vnext: headless capability engine — graph, evidence, projection, planner (#42)

[Thunderkill016]

Summary

Implements issue #42 headless, per docs/vnext/capability-model-v0.md. No UI, no auth, no legacy coupling — src/vnext/ is greenfield. The repo can now answer in code: what can this learner verifiably do, on what evidence, did it survive delay, did it transfer, and what happens next.

• capabilities.js — 12 capabilities × 5 modalities, acyclic prerequisite graph, VN risk-probe references
• evidence.js — append-only EvidenceEvent (11 types); answerBearing() is the one rule deciding "helped"
• projection.js — pure replay → per-capability milestones + state (NOT_SEEN…FLUENT)
• risk-priors.js — 12 VN population priors, diagnostic-only (learnerStateEffect: 'none_without_observed_evidence')
• planner.js — deterministic priority: resume → due retrieval → remediation → transfer → independent attempt → probe/expose (prereq-gated)

Locked invariants (all pinned in tests/vnext.test.mjs)

• aided/self-reported success → SUPPORTED, never INDEPENDENT (repeat is not answer-bearing)
• RETAINED requires an unaided success ≥ RETENTION_DELAY_MS (24h) after first independence
• TRANSFERRED requires practicedOrTransfer: 'transfer' AND a novel promptFamily — replaying the practiced prompt doesn't count
• FLUENT = transfer across ≥2 distinct prompt families
• events whose modality ≠ capability modality earn zero credit — speaking can never mark listening learned
• priors can only schedule diagnostic_probe actions; a fresh learner's state is untouched
• replay deterministic; id-deduped for resync; a baseline fail routes to teaching (prereq), not retry

Test plan

• node tests/vnext.test.mjs — 9 groups incl. the full vertical slice (baseline fail → input → retrieval → supported → feedback → retry → INDEPENDENT → RETAINED → TRANSFERRED → FLUENT)
• npm run verify — typecheck 98 files + all node suites + build ✅

Generated with Devin

[Thunderkill016]

ARCHITECT REVIEW — NOT ACCEPTED YET

The greenfield separation and overall direction are correct, and CI is green. However, this cannot merge yet because the current projection/planner can over-claim capability state or get stuck in a bad learning loop.

Blockers

1. Only real attempt events may advance capability state.
   projection.js defines ATTEMPT_TYPES, but isSuccess(e) ignores it. Today an exposure, feedback, or support_use event with attempt.outcome:'success' can become SUPPORTED/INDEPENDENT/RETAINED/TRANSFERRED.

   • Gate state-advancing success on ATTEMPT_TYPES.has(e.eventType).
   • Add regression tests for success-looking non-attempt events.

2. Replay is not actually arrival-order deterministic for equal timestamps.
   Events are sorted by occurredAt then original array index. If two same-timestamp events arrive in a different order after sync, lastAttemptOutcome (and therefore planner behavior) can differ.

   • Use a stable domain key (e.g. occurredAt, then event id) rather than input index.
   • Add a test that reversed arrival order produces identical projection and plan.

3. Learner isolation is missing from the projection contract.
   EvidenceEvent contains learnerId, but projectLearnerState(events,...) currently merges all learners in the provided log.

   • Require a learner id and filter/validate events, or explicitly reject a mixed-learner log.
   • Add a cross-learner isolation regression test.

4. Failed delayed retrieval can loop forever.
   Planner priority checks due retrieval before remediation. After an overdue delayed retrieval fails, lastIndependentSuccessAt remains old, so the capability is still due and the planner selects another delayed_retrieval instead of feedback/self-repair.

   • A failed/partial due check must route to remediation/retry before rescheduling another delayed check.
   • Add a regression test.

5. FLUENT = two transfer prompt families overclaims fluency.
   Our vNext doctrine defines fluency as repeated transfer-capable performance with lower hesitation/stable intelligibility while preserving meaning. Two changed-context successes prove broader transfer, not fluency.

