))

  end

  test "the public projection never carries private evidence" do

    projection = AcceptedOutcome.public_projection(AcceptedOutcome.evaluate(claim()))

    assert projection.state == :accepted

    assert [

             %{evidence: "receipt:gate:41"},

             %{evidence: :private}

           ] = projection.criteria

    refute inspect(projection) =~ "receipt:test:87"

    refusal =

      AcceptedOutcome.evaluate(

        claim(%{verification: %{claim().verification | terminal_result: :failed}})

      )

    assert %{state: :not_accepted, type: :failed, reasons: [:verifier_failed]} =

             AcceptedOutcome.public_projection(refusal)

  end

  test "human-only work and agents-disabled repositories stay outside the contract" do

    assert {:not_applicable, :human_only_work} =

             AcceptedOutcome.evaluate(claim(%{actor: :human}))

    assert {:not_applicable, :agents_disabled_repository} =

             AcceptedOutcome.evaluate(claim(%{agents_enabled: false}))

  end

end