   • Do not auto-promote to FLUENT from transfer-count alone.
   • For this PR, FLUENT may remain unreachable until a dedicated fluency evidence contract exists, or add an explicit measurable fluency rule.
   • Update the vertical-slice test accordingly.

6. Transfer novelty must be measured against practiced exposure, not only previously independent prompt families.
   provenPromptFamilies records a practiced family only after independent success. If a learner previously saw/practiced a prompt family with support, a later transfer_attempt using that same family can incorrectly count as novel transfer.

   • Track practiced/encountered prompt families separately from proven families.
   • Same practiced family must never become transfer merely because earlier practice was aided.

Non-blocking cleanup

• CAPABILITY_STATES import in planner is unused.
• Re-check risk-probe mappings against the actual language feature of each capability before expanding them.

Do not start UI work. Fix these invariants, add the regression tests, get CI green on the new head, then re-review.

[Thunderkill016]

Round 2 — all 6 blockers addressed in 2df6c5b. Local gates: npm run verify green, tests/vnext.test.mjs 10/10 (6 new regression cases pinned in §9).

1. Attempt-only state advancement — projection.js now gates every outcome-based milestone on ATTEMPT_TYPES.has(e.eventType). exposure/support_use/feedback events carrying outcome:'success' are recorded as contact but cannot lift a capability past EXPOSED. Pinned: §9a loops all three types.

2. Order-free replay — canonical sort is (occurredAt, id); the input array index is gone. §9b feeds the same two same-timestamp events in both orders and deep-equals both the projection and the plan.

3. Learner isolation — projectLearnerState(learnerId, events, …) now requires a learnerId (throws without it) and drops foreign-learner events before projecting; planNext takes the same first arg. §9c: a mixed log leaves generatedFrom === 1 and the other learner's delayed success cannot inflate retention.

4. No due-loop — planner rule 2 skips a capability whose latest attempt is fail/partial; rule 3 then owns it as retry. §9d asserts a failed delayed check plans retry, never another delayed_retrieval.

5. Honest fluency — FLUENT now requires ≥2 novel transfer families AND ≥2 transfer successes with latency ≤ FLUENCY_LATENCY_RATIO (0.8) × the first-independent baseline. Missing latency data honestly caps at TRANSFERRED. §9e: two wins at 5–6s against a 900ms baseline stay TRANSFERRED; the §7 slice earns FLUENT with 700/650ms transfers.

6. Practiced ≠ novel — rehearsedPromptFamilies records every practiced-context family regardless of outcome or support. §9f: a hint-aided rehearsal on p.aided means a later transfer_attempt on p.aided earns nothing.

Cleanup: unused CAPABILITY_STATES import removed. Risk-probe mappings were re-checked — every probe's appliesTo intersects its capability's modality.

[Thunderkill016]

ARCHITECT RE-REVIEW — STILL NOT READY

Head reviewed: 2df6c5bd53a8066ee9b9f638ef6dd691230888d5
CI: verify:full green.

The fixes for blockers 1, 2, 3, 4 and 6 are accepted:

• state advancement is attempt-only;
• replay order is canonical;
• learner isolation is explicit;
• failed delayed retrieval routes to remediation;
• rehearsed prompt families can no longer be re-sold as novel transfer.

Two evidence-honesty blockers remain.

A. FLUENT is still over-claimed

The new rule is measurable, but the threshold is invented:

FLUENCY_LATENCY_RATIO = 0.8

Two transfer successes faster than 80% of the first-independent latency are automatically promoted to FLUENT.

This does not satisfy our own vNext doctrine:

• capability spec: FLUENT requires lower hesitation and stable intelligibility while preserving meaning;
• Vietnamese-first doctrine: fluency should consider hesitation, response latency, successful turns, repairs, intelligibility and stability across repetitions;
• explicit rule: do not reward simply speaking faster.

The 0.8 ratio has no calibration/evidence behind it, and the same mechanism applies to every modality.

For #43, the safe fix is simpler:

• keep FLUENT in the enum/schema if desired;
• do not auto-promote to FLUENT yet;
• ceiling at TRANSFERRED;
• create a later dedicated fluency contract when we have measurable multi-signal evidence and calibration.

Issue #42's first implementation target ends at changed-context transfer anyway, so FLUENT is not required for this PR.

B. Capability conditions are currently dead data for evidence validity

Capability.conditions.supportAllowed exists in the contract, but projection never checks it.

All current capabilities inherit:

supportAllowed: []

Yet the test explicitly asserts:

repeat: true -> INDEPENDENT

because repeat is globally treated as non-answer-bearing.

That means an attempt can earn INDEPENDENT even when the capability's own conditions say no support is allowed. This breaks the core definition of “valid task under defined conditions.”

Required fix:

• make independent evidence respect capability conditions;
• at minimum, support used must be allowed by that capability's conditions;
• if we want repeat_once, evidence needs enough provenance to distinguish one repeat from unlimited repeats, otherwise do not claim that condition.

Add regression tests:

1. repeat used on a capability with no repeat support allowed cannot earn INDEPENDENT;
2. allowed repeat condition can earn valid independent evidence only within its declared limit/contract.

Non-blocking

The old risk-probe cleanup is still only partially addressed: checking appliesTo ∩ modality is not the same as checking linguistic relevance. Example: vn.theta_eth is attached to listen.identity_question_basic, but the listed target chunks do not obviously contain /θ/ or /ð/. Keep this for the content-validation workstream; it does not need to block #43.

Once A+B are fixed and exact-head CI is green, I will re-review and merge.

[Thunderkill016]

Round 3 — both evidence-honesty blockers fixed in 1bcf36f. Local npm run verify green, vnext.test.mjs 11/11.

A. FLUENT auto-promotion removed. FLUENCY_LATENCY_RATIO and the latency fields are gone; the projection no longer contains any path into fluent. FLUENT stays in CAPABILITY_STATES/milestones as a reserved, unreachable state so the enum is stable — v0's ceiling is TRANSFERRED, matching the doctrine (hesitation + intelligibility + successful turns + repairs + stability need a dedicated contract, and "responded faster" is explicitly not fluency). The §7 slice now ends at TRANSFERRED; §9e pins it: two novel transfers at 80–100ms against a 900ms baseline still earn TRANSFERRED, milestones.fluent stays false.

B. Support conditions enforced. isIndependent(e, cap) now requires !conditionsViolated(e.support, cap) — every support kind actually used must be inside cap.conditions.supportAllowed (which is [] on all 12 current capabilities: no support at all). repeat is no longer globally exempt.

• support.repeatCount added to the event schema (validated: non-negative integer or null) so repeat_once is satisfiable only with provenance.
• repeat_once requires repeatCount === 1 — a bare repeat: true cannot distinguish once from many and fails the condition.
• Answer-bearing kinds (hint/modelAnswer/translation/transcript) remain unconditionally disqualifying — listing them in supportAllowed can never launder a hint into independence.

New §10 regression block:

• repeat on interact.greet (supportAllowed: []) → SUPPORTED, never INDEPENDENT;
• synthetic repeat_once capability: repeatCount: 1 → INDEPENDENT; bare repeat → SUPPORTED; repeatCount: 2 → SUPPORTED.

Note: no shipped capability claims repeat_once yet — that is a content decision; the mechanism is proven against a synthetic capability in tests rather than granted speculatively.

[Thunderkill016]

ARCHITECT ACCEPTED — FINAL

Reviewed exact head 1bcf36f92287f1b31b63b6a2067c6f024e4abca0.

The two final evidence-honesty blockers are resolved:

• v0 has no automatic path to FLUENT; TRANSFERRED is the ceiling until a calibrated multi-signal fluency contract exists.
• independent evidence now respects capability support conditions, with explicit provenance for repeat_once.

Previously accepted invariants remain intact: attempt-only credit, canonical replay, learner isolation, delayed-failure remediation, modality isolation, practiced-vs-transfer separation, and diagnostic-only VN priors.

Exact-head CI is green. Accepted for merge into rebuild/vnext.